rdmpw3275m-changelog-20260904-0718-codex-load-normalization

Covered the final Intel Mac over its pinned LAN identity, made the Codex skill budget explicit, and proved a fresh load succeeds at the unchanged 256-descriptor limit.

Scope, files, and result

Fleet scope: six Macs; file changed here: /Users/richh/.codex/config.toml.
The advertised Tailscale hostname timed out, but rdmpw3275m.local was reachable. Before writing, the SSH host key matched the recorded SHA256:KT0oBLND... fingerprint and differed from the local host.
Plugin tables remained 12 enabled and 0 disabled; no exact byte-identical local skill pairs required suppression.
Explicit skill-catalog budget: 10,000 tokens.
Final config SHA-256: 40c47b9ffc7c74e059f6b7334ae2c153cf58d53d569a475d420eb59cf2353f4a.
Auth, history, cookies, approvals, sessions, MCP definitions, Mem0, Firecrawl, and caches were untouched.

Commands and verification

Read-only loading/duplicate inventory; staged dry-run and hash-guarded apply.
Staged and live codex --strict-config doctor --json: config parse successful.
Fresh codex exec: exit 0, exact response CODEX_LOAD_OK, 27,641 input tokens, no skill-budget warning, no EMFILE, with launchctl limit maxfiles still 256.
The test added /private/tmp as a trusted project. That test artifact was removed with a second staged/hash-guarded update; final strict doctor remained green.
A broken app-managed openai-bundled/chrome/latest cache symlink was observed. It was not hand-rewritten because the supported inventory no longer advertises that item and the positive load control passes.

Backups, undo, and pending work

Primary backup: /Users/richh/.agent-coordination/backups/codex-load-normalization-20260904T0658/rdmpw3275m/config.toml.before.
Test-artifact backup: /Users/richh/.agent-coordination/backups/codex-test-trust-cleanup-20260904T0700/rdmpw3275m/config.toml.before.
Undo after a current hash comparison and fresh backup by atomically restoring the appropriate before-file, then run strict doctor.
Apple Notes publication is pending because the host is at the login window/SSH session is Background; this file record is complete.
The configured full-state backup wrapper is absent; exact phase backups remain the verified rollback path.