[Meta-Develop]

Every Codex runtime role now runs on gpt-6.1-sol. Workers, supervisors and auditors differ only in reasoning effort. Grok workers are unchanged, and gpt-6-astra stays prohibited for every role. The rule lives in src/selection/data/runtime-model-policy.json together with a dated 2026-10-22 prior. Other catalog models, including explicit overrides, can no longer be selected. A catalog without gpt-6.1-sol is refused with the model and the minimum codex-cli version (0.162.0) named; there is no fallback to another model. Before this change, the Codex-only run picked gpt-5.6-luna for the worker, and luna repeatedly misused the execution-journal tools.

MACO now works with codex-cli 0.162.0 at the trusted path. That required three changes:

• The app-server version gate accepts 0.162.0.
• Startup and turn-time messages are validated against their schemas, including the emittedAtMs field and the account/updated notification. Unknown methods still fail closed.
• The writable worker's journal carrier precreates the .aws mask that 0.162.0 adds. Without it, the journal wrapper is blocked before it launches.

The carrier stays read-only and only the bound journal is writable. Approval and elevation requests are still refused.

A malformed or misdirected journal call that launched nothing, such as a doubled -- separator or a nonexistent working directory, is now rejected before launch with WorkerJournalPrelaunchRejected and leaves the journal unchanged. A Codex worker may correct the arguments and retry once. A call that may have run is never retried.

A Grok worker that returns a required-edit report without any native tool call and without changed files now gets one continuation, whatever status it claims. A second idle turn is rejected as worker_no_progress.

docs/OPERATOR_QUICKSTART.md lists codex-cli 0.162.0 and ripgrep as host prerequisites. Codex workers call rg, and a missing rg fails the run closed. The quickstart also describes the model lineup and adds troubleshooting rows for each new refusal.

Real WSL runs with a release build of this tree and codex-cli 0.162.0:

• The mixed plan (gpt-6.1-sol xhigh auditors, grok-4.6 worker, run e2e-mixed-r44a4) ended with success and acceptance.
• Codex-only README goals with a gpt-6.1-sol worker: e2e-codex-r44a4-1 and -2 ended with success and acceptance. -3 was refused because the host lacked rg; the edit itself was correct.
• After installing rg, e2e-codex-r44v-1, -2 and -3 all ended with success and acceptance (gpt-6.1-sol worker, gpt-6.1-sol xhigh auditors).

CI follow-ups in this PR:

• local_auth_direct_worker_prepares_app_server_authority uses a Linux-only helper, so it is now gated with #[cfg(target_os = "linux")]. That fixes the macOS and Windows test builds (E0425).
• 49 supervise::tests::budget tests and one bound_parent_turn_tests case still requested models the new policy forbids (priced-model, unpriced-model, gate-fixture-model, gpt-5.6-sol). The fixtures, plan_runtime and prompts_gates tests now use the policy model. Only test files changed. The missing-pricing refusal, token-ceiling admission, oversubscription and cancellation assertions are kept.

Known limitation, unchanged by this PR: the shipped pricing catalog has no gpt-6.1-sol price. Real runtimes already ignored the gpt-5.6 zero placeholders, so a Codex run with --max-cost-usd or a rolling cost quota is refused before launch with MissingCostEstimate. Runs without a USD ceiling degrade and continue.

Known flake, pre-existing on main: scheduler::semantic_block_claims_follow_actual_dispatch_order_with_overlap_scan_ahead failed once on 7e6d9c4 and passed on rerun. Parent review checks the run-wide manifest boundary, which fails while a sibling assignment holds a scratch. A follow-up PR fixes it.