hod 0.1.11 — what the Codex flags actually guarantee

Live validation against interactive Codex workers — started the way you actually start them, through herdr agent start --kind codex — contradicted two claims that 0.1.10 documented as boundaries. Both are corrected.

features.multi_agent=false is not a hard block in interactive mode. It removes spawn_agent under codex exec, but an interactive worker on 0.146.1 started with -s read-only -c features.multi_agent=false still reports the tool. Two workers reported two different names, so never match on the name.

Severity is low, and the docs now say so plainly: a child inherits the same read-only sandbox and cannot write — confirmed by a blocked write leaving the tree clean. What is lost is observability, since delegation would not show up in the Herdr sidebar. Verify by evidence, not by pane presence.

Project-level .codex/config.toml is ignored by interactive workers. In the same directory, sandbox_mode = "read-only" blocks writes under codex exec but an interactive worker with no CLI flags shows an approval dialog instead of blocking — and still exposes spawn_agent despite multi_agent = false in the file. Flags after Herdr's -- remain the only effective path. Committing a config file to a repository creates no boundary.

The controller row is now marked documented-only: it rests on socket evidence alone, with no full worker run behind it.

What still holds, unchanged: read-only blocks writes at the OS layer, .git stays protected until listed in writable_roots, and the impl flag set edits and commits cleanly.

Docs and version only — no behaviour change. Upgrade with hod update.