## What changed
Reject `shell_command` and unified `exec_command` calls that provide a
`justification` without also specifying `sandbox_permissions`. The
model-visible error tells callers to explicitly request `require_escalated`
execution or omit the justification.
## Testing
- Add unit coverage for `shell_command` argument validation.
- Add integration coverage for both shell tool paths, including verification
that rejected unified exec calls do not begin execution.
GitOrigin-RevId: 6af39d2c889af492440615eae12085b99a8b5169
## Why
Linux release packages already include `codex`, `codex-code-mode-host`, and
`codex-resources/bwrap` in the `codex-package-<target>` archive.
## What changed
Remove the release workflow step that also created the redundant
`codex-<target>-bundle.tar.zst` archive for primary Linux builds.
GitOrigin-RevId: b4fd80e96b4fed991e9365e41fe7aad42a3fa28d
## What changed
- Install the skills extension for MCP Codex tool sessions so host skills are
included in the developer instructions.
- Route extension warnings to the matching active MCP turn as `codex/event`
notifications, preserving request and thread metadata and ordering warnings
before the final tool response.
- Track reply turns independently and bound forwarded warning messages to 256
UTF-8 bytes.
## Testing
- Add unit coverage for active-turn routing, request ID collisions, warning
ordering, filtering, and truncation.
- Add an MCP integration test for host skill instructions and skills context
budget warnings.
GitOrigin-RevId: 9e5c699665f6889bf1103e78c3d6ca53824a10a0
## What changed
- Add session connector detection to `ExternalAgentConfigService` for Claude and Cursor migrations.
- Resolve Claude connector attributions through session manifests and map Cursor `CallMcpTool` server IDs through cached plugin metadata.
- Return deduplicated connector candidates with their session counts and detection sources, and expose the new result types from the migration crate.
## Testing
- Cover Claude connector resolution by server name and UUID.
- Cover Cursor connector detection and per-session counting from MCP tool calls.
GitOrigin-RevId: 772bfe949bdc734b385a6e06f6a4b1d35b4cf210
## What changed
- Register the legacy `shell_command` handler only when exactly one local environment is available, including when unified exec keeps it hidden for compatibility.
- Reserve the unnamespaced `shell_command` name so external tools cannot claim it when the built-in handler is unavailable. Namespaced tools with that name remain supported.
## Testing
- Cover remote and multiple-environment tool plans, unified exec routing, and external tool registration for reserved and namespaced variants.
GitOrigin-RevId: 93834539b31ac8a7fea072bfa4de792bcc3e053b
## Why
Host skill path aliases should follow the core skill loader's root discovery
order, independent of how catalog entries are sorted for rendering.
## What changed
- Propagate each host skill root's discovery position into its catalog entries.
- Assign `r0`, `r1`, and subsequent aliases from that position while leaving
entries without an explicit root order last.
## Testing
Added coverage for alias ordering in extension rendering and across consecutive
production turns.
GitOrigin-RevId: 9085a3843c91bf2ce78a378cf5ce4926e9c38eb8
## What changed
Register the skills extension when running `codex debug prompt-input`, using
the configured instruction, bundled skill, orchestrator skill, and skill search
settings when building the model-visible prompt input list.
GitOrigin-RevId: bc5cd2b5915daeca0bf589407c32ce083b8e7087
## Why
MCP servers running in an executor must not reuse host-owned OAuth credentials,
even when they have the same configured server name and URL.
## What changed
- Derive environment-scoped credential names for executor-owned MCP servers and
use them consistently for login, logout, authentication, and connection setup.
- Mark executor-owned entries in the file credential store and fail closed when
loading or saving an entry could cross the host/executor boundary.
- Preserve compatibility with existing local OAuth credentials, including local
server names that overlap the new reserved prefixes.
## Testing
- Extend the executor MCP integration test to verify that executor requests use
the executor token, never send the host token, and persist both credentials
separately.
GitOrigin-RevId: 4fc92d0533b0fe2e0df34f6d47b81e3d20d07807
## What changed
- Load and cache the host skill provider catalog during world-state contribution.
- Render host skill listings from that catalog with Core-compatible budgeting, while preserving Core's full prompt injection for selected host skills.
- Reuse the cached host catalog for shadow selection, including when skill listings are disabled.
- Preserve an empty Core-compatible skills fragment when every entry exceeds the metadata budget, and make budget warnings independent of the configured percentage.
## Testing
- Cover provider-backed host listings, selected-skill prompt injection, shadow selection, disabled listings, oversized prompts, empty fragments, metrics, and warnings.
GitOrigin-RevId: b6b2d8ea14386356094cff5783d121d74657e9e3
## Why
Executor-owned MCP servers must not receive hosted ChatGPT actor credentials or credentials from the host's OAuth store.
## What changed
- Provide the ChatGPT auth provider and consult stored OAuth credentials only for MCP servers in the local environment.
- Require non-local servers configured with `auth = "chatgpt"` to supply a non-empty, valid static `Authorization` header. Reject environment-backed authorization so host secrets are not resolved for an executor-owned server.
- Report unsupported authentication and fail startup before connecting when an executor-owned server has no acceptable explicit authorization.
## Testing
Add coverage for local credential forwarding, non-local credential isolation, static header validation, auth status, OAuth lookup avoidance, and startup rejection.
GitOrigin-RevId: e18f1878f260c93d9babd390a5a7eac86172299b
## Why
Report prompt metadata should reflect the persisted rollout instead of
unverified tags supplied by the client.
## What changed
- Hash the session's base instructions with SHA-256 after normalizing
whitespace, and add the result to report uploads as `prompt_hash`.
- Treat `prompt_hash` and `prompt_version` as reserved tags: remove
client-provided values and only restore `prompt_hash` when it can be derived
from the rollout.
- Collect the prompt hash alongside the selected turn's model and reasoning
effort metadata.
## Testing
Added unit tests for prompt normalization, rollout metadata selection, and
replacement or removal of client-provided prompt tags.
GitOrigin-RevId: 4a21d7b90e100f96f3f7b39d07fec75b30c0d33f
## What changed
- Resolve the code mode host from the package or standalone `resources` directory before checking beside the Codex executable.
- Preserve the existing executable-adjacent fallback when the bundled resource is missing or is not a file.
## Testing
- Cover package and standalone layouts, resource precedence, missing legacy binaries, and resource paths that point to directories.
GitOrigin-RevId: c9e97c22f35a118377dea715d255899192d1b48a
## What changed
- Include detected connector candidates in `ExternalAgentConfigDetectResponse`, with their name, session count, and detection source.
- Add `enterprise_cbp_automation` to the generated `PlanType` variants.
- Use `LegacyAppPathString` for read-command paths in the generated JSON Schema and TypeScript exports.
GitOrigin-RevId: 4eec2024496209681e1f119da8587993ba1cf782
## Why
The `:slash_tmp` filesystem entry represents the Unix `/tmp` directory and
should not affect Windows sandbox policy decisions.
## What changed
- Ignore symbolic `SlashTmp` entries when resolving Windows filesystem access,
converting permission profiles, and intersecting requested permissions.
- Continue treating a literal `/tmp` entry as a regular filesystem path.
## Testing
Add Windows-specific coverage for policy conversion, access checks, and
permission-profile intersection.
GitOrigin-RevId: f4cdd37ea41abc9debfe8a0d3a456b70da5e534c
## What changed
- Recognize `enterprise_cbp_automation` as an Enterprise workspace plan in authentication, backend responses, and app-server account and rate-limit APIs.
- Expose the plan in generated protocol schemas and display it as `Enterprise (Automation)` in account status.
- Apply existing workspace eligibility and Business usage-limit behavior to the new plan.
## Testing
- Cover JWT parsing, plan conversion and serialization, app-server responses, workspace eligibility, usage-limit formatting, and TUI status rendering.
GitOrigin-RevId: d84ae2be3dd60fe398f226e6dc434efe27a387a5
## Why
Read command actions were omitted when a selected environment used a path
convention foreign to the app-server host. Clients need these actions to refer
to files in the executor's filesystem, not paths interpreted on the host.
## What changed
- Resolve read paths against the executor's `PathUri` and serialize them using
the executor's native POSIX, Windows drive, or UNC convention.
- Accept same-drive Windows-relative paths while continuing to reject paths
that require another drive's executor-local current directory.
- Document the path convention used by `commandExecution` notifications.
## Testing
Cover native and cross-platform path serialization, Windows drive-relative
joins, and selected-environment `item/started` and `item/completed`
notifications.
GitOrigin-RevId: 3c5a9bb1caafd35e04a0a0cceab91fee590372b9
## What changed
- Remove top-level `internal_chat_message_metadata_passthrough` from model items before rollout-trace normalization so replayed tool calls and outputs reuse their existing conversation items.
- Keep nested metadata model-visible and continue rejecting call ID reuse when that content changes.
## Testing
- Add reducer coverage for replayed tool search calls and tool outputs with top-level passthrough metadata, plus conflicting nested metadata.
GitOrigin-RevId: db81b9957770a2226f77db1d9df87e75572fc6de
## What changed
- Add a `connectors` array to `ExternalAgentConfigDetectResponse` with each candidate's normalized name, detected session count, and detection source.
- Define detection sources for remote MCP server configuration and session tool use, and export the corresponding JSON Schema and TypeScript types.
- Default `connectors` to an empty array when deserializing responses from older servers.
## Testing
- Add a protocol test covering deserialization when `connectors` is omitted.
GitOrigin-RevId: b65d76791099385226ed54411f4c1ef902be43d8
## What changed
- Move the V8 implementation into a dedicated `codex-code-mode-runtime` crate used by `codex-code-mode-host`, removing the embedded runtime fallback from the Codex process.
- Resolve the host executable from the active installation layout and check its availability before selecting tools.
- Fall back to direct tools with a one-time warning when optional code mode is unavailable. Keep `code_mode_only` and `disable_in_process_fallback` configurations fail-closed.
## Testing
- Cover host discovery for standalone and package layouts, including missing hosts and symlinks.
- Verify direct-tool fallback, one-time warnings, and fail-closed code-mode-only behavior.
GitOrigin-RevId: 5aa3c6f1db148b2231fc24089a2ee0e2b00dbddb
## Why
Normal app-server protocol builds do not need the `ts-rs` and `schemars`
implementations used to generate schema exports.
## What changed
- Embed compressed stable and experimental TypeScript and JSON schema exports,
and serve the existing export APIs from those artifacts.
- Use no-op schema derives in non-test builds while keeping the real generators
available for fixture regeneration and tests.
- Move schema fixture regeneration behind a Python helper and update
`just write-app-server-schema --experimental` to refresh the experimental
embedded exports.
## Testing
- Verify embedded exports match freshly generated stable and experimental
schemas.
- Verify export options and on-disk output remain compatible.
GitOrigin-RevId: e8536338b457e6eec34bdf29ec0684144bd13734
## Why
Filesystem denials and managed-network blocks did not share a structured event
shape, requiring downstream consumers to rediscover enforcement paths and parse
backend-specific output. See https://github.com/openai/codex/pull/17573.
## What changed
- Add normalized filesystem and network violation types in `codex-sandboxing`
and emit them through a shared tracing seam.
- Classify filesystem denials by backend and reason, retaining an optional path
and bounded output snippet, and preserve managed-network block context.
- Report the sandbox type through exec-server responses so unified exec can
classify remote denials without guessing; omitted values remain compatible
with older peers.
- Record violations from exec, apply-patch, shell-escalation, unified-exec, and
managed-network enforcement paths without changing denial behavior.
## Testing
- Cover filesystem classification, path extraction, `SIGSYS`, network event
conversion, protocol compatibility, and remote sandbox-type propagation.
GitOrigin-RevId: d673173b4fa6bdf0a24421194a8a61c81fab9c96
## Why
Removing each decoded prefix from a `Vec` shifts all remaining bytes. Repeating
that work is costly for streams containing many invalid UTF-8 bytes or many
framed messages in one relay record.
## What changed
- Buffer unified exec output in a `VecDeque` and use UTF-8 error offsets to
consume the largest valid prefix while continuing to make progress on invalid
input.
- Buffer Noise relay messages in `BytesMut` and advance past decoded frames
without moving the remaining bytes.
## Testing
Added regression coverage for valid data surrounding invalid UTF-8, front
consumption without shifting, and reassembling many JSON-RPC messages from one
record.
GitOrigin-RevId: 661ccfffc68960ac6c9d37c738224da8ea83cbf0
## Why
The `codex.skill.injected` counter needs to distinguish explicitly requested
skills from implicitly invoked skills.
## What changed
Add the `invoke_type=explicit` attribute to skill injection metrics emitted for
explicit skill mentions, including both successful and failed injections.
GitOrigin-RevId: 22023f8d628be0f22b23f5376b668e8d5492c14a
## Why
A failed rollout append can leave a rejected line before a valid same-ordinal
retry. Advancing the byte checkpoint past that line without also advancing the
ordinal checkpoint can prevent subsequent history from being projected.
## What changed
- Defer rejected and unknown rollout lines until a later valid ordinal shows
whether they were replaced by a retry or consumed an ordinal.
- Advance skipped ordinal ranges together with the durable byte checkpoint,
while rejecting gaps that cannot be explained by rejected lines.
- Prefer item event timestamps and parse the rollout timestamp only when an
item needs it as a fallback.
## Testing
Added coverage for same-ordinal retries, inferred ordinal gaps, unknown and
malformed records, invalid fallback timestamps, and unexplained gaps.
GitOrigin-RevId: 374beda316c605d562bd9526abed19916598d69f
## Why
The `<current_date>` in environment context could diverge from the clock used by current-time features, especially when a host provides an external clock.
## What changed
- Read the current time from the session's time provider whenever world state is built, and render its local date in environment context.
- Use each session's own thread ID for clock reads, including guardian sessions.
- Propagate clock-read failures through turn error events and stop before model inference.
## Testing
- Cover date updates across turns and app-server requests.
- Verify guardian clock reads use the corresponding root or guardian thread ID and do not run during prewarm.
- Verify clock failures emit an error without sending an inference request.
GitOrigin-RevId: bb7f32ccc0229b7bc6f14d7356db00bcce78066d
## Why
Concurrent callers can request metadata for the same remote path, resulting in duplicate `fs/getMetadata` RPCs.
## What changed
- Share an unsandboxed metadata request with concurrent callers for the same path while the RPC is in flight.
- Remove completed and failed requests so later callers fetch fresh metadata, and clear in-flight entries after filesystem mutations, including failed mutations.
- Keep requests for different paths separate and bypass sharing for sandboxed requests.
## Testing
Add WebSocket-backed tests covering shared results and errors, retry after cancellation or failure, mutation invalidation, and path and sandbox isolation.
GitOrigin-RevId: f91e51b94db3fb984597aec8d302b8715778121c
## What changed
- Pass the canonical `PermissionProfile` through execution requests, sandbox
selection, escalation, and the exec server instead of carrying separate
derived filesystem and network policies.
- Derive runtime sandbox policies from the effective profile at their points of
use, including after applying additional permissions.
- Update sandbox and escalation tests to inspect policies through the profile.
GitOrigin-RevId: 695b82ea94f5289516b0933bb23074cb2dcce8ac
## What changed
- Add the opt-in `executed_tool_call_metadata` feature to record model-attempted direct and code-mode tool calls.
- Attach recorded names and arguments to the matching tool output in the next Responses request, preserving the metadata across sampling retries.
- Bound pending calls and argument sizes, and emit truncation metadata when limits are exceeded.
## Testing
- Cover disabled-by-default behavior, namespaced and nested calls, blocked or failed attempts, retry handling, and recorder limits.
GitOrigin-RevId: 5ce917b73e797b0f6904d46477b9d2cf8ea71bf2
## What changed
Add integration coverage for managed network requests that verifies:
- Guardian allow and deny decisions apply only to the triggering request.
- A decision for a remote environment does not carry over to a local one.
- A user-granted remote session approval remains active after Guardian-reviewed requests.
- Guardian assessments receive the exact network action and execution environment for each request.
GitOrigin-RevId: 6701074c6d60b9f28a6d47ebaf910bb1e9f2fa07
## What changed
Add integration coverage for `apply_patch` with unified exec workspace roots. The test verifies that a normal file can be added while writes under existing `.git`, `.agents`, and `.codex` directories are rejected and do not create files.
GitOrigin-RevId: 21ad5ce7fb06e7c47b4086c1439f12d52d9235de
## What changed
Return telemetry tags directly from `CoreToolRuntime::telemetry_tags` instead of
wrapping them in a future, and update the MCP runtime and tool registry call site
accordingly.
GitOrigin-RevId: 54e03972fe23c0e644c68c73af504dba0871be8e
## What changed
- Force an online model-catalog refresh and verify that the mock server receives it.
- Allow the catalog mock to handle repeated requests.
- Bound the catalog refresh and session shutdown with timeouts, and explicitly wait for shutdown before completing the test.
GitOrigin-RevId: 503b52fd296928757b982abc053c74ed36700ff0
## What changed
- Replace fixed delays with explicit signals that pause the sideband connection after its HTTP handshake request begins.
- Release the handshake after closing the realtime conversation and verify that the connection ends before the handshake completes.
- Shut down the test session while rejecting stale realtime errors or duplicate close events from the canceled sideband task.
GitOrigin-RevId: 37072842b973fff41ec47235ceb9cfe3cf1a5a37
## What changed
- Disable shell snapshots in the file-change approval replay fixture.
- Wait for the thread to report `WaitingOnApproval` before resuming it.
- Gracefully shut down the app server and assert that it exits successfully.
GitOrigin-RevId: a1e18d31fcc819dcf9f0e066d0da73c25a47d984
## Why
The notification helper buffers unrelated server requests, so the session-scoped
file change approval test could overlook an unexpected second approval request.
## What changed
- Consume approval resolution and file change completion events directly and
verify their request, thread, turn, and item identities.
- Fail if the second patch requests approval after the first patch was accepted
for the session.
- Shut down the app server gracefully and assert that it exits successfully.
GitOrigin-RevId: 53a3f746940677043e097094862c28faf4db1a8d
## What changed
- Disable shell snapshot startup so the test stays focused on file change approval.
- Shut down the app server cleanly and assert that the turn makes exactly two Responses API requests.
GitOrigin-RevId: b19a67791d1bd371523e68ad6fae32d1dd426f2f
## What changed
- Seed approval scenarios with the bundled model catalog so their model metadata is deterministic.
- Make the patch approval helper surface unexpected exec approvals, errors, aborts, and shutdowns immediately instead of waiting for its timeout.
GitOrigin-RevId: b5ec88494ecaf571a480b4142300eb5f3f98def9
## Why
A phase-two memory job could release its lease while its consolidation agent was
still shutting down, allowing another worker to race the existing agent.
## What changed
- Await consolidation-agent shutdown before validating artifacts and completing
the job.
- Keep the lease until it expires if shutdown fails, and remove the agent from
the thread manager only after shutdown succeeds.
## Testing
Update startup tests to wait for the phase-two job lifecycle to finish and verify
that the consolidation thread has been removed.
GitOrigin-RevId: 7ac3a7369529822ac95fd2ee9dcb27d39c191d20
## What changed
Update the code mode yield and termination integration test to generate a
bounded output backlog, then wait on a file-backed gate until the session is
terminated. Remove the timeout that previously guarded submission of the
infinite-loop workload.
GitOrigin-RevId: dd48307f18ab12bfbf02dc26b0f3715f073402a7
## What changed
- Run the strict auto-review enabled and disabled scenarios as separate test cases on a two-thread Tokio runtime.
- Explicitly shut down each Codex instance after verifying that the approved folder grant allows the later `apply_patch` call.
GitOrigin-RevId: cbbf47d834c4a9adcf181b97b8aa72b5f0a513e2
## What changed
Build the `apply_patch` filesystem sandbox context from the executor's canonical permission profile instead of the execution attempt's materialized profile. Continue merging any additional permissions requested by the patch while keeping workspace roots scoped separately to the attempt.
## Testing
- Update the sandbox-context test to verify that executor `workspace-write` permissions are preserved when attempt workspace roots and additional file permissions are present.
GitOrigin-RevId: 2a9a8c2e1b1945e300283c400d0f1e573225a553
## What changed
- Track the first registered tool for each normalized code-mode identifier and use that tool consistently for dispatch metadata and model-facing code-mode declarations.
- Skip duplicate normalized names when building the code-mode executor while preserving shadowed tools in the registry and direct tool exposure where applicable.
- Cover collisions across dynamic and namespaced tools, direct and deferred exposure, code-mode-only operation, and Responses Lite metadata.
GitOrigin-RevId: a4acb57ce44e7de1398981b22af4b87e2a35870f
## What changed
- Retain bounded, non-completion agent messages in remote v2 compaction history so delegated tasks remain available on follow-up turns.
- Account for encrypted agent-message content when estimating token usage and place restored initial context before the latest real user or agent message.
- Exclude child completion messages from retained follow-up history and strip inherited parent agent messages when forking a child.
## Testing
- Extend compaction, history-estimation, and agent-fork tests to cover encrypted delegated tasks, child completions, context ordering, and fork sanitization.
GitOrigin-RevId: ba4392e9cfdf4ecbcdc9c7d8581d58a8d2d78260
## Why
External MCP, extension, and dynamic tools can collide with host-owned tool
names. In particular, a dynamic `tool_search` definition must not replace the
host implementation used to discover and route deferred tools.
## What changed
- Build each turn's tools through a single ordered `ToolRegistry` that retains
the first runtime registered for a name.
- Treat duplicate external tools as skippable collisions while preserving
strict duplicate checks for trusted host tools.
- Reserve host-owned code-mode and `tool_search` runtimes before producing the
model-visible tool list.
- Base hosted web-search fallback behavior on the extension runtime that
actually won registration.
## Testing
- Cover ordered registry mutation and duplicate handling.
- Verify a client-provided `tool_search` cannot shadow the host tool.
- Verify hosted web-search fallback follows the registered browser runtime.
GitOrigin-RevId: acebe360de8ec69ad7da2f684cc2542cbf18a984
## Why
Executor capability discovery can traverse plugin and skill roots, including
symlinks. Under restricted filesystem permissions, discovery must not expose
files outside the permitted paths.
## What changed
- Pass each environment's filesystem sandbox context through capability root
discovery and apply it to metadata, directory walks, and file reads.
- Enable discovery for restricted sessions so permitted executor skills remain
available while inaccessible roots and symlink targets are omitted.
- Key discovery caches by sandbox context and reject sandboxed discovery on
executors that do not advertise support for it.
- Split requests with more than 128 roots into supported-size batches.
## Testing
- Cover permitted and denied external symlink targets.
- Verify restricted skill listing excludes inaccessible skills.
- Verify cache separation across permission contexts and discovery of 129 roots.
GitOrigin-RevId: 44d16468ca003403bdb8b71a04ae8c9ff94ed494
## Why
Executor-backed skill resources must honor the active filesystem permission profile instead of reading outside its allowed roots.
## What changed
- Propagate each environment's filesystem sandbox context into `skills.read` calls.
- Apply turn-scoped permission grants when reading executor skill resources.
- Fail closed when no matching sandbox context exists or a restricted Windows read cannot be sandboxed.
- Preserve the existing resource size limit for both sandboxed and streamed reads.
## Testing
- Cover reads within permitted roots and reads that succeed after a permission grant.
- Verify denied references do not expose their contents and disabled Windows sandboxing is rejected.
GitOrigin-RevId: 5cc679b9385b0621665ff20cf5848863cc6396a4
## What changed
- Add an optional `wait_until_ready` hook to `CoreToolRuntime` and invoke it
before acquiring the tool execution gate.
- Move MCP refresh and server-startup waiting into the MCP runtime's hook.
- Forward readiness waits through tool exposure and namespace wrappers.
- Test exact runtime selection for plain and namespaced tools, including
exposure overrides and missing tools.
GitOrigin-RevId: 8718589fa06f14d053a35a288186613f649d25ff
## What changed
- Split core tool planning from the assembly of MCP, extension, and dynamic tool runtimes.
- Build `ToolRouter` from a single ordered runtime list plus hosted tool specs.
- Centralize whether each `ToolExposure` variant is available in code mode.
- Preserve core, MCP, extension, and dynamic source ordering and existing name-collision priority.
## Testing
- Add coverage for unified source ordering and collisions, code-mode exposure, and standalone web search alongside MCP and dynamic `web.run` tools.
GitOrigin-RevId: b010c2e9728b92b75a35325ca9b2ec465c3bac12
## What changed
- Send the active turn ID in the `x-codex-image-turn-id` header for image generation and edit requests.
- Add `explicit_client_interrupt_requested_at_ms` to turn analytics. Record the earliest explicit interrupt request that receives a successful response, while excluding rejected requests.
- Track errors returned by `turn/interrupt` so pending analytics state is cleaned up correctly.
## Testing
- Cover turn ID headers for image generation and editing.
- Cover accepted, retried, and rejected explicit interrupt requests in analytics tests.
GitOrigin-RevId: 80fe996a161b4952b79c5c38238f75b7661b92af
## Why
Paginated thread history could reject valid rollout records when rate-limit
percentages were encoded as floating-point JSON values, preventing later final
answers from being projected.
## What changed
Deserialize each rollout line through `serde_json::Value` before converting it
to `RolloutLine`, preserving floating-point rate-limit values during history
materialization.
## Testing
Added coverage for projecting fractional, integral, very small, and large
floating-point rate-limit percentages across both catch-up materialization and
subsequent history appends.
GitOrigin-RevId: 68da907987ffe59f4a3033ef90f3b88c39734cb1
