fix(adoption): report Codex profile drift without replacing values

[seathatflowsinourveins]

Scope

F9 could preserve a differing Codex profile and still report codex-files current and verification success. --check --host NAME now compares installed profile keys to the selected render, and default apply verification reports mismatching keys and fails. Existing profile bytes and operator values remain intact.

• Base commit: 424b8a778222ae8857aade42c49ae6f7a13b3138.
• Lane: lane:foundation; draft pending the command center's Claude cross-family read.
• Owned paths: tools/adoption/new_wsl_client_config.py, its test module, one dated decision, one sanitized artifact receipt, and manifests/evidence.json in the final commit.
• Plain --check retains repository-only validation. Extra operator fields are outside the comparison; --with-authorization-settings explicitly selects authorization keys for comparison. No profile replacement or host apply is added.

SOTA sources

• Root cause and reused typed merge: native-agent-stack@2d849ba1:tools/adoption/new_wsl_client_config.py:1475-1521, create-only profile outcome:2409-2437, PATH-only verify:2452-2467, and existing additive comparison:1626-1661.
• Native profile-v2 boundary: openai/codex@a956835d020762cb2b570053af06f643a11c0ecc, rust-v0.160.0, config loader:286-333, native merge:96-149, and config/read parameters:389-407. An expected-render comparator was not found in installed 0.160.0 top-level/doctor/debug help or its release notes; F9 already owns the render this check needs.
• Typed TOML parsing uses maintained stdlib tomllib. Exception-class-only reporting includes existence checks because python/cpython@v3.11.17:Lib/pathlib.py:1230-1238 propagates permission errors.

Evidence-class table

Claim	Evidence class	Command / receipt
Both old false passes reproduced; drift, matching and merge-kept behavior covered	synthetic	Focused red: 3 tests, 2 failures; repaired controls in receipt
Full module passes with key-only errors and preserved values	local_integration using synthetic profiles/client stubs	python3 -m unittest tests.test_new_wsl_client_config -q: 193 tests, exit 0
Source boundary, reused merge and completeness review	source_review	Pinned sources above; bounded independent read-only GPT review
Installed native version/help	native_proven metadata only	codex --version, codex --help: exit 0; no provider session
Repository hashes and scope consistent	local_integration	python3 scripts/validate.py: passed; no provider/GPU acceptance

No real host profile was reread or changed. This establishes file comparison against a render, without claiming effective running-session configuration, MCP availability or upstream native-test acceptance.

Local commands run

Tests and validation used PYTHONDONTWRITEBYTECODE=1 and an owned external-cache TMPDIR; private host paths are omitted here.

rtk proxy python3 -m unittest tests.test_new_wsl_client_config -q
exit 0: Ran 193 tests in 64.098s; OK
rtk proxy python3 scripts/component_matrix.py --write
exit 0: 32 rows, 0 flip-rule violations; generated files unchanged
rtk proxy python3 scripts/new_host_grand_list.py --write
exit 0: 32 layers, 66 winners; generated files unchanged
rtk proxy python3 scripts/validate.py
exit 0: 69 components, 10240 hashed files, 4 profiles, 208 receipts; passed
rtk git diff --check
exit 0

Failed reproduction, old expectation corrections and scratch/interface setup errors are retained in the sanitized receipt. Registry updates use the documented host_receipts.register_file API; the registry is committed last.

Decision record

2026-10-05-codex-profile-drift-check.md records native alternatives, preservation and comparison scope, and the upstream comparator or changed owner policy that would reopen the decision.

Host evidence

No evidence/hosts/ change or platform-status promotion. Independent static review is recorded; command-center Claude readiness review remains pending.

Checklist

• No GitHub Actions changes; workflow pin and permission requirements are unaffected.
• No secrets printed, logged or committed; no new required secret.
• No new paid hosting, subscription or billing surface.
• Peer-owned files and worktrees preserved.
• Draft with one lane:foundation label; registry committed last; no merge or host apply.

[seathatflowsinourveins]

Folded into #770 by the PR triage of 2026-10-07 (the command center's ruling, item review-ns2604-coop-20261007T023012Z, section 3). Closed with a record, not merged. The co-op verified the fold at #770's head e4e1e60: 2/5 of this PR's files are byte-identical there, and the shared files (the registry, the client-config tool and its test, the decision records) are merged with this PR's added lines present except where the merge re-hashed or re-counted them; #770's description names this fold, its composition record (docs/decisions/2026-10-07-codex-profile-environment-content-fold.md) and the donor-byte ledger under evidence/artifacts/codex-profile-env-fold-20261007/. This branch codex/ns2604-f9-profile-drift-20261005 stays on origin at 5cfb02f. Reopen trigger: none, because its content lives in #770.