Codex now binds direct tool-call metadata to invocations so reused call IDs can't fake Code Mode completeness.

PR #45185, merged September 12, attaches direct-call records to outputs before they enter history and sets tool_calls_complete only when an invocation's arguments are fully recorded, regardless of whether the tool succeeded. It tracks call IDs that bypass dispatch specifically so their reuse can't establish completeness. Executed-call metadata is now stripped from app-server raw response notifications and excluded from Guardian history retention budgets. Six of Codex's last thirty hours of commits also went to a native Windows MXC sandbox (#45176 and three siblings), which refuses exec-server requests asking for a TTY, an arg0 override, managed networking or private desktop isolation, and refuses outright when native MXC is unavailable.