docs(#3240): record the codex passive/session-only model posture (#3251)

* docs(#3240): record the codex passive/session-only model posture

ADR-2313 locks the install-time contract for epic #2313: omit the
per-agent model from generated ~/.codex/agents/<agent>.toml by default
so the agent inherits the always-available Codex session model, embed
one only for an explicit real-Codex model_overrides pin, and keep
model_reasoning_effort coupled to a pinned model (#838). Supersedes
#2517's per-tier embedding on the default path only.

Also records the reader/writer boundary the downstream phases need
(strict writer, liberal-but-visible readers, never partially rewrite an
unparseable .toml), the migration path for API-key Codex users, and the
Phase 5 the coverage gate found unowned.

Amends ADR-1239 with a dated section: its effortSurface amendment
described this ADR as "not yet written", and the install-time vs
invocation-time boundary is now stated from both sides.

Docs-only. The posture is not real until Phase 1 (#3241) merges.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#3240): remove the ADR index count cells that race between PRs

The generated region of docs/adr/README.md carried three numeric cells —
a per-group `### <heading> (N)` and a `_N ADRs._` footer — that every
ADR-adding PR must rewrite. Two PRs adding different ADRs merge their
table rows cleanly, since those are distinct lines, but both rewrite the
same count lines, so whichever lands second gets a green local
`gen-adr-index.cjs --check` and a red CI one: CI evaluates the PR merged
with next, where the count reflects both ADRs.

That is not hypothetical. It reddened this PR: ADR-2313 regenerated the
index at 75 while #3249 landed ADR-3247 concurrently, making the merged
tree 76.

The counts carry no verification value — --check regenerates and diffs
the whole region regardless — and are derivable by reading the table, so
they are removed rather than tolerated. Loosening --check to ignore them
would have let genuine staleness through. This is the shared-mutable-cell
problem CHANGELOG.md and the drift acks already solved with per-PR
fragment files; here removing the cell is enough.

The regression test locks the invariant rather than the symptom: adding
an ADR only INSERTS lines, so render(N) is a line-subsequence of
render(N+1). That is the property that makes concurrent PRs merge, and
unlike asserting the absence of one count format it fails for a count
reintroduced in any shape. Covered at append, lowest-id, middle-id,
empty-corpus, new-status-group, and hazardous-title positions; each names
the pre-fix line that would have failed it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

scripts/gen-adr-index.cjs

@@ -442,7 +442,17 @@ function renderIndex(corpus) {
     const rows = corpus.adrs.filter(g.match).sort((x, y) => Number(x.fileId) - Number(y.fileId));
     if (rows.length === 0) continue;
 
-    out.push(`### ${g.heading} (${rows.length})`, '', g.blurb, '');
+    // No row count in the heading: it is a numeric cell inside the generated
+    // region, shared by every ADR-adding PR. Two PRs that add different ADRs
+    // touch different table rows and merge cleanly — but both rewrite this
+    // same count line, so whichever lands second gets a stale local --check
+    // pass and a red CI --check against the merged tree (#3251). Same failure
+    // mode CHANGELOG.md and drift-acks already solved by moving to per-PR
+    // fragment files (.changeset/, tests/emitted-drift-acks/); here the fix is
+    // simpler still — the count carries no verification value (--check
+    // regenerates and diffs the whole region regardless) and is trivially
+    // derivable by counting the table rows. Do not add it back.
+    out.push(`### ${g.heading}`, '', g.blurb, '');
     const isHistorical = g.heading.startsWith('Superseded');
     // "Read first" points at the broader ADR that now frames this one. It is how a
     // reader of a still-Accepted component decision (e.g. the runtime descriptor)
@@ -464,8 +474,12 @@ function renderIndex(corpus) {
     out.push('');
   }
 
+  // No total ADR count either, for the same reason as the per-group heading
+  // count above: it is a second shared mutable cell in the generated region
+  // that every ADR-adding PR would rewrite, guaranteeing the identical merge
+  // race (#3251). Leave it out; the count is derivable by reading the table.
   out.push(
-    `_${corpus.adrs.length} ADRs. Generated by \`scripts/gen-adr-index.cjs\` — run \`--write\` after adding or restatusing an ADR._`,
+    `_Generated by \`scripts/gen-adr-index.cjs\` — run \`--write\` after adding or restatusing an ADR._`,
     '',
     END_MARKER,
   );