fix(herdr): rewrite CodexActivity against the real live rollout shape (S11)

The previous function_call/function_call_output shape was never verified
and doesn't exist in any real Codex rollout. Confirmed the real shape
against this machine's own ~/.codex/sessions files: file edits arrive as
event_msg/patch_apply_end (changes+success, no pairing needed), and shell
commands arrive as a freeform custom_tool_call named "exec" whose input is
a JS snippet embedding cmd:"..." rather than a flat arguments object, with
failure signaled by a literal "Script error:" prefix in the output text.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

progress.md

@@ -398,9 +398,40 @@ Fixed so far:
     its unverified parser is checked; opencode not until a real per-tool-call
     source is found).
 
+- **S11 (CodexActivity verified against a live rollout) — closed, 2026-07-28.**
+  The previously-unverified `function_call`/`function_call_output` shape
+  turned out not to exist in any real Codex rollout on this machine. Rewrote
+  `CodexActivity` against the real shape found in `~/.codex/sessions`:
+  `event_msg`/`patch_apply_end` for file edits (has `changes`+`success`
+  directly, no pairing needed), and `response_item`/`custom_tool_call` named
+  `"exec"` (a freeform JS-scripted tool, not flat arguments — commands are
+  extracted from an embedded `cmd:"..."` via regex) paired with
+  `custom_tool_call_output`, whose failure signal is the observed literal
+  prefix `"Script error:"` in the output text. New tests
+  (`TestCodexActivityParsesRealRolloutShape`,
+  `TestCodexActivityMarksScriptErrorAsFailure`) use fixtures built from the
+  confirmed shape; also manually re-ran the parser against a real multi-
+  hundred-line rollout file and spot-checked the output by eye. See
+  AUDIT.md's S11 section for the full writeup and the one known remaining
+  limitation (only the first command in a chained exec script is extracted,
+  so `DetectMilestone` can miss a commit that isn't the first call in its
+  script).
+
+- **Live status check, 2026-07-28** — the stuck task named throughout this
+  file (`06FT6CKD9Y98AZRX6X8K3QXFZG`) is no longer "stuck" from Orchestra's
+  own point of view: it now reads `state: "failed"` (retries exhausted,
+  `MaxAttempts` hit it). But the underlying herdr pane (`wA:p1`, opencode)
+  is still live and `agent_status: "blocked"` — confirmed via a direct
+  `agent.get` probe against `192.168.1.105:9245` — meaning the orphaned-pane
+  prediction in AUDIT.md's B2/B5 sections was correct: the router gave up
+  and moved on, but nothing ever released or killed the actual agent. Left
+  untouched deliberately (no `pane.close`/`release_agent` call made) — user
+  was asked and chose to leave it for now rather than have it cleaned up in
+  this session.
+
 Not yet started: live verification of Phase 1 occupancy against a real
-session, verifying `CodexActivity`'s parser shape against a live rollout, and
-the two-machine federation run. See `AUDIT.md` for the full plan.
+session, and the two-machine federation run. See `AUDIT.md` for the full
+plan.
 
 **Phase 0 done (2026-07-27):** this box has live TCP reachability to the real
 herdr instance at `192.168.1.105:9245` — verified by hand (raw JSON-RPC