added automatic latest firmware spoofing

AGENTS.md

@@ -89,3 +89,28 @@ behavior that still needs manual testing.
   state in the handoff.
 - Do not commit generated binaries, OpenWrt build output, runtime state, logs, or
   captured protocol payloads.
+
+## Environment pitfalls and shared discoveries
+
+- In this workspace, the Codex `apply_patch` helper is currently unusable. It
+  fails with `bwrap: No permissions to create a new namespace`, including when
+  invoked from an approved command outside the normal sandbox. Do not spend time
+  retrying it or tracing its symlink after seeing this known error.
+- For repository edits, use `git apply --recount` with a focused unified diff as
+  the fallback. `--recount` avoids failures caused by manually miscounted hunk
+  lengths. Review the resulting `git diff` and run `git diff --check` afterward.
+  Preserve unrelated worktree changes exactly as with any other editing method.
+- Ordinary read-only commands may fail with the same `bwrap` namespace error.
+  When the command is safe and required, rerun it using the environment's normal
+  escalation/approval mechanism instead of investigating the namespace setup.
+
+Agents must preserve useful environment knowledge for later agents. When a new
+pitfall or workaround is verified to be deterministic or repeatedly encountered,
+add a short entry to this section before handoff. Keep these entries actionable
+and specific: include the recognizable failure, the confirmed workaround, and
+any validation required afterward.
+
+Do not record transient command failures, guesses, lengthy logs, credentials,
+auth keys, host secrets, or details that only apply to a single task. If a
+discovery could weaken safety controls or requires broader permissions, report
+it to the user instead of documenting a bypass.