diff --git a/TODO.md b/TODO.md
index df04727..eb99a67 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,5 +1,8 @@
 # Bugs
 
+- Codex 0.163 notifications byre doesn't know
+  The service's codex is 0.163.0, and its app-server sends `thread/readState/changed`, which `internal/codex` rejects as `unrecognised method` (a `protocol_errors` entry in `/api/admin/status`). Regenerate the types with `go generate ./internal/codex` against the installed CLI and handle or ignore the new methods.
+
 # M1 — One agent end to end
 
 - Cancel a queued message
diff --git a/docs/operations.md b/docs/operations.md
index 342886d..5bf6ceb 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -101,10 +101,10 @@ The listen address is `byre serve --listen`, whose default is in `cmd/byre/serve
 go install ./cmd/byre
 cp deploy/run.fc.byre.plist ~/Library/LaunchAgents/
 launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/run.fc.byre.plist
-tailscale serve --bg --https=<listen port> http://<listen address>
+tailscale serve --bg --https=443 http://<listen address>
 ```
 
-byre gets its own HTTPS port on the machine's `ts.net` name rather than a path under another service: the API uses absolute paths, and the macOS app takes an origin with no path. `tailscale serve status` shows the URL and what else the machine serves.
+byre is served at the root of the machine's `ts.net` name on 443 (`https://<machine>.<tailnet>.ts.net`), not under a path: the API uses absolute paths, and the macOS app takes an origin with no path. `tailscale serve status` shows the URL and what else the machine serves.
 
 After rebuilding: `go install ./cmd/byre && launchctl kickstart -k gui/$(id -u)/run.fc.byre`. Logs go to `~/Library/Logs/byre.log`.
 
diff --git a/mac/byre.provisionprofile b/mac/byre.provisionprofile
index f44f51f..9f508ba 100644
Binary files a/mac/byre.provisionprofile and b/mac/byre.provisionprofile differ