# Support and limitations

| Platform | Pre-flight deny | Start/stop detection | Desktop notification |
| --- | --- | --- | --- |
| Linux | yes | yes | `notify-send`, `kitten notify` |
| macOS | yes | yes | `terminal-notifier`, `osascript` (best-effort, untested) |
| Windows | yes | yes | PowerShell toast (best-effort, untested) |

Claude Code's three layers and Codex's native pre-flight spawn_agent denial have been exercised with synthetic payloads on Linux.

## Known limits

- `SubagentStop` is detection, not prevention; that agent's tokens have already been spent.
- Dynamic model options can escape workflow static analysis, then surface at stop-time.
- A launch remains unobservable and therefore fails open when it has no explicit model, no resolvable on-disk definition, no readable parent transcript, and no remembered session model from the last six hours.
- Codex provides the native pre-flight spawn_agent event, but not Claude-compatible start/stop lifecycle events; its runtime-only launches have no notification backstop.
- A missing hook script blocks the matched Claude Code call; uninstall through the supported
  command instead of deleting files by hand.
- New model families remain ungated until `superheavy_pattern` includes them.
- Grant locking is advisory on network filesystems.
- Notification throttling groups repeated detections by subject and session.