docs: refresh faq defaults

docs/faq.md

@@ -8,7 +8,7 @@ In 2021, OpenAI released Codex, an AI system designed to generate code from natu
 
 ### Which models are supported?
 
-We recommend using Codex with GPT-5 Codex, our best coding model. The default reasoning level is medium, and you can upgrade to high for complex tasks with the `/model` command.
+We recommend using Codex with GPT-5 Codex, our best coding model. Reasoning effort is unset by default, so the provider applies its own default; set `/reasoning high` when you need extra depth.
 
 You can also use older models by using API-based auth and launching codex with the `--model` flag.
 
@@ -22,7 +22,7 @@ Yes. [`codex exec`](./exec.md) runs Codex in non-interactive mode with streaming
 
 ### How do I stop Codex from editing my files?
 
-By default, Codex can modify files in your current working directory (Auto mode). To prevent edits, run `codex` in read-only mode with the CLI flag `--sandbox read-only`. Alternatively, you can change the approval level mid-conversation with `/approvals`.
+Codex starts in read-only sandbox mode with `AskForApproval::OnRequest`, so it asks before modifying your workspace. To allow automatic writes, launch with `--sandbox workspace-write` or change approvals mid-conversation with `/approvals`.
 
 ### How do I connect Codex to MCP servers?
 

docs/sandbox.md

@@ -14,7 +14,7 @@ If you want maximum guardrails for a trusted repo, switch back to Read Only from
 
 - Every session starts in a sandbox. Until a repo is trusted, Codex enforces read-only access and will prompt before any write or command.
 - Marking a repo as trusted switches the default preset to Auto (`workspace-write` + `ask-for-approval on-request`) so Codex can keep iterating locally without nagging you.
-- The workspace always includes the current directory plus temporary directories like `/tmp`.
+- The workspace always includes the current directory plus temporary directories like `/tmp`. Use `/status` to confirm the exact writable roots.
 - You can override the defaults from the command line at any time:
   - `codex --sandbox read-only --ask-for-approval on-request`
   - `codex --sandbox workspace-write --ask-for-approval on-request`
@@ -56,13 +56,13 @@ You can also save presets as **profiles**:
 ```toml
 [profiles.full_auto]
 approval_policy = "on-request"
+sandbox_mode    = "workspace-write"
 
 [profiles.readonly_quiet]
 approval_policy = "never"
+sandbox_mode    = "read-only"
 ```
 
-> Profiles currently apply only their approval policy. Set the sandbox mode via CLI flags or top-level config keys until profile support catches up.
-
 ### Sandbox mechanics by platform {#platform-sandboxing-details}
 
 The mechanism Codex uses to enforce the sandbox policy depends on your OS: