diff --git a/tests/helpers/update-import-policy.ts b/tests/helpers/update-import-policy.ts
index 79339f5ab85..1ac54e9799a 100644
--- a/tests/helpers/update-import-policy.ts
+++ b/tests/helpers/update-import-policy.ts
@@ -68,6 +68,11 @@ const baseStaticImports: Readonly<Record<string, readonly string[]>> = {
   ],
   "src/update/check-types.ts": [],
   "src/update/codex-cli-update-launch-policy.mjs": [],
+  "src/update/config-preflight.ts": [
+    // Read-only config descriptor inspection and passive raw diagnostics; warnings are discarded, no backup is written.
+    'import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";',
+    'import { configDiagnosticsFromRaw } from "../config/diagnostics";'
+  ],
   "src/update/desktop-badge.ts": [
     "import { defaultUpdateTag } from \"./index\";"
   ],
@@ -106,7 +111,8 @@ const baseStaticImports: Readonly<Record<string, readonly string[]>> = {
     "import { existsSync, readFileSync, readdirSync } from \"node:fs\";",
     "import { fileURLToPath } from \"node:url\";",
     "import { dirname, join, resolve } from \"node:path\";",
-    "import { getConfigDir, loadConfig } from \"../config\";",
+    "import { getConfigDir, getConfigPath, loadConfig } from \"../config\";",
+    'import { runConfigPreflight } from "./config-preflight";',
     "import { readPid, readRuntimePort, getRuntimePortPath } from \"../config/process-state\";",
     "import { pendingTeardownOutstanding } from \"../config/pending-teardown\";",
     "import { planUpdateRuntimeHandling, planStoppedRuntimeRecovery, inspectPackageRuntimeLiveness } from \"./runtime-ownership.mjs\";",
diff --git a/tests/helpers/update-primitive-allowlist.ts b/tests/helpers/update-primitive-allowlist.ts
index b6710a853e4..21d50dbf528 100644
--- a/tests/helpers/update-primitive-allowlist.ts
+++ b/tests/helpers/update-primitive-allowlist.ts
@@ -6,6 +6,9 @@ import { orchestratedChildReview } from "./update-review-orchestrated-child";
 import { orchestratedEntryReview } from "./update-review-orchestrated-entry";
 
 const basePrimitiveAllowlist: readonly (readonly [string, string])[] = [
+  ["src/update/config-preflight.ts:<module>:import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from \"node:fs\";", "read-only config preflight: open with O_RDONLY | O_NONBLOCK, inspect and read the fd, then close it"],
+  ["src/update/config-preflight.ts:runConfigPreflight:openSync", "read-only config preflight default opener; called with O_RDONLY | O_NONBLOCK"],
+  ["src/update/config-preflight.ts:runConfigPreflight:closeSync", "read-only config preflight default descriptor closer"],
   ["bin/ocx.mjs:runPackageManagerSelfUpdate:probeSpawnSync(bun.path, [\"--no-env-file\", join(here, \"../src/update/orchestrated-identity-probe-entry.ts\"), \"__update-orchestrated-identity\"], { encoding: \"utf8\", timeout: 8000, maxBuffer: 8192, windowsHide: true, stdio: [\"ignore\", \"pipe\", \"ignore\"], env: { ...updateHomeProbeEnvironment(process.env, { codexHome: process.env.CODEX_HOME ?? \"\", opencodexHome: configDir() }), OCX_IDENTITY_CLI_ROOT: resolve(here, \"..\"), OCX_IDENTITY_INSTALLER: manager, OCX_IDENTITY_TARGET: child.version }, })","read-only: verify child identity before mutation"],
   ["bin/ocx.mjs:<module>:probeSpawnSync(bun.path, [\"--no-env-file\", join(here, \"../src/update/orchestrated-identity-probe-entry.ts\"), process.argv[2]], { stdio: \"inherit\", timeout: 8000, windowsHide: true, env: { ...process.env, OCX_IDENTITY_CLI_ROOT: resolve(here, \"..\"), OCX_IDENTITY_INSTALLER: \"\", OCX_IDENTITY_TARGET: \"\" }, })","read-only: identity probe before launcher mutation"],
   ["bin/ocx.mjs:<module>:probeSpawnSync(bun.path, [\"--no-env-file\", cliPath, \"update\", \"--plan\", \"--json\", ...(version ? [\"--version\", version] : tag ? [\"--tag\", tag] : [])], { encoding: \"utf8\", maxBuffer: 65536, timeout: 60000, windowsHide: true, stdio: [\"ignore\", \"pipe\", 2], env: process.env })","read-only: orchestrated plan probe"],