@lyupro/codex-bridge 0.6.15 → 0.6.16

package/src/home/lib/dispatcher-command.mjs

@@ -2,9 +2,14 @@
 import { CLI_NAMES } from './cli-names.mjs';
 import { parseDispatcherCall } from './dispatcher-call.mjs';
 import { ORDER_AGENTS } from './order-schema.mjs';
+import { orderRuleMessage } from './order-rules.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
+import { checkOutgoingRefusal } from './order-text-record.mjs';
 
 function refusal(reason) {
-  return { refusal: `Refused: ${reason}.` };
+  const text = orderDiagnosticMessage('dispatcher-refusal', { reason });
+  checkOutgoingRefusal(text, 'refusal');
+  return { refusal: text };
 }
 
 function assembleRunCommand(agentType, taskFile) {
@@ -15,7 +20,7 @@ function assembleRunCommand(agentType, taskFile) {
 /** Plan_63 D11: prompt templates and the gate must use the same command assembler. */
 export function renderRunCommandTemplate(agentType) {
   if (typeof agentType !== 'string' || !ORDER_AGENTS.includes(agentType)) {
-    throw new Error(`unknown dispatcher agent ${JSON.stringify(agentType)}`);
+    throw new Error(orderDiagnosticMessage('dispatcher-agent-input-known', { agentType }));
   }
   return assembleRunCommand(agentType, '<task-file path from the orchestrator>');
 }
@@ -23,15 +28,16 @@ export function renderRunCommandTemplate(agentType) {
 /** Builds the only permitted run command directly from the immutable order transcript. */
 export function canonicalRunCommand(agentType, promptText) {
   if (typeof agentType !== 'string' || !ORDER_AGENTS.includes(agentType)) {
-    return refusal(`unknown dispatcher agent ${JSON.stringify(agentType)}`);
+    return refusal(orderDiagnosticMessage('dispatcher-agent-input-known', { agentType }));
   }
-  if (typeof promptText !== 'string') return refusal('prompt text is missing or is not text');
+  if (typeof promptText !== 'string') return refusal(orderDiagnosticMessage('dispatcher-prompt-text-required'));
 
   // Plan_63 D9, OW-054: the call cannot switch continuation or bypass order ownership.
   const { inputs, problems } = parseDispatcherCall(agentType, promptText);
   if (problems.length) {
-    const reasons = problems.map(({ line, reason }) => line === null ? reason : `line ${line}: ${reason}`);
-    return refusal(`the call text must be only label: value lines: ${reasons.join('; ')}`);
+    const reasons = problems.map(({ line, reason }) => line === null ? reason
+      : orderRuleMessage('dispatcher-call-refusal', { part: 'command-line', line, reason }));
+    return refusal(orderRuleMessage('dispatcher-call-refusal', { part: 'command', reasons: reasons.join('; ') }));
   }
 
   return { command: assembleRunCommand(agentType, inputs.get('task file')) };

package/src/home/lib/dispatcher-gate.mjs

@@ -2,6 +2,8 @@
 import { canonicalRunCommand, sameCommand } from './dispatcher-command.mjs';
 import { ownTranscriptPath, transcriptPrompt } from './dispatcher-order.mjs';
 import { HANDBACK_TOOL } from './hook-definitions.mjs';
+import { dispatcherDenial, dispatcherProtocolMessage } from './dispatcher-protocol.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
 
 export { HANDBACK_TOOL };
 
@@ -10,7 +12,9 @@ export function gateOrder(payload) {
   const prompt = transcriptPath ? transcriptPrompt(transcriptPath) : null;
   if (!transcriptPath || !prompt) {
     return {
-      refusal: `the order could not be read from the agent transcript ${transcriptPath || '(none)'}`,
+      refusal: orderDiagnosticMessage('dispatcher-order-transcript-readable', {
+        transcriptPath: transcriptPath || '(none)',
+      }),
     };
   }
   return canonicalRunCommand(payload.agent_type, prompt);
@@ -36,9 +40,7 @@ export function isFinalOutput(output) {
 }
 
 function denial(message, order) {
-  const prefix = `codex-bridge dispatcher gate: ${message}`;
-  if (typeof order?.command !== 'string' || order.command.length === 0) return prefix;
-  return `${prefix}\n${order.command}\nRun it exactly, in the foreground; repeating it attaches to the same run.`;
+  return dispatcherDenial(message, order?.command);
 }
 
 function deny(message, order, stateUpdate) {
@@ -57,43 +59,45 @@ export function decidePreToolUse({ payload, order, state }) {
   // after the handback and wrote into a tree the caller believed settled; a substituted FAIL followed by a
   // late run would repeat exactly that, so nothing — not even the canonical command — runs past delivery.
   if (state?.handback === 'delivered') {
-    return deny('the handback was already delivered; this dispatcher is finished and may not act further.');
+    return deny(dispatcherProtocolMessage('handback-delivered'));
   }
   if (toolName === 'Bash') {
     if (order?.refusal) {
-      return deny('the order could not be read; nothing may run, so hand back now.', order);
+      return deny(dispatcherProtocolMessage('order-unreadable'), order);
     }
     if (order?.command && sameCommand(payload.tool_input?.command, order.command)
       && payload.tool_input?.run_in_background !== true) return { kind: 'pass' };
-    return deny('only the canonical runner command may run in the foreground.', order);
+    return deny(dispatcherProtocolMessage('canonical-foreground'), order);
   }
 
   if (toolName === HANDBACK_TOOL) {
-    if (order?.refusal) return allow(`FAIL — dispatcher gate: ${order.refusal}`);
+    if (order?.refusal) return allow(orderDiagnosticMessage('dispatcher-order-refusal', { refusal: order.refusal }));
     if (typeof state?.runReceiptConflict === 'string' && state.runReceiptConflict.length > 0) {
-      return allow('FAIL — dispatcher gate: the runner reported two different run folders for one dispatcher: ' +
-        `${state.runReceipt} and ${state.runReceiptConflict}; the answer is not delivered.`);
+      return allow(orderDiagnosticMessage('dispatcher-receipt-conflict', {
+        runReceipt: state.runReceipt, runReceiptConflict: state.runReceiptConflict,
+      }));
     }
     if (typeof state?.runnerOutput === 'string' && state.runnerOutput.length > 0) {
-      if (state.runnerFinal) return allow(state.runnerOutput);
-      return deny('the run has started without a verdict; repeat the exact command to attach and wait.', order);
+      if (state.runnerFinal) return allow(orderDiagnosticMessage('dispatcher-runner-output',
+        { output: state.runnerOutput }));
+      return deny(dispatcherProtocolMessage('verdict-pending'), order);
     }
 
     const attempts = Number.isInteger(state?.handbackAttempts) ? state.handbackAttempts : 0;
     const handbackAttempts = attempts + 1;
     if (handbackAttempts === 1) {
-      return deny('the dispatcher handed back without a runner verdict; run the command first.', order,
+      return deny(dispatcherProtocolMessage('runner-verdict-required'), order,
         { handbackAttempts });
     }
     return {
       kind: 'allow',
-      message: 'FAIL — dispatcher did not delegate: it handed back without running `' + order.command + '`',
+      message: orderDiagnosticMessage('dispatcher-did-not-delegate', { command: order.command }),
       stateUpdate: { handbackAttempts, handback: 'delivered' },
     };
   }
 
   if (order?.refusal) {
-    return deny('the order could not be read; nothing may run, so hand back now.', order);
+    return deny(dispatcherProtocolMessage('order-unreadable'), order);
   }
-  return deny('only the canonical runner command may run before handback.', order);
+  return deny(dispatcherProtocolMessage('canonical-before-handback'), order);
 }

package/src/home/lib/dispatcher-model.mjs

@@ -7,6 +7,7 @@ import { readDispatcherPin } from './dispatcher-pin.mjs';
 import { parseJsonText } from './json-file.mjs';
 import { compareModelFamilies } from './model-family.mjs';
 import { normalizeLedger, readLedgerFile, recordObservation } from './observation-ledger.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
 
 export const DISPATCHER_MODEL_FILE = 'dispatcher-model.json';
 
@@ -46,13 +47,9 @@ export function modelObservation({ agentType, hostVersion, pin, models, complete
     ...(pin.family === null ? { pinReasons: pin.reasons } : {}),
     ...(incompleteMatch ? { complete: false } : {}),
   };
-  const detail = verdict === 'violation'
-    ? `${agentType} ran on ${parsed.join(', ')} while the installed contract pins ${pin.family}`
-    : verdict === 'match'
-      ? `${agentType} ran on ${parsed.join(', ')} matching the installed contract pin ${pin.family}`
-      : incompleteMatch
-        ? `${agentType} model comparison is undetermined: the transcript has unreadable records`
-        : `${agentType} model comparison against the installed contract is undetermined`;
+  const detail = orderDiagnosticMessage('dispatcher-model-observation', {
+    verdict, agentType, models: parsed.join(', '), pinFamily: pin.family, incompleteMatch,
+  });
   return { key: `${hostVersion || 'unknown'}|${agentType}`, verdict, detail, data };
 }
 
@@ -107,6 +104,8 @@ export async function observeDispatcherModelStop({ brandRoot, stateDir, input, h
     // D4: a diagnostic write failure must not block the stop or hide an observed quota violation.
   }
   return observation.verdict === 'violation'
-    ? `codex-bridge: dispatcher ${input.agent_type} ran on ${observation.data.parsed.join(', ')} while the installed contract pins ${observation.data.pinFamily} — Claude quota was spent on it; run codex-bridge doctor.`
+    ? orderDiagnosticMessage('dispatcher-model-stop-warning', {
+      agentType: input.agent_type, models: observation.data.parsed.join(', '), pinFamily: observation.data.pinFamily,
+    })
     : null;
 }

package/src/home/lib/dispatcher-pin.mjs

@@ -10,6 +10,7 @@ import { CLI_NAMES } from './cli-names.mjs';
 import { parseFrontmatter } from './frontmatter.mjs';
 import { readOwnerRoots } from './install-owner-roots.mjs';
 import { modelFamily } from './model-family.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
 
 export function readDispatcherPin({ brandRoot, agentType }) {
   const owners = readOwnerRoots({ brandRoot });
@@ -23,8 +24,8 @@ export function readDispatcherPin({ brandRoot, agentType }) {
     try {
       content = fs.readFileSync(file, 'utf8');
     } catch (error) {
-      const problem = error.code === 'ENOENT' ? 'is missing' : 'cannot be read';
-      reasons.push(`Dispatcher file "${file}" ${problem}; repair with ${CLI_NAMES[0]} install --host "${root}".`);
+      const problem = error.code === 'ENOENT' ? 'missing' : 'unreadable';
+      reasons.push(orderDiagnosticMessage('dispatcher-pin-file-readable', { file, problem, cli: CLI_NAMES[0], root }));
       continue;
     }
 
@@ -35,16 +36,16 @@ export function readDispatcherPin({ brandRoot, agentType }) {
       frontmatter = null;
     }
     if (frontmatter === null) {
-      reasons.push(`The frontmatter in "${file}" is unreadable.`);
+      reasons.push(orderDiagnosticMessage('dispatcher-pin-frontmatter-readable', { file }));
       continue;
     }
     if (frontmatter.name !== agentType) {
-      reasons.push(`Dispatcher file "${file}" does not declare the required frontmatter name "${agentType}".`);
+      reasons.push(orderDiagnosticMessage('dispatcher-pin-agent-name', { file, agentType }));
       continue;
     }
     const family = modelFamily(frontmatter.model);
     if (family === null) {
-      reasons.push(`Dispatcher file "${file}" has no parseable model family in its frontmatter model.`);
+      reasons.push(orderDiagnosticMessage('dispatcher-pin-model-family', { file }));
       continue;
     }
     pins.push({ root, family });
@@ -52,7 +53,7 @@ export function readDispatcherPin({ brandRoot, agentType }) {
 
   if (new Set(pins.map(({ family }) => family)).size > 1) {
     const disagreement = pins.map(({ root, family }) => `"${root}" -> ${family}`).join(', ');
-    reasons.push(`Installed dispatcher model families disagree across owners: ${disagreement}.`);
+    reasons.push(orderDiagnosticMessage('dispatcher-pin-owner-agreement', { disagreement }));
   }
   return reasons.length
     ? { family: null, reasons }

package/src/home/lib/dispatcher-protocol.mjs

@@ -5,10 +5,63 @@
  */
 import { renderRunCommandTemplate } from './dispatcher-command.mjs';
 import { TASK_FILE_INPUT } from './dispatcher-call.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
+import { checkedOrderText } from './order-text-record.mjs';
+
+// Plan_79 D8: prompt and gate quote the same obligations, including corrective deny sentences.
+export const DISPATCHER_PROTOCOL = Object.freeze({
+  'handback-delivered': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'the handback was already delivered; this dispatcher is finished and may not act further.',
+  }),
+  'order-unreadable': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'the order could not be read; nothing may run, so hand back now.',
+  }),
+  'canonical-foreground': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'only the canonical runner command may run in the foreground.',
+  }),
+  'verdict-pending': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'the run has started without a verdict; repeat the exact command to attach and wait.',
+  }),
+  'runner-verdict-required': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'the dispatcher handed back without a runner verdict; run the command first.',
+  }),
+  'canonical-before-handback': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'only the canonical runner command may run before handback.',
+  }),
+  'command-repeat': Object.freeze({
+    data: Object.freeze([]),
+    message: () => 'Run it exactly, in the foreground; repeating it attaches to the same run.',
+  }),
+  'denial': Object.freeze({
+    data: Object.freeze(['command']),
+    message: ({ reason, command }) => `codex-bridge dispatcher gate: ${reason}` +
+      (typeof command === 'string' && command.length > 0
+        ? `\n${command}\n${dispatcherProtocolMessage('command-repeat')}` : ''),
+  }),
+});
+
+export function dispatcherProtocolMessage(key, values = {}) {
+  if (!Object.hasOwn(DISPATCHER_PROTOCOL, key)) {
+    throw new Error(orderDiagnosticMessage('dispatcher-protocol-key-known', { key }));
+  }
+  const entry = DISPATCHER_PROTOCOL[key];
+  return checkedOrderText('dispatcherProtocolMessage', key, values, entry.data, entry.message);
+}
+
+// D8: command is data; the reason and command-repeat correction must already be checked text.
+export function dispatcherDenial(reason, command) {
+  return dispatcherProtocolMessage('denial', { reason, command });
+}
 
 export function renderDispatcherProtocol(agentType) {
   const command = renderRunCommandTemplate(agentType);
-  return `## Required dispatcher input
+  return String(`## Required dispatcher input
 
 The call is exactly one line: \`${TASK_FILE_INPUT.label}: <task-file path from the orchestrator>\`.
 The path must be absolute and name a file the orchestrator wrote with its file tool.
@@ -49,6 +102,16 @@ ${command}
 \`\`\`
 
 Replace the placeholder with the path from the call, nothing else.
+The gate requires these instructions:
+
+- ${dispatcherProtocolMessage('canonical-before-handback')}
+- ${dispatcherProtocolMessage('canonical-foreground')}
+- ${dispatcherProtocolMessage('command-repeat')}
+
+If the order cannot be read, the gate's correction is:
+
+- ${dispatcherProtocolMessage('order-unreadable')}
+
 The first call starts the run and returns at once with \`RUN=<path> order-id=<id>\` and a
 \`STARTED\` line. To get the verdict, run the identical command again. That call does not start
 a second run or cost quota: it attaches to the run already in flight, prints
@@ -58,8 +121,14 @@ which is normal, not a hang. If the ceiling kills it, run the identical command
 it attaches to the same run and keeps waiting.
 
 Background execution (\`run_in_background\`, \`&\`, \`nohup\`) is prohibited, and so is inventing
-a report from memory. Never add a flag: the host allows exactly the one canonical command
-and refuses every other.
+a report from memory. Never add a flag.
+If you try to return before the runner's verdict, the gate's correction is:
+
+- ${dispatcherProtocolMessage('runner-verdict-required')}
+
+If the first call has only started the run, the gate's correction is:
+
+- ${dispatcherProtocolMessage('verdict-pending')}
 
 A runner refusal — an order id collision, a header problem or a grant problem — is the whole
 answer: return it as \`FAIL\` with the runner's text. Never retry with a changed command or another
@@ -87,5 +156,8 @@ by checking \`status.json\` manually.
 Inventing any outcome the runner did not print is equally prohibited. On 2026-08-13 a dispatcher said
 \`FAIL — could not get the Codex run result because of an architectural environment limitation\` while
 that run's \`status.json\` already said \`state=finished\`, \`status=OK\`.
-`;
+After delivering the handback, the gate refuses every further action:
+
+- ${dispatcherProtocolMessage('handback-delivered')}
+`);
 }

package/src/home/lib/dispatcher-state.mjs

@@ -6,6 +6,7 @@ import { writeHomeJsonAtomic } from './atomic-json.mjs';
 import { parseJsonText } from './json-file.mjs';
 import { withHomeFileLock } from './file-lock.mjs';
 import { stateDirWriter } from './home-write.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
 
 // Plan_65 B5: every write goes through the registry id so purge accounts for records, locks and
 // temporaries alike.
@@ -14,7 +15,7 @@ const ARTIFACT = 'dispatcher-state';
 function assertIdentity(sessionId, agentId) {
   if (typeof sessionId !== 'string' || sessionId.length === 0
     || typeof agentId !== 'string' || agentId.length === 0) {
-    throw new TypeError('sessionId and agentId must be non-empty strings');
+    throw new TypeError(orderDiagnosticMessage('dispatcher-state-identity-required'));
   }
 }
 
@@ -57,7 +58,7 @@ function clockValue(ids) {
 
 
 export async function updateDispatcherState(ids, mutate) {
-  if (typeof mutate !== 'function') throw new TypeError('mutate must be a function');
+  if (typeof mutate !== 'function') throw new TypeError(orderDiagnosticMessage('dispatcher-state-mutator-required'));
   const file = dispatcherStatePath(ids);
   const { sessionId, agentId } = ids;
   const writer = stateDirWriter(ids.stateDir);
@@ -69,7 +70,7 @@ export async function updateDispatcherState(ids, mutate) {
     const result = await mutate(current);
     const candidate = result === undefined ? current : result;
     if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
-      throw new TypeError('mutate must produce a JSON record object');
+      throw new TypeError(orderDiagnosticMessage('dispatcher-state-record-required'));
     }
     const record = {
       ...candidate,

package/src/home/lib/install-owner-roots.mjs

@@ -1,55 +1,57 @@
-/**
- * Reads which host roots own this home from the installation record, read-only, for hooks.
- * Plan_67 D10 needs every recorded owner; the home image has no cli/ modules.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import { homeArtifact } from './home-registry.mjs';
-import { parseJsonText } from './json-file.mjs';
-
-const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-
-export function isFormat2(parsed) {
-  return isObject(parsed) && parsed.format === 2;
-}
-
-export function readOwnerRoots({ brandRoot }) {
-  const file = path.join(brandRoot, homeArtifact('install-record').primary[0]);
-  let raw;
-  try {
-    raw = fs.readFileSync(file, 'utf8');
-  } catch (error) {
-    return error.code === 'ENOENT'
-      ? { problem: 'missing', detail: `Installation record at ${file} is missing.` }
-      : { problem: 'unreadable', detail: `Installation record at ${file} cannot be read.` };
-  }
-
-  let parsed;
-  try {
-    parsed = parseJsonText(file, raw);
-  } catch {
-    return { problem: 'unreadable', detail: `Installation record at ${file} contains invalid JSON.` };
-  }
-  if (!isFormat2(parsed)) {
-    return { problem: 'not-format-2', detail: `Installation record at ${file} is not format 2.` };
-  }
-  // Plan_67 R2: confirmation refuses ownerless records; enrollment must come first.
-  if (!isObject(parsed.owners) || Object.keys(parsed.owners).length === 0) {
-    return { problem: 'no-owners', detail: `Installation record at ${file} has no owners.` };
-  }
-  if (parsed.inventory !== 'complete') {
-    // Plan_67 D11: match cli/inventory-confirm.mjs INVENTORY_CONFIRM_COMMAND; hooks cannot import cli/.
-    return { problem: 'inventory-incomplete', detail: `Installation record at ${file} has an incomplete inventory; if the recorded hosts are all the hosts using this home, run codex-bridge inventory confirm.` };
-  }
-  if (Object.hasOwn(parsed, 'legacy')) {
-    return { problem: 'legacy-partition', detail: `Installation record at ${file} contains a legacy partition.` };
-  }
-  const roots = [];
-  for (const owner of Object.values(parsed.owners)) {
-    if (typeof owner?.root !== 'string' || owner.root.trim().length === 0) {
-      return { problem: 'malformed-owner', detail: `Installation record at ${file} has an owner without a non-empty root.` };
-    }
-    roots.push(owner.root);
-  }
-  return { roots: roots.sort() };
-}
+/**
+ * Reads which host roots own this home from the installation record, read-only, for hooks.
+ * Plan_67 D10 needs every recorded owner; the home image has no cli/ modules.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { CLI_NAMES } from './cli-names.mjs';
+import { homeArtifact } from './home-registry.mjs';
+import { parseJsonText } from './json-file.mjs';
+import { orderDiagnosticMessage } from './order-diagnostics.mjs';
+
+const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+export function isFormat2(parsed) {
+  return isObject(parsed) && parsed.format === 2;
+}
+
+export function readOwnerRoots({ brandRoot }) {
+  const file = path.join(brandRoot, homeArtifact('install-record').primary[0]);
+  const detail = (problem) => orderDiagnosticMessage('install-record-owners-readable', { file, problem, cli: CLI_NAMES[0] });
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    return error.code === 'ENOENT'
+      ? { problem: 'missing', detail: detail('missing') }
+      : { problem: 'unreadable', detail: detail('unreadable') };
+  }
+
+  let parsed;
+  try {
+    parsed = parseJsonText(file, raw);
+  } catch {
+    return { problem: 'unreadable', detail: detail('invalid-json') };
+  }
+  if (!isFormat2(parsed)) {
+    return { problem: 'not-format-2', detail: detail('not-format-2') };
+  }
+  // Plan_67 R2: confirmation refuses ownerless records; enrollment must come first.
+  if (!isObject(parsed.owners) || Object.keys(parsed.owners).length === 0) {
+    return { problem: 'no-owners', detail: detail('no-owners') };
+  }
+  if (parsed.inventory !== 'complete') {
+    return { problem: 'inventory-incomplete', detail: detail('inventory-incomplete') };
+  }
+  if (Object.hasOwn(parsed, 'legacy')) {
+    return { problem: 'legacy-partition', detail: detail('legacy-partition') };
+  }
+  const roots = [];
+  for (const owner of Object.values(parsed.owners)) {
+    if (typeof owner?.root !== 'string' || owner.root.trim().length === 0) {
+      return { problem: 'malformed-owner', detail: detail('malformed-owner') };
+    }
+    roots.push(owner.root);
+  }
+  return { roots: roots.sort() };
+}

package/src/home/lib/meta/advisor-task.mjs

@@ -1,9 +1,12 @@
 /** Parses blind advisor task choices so Plan_59 D5 rejects biased or ambiguous inputs before review. */
+import { orderRuleMessage } from '../order-rules.mjs';
+import { orderDiagnosticMessage } from '../order-diagnostics.mjs';
+
 const OPTION = /^\s*-\s+([a-z0-9][a-z0-9-]*):\s*(.*)$/;
 const PREFERENCE = /recommend|prefer|рекоменд|предпочт|\(✓\)|★/iu;
 
 function sections(text) {
-  if (typeof text !== 'string') throw new TypeError('Advisor task text must be a string.');
+  if (typeof text !== 'string') throw new TypeError(orderDiagnosticMessage('advisor-task-text-required'));
   const found = { options: { header: null, lines: [] }, paths: { header: null, lines: [] } };
   let current = null;
   for (const [index, value] of text.split(/\r\n|\n|\r/).entries()) {
@@ -39,31 +42,37 @@ export function parseAdvisorTask(text) {
   return { options: optionsFrom(options.lines), paths: pathsFrom(paths.lines) };
 }
 
-function at(line) {
-  return `line ${line.number} ${JSON.stringify(line.value)}`;
-}
-
 export function advisorTaskRefusal(text) {
   const { options, paths } = sections(text);
-  if (!options.header) return 'Options: add a "## Options" section with at least two options.';
+  if (!options.header) return orderRuleMessage('advisor-task-options', { violation: 'missing' });
   const ids = new Set();
   for (const line of options.lines) {
     const preference = line.value.match(PREFERENCE);
     if (preference) {
-      return `Options ${at(line)}: remove preference marker ${JSON.stringify(preference[0])} (D5).`;
+      return orderRuleMessage('advisor-task-options', {
+        violation: 'preference', lineNo: line.number, line: line.value, preference: preference[0],
+      });
     }
     if (!/^\s*[-*+](?:\s|$)/.test(line.value)) continue;
     const match = line.value.match(OPTION);
     if (!match) {
-      return `Options ${at(line)}: use "- option-id: description" with id matching [a-z0-9][a-z0-9-]*.`;
+      return orderRuleMessage('advisor-task-options', {
+        violation: 'option-shape', lineNo: line.number, line: line.value,
+      });
     }
-    if (ids.has(match[1])) return `Options ${at(line)}: replace duplicate option id "${match[1]}".`;
+    if (ids.has(match[1])) return orderRuleMessage('advisor-task-options', {
+      violation: 'duplicate', lineNo: line.number, line: line.value, optionId: match[1],
+    });
     ids.add(match[1]);
   }
-  if (ids.size < 2) return `Options ${at(options.header)}: provide at least two distinct options.`;
-  if (!paths.header) return 'Paths: add a "## Paths" section with repository-relative paths.';
+  if (ids.size < 2) return orderRuleMessage('advisor-task-options', {
+    violation: 'too-few', lineNo: options.header.number, line: options.header.value,
+  });
+  if (!paths.header) return orderRuleMessage('advisor-task-paths', { violation: 'missing' });
   if (!pathsFrom(paths.lines).length) {
-    return `Paths ${at(paths.header)}: add at least one repository-relative path as a list item.`;
+    return orderRuleMessage('advisor-task-paths', {
+      violation: 'empty', lineNo: paths.header.number, line: paths.header.value,
+    });
   }
   return null;
 }

package/src/home/lib/meta/reply.mjs

@@ -16,6 +16,7 @@ import { changedPaths, line, readText } from './paths.mjs';
 import { splitRunChanges } from './environment.mjs';
 import { scoutCoverage } from './verdict.mjs';
 import { orderInputName } from '../order-schema.mjs';
+import { unavailableRows } from './unavailable-rows.mjs';
 
 /** What the run itself changed, and what the tooling around it changed while it worked. */
 const runChanges = (runDir) =>
@@ -235,16 +236,6 @@ export function limitReply(ctx, meta) {
   return rows;
 }
 
-/** Plan_60 D2: pre-start and post-start refusals share the same handoff contract. */
-export function unavailableRows(signal) {
-  return [
-    'UNAVAILABLE — Codex is not available (signed out); ' +
-      'hand the task to the next executor, do not retry',
-    `Signal: ${line(signal, 170)}`,
-    'Operator check: codex --version; codex login status (sign in with codex login)',
-  ];
-}
-
 export function unavailableReply(ctx, meta) {
   const rows = unavailableRows(meta.reason);
   if (ctx.agent === 'codex-build') {

package/src/home/lib/meta/unavailable-rows.mjs

@@ -0,0 +1,11 @@
+/** Plan_60 D2: pre-start and post-start refusals share the same UNAVAILABLE handoff rows. */
+import { orderDiagnosticMessage } from '../order-diagnostics.mjs';
+import { line } from './paths.mjs';
+
+export function unavailableRows(signal) {
+  return [
+    orderDiagnosticMessage('codex-unavailable-handoff', { variant: 'handoff' }),
+    orderDiagnosticMessage('codex-unavailable-handoff', { variant: 'signal', signal: line(signal, 170) }),
+    orderDiagnosticMessage('codex-unavailable-handoff', { variant: 'operator-check' }),
+  ];
+}

package/src/home/lib/order-diagnostics/cli-flags.mjs

@@ -0,0 +1,56 @@
+/** Plan_79 D4: owns diagnostics for the command-line flags the dispatcher passes to the runner. */
+export const DIAGNOSTICS = Object.freeze({
+  'no-wait-grant-conflict': Object.freeze({
+    data: Object.freeze(['grant']),
+    category: 'cli-flags',
+    message: ({ grant }) =>
+      `--no-wait cannot be combined with a ${grant} grant: ` +
+      'checking an existing run must never authorize a new one.',
+  }),
+  'task-channel-conflict': Object.freeze({
+    data: Object.freeze([]),
+    category: 'cli-flags',
+    message: () => 'task text was supplied through both stdin and --task-file; choose exactly one channel',
+  }),
+  'unexpected-argument': Object.freeze({
+    data: Object.freeze(['value']),
+    category: 'cli-flags',
+    message: ({ value }) => `unexpected argument: ${value}`,
+  }),
+  'unknown-flag': Object.freeze({
+    data: Object.freeze(['name']),
+    category: 'cli-flags',
+    message: ({ name, help }) =>
+      `unknown flag --${name}: codex-bridge run takes only --agent, --task-file and --no-wait; ` +
+      'the order belongs in the task-file header' + (help ? `\n${help}` : ''),
+  }),
+  'boolean-flag-value': Object.freeze({
+    data: Object.freeze(['name', 'value']),
+    category: 'cli-flags',
+    message: ({ name, value }) =>
+      `--${name} takes no value, or one of 1/true/yes/0/false/no; got ${JSON.stringify(value)}. ` +
+      'A placeholder left in from the prompt template is not consent.',
+  }),
+  'missing-flag-value': Object.freeze({
+    data: Object.freeze(['key']),
+    category: 'cli-flags',
+    message: ({ key }) => `missing value for ${key}`,
+  }),
+  'flag-shell-safety': Object.freeze({
+    data: Object.freeze(['name', 'sequence']),
+    category: 'cli-flags',
+    message: ({ name, sequence }) =>
+      `--${name} contains forbidden shell sequence ${JSON.stringify(sequence)}; ` +
+      'put free text in the task file and pass only a short command-line value.',
+  }),
+  'agent-required': Object.freeze({
+    data: Object.freeze([]),
+    category: 'cli-flags',
+    message: () => '--agent is required',
+  }),
+  'agent-known': Object.freeze({
+    data: Object.freeze(['agent']),
+    category: 'cli-flags',
+    message: ({ agent }) => `unknown --agent ${agent}`,
+  }),
+});