@lyupro/codex-bridge 0.6.15 → 0.6.16

package/src/home/lib/runner/advise-carry.mjs

@@ -4,25 +4,26 @@ import path from 'node:path';
 import { readJsonFileSync } from '../json-file.mjs';
 import { parseAdvisorTask } from '../meta/advisor-task.mjs';
 import { die } from './args.mjs';
+import { orderDiagnosticMessage } from '../order-diagnostics.mjs';
 
 export function advisorTaskArtifact({ taskText, phase, runsRoot, grantRun }) {
   const task = parseAdvisorTask(taskText);
   if (phase !== 'advise') return task;
   if (typeof runsRoot !== 'string' || !runsRoot || typeof grantRun !== 'string' || !grantRun) {
-    throw new Error('Cannot carry advise scope result: runsRoot and grantRun are required.');
+    throw new Error(orderDiagnosticMessage('advise-scope-input-required'));
   }
   const scopeFile = path.join(runsRoot, grantRun, 'result.json');
   let result;
   try {
     result = readJsonFileSync(scopeFile);
   } catch (error) {
-    throw new Error(`Cannot read advise scope result at ${scopeFile}: ${error.message}`);
+    throw new Error(orderDiagnosticMessage('advise-scope-result-readable', { scopeFile, message: error.message }));
   }
   if (!result || typeof result !== 'object' || Array.isArray(result) ||
       !Array.isArray(result.predicted_risks) || !Array.isArray(result.missing_paths) ||
       result.predicted_risks.some((risk) => !risk || typeof risk.id !== 'string' || typeof risk.risk !== 'string') ||
       result.missing_paths.some((entry) => typeof entry !== 'string')) {
-    throw new Error(`Malformed advise scope result at ${scopeFile}: expected predicted_risks and missing_paths arrays.`);
+    throw new Error(orderDiagnosticMessage('advise-scope-result-shape', { scopeFile }));
   }
   return { ...task, scope: { run: grantRun, predicted_risks: result.predicted_risks, missing_paths: result.missing_paths } };
 }
@@ -33,13 +34,13 @@ export function advisorTaskOrRefuse(input) {
   try {
     return advisorTaskArtifact(input);
   } catch (error) {
-    return die(`${error.message} The run folder was not created; quota was not spent.`, EXIT.FAIL);
+    return die([error.message, orderDiagnosticMessage('run-not-created')].join(' '), EXIT.FAIL);
   }
 }
 
 export function adviseSection(artifact) {
-  if (!artifact?.scope) return '';
-  return [
+  if (!artifact?.scope) return String();
+  const lines = [
     '## Scope phase results',
     '',
     'Predicted risks:',
@@ -47,5 +48,6 @@ export function adviseSection(artifact) {
     '',
     'Paths you may additionally read and cite:',
     ...artifact.scope.missing_paths.map((entry) => `- ${entry}`),
-  ].join('\n');
+  ];
+  return lines.join('\n');
 }

package/src/home/lib/runner/args.mjs

@@ -12,7 +12,10 @@ import { isAbsoluteTaskFilePath } from '../order-values.mjs';
 import { firstShellUnsafeSequence } from '../shell-unsafe.mjs';
 import { parseTaskDocument } from './task-file.mjs';
 import { parseTaskHeader, taskHeaderRefusal } from '../task-header.mjs';
-import { renderOrderHeaderHelp } from '../order-schema.mjs';
+import { renderOrderHeaderHelp } from '../order-schema.mjs';
+import { orderRuleMessage, orderRefusalAt } from '../order-rules.mjs';
+import { orderDiagnosticMessage } from '../order-diagnostics.mjs';
+import { checkOutgoingRefusal } from '../order-text-record.mjs';
 
 export class RunnerUsageError extends Error {
   // 2 says the order itself is wrong and has to be rewritten. A refusal about the state of the
@@ -24,8 +27,9 @@ export class RunnerUsageError extends Error {
   }
 }
 
-export function die(message, exitCode = EXIT.USAGE) {
-  console.error(`run-codex: ${message}`);
+export function die(message, exitCode = EXIT.USAGE) {
+  checkOutgoingRefusal(message, 'die');
+  console.error(`run-codex: ${message}`);
   throw new RunnerUsageError(message, exitCode);
 }
 
@@ -34,39 +38,39 @@ export function readTaskDocument(opts) {
   const stdinText = process.stdin.isTTY ? '' : fs.readFileSync(0, 'utf8');
   if (opts['task-file'] !== undefined) {
     if (stdinText.trim()) {
-      refuse('task text was supplied through both stdin and --task-file; choose exactly one channel');
+      refuse(orderDiagnosticMessage('task-channel-conflict'));
     }
     const taskFile = opts['task-file'];
     // The 2026-08-15 incident resolved a relative order against the repository cwd and ran an
     // unrelated task.md. Refuse the supplied value instead of silently selecting another file.
     if (!isAbsoluteTaskFilePath(taskFile)) {
-      refuse(`--task-file must be an absolute path; got ${JSON.stringify(taskFile)}`);
+      refuse(orderRuleMessage('task-file-path', { value: taskFile }));
     }
     let fileText;
     try {
       fileText = fs.readFileSync(taskFile, 'utf8');
     } catch (err) {
-      refuse(`task file from --task-file could not be read: ${err.message}`);
+      refuse(orderDiagnosticMessage('task-file-readable', { message: err.message }));
     }
-    if (!fileText.trim()) refuse(`task file from --task-file is empty: ${taskFile}`);
+    if (!fileText.trim()) refuse(orderRuleMessage('task-body-required', { channel: 'task-file', taskFile }));
     // Plan_75 D5, 2026-10-03 20:42: validate raw metadata before sections can hide a grant.
     const parsed = parseTaskHeader(fileText);
     const refusal = taskHeaderRefusal(parsed);
-    if (refusal) refuse(`${taskFile}: ${refusal}`);
-    if (!parsed.body.trim()) refuse(`task file from --task-file is empty: ${taskFile}`);
+    if (refusal) refuse(orderRefusalAt(taskFile, refusal));
+    if (!parsed.body.trim()) refuse(orderRuleMessage('task-body-required', { channel: 'task-file', taskFile }));
     let document;
     try {
       document = parseTaskDocument(parsed.body);
     } catch (err) {
-      refuse(`${taskFile}: ${err.message}`);
+      refuse(orderRefusalAt(taskFile, err.message));
     }
     return { ...document, header: parsed };
   }
-  if (!stdinText.trim()) refuse('task text on stdin is empty');
+  if (!stdinText.trim()) refuse(orderRuleMessage('task-body-required', { channel: 'stdin' }));
   const parsed = parseTaskHeader(stdinText);
   const refusal = taskHeaderRefusal(parsed);
   if (refusal) refuse(refusal);
-  if (!parsed.body.trim()) refuse('task text on stdin is empty');
+  if (!parsed.body.trim()) refuse(orderRuleMessage('task-body-required', { channel: 'stdin' }));
   try {
     return { ...parseTaskDocument(parsed.body), header: parsed };
   } catch (err) {
@@ -94,22 +98,18 @@ export function parseArgs(argv) {
   const opts = {};
   for (let i = 0; i < argv.length; i += 1) {
     const key = argv[i];
-    if (!key.startsWith('--')) die(`unexpected argument: ${key}`);
+    if (!key.startsWith('--')) die(orderDiagnosticMessage('unexpected-argument', { value: key }));
     const name = key.slice(2);
     if (!['agent', 'task-file', 'no-wait'].includes(name)) {
       const agent = opts.agent ?? argv[argv.indexOf('--agent') + 1];
       const help = Object.hasOwn(AGENTS, agent) ? renderOrderHeaderHelp(agent) : '';
-      die(`unknown flag --${name}: codex-bridge run takes only --agent, --task-file and --no-wait; ` +
-        'the order belongs in the task-file header' + (help ? `\n${help}` : ''));
+      die(orderDiagnosticMessage('unknown-flag', { name, help }));
     }
     const value = argv[i + 1];
     if (BOOLEAN_FLAGS.has(name)) {
       if (value !== undefined && !value.startsWith('--')) {
         if (!BOOLEAN_YES.test(value) && !BOOLEAN_NO.test(value)) {
-          die(
-            `--${name} takes no value, or one of 1/true/yes/0/false/no; got ${JSON.stringify(value)}. ` +
-              'A placeholder left in from the prompt template is not consent.',
-          );
+          die(orderDiagnosticMessage('boolean-flag-value', { name, value }));
         }
         opts[name] = BOOLEAN_YES.test(value);
         i += 1;
@@ -119,7 +119,7 @@ export function parseArgs(argv) {
       continue;
     }
     // A flag name where a value belongs means the value was left out.
-    if (value === undefined || value.startsWith('--')) die(`missing value for ${key}`);
+    if (value === undefined || value.startsWith('--')) die(orderDiagnosticMessage('missing-flag-value', { key }));
     opts[name] = value;
     i += 1;
   }
@@ -127,14 +127,11 @@ export function parseArgs(argv) {
     if (opts[name] === undefined) continue;
     const sequence = firstShellUnsafeSequence(opts[name]);
     if (sequence !== null) {
-      die(
-        `--${name} contains forbidden shell sequence ${JSON.stringify(sequence)}; ` +
-          'put free text in the task file and pass only a short command-line value.',
-      );
+      die(orderDiagnosticMessage('flag-shell-safety', { name, sequence }));
     }
   }
-  if (!opts.agent) die('--agent is required');
-  if (!AGENTS[opts.agent]) die(`unknown --agent ${opts.agent}`);
+  if (!opts.agent) die(orderDiagnosticMessage('agent-required'));
+  if (!AGENTS[opts.agent]) die(orderDiagnosticMessage('agent-known', { agent: opts.agent }));
   opts.noWait = Boolean(opts['no-wait']);
   return opts;
 }

package/src/home/lib/runner/codex-availability.mjs

@@ -4,6 +4,7 @@
  */
 import { resolveCommandOnPath } from '../command-path.mjs';
 import { codexSpawnSpec, spawnCaptured } from './codex-cmd.mjs';
+import { orderDiagnosticMessage } from '../order-diagnostics.mjs';
 
 // A signed-in answer takes ~200 ms; ten seconds bounds a hung CLI without delaying a healthy start.
 export const PROBE_TIMEOUT_MS = 10_000;
@@ -13,9 +14,10 @@ function lines(text) {
 }
 
 function failureDetail(result, command) {
-  return lines(result.stderr).at(-1)
-    || lines(result.error?.message).at(-1)
-    || `${command} exited ${result.status}`;
+  const message = lines(result.stderr).at(-1) || lines(result.error?.message).at(-1);
+  return orderDiagnosticMessage('codex-availability-detail', message
+    ? { variant: 'message', message }
+    : { variant: 'exit-status', command, status: result.status });
 }
 
 export async function probeCodexAvailability({
@@ -31,7 +33,7 @@ export async function probeCodexAvailability({
       if (resolve('codex', env) === null) {
         return {
           state: 'inconclusive', pathMiss: true,
-          detail: 'codex could not be resolved in this process PATH; readiness is unconfirmed',
+          detail: orderDiagnosticMessage('codex-availability-detail', { variant: 'path-miss' }),
         };
       }
     }
@@ -50,10 +52,12 @@ export async function probeCodexAvailability({
     }
     if (login.status === 0) return { state: 'available' };
     if (login.status === 1 && [...lines(login.stderr), ...lines(login.stdout)].includes('Not logged in')) {
-      return { state: 'logged-out', detail: 'codex login status: Not logged in' };
+      return { state: 'logged-out', detail: orderDiagnosticMessage('codex-availability-detail', { variant: 'logged-out' }) };
     }
     return { state: 'inconclusive', detail: failureDetail(login, 'codex login status') };
   } catch (error) {
-    return { state: 'inconclusive', detail: lines(error?.message).at(-1) || 'codex availability probe failed' };
+    const message = lines(error?.message).at(-1);
+    return { state: 'inconclusive', detail: orderDiagnosticMessage('codex-availability-detail', message
+      ? { variant: 'message', message } : { variant: 'failed' }) };
   }
 }

package/src/home/lib/runner/continuation.mjs

@@ -1,174 +1,158 @@
-/**
- * Owns the zero-quota decision about whether a requested continuation was ordered.
- *
- * The 2026-08-05 incident showed why the runner must not infer a second pass from a verdict:
- * only the orchestrator read that verdict and can name the run and reason it is willing to fund.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import { CONTINUATION_ORDER_INPUT, orderInputName } from '../order-schema.mjs';
-import { readJson } from '../write-meta.mjs';
-import { workerMayBeAlive } from '../meta/run-liveness.mjs';
-
-// One comparison of run names for the grant gate and for attach, so a repeat and a grant can never
-// disagree about whether two spellings name the same folder.
-export const sameRun = (runsRootPath, left, right) => {
-  const a = path.resolve(runsRootPath, left);
-  const b = path.resolve(runsRootPath, right);
-  return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
-};
-
-function namedRunDirectory(runsRootPath, run) {
-  if (!run || run === '.' || run === '..' || path.basename(run) !== run) return null;
-  const directory = path.join(runsRootPath, run);
-  try {
-    return fs.statSync(directory).isDirectory() ? directory : null;
-  } catch {
-    return null;
-  }
-}
-
-function normalizeGrant(grant) {
-  if (!grant || typeof grant !== 'object') return null;
-  const run = String(grant.run ?? '').trim();
-  const reason = String(grant.reason ?? '').trim();
-  return run && reason ? { run, reason } : null;
-}
-
-const grantExample = `Example: \`continue: ${CONTINUATION_ORDER_INPUT.example}\`.`;
-const grantAction =
-  'Action: ask the orchestrator for an explicit grant naming the run and reason; do not invent or reuse a continuation.';
-
-// The 2026-08-10_220535_plan25-2-install-table-two-roots incident showed that a refusal must
-// carry the repair line; otherwise a typo forces an unnecessary directory listing and retry.
-function lastRunOutcome(runsRootPath, chain) {
-  const run = chain[chain.length - 1];
-  if (!run) return null;
-  const status = readJson(path.join(runsRootPath, run, 'status.json')) || {};
-  const meta = readJson(path.join(runsRootPath, run, 'meta.json')) || {};
-  const outcomeStatus = String(meta.status ?? status.status ?? status.state ?? 'unknown').trim() || 'unknown';
-  const outcomeReason = String(meta.reason ?? status.reason ?? 'reason not recorded').trim() || 'reason not recorded';
-  return { run, status: outcomeStatus, reason: outcomeReason, verdict: meta.status, orderId: status.order_id };
-}
-
-export function readyGrantLines(runsRootPath, chain, grantReason) {
-  const last = lastRunOutcome(runsRootPath, chain);
-  if (!last) return 'Ready grant line: none (there is no run to continue).';
-  const reason = String(grantReason ?? last.reason).trim() || last.reason;
-  const continuation = `Ready grant line: continue: ${last.run} — ${reason}.`;
-  // Plan_75 D1: the TradeForge failed advise spent its continuation, so show the same-pass repair.
-  // A run without order_id cannot be retried (retryRefusal step d), so it gets no retry line.
-  const orderId = String(last.orderId ?? '').trim();
-  if (!last.verdict || last.verdict === 'OK' || !orderId) return continuation;
-  return continuation +
-    ` Ready retry line: retry: ${last.run} — ${last.reason} (repeats that pass under order ${orderId}).`;
-}
-
-function lastRunHints(runsRootPath, chain, grantReason) {
-  const last = lastRunOutcome(runsRootPath, chain);
-  if (!last) {
-    return 'Last run: none. Outcome: none. Ready grant line: none (there is no run to continue).';
-  }
-  return `Last run: ${last.run}. Outcome: ${last.status} — ${last.reason}. ` +
-    readyGrantLines(runsRootPath, chain, grantReason);
-}
-
-/**
- * Applies the one-continuation limit and all continuation safety gates before a folder is created.
- *
- * The limit is counted over the runs carrying THIS order id, not over the whole chain. The chain
- * also ties runs together by slug and by the fingerprint of the task text, which is what catches a
- * repeat that renamed itself — but counting continuations that way makes the escape hatch
- * unreachable: the operator's rule is "more passes than one need a new order id", and a new order
- * id lands in the same chain through the task hash. A task would then be refused with a grant
- * for having spent its continuation and refused without one for already having runs — permanently
- * unrunnable, which is a worse failure than the retry storm this limit exists to stop.
- */
-export function continuationRefusal(runsRootPath, chain, isContinue, orderId, grant) {
-  const continuation = normalizeGrant(grant);
-  // Plan_63 D9: only header grant objects authorize a pass; a string is no grant.
-  if (!isContinue || !continuation) return null;
-
-  const namedDirectory = namedRunDirectory(runsRootPath, continuation.run);
-  if (!namedDirectory) {
-    return (
-      `${orderInputName('continue')} is refused: the orchestrator named run “${continuation.run}”, but it does not ` +
-      `exist as a run folder in this project's runs directory ${runsRootPath}. ` +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      `${grantExample} ${grantAction} The submitted grant was not rewritten. ` +
-      'The run folder was not created; quota was not spent.'
-    );
-  }
-
-  const last = chain[chain.length - 1];
-  // Continuing the last run appends a later run, so the old grant stops matching by itself; this
-  // incident needs no counter or new state to make an orchestrator grant single-use.
-  if (!last || !sameRun(runsRootPath, continuation.run, last)) {
-    return (
-      `${orderInputName('continue')} is refused: grant ${continuation.run} is not the LAST run of this task's chain; ` +
-      `the current last run is ${last || 'none'}. A continuation is single-use: continuing the ` +
-      'last run appends a later run, so the old grant stops matching by itself — no counter or new ' +
-      `state is used. ${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      `${grantExample} ${grantAction} The run folder was not created; quota was not spent.`
-    );
-  }
-
-  const wanted = String(orderId ?? '').trim();
-  // Plan_75 D1, TradeForge capacity incident: a retry spends no new pass, even after an OK verdict.
-  const ofThisOrder = chain.filter((run) => {
-    const status = readJson(path.join(runsRootPath, run, 'status.json'));
-    return String(status?.order_id ?? '').trim() === wanted && !String(status?.retry_of ?? '').trim();
-  });
-  if (ofThisOrder.length === 0) return null;
-  if (ofThisOrder.length > 1) {
-    const spent = ofThisOrder.map((run) => path.join(runsRootPath, run)).join(', ');
-    return (
-      `${orderInputName('continue')} is refused: order “${wanted}” already spent its allowed continuation on ${spent}. ` +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} ` +
-      'A further pass needs a new order id from the orchestrator. The run folder was not ' +
-      'created; quota was not spent.'
-    );
-  }
-  const previous = path.join(runsRootPath, ofThisOrder[0]);
-  const status = readJson(path.join(previous, 'status.json'));
-  const meta = readJson(path.join(previous, 'meta.json'));
-  if (!meta?.status || status?.state === 'running') {
-    return (
-      `${orderInputName('continue')} is refused: previous run ${previous} has no finished verdict and may still ` +
-      `be editing the worktree. Repeat without ${orderInputName('continue')} to attach to it. ` +
-      `${lastRunHints(runsRootPath, chain, continuation.reason)} The run folder was ` +
-      'not created; quota was not spent.'
-    );
-  }
-  return null;
-}
-
-export function retryRefusal(runsRootPath, chain, isContinue, orderId, grant, liveness = workerMayBeAlive) {
-  const refuse = (message) => `${message} The run folder was not created; quota was not spent.`;
-  const runDir = namedRunDirectory(runsRootPath, grant?.run);
-  if (!runDir) {
-    return refuse(`Retry is refused: ${grant?.run || 'none'} is not a bare existing run folder in ${runsRootPath}.`);
-  }
-  const last = chain[chain.length - 1];
-  // Plan_75 D1: appending the TradeForge retry makes this grant single-use without a new counter.
-  if (!last || !sameRun(runsRootPath, grant.run, last)) {
-    return refuse(`Retry is refused: grant ${grant.run} is not the LAST run of this task's chain; a retry is single-use.`);
-  }
-  const status = readJson(path.join(runDir, 'status.json'));
-  const wanted = String(orderId ?? '').trim();
-  const previousOrder = String(status?.order_id ?? '').trim();
-  if (!previousOrder || previousOrder !== wanted) {
-    return refuse(`Retry is refused: run ${grant.run} order_id ${previousOrder || '(missing)'} differs from order ${wanted}. ` +
-      'A retry repeats its own order; a run without order_id predates orders — start a new order.');
-  }
-  const meta = readJson(path.join(runDir, 'meta.json'));
-  // Plan_75 D1: a verdict alone must not let a retry overlap the failed advise's live writer.
-  if (!meta?.status || liveness({ runDir, status })) {
-    return refuse(`Retry is refused: run ${grant.run} has no finished verdict or its worker may still be alive and writing. ` +
-      `Repeat without ${orderInputName('retry')} to attach to it.`);
-  }
-  if (meta.status === 'OK') {
-    return refuse(`Retry is refused: run ${grant.run} ended OK. A retry repeats a failed pass; use continue: for the next pass.`);
-  }
-  return null;
-}
+/**
+ * Owns the zero-quota decision about whether a requested continuation was ordered.
+ *
+ * The 2026-08-05 incident showed why the runner must not infer a second pass from a verdict:
+ * only the orchestrator read that verdict and can name the run and reason it is willing to fund.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { CONTINUATION_ORDER_INPUT, orderInputName } from '../order-schema.mjs';
+import { orderRuleMessage } from '../order-rules.mjs';
+import { orderDiagnosticMessage } from '../order-diagnostics.mjs';
+import { readJson } from '../write-meta.mjs';
+import { workerMayBeAlive } from '../meta/run-liveness.mjs';
+
+// One comparison of run names for the grant gate and for attach, so a repeat and a grant can never
+// disagree about whether two spellings name the same folder.
+export const sameRun = (runsRootPath, left, right) => {
+  const a = path.resolve(runsRootPath, left);
+  const b = path.resolve(runsRootPath, right);
+  return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+};
+
+function namedRunDirectory(runsRootPath, run) {
+  if (!run || run === '.' || run === '..' || path.basename(run) !== run) return null;
+  const directory = path.join(runsRootPath, run);
+  try {
+    return fs.statSync(directory).isDirectory() ? directory : null;
+  } catch {
+    return null;
+  }
+}
+
+function normalizeGrant(grant) {
+  if (!grant || typeof grant !== 'object') return null;
+  const run = String(grant.run ?? '').trim();
+  const reason = String(grant.reason ?? '').trim();
+  return run && reason ? { run, reason } : null;
+}
+
+// The 2026-08-10_220535_plan25-2-install-table-two-roots incident showed that a refusal must
+// carry the repair line; otherwise a typo forces an unnecessary directory listing and retry.
+function lastRunOutcome(runsRootPath, chain) {
+  const run = chain[chain.length - 1];
+  if (!run) return null;
+  const status = readJson(path.join(runsRootPath, run, 'status.json')) || {};
+  const meta = readJson(path.join(runsRootPath, run, 'meta.json')) || {};
+  const outcomeStatus = String(meta.status ?? status.status ?? status.state ?? 'unknown').trim() || 'unknown';
+  const outcomeReason = String(meta.reason ?? status.reason ?? 'reason not recorded').trim() || 'reason not recorded';
+  return { run, status: outcomeStatus, reason: outcomeReason, verdict: meta.status, orderId: status.order_id };
+}
+
+export function readyGrantLines(runsRootPath, chain, grantReason) {
+  const last = lastRunOutcome(runsRootPath, chain);
+  if (!last) return orderRuleMessage('ready-grant-line', { variant: 'none' });
+  const reason = String(grantReason ?? last.reason).trim() || last.reason;
+  const continuation = orderRuleMessage('ready-grant-line', { variant: 'continue', run: last.run, reason });
+  // Plan_75 D1: the TradeForge failed advise spent its continuation, so show the same-pass repair.
+  // A run without order_id cannot be retried (retryRefusal step d), so it gets no retry line.
+  const orderId = String(last.orderId ?? '').trim();
+  if (!last.verdict || last.verdict === 'OK' || !orderId) return continuation;
+  return [continuation, orderRuleMessage('ready-grant-line', {
+    variant: 'retry', run: last.run, reason: last.reason, orderId,
+  })].join(' ');
+}
+
+function lastRunHints(runsRootPath, chain, grantReason) {
+  const last = lastRunOutcome(runsRootPath, chain);
+  if (!last) {
+    return [orderRuleMessage('grant-last-run-hint', { variant: 'none' }),
+      orderRuleMessage('ready-grant-line', { variant: 'none' })].join(' ');
+  }
+  return [orderRuleMessage('grant-last-run-hint', {
+    variant: 'last', run: last.run, status: last.status, reason: last.reason,
+  }), readyGrantLines(runsRootPath, chain, grantReason)].join(' ');
+}
+
+/**
+ * Applies the one-continuation limit and all continuation safety gates before a folder is created.
+ *
+ * The limit is counted over the runs carrying THIS order id, not over the whole chain. The chain
+ * also ties runs together by slug and by the fingerprint of the task text, which is what catches a
+ * repeat that renamed itself — but counting continuations that way makes the escape hatch
+ * unreachable: the operator's rule is "more passes than one need a new order id", and a new order
+ * id lands in the same chain through the task hash. A task would then be refused with a grant
+ * for having spent its continuation and refused without one for already having runs — permanently
+ * unrunnable, which is a worse failure than the retry storm this limit exists to stop.
+ */
+export function continuationRefusal(runsRootPath, chain, isContinue, orderId, grant) {
+  const continuation = normalizeGrant(grant);
+  // Plan_63 D9: only header grant objects authorize a pass; a string is no grant.
+  if (!isContinue || !continuation) return null;
+
+  const refuse = (violation, values) => [orderRuleMessage('continuation-grant-usable', {
+    violation, labelName: orderInputName('continue'), run: continuation.run,
+    hints: lastRunHints(runsRootPath, chain, continuation.reason), ...values,
+  }), orderDiagnosticMessage('run-not-created')].join(' ');
+
+  const namedDirectory = namedRunDirectory(runsRootPath, continuation.run);
+  if (!namedDirectory) {
+    return refuse('missing-folder', { runsRoot: runsRootPath, example: CONTINUATION_ORDER_INPUT.example });
+  }
+
+  const last = chain[chain.length - 1];
+  // Continuing the last run appends a later run, so the old grant stops matching by itself; this
+  // incident needs no counter or new state to make an orchestrator grant single-use.
+  if (!last || !sameRun(runsRootPath, continuation.run, last)) {
+    return refuse('not-last', { lastRun: last || 'none', example: CONTINUATION_ORDER_INPUT.example });
+  }
+
+  const wanted = String(orderId ?? '').trim();
+  // Plan_75 D1, TradeForge capacity incident: a retry spends no new pass, even after an OK verdict.
+  const ofThisOrder = chain.filter((run) => {
+    const status = readJson(path.join(runsRootPath, run, 'status.json'));
+    return String(status?.order_id ?? '').trim() === wanted && !String(status?.retry_of ?? '').trim();
+  });
+  if (ofThisOrder.length === 0) return null;
+  if (ofThisOrder.length > 1) {
+    const spent = ofThisOrder.map((run) => path.join(runsRootPath, run)).join(', ');
+    return refuse('spent', { orderId: wanted, spent });
+  }
+  const previous = path.join(runsRootPath, ofThisOrder[0]);
+  const status = readJson(path.join(previous, 'status.json'));
+  const meta = readJson(path.join(previous, 'meta.json'));
+  if (!meta?.status || status?.state === 'running') {
+    return refuse('unfinished', { previous });
+  }
+  return null;
+}
+
+export function retryRefusal(runsRootPath, chain, isContinue, orderId, grant, liveness = workerMayBeAlive) {
+  const refuse = (violation, values) => [orderRuleMessage('retry-grant-usable', {
+    violation, run: grant?.run || 'none', ...values,
+  }), orderDiagnosticMessage('run-not-created')].join(' ');
+  const runDir = namedRunDirectory(runsRootPath, grant?.run);
+  if (!runDir) {
+    return refuse('missing-folder', { runsRoot: runsRootPath });
+  }
+  const last = chain[chain.length - 1];
+  // Plan_75 D1: appending the TradeForge retry makes this grant single-use without a new counter.
+  if (!last || !sameRun(runsRootPath, grant.run, last)) {
+    return refuse('not-last', {});
+  }
+  const status = readJson(path.join(runDir, 'status.json'));
+  const wanted = String(orderId ?? '').trim();
+  const previousOrder = String(status?.order_id ?? '').trim();
+  if (!previousOrder || previousOrder !== wanted) {
+    return refuse('order-mismatch', { previousOrder: previousOrder || '(missing)', orderId: wanted });
+  }
+  const meta = readJson(path.join(runDir, 'meta.json'));
+  // Plan_75 D1: a verdict alone must not let a retry overlap the failed advise's live writer.
+  if (!meta?.status || liveness({ runDir, status })) {
+    return refuse('unfinished', { labelName: orderInputName('retry') });
+  }
+  if (meta.status === 'OK') {
+    return refuse('ended-ok', {});
+  }
+  return null;
+}