@lyupro/codex-bridge 0.6.8 → 0.6.10

package/src/agents/codex-advisor.md

@@ -46,9 +46,11 @@ and do not reason about the design yourself.
   `order id` as `--order-id`, `task file` as `--task-file`, and `phase` as `--phase`. Use the same
   order id for both phases; never invent or edit it. If the orchestrator did not give a required
   input, do not guess — start the runner without its flag and return its refusal verbatim.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
+- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
+  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
+  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
+  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
+  and let the runner issue the refusal. A continuation is
   assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
   output and stop; do not issue or invent another continuation. If no such grant line is present,
   the flag must not be present. The advise phase requires this grant to continue the scope run.
@@ -82,9 +84,11 @@ unmatchable by construction. Reaching for one does not rescue the run; it guaran
 codex-bridge run --agent codex-advisor --repo "<repository-path or .>" --phase "<phase from the orchestrator>" --slug "<slug>" --order-id "<order id from the orchestrator>" --task-file "<task-file path from the orchestrator>"
 ```
 
-That is one command line. Add only the bare `--continue` when the task text contains a line
-beginning with `continue:`; it has no value. The runner accepts only `1/true/yes/0/false/no` as a
-grant value in the task text, so a malformed grant is passed through for the runner to refuse. If
+That is one command line. Add only the bare `--continue` when the orchestrator's call carries a line
+beginning with `continue:` or `retry:`; the flag itself takes no value (the runner accepts only
+`1/true/yes/0/false/no` there). The grant line names a run folder and a reason; never inspect, repair,
+or swallow it. The runner parses it, so a malformed grant is passed through for the runner to
+refuse. If
 there is no grant line, do not add the flag. Add `--effort "<value>"` only if the orchestrator
 named a depth, and only with one of `none|low|medium|high|xhigh|max`. Never add free text or any
 flags beyond those two conditional flags.
@@ -141,9 +145,13 @@ path.
 - `FAIL` — the result is empty, invalid, the return code is nonzero, or the run was abandoned.
 - `LIMIT` — the result is empty and the log signals a ChatGPT quota limit. The quota is spent and
   the task was not completed; do not restart it.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
-The script return code mirrors the status: `0` / `1` / `3`. A nonzero code is not a reason to
+The script return code mirrors the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to
 retry, change the command, or investigate on your own.
+Code `5` means `UNAVAILABLE`.
 
 For `scope`, `OK — scope: sufficient; …` means the listed paths cover the question; continue with
 `--phase advise` only when the orchestrator supplies that continuation. `OK — scope: insufficient;
@@ -158,12 +166,17 @@ verbatim; compose nothing.
 The run folder contains its status and artifacts. An abandoned run is not a reason to start over
 yourself: the orchestrator decides whether to continue, and without the `--continue` it issued,
 the runner will reject that continuation itself.
+The orchestrator repeats a failed scope or a failed advise with a `retry:` grant naming that failed
+run, under the same order id. A successful scope is never continued as scope:
+the runner refuses a continued scope, because it would spend the continuation that advise needs.
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed, it prints a ready-made `FAIL` with a verification command for the operator. Return that
-output. Performing the task manually instead of Codex is prohibited for any reason it fails.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
+Performing the task manually instead of Codex is prohibited for any reason it fails.
 
 ## What a violation looks like
 

package/src/agents/codex-build.md

@@ -39,9 +39,11 @@ job is to report the run status honestly, including failure.
   reuse an order id from another order — the runner chains runs by that label, and a made-up label
   is how a repeat run hides. If the orchestrator did not give a required input, do not guess: start
   the runner without its flag and return the runner's refusal exactly.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
+- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
+  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
+  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
+  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
+  and let the runner issue the refusal. A continuation is
   assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
   output and stop; do not issue or invent another continuation. If no such grant line is present,
   the flag must not be present.
@@ -51,11 +53,13 @@ job is to report the run status honestly, including failure.
   heading, one line. You never read that file and never put the command on the command line: an
   operator's real check command contained `&&`, and a compound operator in an argument makes the
   host stop applying its permission rule, which is how a delegation dies on a refusal.
-- Every build task file must contain exactly one `advice:` line from the orchestrator: an absolute
+- Every build task file must start with a header of consecutive lowercase `label: value` lines
+  from the first line: exactly one `advice:` line from the orchestrator and the `continue:` or
+  `retry:` grant when there is one, then a blank line. The `advice:` value is an absolute
   path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
   status `OK`, or exactly
   `mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
-  starts. Pass the task file as supplied; the orchestrator owns this line.
+  starts. Pass the task file as supplied and never edit it; the orchestrator owns this header.
 
 ## When the host refuses the command
 
@@ -90,8 +94,9 @@ Add `--effort "<value>"` only when the orchestrator named a depth, and only with
 decides, which is the intended default — a placeholder copied from this template is refused before
 Codex starts.
 
-If the task text contains a line beginning with the `continue:` label, add the bare `--continue`
-flag even when its run name or reason looks malformed. Do not inspect, repair, or swallow the line;
+If the orchestrator's call carries a line beginning with `continue:` or `retry:`, add the bare
+`--continue` flag even when its run name or reason looks malformed. Do not inspect, repair, or
+swallow the line;
 the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
 present in the command.
 No value
@@ -191,8 +196,9 @@ anything.
 An empty `summary` is FAIL.
 
 The `Flags` line in the response lists `TODO`, `FIXME`, `test.skip`/`.only`, and
-`NotImplemented` found in the diff. They are not hidden: false completion must be visible to the
-orchestrator.
+`NotImplemented` markers on lines THIS run added, compared with its start content. They are not
+hidden: false completion must be visible to the orchestrator. `Flags coverage: incomplete` means
+some files could not be judged.
 
 ## The script determines status, not you
 
@@ -214,6 +220,9 @@ orchestrator.
   separate
   line, the runner reports whether the worktree was left touched, because a run interrupted
   halfway is more dangerous than one that never happened. Do not restart.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
 A failed verification and a mismatch between the report and worktree cancel `OK` status — the
 orchestrator branches on
@@ -221,7 +230,8 @@ the first word, so failure must not be buried on the third line. Found placehold
 it, but they
 are visible in the `Flags` line — the orchestrator decides what to do with them. The script return
 code mirrors
-the status: `0` / `1` / `3`. A nonzero code is not a reason to retry or finish the code yourself.
+the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to retry or finish the code yourself.
+Code `5` means `UNAVAILABLE`.
 
 The run folder contains `status.json` (`running` / `finished` / `failed` / `abandoned`) and the
 runner pid.
@@ -231,10 +241,10 @@ without the `--continue` it issued, the runner will reject that repeat run itsel
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed,
-it prints a ready-made FAIL with a verification command for the operator. Your job is to return that
-output.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
 Implementing the task instead of Codex is prohibited for any reason it fails.
 
 ## What a violation looks like

package/src/agents/codex-review.md

@@ -38,9 +38,11 @@ opinion, not a verdict.
   another order — the runner chains runs by that label, and a made-up label is how a repeat run
   hides. If the orchestrator did not give a required input, do not guess — start the runner without
   its flag and return the runner's refusal verbatim.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
+- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
+  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
+  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
+  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
+  and let the runner issue the refusal. A continuation is
   assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
   output and stop; do not issue or invent another continuation. If no such grant line is present,
   the flag must not be present.
@@ -90,8 +92,9 @@ If the runner refuses with an order id collision — the id already belongs to a
 differs — that refusal is the whole answer: return `FAIL` with the runner's text, which names the
 remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
 
-If the task text contains a line beginning with the `continue:` label, add the bare `--continue`
-flag even when its run name or reason looks malformed. Do not inspect, repair, or swallow the line;
+If the orchestrator's call carries a line beginning with `continue:` or `retry:`, add the bare
+`--continue` flag even when its run name or reason looks malformed. Do not inspect, repair, or
+swallow the line;
 the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
 present in the command at all.
 
@@ -176,9 +179,13 @@ and the wait can be repeated for free, so neither has any reason to restart anyt
 - `LIMIT` — the result is empty and the log signals a limit. The ChatGPT quota is exhausted, and the
   review was not
   completed; this is not a review failure and not a reason to restart.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
-The script return code mirrors the status: `0` / `1` / `3`. A nonzero code is not a reason to retry,
+The script return code mirrors the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to retry,
 not a reason to change the command, and not a reason to review it yourself.
+Code `5` means `UNAVAILABLE`.
 
 The run folder contains `status.json` (`running` / `finished` / `failed` / `abandoned`) and the
 runner pid.
@@ -190,10 +197,10 @@ Token spending now goes into `meta.json` (the `review` subcommand did not print
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed,
-it prints a ready-made FAIL with a verification command for the operator. Your job is to return that
-output.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
 
 ## What a violation looks like
 

package/src/agents/codex-scout.md

@@ -38,13 +38,17 @@ files, do not run grep, do not retell the report, and do not reason about the ta
   hides. If the orchestrator did not give a required input, do not guess — start the runner without
   its flag and return the runner's refusal verbatim.
 - The sub-questions are NOT yours to pass. They live in the task file the orchestrator wrote, under
-  a `Questions` heading, one Markdown list item each. You never read that file, never edit it and
-  never put a question on the command line: a question is free prose, and free prose in an argument
+  a `Questions` heading, one Markdown list item each. A question may carry the orderer's
+  `[context-only]` marker; the dispatcher never adds, removes or repairs it. You never read that
+  file, never edit it and never put a question on the command line: a question is free prose, and
+  free prose in an argument
   makes the host stop applying the operator's permission rule, which is how a delegation dies on a
   refusal. If the file holds no question, start the runner anyway and return its refusal verbatim.
-- `continue` — when the task text contains a line beginning with the `continue:` label, pass the
-  bare `--continue` flag even when its run name or reason looks malformed. Do not inspect, repair,
-  or swallow this grant; pass it through and let the runner issue the refusal. A continuation is
+- `continue` — when the orchestrator's call carries a line beginning with `continue:` or `retry:`,
+  pass the bare `--continue` flag even when its run name or reason looks malformed. A `retry:`
+  grant lets the orchestrator repeat a failed pass (FAIL, LIMIT, UNAVAILABLE) of the same order
+  once; it is not the next pass. Do not inspect, repair, or swallow this grant; pass it through
+  and let the runner issue the refusal. A continuation is
   assigned by the orchestrator, never chosen by you. After the verdict, return the exact attaching
   output and stop; do not issue or invent another continuation. If no such grant line is present,
   the flag must not be present.
@@ -85,8 +89,9 @@ Add `--effort "<value>"` only when the orchestrator named a depth, and only with
 decides, which is the intended default — a placeholder copied from this template is refused before
 Codex starts.
 
-If the task text contains a line beginning with the `continue:` label, add the bare `--continue`
-flag even when its run name or reason looks malformed. Do not inspect, repair, or swallow the line;
+If the orchestrator's call carries a line beginning with `continue:` or `retry:`, add the bare
+`--continue` flag even when its run name or reason looks malformed. Do not inspect, repair, or
+swallow the line;
 the runner parses it and issues the refusal. If no such grant line is present, the flag must not be
 present in the command.
 No value
@@ -170,6 +175,7 @@ confidence), `unknowns[]`, and `report_markdown`. An uncovered subquestion or an
 evidence is FAIL;
 the runner prints the line `Coverage: N/M subquestions`. The runner expands the last field into
 `report.md`.
+A `[context-only]` subquestion is answered with `startup:<source>` evidence.
 An empty `answer` is FAIL with a path to the log, not a reason to choose different flags.
 
 ## The script determines status, not you
@@ -180,9 +186,13 @@ An empty `answer` is FAIL with a path to the log, not a reason to choose differe
 - `LIMIT` — the result is empty and the log signals a limit. The ChatGPT quota is exhausted, and the
   task was not
   completed; this is not a task failure and not a reason to restart.
+- `UNAVAILABLE` — Codex is missing or signed out (checked before start, or recognised from the CLI's own
+  sign-in refusal after start). The task was not attempted or could not run; this is not a task failure and
+  not a reason to restart — return the block as is, the orchestrator hands the task to the next executor.
 
-The script return code mirrors the status: `0` / `1` / `3`. A nonzero code is not a reason to retry,
+The script return code mirrors the status: `0` / `1` / `3` / `5`. A nonzero code is not a reason to retry,
 not a reason to change the command, and not a reason to investigate on your own.
+Code `5` means `UNAVAILABLE`.
 
 The run folder contains `status.json` (`running` / `finished` / `failed` / `abandoned`) and the
 runner pid.
@@ -194,10 +204,10 @@ which is the runner telling you the answer is on disk already.
 
 ## Codex is unavailable
 
-The runner checks `codex --version` before starting. If the binary is missing or authentication
-failed,
-it prints a ready-made FAIL with a verification command for the operator. Your job is to return that
-output.
+The runner looks `codex` up on PATH and asks `codex login status` before starting. A missing binary
+or the measured "Not logged in" answer prints a ready-made `UNAVAILABLE` block (first line
+`UNAVAILABLE — `, exit 5, no run folder). An unclear probe prints an ordinary refusal starting
+`Codex CLI unavailable:` (exit 1). Return that output verbatim.
 Performing the task manually instead of Codex is prohibited for any reason it fails.
 
 ## What a violation looks like

package/src/home/conventions.md

@@ -42,3 +42,12 @@ boundary is needed.
 The 2026-08-05 step 2b acceptance found the abandoned-run check below the commit check. Test the
 ordering invariant itself, and leave the incident in the comment so a later cleanup does not
 silently undo it.
+
+## Failing tests are evidence - Plan_73 B3 fixture incident
+
+- Never change a fixture or an expectation only to make a failing test pass.
+- When an existing test fails for a reason the task does not describe, leave it failing and name
+  it under deviations.
+
+The 2026-09-30 Plan_73 B3 run rewrote a witness fixture so that a snapshot codec defect stopped
+showing; that defect would have failed every build started on a clean tree.

package/src/home/hooks/guard-tries.mjs

@@ -1,6 +1,6 @@
-import fs from 'node:fs';
 import path from 'node:path';
-import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { createHomeWriter } from '../lib/home-write.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 
 /**
@@ -49,8 +49,10 @@ export function takeTry(agentId, kind, maxBlocks = kind === STATE ? MAX_STATE_BL
   const ids = Object.keys(seen);
   if (ids.length > 200) ids.slice(0, ids.length - 200).forEach((id) => delete seen[id]);
   try {
-    fs.mkdirSync(path.dirname(BLOCKED_FILE), { recursive: true });
-    fs.writeFileSync(BLOCKED_FILE, `${JSON.stringify(seen)}\n`);
+    // Plan_65 B4: the budget is the registered guard-tries artifact, so purge can name and remove it.
+    const writer = createHomeWriter({ root: BRAND_HOME.root });
+    writer.mkdirSync('guard-tries', path.dirname(BLOCKED_FILE), { recursive: true });
+    writer.writeFileSync('guard-tries', BLOCKED_FILE, `${JSON.stringify(seen)}\n`);
   } catch {
     return 'untracked';
   }

package/src/home/hooks/order-gate.mjs

@@ -14,23 +14,23 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
-import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 import {
   diagnoseInput,
   extractValue,
   missingInputs,
-  parseContinuationGrant,
+  parseGrant,
   shellUnsafeInputs,
 } from '../lib/required-inputs.mjs';
 import { SUBAGENT_TOOLS } from '../lib/hook-definitions.mjs';
 import { taskFingerprint } from '../lib/meta/chain.mjs';
-import { conflictingOrderOwner } from '../lib/runner/order-owner.mjs';
+import { conflictingOrderOwner, orderOwnerConflictText } from '../lib/runner/order-owner.mjs';
 import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { parseTaskDocument } from '../lib/runner/task-file.mjs';
+import { parseTaskHeader, taskHeaderRefusal } from '../lib/task-header.mjs';
 
-const DIAGNOSTICS_DIR = path.join(BRAND_STATE_DIR, 'diagnostics');
 const GUARDED = new Set(Object.keys(AGENTS));
 /**
  * Both spellings of the subagent-launching tool, from the same list the installer builds its
@@ -58,12 +58,7 @@ try {
   pass();
 }
 
-try {
-  fs.mkdirSync(DIAGNOSTICS_DIR, { recursive: true });
-  fs.writeFileSync(path.join(DIAGNOSTICS_DIR, 'order-gate.last.json'), `${JSON.stringify(input, null, 2)}\n`);
-} catch {
-  // Diagnostics are a convenience, never a reason to fail the turn.
-}
+recordHookDiagnostic('order-gate', input);
 
 if (!input || typeof input !== 'object' || Array.isArray(input)) pass();
 if (!SUBAGENT_TOOL_NAMES.has(input.tool_name)) pass();
@@ -121,11 +116,29 @@ const readStatus = (file) => {
 
 const orderId = extractValue(toolInput.prompt, 'order id');
 const taskFile = extractValue(toolInput.prompt, 'task file');
-if (!orderId || !taskFile || parseContinuationGrant(toolInput.prompt)) pass();
+// Plan_75 D1, TradeForge capacity incident: retries keep their order; the runner owns conflicting-grant refusal.
+const grant = parseGrant(toolInput.prompt);
+if (!orderId || !taskFile || grant?.kind || grant?.error) pass();
+
+let rawTask;
+try {
+  rawTask = fs.readFileSync(taskFile, 'utf8');
+} catch {
+  pass();
+}
+// Plan_75 D5, 2026-10-03 20:42: malformed metadata must not disappear into the disk-state guard.
+const parsed = parseTaskHeader(rawTask);
+const headerRefusal = taskHeaderRefusal(parsed);
+if (headerRefusal) deny(headerRefusal);
+let taskHash;
+try {
+  taskHash = taskFingerprint(parseTaskDocument(parsed.body).task);
+} catch {
+  // A malformed Questions or Verify section is the runner's refusal to issue, with its own text.
+  pass();
+}
 
 try {
-  const taskDocument = parseTaskDocument(fs.readFileSync(taskFile, 'utf8'));
-  const taskHash = taskFingerprint(taskDocument.task);
   const projectRunsDir = resolveProjectRunsDir(runsRoot(), input.cwd, { create: false }).dir;
   // Per folder, not per directory: a run folder created a moment before its status.json, or any
   // leftover beside the runs, would otherwise throw out of the whole check and silently disarm the
@@ -137,12 +150,7 @@ try {
   const owner = conflictingOrderOwner(runs, orderId, taskHash);
   if (owner) {
     const ownerDir = path.join(projectRunsDir, owner.run);
-    deny(
-      `Order gate denied the Agent call because order id ${JSON.stringify(orderId)} already belongs ` +
-        `to run folder ${ownerDir} (slug ${owner.status.slug}, started_at ${owner.status.started_at}) ` +
-        'with a different task. Use a new order id, or provide an explicit continuation grant if ' +
-        'this is another pass of that order.',
-    );
+    deny(orderOwnerConflictText(owner, ownerDir, orderId));
   }
 } catch {
   // The 2026-08-15 collision guard is diagnostic: uncertain disk state must not block real work.

package/src/home/hooks/reply-guard.mjs

@@ -33,6 +33,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
 import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
 import { runOrderMismatch, transcriptOrderId } from '../lib/dispatcher-order.mjs';
 import { decideDispatcherStop, transcriptToolUses } from '../lib/dispatcher-stop.mjs';
 import { recognizeHostRefusal } from '../lib/host-refusal.mjs';
@@ -111,13 +112,7 @@ try {
   pass();
 }
 
-try {
-  const diagnosticsDir = path.join(BRAND_STATE_DIR, 'diagnostics');
-  fs.mkdirSync(diagnosticsDir, { recursive: true });
-  fs.writeFileSync(path.join(diagnosticsDir, 'reply-guard.last.json'), `${JSON.stringify(input, null, 2)}\n`);
-} catch {
-  // Diagnostics are a convenience, never a reason to fail the turn.
-}
+recordHookDiagnostic('reply-guard', input);
 
 // A host that stops sending agent_type would let every dispatcher past the gate and this
 // audit without a word (Plan_66 D2 (c)); say so instead of passing silently.

package/src/home/hooks/reply-parser.mjs

@@ -1,5 +1,5 @@
 /** Parses dispatcher replies into guard facts. */
-const STATUSES = ['OK', 'FAIL', 'LIMIT'];
+const STATUSES = ['OK', 'FAIL', 'LIMIT', 'UNAVAILABLE'];
 
 /**
  * Either line names the run folder. `RUN=` is printed by the call that starts a run, `ATTACH=`

package/src/home/hooks/worktree-witness.mjs

@@ -15,7 +15,7 @@ import path from 'node:path';
 import { SHELL_TOOLS } from '../lib/hook-definitions.mjs';
 import { parseJsonText } from '../lib/json-file.mjs';
 import { splitRunChanges } from '../lib/meta/environment.mjs';
-import { changedPaths } from '../lib/meta/paths.mjs';
+import { compareSnapshots } from '../lib/meta/snapshot-format.mjs';
 import { outOfScope } from '../lib/meta/verdict.mjs';
 import { git, worktreeSnapshot } from '../lib/runner/git-state.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
@@ -64,16 +64,16 @@ if (beforeText === null || scopeText === null) pass();
 
 let outside;
 try {
-  // changedPaths tolerates malformed rows; a hook must instead fail open on a damaged baseline.
-  if (beforeText.split(/\r?\n/).filter(Boolean).some((row) =>
-    !/^(?:\d+\t\d+|-\t-|U\t\d+)\t\S.*$/.test(row))) pass();
   const patterns = scopeText.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   if (!patterns.length) pass();
   // The shared snapshot returns empty output on git errors; do not call that a restored tree.
   const repository = git(status.repo, ['rev-parse', '--is-inside-work-tree']);
   if (repository.error || repository.status !== 0 || repository.stdout?.trim() !== 'true') pass();
-  const current = worktreeSnapshot(status.repo);
-  const { work } = splitRunChanges(dir, changedPaths(beforeText, current));
+  // Plan_73 / 2026-09-30: a damaged or incompatible baseline proves neither a clean
+  // tree nor a stray edit. The advisory witness stays silent when the codec refuses it.
+  const comparison = compareSnapshots(beforeText, worktreeSnapshot(status.repo));
+  if (!comparison.ok) pass();
+  const { work } = splitRunChanges(dir, comparison.changed);
   outside = outOfScope(work, patterns);
 } catch {
   pass();

package/src/home/lib/agents.mjs

@@ -12,7 +12,7 @@ export const AGENTS = {
   'codex-build': { role: 'build', budget: 25, writes: true, result: 'result.json' },
   'codex-review': { role: 'review', budget: 20, writes: false, result: 'review.json' },
   // Plan_59: design advice needs a bounded scope pass before the continued decision pass.
-  'codex-advisor': { role: 'advisor', budget: { scope: 5, advise: 15 }, writes: false, result: 'result.json' },
+  'codex-advisor': { role: 'advisor', budget: { scope: 10, advise: 25 }, writes: false, result: 'result.json' },
 };
 
 export const agentRole = (agent) => AGENTS[agent]?.role;

package/src/home/lib/atomic-json.mjs

@@ -6,16 +6,34 @@
  * (`config-edit.mjs` keeps its own compare-and-swap publish for that reason).
  */
 import { randomUUID } from 'node:crypto';
-import fs from 'node:fs';
 import path from 'node:path';
 
-export function writeJsonAtomic(file, record) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
+function removeIfPresent(remove, temporary) {
+  try {
+    remove(temporary);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
+function publishJsonAtomic(file, record, operations) {
   const temporary = `${file}.${randomUUID()}.tmp`;
   try {
-    fs.writeFileSync(temporary, `${JSON.stringify(record, null, 2)}\n`, { flag: 'wx' });
-    fs.renameSync(temporary, file);
+    operations.mkdir(path.dirname(file), { recursive: true });
+    operations.write(temporary, `${JSON.stringify(record, null, 2)}\n`, { flag: 'wx' });
+    operations.rename(temporary, file);
   } finally {
-    fs.rmSync(temporary, { force: true });
+    removeIfPresent(operations.unlink, temporary);
   }
 }
+
+export function writeHomeJsonAtomic(writer, id, file, record) {
+  // Plan_65 B2: `state/` is shared by artifacts, so validate the file before mkdir can create it.
+  writer.assertArtifact(id, file);
+  return publishJsonAtomic(file, record, {
+    mkdir(directory, options) { return writer.mkdirSync(id, directory, options); },
+    write(temporary, contents, options) { return writer.writeFileSync(id, temporary, contents, options); },
+    rename(temporary, target) { return writer.renameSync(id, temporary, target); },
+    unlink(temporary) { return writer.unlinkSync(id, temporary); },
+  });
+}

package/src/home/lib/command-path.mjs

@@ -0,0 +1,32 @@
+/**
+ * Finds a command on PATH the way the host shell would, without starting it.
+ * The runner and CLI share this home module because the home never imports cli/ (Plan_60 D2).
+ */
+import { existsSync, statSync } from 'node:fs';
+import path from 'node:path';
+
+export function envValue(env, name) {
+  const key = Object.keys(env).find((entry) => entry.toLowerCase() === name);
+  return key ? env[key] : '';
+}
+
+function pathValue(env) {
+  return envValue(env, 'path');
+}
+
+export function resolveCommandOnPath(name, env = process.env) {
+  const extensions = process.platform === 'win32'
+    ? (env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';')
+    : [''];
+  for (const directory of pathValue(env).split(path.delimiter).filter(Boolean)) {
+    for (const extension of extensions) {
+      const candidate = path.join(path.resolve(directory), `${name}${extension}`);
+      try {
+        if (existsSync(candidate) && statSync(candidate).isFile()) return candidate;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}