@lyupro/codex-bridge 0.6.8 → 0.6.10

package/src/home/lib/home-write.mjs

@@ -0,0 +1,189 @@
+/**
+ * Performs a write into the package home only when the path belongs to the artifact id it names.
+ *
+ * The registry alone is a list someone can forget to consult; routing the write through it is what
+ * makes `uninstall --purge` complete by construction (Plan_62 D22). The check is lexical and
+ * in-memory — no lock, no stat, no listing — because hooks call it on every shell command of every
+ * session, and links are deliberately not resolved, as everywhere else in the package.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { classifyHomePath, HOME_ARTIFACTS, HOME_DIRECTORIES } from './home-registry.mjs';
+
+function registryError(id, absolutePath, reason) {
+  const error = new Error(`Home artifact "${id}" refused path "${absolutePath}": ${reason}`);
+  error.code = 'EHOMEREGISTRY';
+  return error;
+}
+
+function toPosix(relativePath) {
+  return relativePath.split(path.sep).join('/');
+}
+
+function homeRelativePath(root, id, absolutePath) {
+  if (typeof absolutePath !== 'string' || !path.isAbsolute(absolutePath)) {
+    throw registryError(id, absolutePath, 'an absolute path is required');
+  }
+  const relativeNative = path.relative(root, absolutePath);
+  if (
+    path.isAbsolute(relativeNative)
+    || relativeNative === '..'
+    || relativeNative.startsWith(`..${path.sep}`)
+  ) {
+    throw registryError(id, absolutePath, 'path is outside the home root');
+  }
+  return toPosix(relativeNative);
+}
+
+function directoryContainsArtifact(entry, relativeDirectory, imageMembers) {
+  if (Array.isArray(entry.primary)) {
+    if (entry.primary.some((candidate) => candidate.startsWith(`${relativeDirectory}/`))) return true;
+  } else if (
+    entry.primary.dir === relativeDirectory
+    || entry.primary.dir.startsWith(`${relativeDirectory}/`)
+  ) {
+    return true;
+  }
+
+  if (entry.id === 'install-image') {
+    return imageMembers.some((candidate) => candidate.startsWith(`${relativeDirectory}/`));
+  }
+  return false;
+}
+
+function directoryIsAllowed(id, relativeDirectory, imageMembers) {
+  const entry = HOME_ARTIFACTS.find((candidate) => candidate.id === id);
+  if (!entry) return false;
+  if (relativeDirectory === '') return true;
+
+  if (
+    HOME_DIRECTORIES.includes(relativeDirectory)
+    && directoryContainsArtifact(entry, relativeDirectory, imageMembers)
+  ) {
+    return true;
+  }
+
+  // Every ancestor of an image member, not only its direct parent: the installer creates the chain
+  // recursively, and uninstall takes emptied ones down one by one (Plan_65 B15b2b — `agents/` holds
+  // only subfolders, and refusing it left an empty folder or threw mid-uninstall).
+  if (entry.id === 'install-image') {
+    return imageMembers.some((candidate) => candidate.startsWith(`${relativeDirectory}/`));
+  }
+
+  if (Array.isArray(entry.primary)) {
+    return entry.primary.some((candidate) => {
+      const slash = candidate.lastIndexOf('/');
+      const parent = slash < 0 ? '' : candidate.slice(0, slash);
+      return parent === relativeDirectory;
+    });
+  }
+  return entry.primary.dir === relativeDirectory;
+}
+
+function recursiveOptions(options) {
+  if (typeof options === 'string') return { encoding: options, recursive: true };
+  return { ...options, recursive: true };
+}
+
+/**
+ * The state modules receive `stateDir`, which is always `brandStateDir(root)` (Plan_62 D14), so the
+ * home root is its parent. A stateDir anywhere else is refused by the registry, not guessed.
+ */
+export function stateDirWriter(stateDir) {
+  return createHomeWriter({ root: path.dirname(path.resolve(stateDir)) });
+}
+
+export function createHomeWriter({ root, imageMembers } = {}) {
+  const homeRoot = path.resolve(root);
+  const declaredImageMembers = Object.freeze([...(imageMembers ?? [])]);
+
+  function assertArtifactPath(id, absolutePath) {
+    const relativePath = homeRelativePath(homeRoot, id, absolutePath);
+    const artifact = classifyHomePath(relativePath, { imageMembers: declaredImageMembers });
+    if (!artifact || artifact.id !== id) {
+      throw registryError(id, absolutePath, 'path is not declared for this artifact id');
+    }
+  }
+
+  function assertDirectoryPath(id, absolutePath) {
+    const relativeDirectory = homeRelativePath(homeRoot, id, absolutePath);
+    if (!directoryIsAllowed(id, relativeDirectory, declaredImageMembers)) {
+      throw registryError(id, absolutePath, 'directory is not an allowed artifact directory');
+    }
+  }
+
+  return {
+    // Plan_65 B2: a helper whose first write is a shared parent (`state/`) checks the target here, so a
+    // wrong id is refused before mkdir creates anything — without opening the file to find out.
+    assertArtifact(id, absolutePath) {
+      assertArtifactPath(id, absolutePath);
+    },
+    // Plan_65 B9 (advice A1, order 11): a helper that also writes outside the home — the installer's
+    // copier for Claude host files and Codex rules — takes its raw route only past this check, so the
+    // raw route can never land in the home and escape the registry.
+    assertOutside(absolutePath) {
+      if (typeof absolutePath !== 'string' || !path.isAbsolute(absolutePath)) {
+        throw registryError('outside', absolutePath, 'an absolute path is required');
+      }
+      const relativeNative = path.relative(homeRoot, absolutePath);
+      const inside = relativeNative === ''
+        || !(path.isAbsolute(relativeNative) || relativeNative === '..'
+          || relativeNative.startsWith(`..${path.sep}`));
+      if (inside) throw registryError('outside', absolutePath, 'path is inside the home root');
+    },
+    writeFileSync(id, absolutePath, ...args) {
+      assertArtifactPath(id, absolutePath);
+      return fs.writeFileSync(absolutePath, ...args);
+    },
+    writeFile(id, absolutePath, ...args) {
+      assertArtifactPath(id, absolutePath);
+      return fs.promises.writeFile(absolutePath, ...args);
+    },
+    mkdirSync(id, absolutePath, options) {
+      assertDirectoryPath(id, absolutePath);
+      return fs.mkdirSync(absolutePath, recursiveOptions(options));
+    },
+    mkdir(id, absolutePath, options) {
+      assertDirectoryPath(id, absolutePath);
+      return fs.promises.mkdir(absolutePath, recursiveOptions(options));
+    },
+    openSync(id, absolutePath, ...args) {
+      assertArtifactPath(id, absolutePath);
+      return fs.openSync(absolutePath, ...args);
+    },
+    open(id, absolutePath, ...args) {
+      assertArtifactPath(id, absolutePath);
+      return fs.promises.open(absolutePath, ...args);
+    },
+    renameSync(id, oldAbsolutePath, newAbsolutePath) {
+      assertArtifactPath(id, oldAbsolutePath);
+      assertArtifactPath(id, newAbsolutePath);
+      return fs.renameSync(oldAbsolutePath, newAbsolutePath);
+    },
+    rename(id, oldAbsolutePath, newAbsolutePath) {
+      assertArtifactPath(id, oldAbsolutePath);
+      assertArtifactPath(id, newAbsolutePath);
+      return fs.promises.rename(oldAbsolutePath, newAbsolutePath);
+    },
+    copyFile(id, sourceAbsolutePath, destinationAbsolutePath, ...args) {
+      assertArtifactPath(id, destinationAbsolutePath);
+      return fs.promises.copyFile(sourceAbsolutePath, destinationAbsolutePath, ...args);
+    },
+    unlinkSync(id, absolutePath) {
+      assertArtifactPath(id, absolutePath);
+      return fs.unlinkSync(absolutePath);
+    },
+    unlink(id, absolutePath) {
+      assertArtifactPath(id, absolutePath);
+      return fs.promises.unlink(absolutePath);
+    },
+    rmdirSync(id, absolutePath) {
+      assertDirectoryPath(id, absolutePath);
+      return fs.rmdirSync(absolutePath);
+    },
+    async rmdir(id, absolutePath) {
+      assertDirectoryPath(id, absolutePath);
+      return fs.promises.rmdir(absolutePath);
+    },
+  };
+}

package/src/home/lib/hook-diagnostics.mjs

@@ -0,0 +1,20 @@
+/**
+ * Records the last hook input through the home artifact registry. Plan_65 B3 consolidates two
+ * duplicated direct writes whose paths must remain purgeable and whose failures must stay fail-open.
+ */
+import path from 'node:path';
+import { BRAND_HOME, brandStateDir } from './brand-home.mjs';
+import { createHomeWriter } from './home-write.mjs';
+
+export function recordHookDiagnostic(hookName, input, { root = BRAND_HOME.root } = {}) {
+  try {
+    const diagnosticsDir = path.join(brandStateDir(root), 'diagnostics');
+    const diagnosticFile = path.join(diagnosticsDir, `${hookName}.last.json`);
+    const writer = createHomeWriter({ root });
+    writer.assertArtifact('diagnostics', diagnosticFile);
+    writer.mkdirSync('diagnostics', diagnosticsDir, { recursive: true });
+    writer.writeFileSync('diagnostics', diagnosticFile, `${JSON.stringify(input, null, 2)}\n`);
+  } catch {
+    // Diagnostics are a convenience, never a reason to fail the turn.
+  }
+}

package/src/home/lib/host-observations.mjs

@@ -1,8 +1,9 @@
 /** Records session host versions after the 2026-09-25 PATH host identity incident. */
 import fs from 'node:fs';
 import path from 'node:path';
-import { writeJsonAtomic } from './atomic-json.mjs';
-import { withFileLock } from './file-lock.mjs';
+import { writeHomeJsonAtomic } from './atomic-json.mjs';
+import { withHomeFileLock } from './file-lock.mjs';
+import { stateDirWriter } from './home-write.mjs';
 import { parseJsonText } from './json-file.mjs';
 import { transcriptHostVersion } from './host-version.mjs';
 
@@ -37,7 +38,9 @@ export async function observeSessionHost({
   if (readHostObservations({ stateDir }).sessions[sessionId]) return { recorded: false };
   const version = await readVersion(transcriptPath);
   if (version === null) return { recorded: false };
-  return withFileLock(`${file}.lock`, async () => {
+  // Plan_65 B6: the observations, their lock and temporaries are the registered host-observations artifact.
+  const writer = stateDirWriter(stateDir);
+  return withHomeFileLock(writer, 'host-observations', `${file}.lock`, async () => {
     const current = readHostObservations({ stateDir });
     if (current.corrupt) throw new Error(`Cannot update corrupt host observations: ${file}`);
     if (current.sessions[sessionId]) return { recorded: false };
@@ -51,7 +54,7 @@ export async function observeSessionHost({
     sessions[sessionId] = { version, at };
     const existing = hosts[version];
     hosts[version] = { firstSeen: existing?.firstSeen || at, lastSeen: at };
-    writeJsonAtomic(file, { hosts, sessions });
+    writeHomeJsonAtomic(writer, 'host-observations', file, { hosts, sessions });
     return { recorded: true };
   }, { description: 'host observations' });
 }

package/src/home/lib/kernel-lock.mjs

@@ -0,0 +1,171 @@
+/**
+ * Locks the kernel releases on its holder's death, shared by the lifecycle lock and the order claim.
+ * Plan_60 D4: on 2026-09-24 two launchers with one order id started 2.8 seconds apart and both ran
+ * and billed; the runner needs the lifecycle lock's primitive and may not import `cli/`.
+ * Where the kernel can release a lock on the holder's death, the lock is a kernel object: a named
+ * pipe on Windows, an abstract socket on Linux — both reproduced on real machines (hard kill, name
+ * free at once, nothing on disk), which matters on a machine that lost power six times in two weeks.
+ * The name comes from the directory's dev+ino, not its path: aliases must reach the same claim.
+ * A second listen inside the holder must fail, or the platform did not give exclusivity and the
+ * call refuses rather than switch protocols (Plan_65 D5/D8). What the holder answers a waiter is
+ * diagnosis only — it never grants anything.
+ */
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+
+const wait = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+
+export function kernelLockStrategy(platform = process.platform) {
+  if (platform === 'win32') return 'named-pipe';
+  return platform === 'linux' ? 'abstract-socket' : null;
+}
+
+export function kernelLockAddress(purpose, digest, platform = process.platform) {
+  if (typeof purpose !== 'string' || !/^[a-z][a-z-]*$/.test(purpose)) {
+    throw new TypeError('purpose must match ^[a-z][a-z-]*$');
+  }
+  if (platform === 'win32') return `\\\\.\\pipe\\codex-bridge-${purpose}-${digest}`;
+  return platform === 'linux' ? `\0codex-bridge-${purpose}-${digest}` : null;
+}
+
+export function directoryDigest(directory, { suffix } = {}) {
+  try {
+    const stat = fs.statSync(directory, { bigint: true });
+    if (!stat.isDirectory()) throw new Error(`${directory} is not a directory`);
+    const identity = `${stat.dev}:${stat.ino}`;
+    const extra = typeof suffix === 'string' && suffix.length > 0 ? `:${suffix}` : '';
+    return createHash('sha256').update(identity + extra).digest('hex');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function listen(server, address) {
+  return new Promise((resolve, reject) => {
+    const listening = () => { server.removeListener('error', failed); resolve(); };
+    const failed = (error) => { server.removeListener('listening', listening); reject(error); };
+    server.once('listening', listening);
+    server.once('error', failed);
+    try {
+      server.listen(address);
+    } catch (error) {
+      server.removeListener('listening', listening);
+      server.removeListener('error', failed);
+      reject(error);
+    }
+  });
+}
+
+function closeServer(server) {
+  if (!server) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    try {
+      server.close((error) => {
+        if (error && error.code !== 'ERR_SERVER_NOT_RUNNING') reject(error);
+        else resolve();
+      });
+    } catch (error) {
+      if (error.code === 'ERR_SERVER_NOT_RUNNING') resolve();
+      else reject(error);
+    }
+  });
+}
+
+async function closeQuietly(server) {
+  try { await closeServer(server); } catch { /* Preserve the original failure. */ }
+}
+
+async function selfCheck(server, address, createServer, label) {
+  let probe;
+  let detail;
+  try {
+    probe = createServer();
+    await listen(probe, address);
+    detail = 'a second listener succeeded';
+  } catch (error) {
+    if (!error || error.code !== 'EADDRINUSE') detail = (error && (error.code || error.message)) || String(error);
+  }
+  if (detail === undefined) {
+    await closeQuietly(probe);
+    return;
+  }
+  await Promise.all([closeQuietly(probe), closeQuietly(server)]);
+  throw new Error(`${label} self-check failed: ${detail}`);
+}
+
+export async function tryHoldSocket(address, createServer = net.createServer, label = 'kernel lock') {
+  const server = createServer((socket) => socket.destroy());
+  try {
+    await listen(server, address);
+    await selfCheck(server, address, createServer, label);
+    let releasePromise;
+    return () => (releasePromise ??= closeServer(server));
+  } catch (error) {
+    await closeQuietly(server);
+    if (error?.code === 'EADDRINUSE') return 'in-use';
+    throw error;
+  }
+}
+
+function readSocketHolder(address, timeoutMs, parseAnswer) {
+  return new Promise((resolve) => {
+    let data = '';
+    let settled = false;
+    const socket = net.createConnection(address);
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const finish = (holder) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(holder);
+    };
+    socket.on('data', (chunk) => {
+      data += chunk.toString('utf8');
+      const newline = data.indexOf('\n');
+      if (newline !== -1) finish(parseAnswer(data.slice(0, newline)));
+    });
+    socket.once('end', () => finish(parseAnswer(data)));
+    socket.once('error', () => finish(null));
+  });
+}
+
+export async function acquireKernelLock({
+  address, holder, waitMs, retryMs, answerTimeoutMs, parseAnswer, label,
+  createServer = net.createServer,
+}) {
+  const accepted = new Set();
+  const onConnection = (socket) => {
+    accepted.add(socket);
+    socket.once('close', () => accepted.delete(socket));
+    socket.end(`${JSON.stringify(holder)}\n`);
+  };
+  const deadline = Date.now() + waitMs;
+
+  for (;;) {
+    const server = createServer(onConnection);
+    try {
+      await listen(server, address);
+      holder.acquiredAt = new Date().toISOString();
+      await selfCheck(server, address, createServer, label);
+      server.unref();
+      let releasePromise;
+      const release = async () => {
+        const closing = closeServer(server);
+        for (const socket of accepted) socket.destroy();
+        await closing;
+      };
+      return { held: true, release: () => (releasePromise ??= release()) };
+    } catch (error) {
+      await closeQuietly(server);
+      if (!error || error.code !== 'EADDRINUSE') throw error;
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      await wait(Math.min(retryMs, remaining));
+    }
+  }
+
+  return { held: false, holder: await readSocketHolder(address, answerTimeoutMs, parseAnswer) };
+}

package/src/home/lib/meta/advice-status.mjs

@@ -3,11 +3,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { DEFAULTS } from '../run-config.mjs';
 import { judgeAdvice } from './advice-verdict.mjs';
-import { readJson } from './paths.mjs';
+import { readJson, safeSlice } from './paths.mjs';
 
 function contractReason(reasons) {
   const message = `advice contract broken (${reasons.length}): ${reasons.slice(0, 2).join('; ')}`;
-  return message.length <= 200 ? message : `${message.slice(0, 197)}...`;
+  return message.length <= 200 ? message : `${safeSlice(message, 197)}...`;
 }
 
 export function adviceGap(runDir, result, eventData) {

package/src/home/lib/meta/advice-verdict.mjs

@@ -76,6 +76,16 @@ function* addressesIn(value, root) {
   }
 }
 
+// Plan_68 D7: `<anything>:<digits>` is not evidence of intent. On 2026-09-28 the prose "so 00:05 under
+// yesterday's log" failed a complete advise run as file `00`, line 5 — a lost pass of the quota. A left side
+// with a directory is always a claim and stays strict; a bare name is one only when that root file exists,
+// so times, ratios and host:port pass while package.json and Makefile keep the read boundary. No extension
+// test: `api.example.com:443` would fail as a file. The accepted cost — an invented bare name is not caught.
+function isCitationInProse(address, root) {
+  const file = address.match(/^(.+):\d+(?:-\d+)?$/)?.[1];
+  return file !== undefined && (/[\\/]/.test(file) || entryInRepo(root, file)?.isFile === true);
+}
+
 function citationProblem(file, start, end, root, allowed) {
   if (typeof file !== 'string' || !file) return 'use a repository-relative path:line or path:line-line address';
   const entry = entryInRepo(root, file);
@@ -126,7 +136,9 @@ function checkCitations({ phase, result, task, repoRoot, scopeResult }, reasons)
   // Structured evidence and the free-text early_check.target are handled separately below.
   for (const { field, value } of strings(result)) {
     if (/(?:^|\.)evidence(?:\[|\.|$)|\.early_check\.target$/.test(field)) continue;
-    for (const address of addressesIn(value, root)) checkAddress(field, address);
+    for (const address of addressesIn(value, root)) {
+      if (isCitationInProse(address, root)) checkAddress(field, address);
+    }
   }
   const checkEvidence = (field, evidence) => {
     for (const [index, location] of evidence.entries()) checkLocation(`${field}[${index}]`, location);
@@ -157,6 +169,22 @@ function checkCitations({ phase, result, task, repoRoot, scopeResult }, reasons)
   }
 }
 
+// Plan_68 D6: on 2026-09-27 an advise answer cut by the schema ended in U+0000 and passed as OK.
+// This is integrity, not completeness: a cut that ends on a whole character is not detectable here,
+// which is why the cause — the hidden length cap — was removed from the schema instead.
+const CONTROL = /[\u0000-\u0008\u000B\u000C\u000E-\u001F]/;
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const codePoint = (char) => `U+${char.charCodeAt(0).toString(16).toUpperCase().padStart(4, '0')}`;
+
+function integrityProblems(result, reasons) {
+  for (const { field, value } of strings(result)) {
+    const control = value.match(CONTROL)?.[0];
+    const surrogate = value.match(LONE_SURROGATE)?.[0];
+    if (control) reasons.push(`integrity ${field}: remove control character ${codePoint(control)}.`);
+    else if (surrogate) reasons.push(`integrity ${field}: remove lone surrogate ${codePoint(surrogate)}.`);
+  }
+}
+
 export function judgeAdvice({ phase, result, task, repoRoot, commandsRun, language, scopeResult }) {
   if (phase !== 'scope' && phase !== 'advise') throw new RangeError('phase must be "scope" or "advise".');
   if (!Number.isInteger(commandsRun) || commandsRun < 0) {
@@ -168,6 +196,7 @@ export function judgeAdvice({ phase, result, task, repoRoot, commandsRun, langua
     throw new TypeError('result and a parsed advisor task are required.');
   }
   const reasons = [];
+  integrityProblems(result, reasons);
   if (commandsRun === 0) reasons.push('D4 commandsRun 0: inspect repository evidence before answering.');
   if (phase === 'scope') {
     if (!result.taken_on_trust.length) {

package/src/home/lib/meta/chain.mjs

@@ -12,6 +12,10 @@ import { createHash } from 'node:crypto';
 import { startedRuns } from './pre-start.mjs';
 import { normalizePath, readJson } from './paths.mjs';
 
+// Plan_75 D5: 2 hashes the header-free body. Runs without this field used earlier schemes:
+// the whole task text, then the task without grant lines (Plan_75 P1).
+export const TASK_HASH_SCHEME = 2;
+
 /**
  * What makes two runs the same task when their names disagree.
  *
@@ -21,6 +25,8 @@ import { normalizePath, readJson } from './paths.mjs';
  * built to refuse. Whitespace and case are normalized away because the same order re-sent
  * through a shell is rewrapped, not rewritten; anything more forgiving would tie together
  * tasks that merely look alike.
+ * Plan_75 D5: the runner supplies the header-free body; every body line counts, including
+ * prose beginning with a grant label. Stripping it again would silently change identity.
  */
 export const taskFingerprint = (taskText) => {
   const normalized = String(taskText ?? '').replace(/\s+/g, ' ').trim().toLowerCase();
@@ -35,14 +41,19 @@ export const taskFingerprint = (taskText) => {
  * honestly, changed nothing and was told it had done no work. Folder names rather than
  * full paths; the current run joins the list as soon as its status.json exists.
  */
-export function chainRuns(runsRoot, repo, slug, taskHash = '', orderId = '') {
+export function chainRuns(runsRoot, repo, slug, taskHash = '', orderId = '', grantRun = '') {
   const wantedRepo = normalizePath(repo);
-  const wantedSlug = String(slug ?? '').trim().toLowerCase();
-  const wantedHash = String(taskHash ?? '').trim().toLowerCase();
-  const wantedOrderId = String(orderId ?? '').trim();
+  if (!wantedRepo) return [];
+  const namedStatus = typeof grantRun === 'string' && grantRun &&
+    !/[\\/]/.test(grantRun) && grantRun !== '.' && grantRun !== '..'
+    ? readJson(path.join(runsRoot, grantRun, 'status.json')) : null;
+  const namedRun = namedStatus && normalizePath(namedStatus.repo) === wantedRepo ? namedStatus : null;
+  const wantedSlugs = new Set([slug, namedRun?.slug].map((value) => String(value ?? '').trim().toLowerCase()).filter(Boolean));
+  const wantedHashes = new Set([taskHash, namedRun?.task_hash].map((value) => String(value ?? '').trim().toLowerCase()).filter(Boolean));
+  const wantedOrderIds = new Set([orderId, namedRun?.order_id].map((value) => String(value ?? '').trim()).filter(Boolean));
   // No handle on the task, or no repo, means nothing to chain — an empty context must find
   // nothing rather than fall back to "every run in this folder".
-  if (!wantedRepo || (!wantedSlug && !wantedHash && !wantedOrderId)) return [];
+  if (!wantedSlugs.size && !wantedHashes.size && !wantedOrderIds.size) return [];
   let entries;
   try {
     entries = fs.readdirSync(runsRoot, { withFileTypes: true });
@@ -56,9 +67,9 @@ export function chainRuns(runsRoot, repo, slug, taskHash = '', orderId = '') {
     if (!status) continue;
     // Either handle identifies the task. The hash catches a repeat that renamed itself; the
     // slug still catches the follow-up whose wording the orchestrator edited on purpose.
-    const sameSlug = Boolean(wantedSlug) && String(status.slug ?? '').trim().toLowerCase() === wantedSlug;
-    const sameTask = Boolean(wantedHash) && String(status.task_hash ?? '').trim().toLowerCase() === wantedHash;
-    const sameOrder = Boolean(wantedOrderId) && String(status.order_id ?? '').trim() === wantedOrderId;
+    const sameSlug = wantedSlugs.has(String(status.slug ?? '').trim().toLowerCase());
+    const sameTask = wantedHashes.has(String(status.task_hash ?? '').trim().toLowerCase());
+    const sameOrder = wantedOrderIds.has(String(status.order_id ?? '').trim());
     if (!sameSlug && !sameTask && !sameOrder) continue;
     if (normalizePath(status.repo) !== wantedRepo) continue;
     runs.push({ name: entry.name, at: String(status.started_at || '') });

package/src/home/lib/meta/context-only.mjs

@@ -0,0 +1,43 @@
+/**
+ * Judges startup-context references and unread repository coordinates in scout responses.
+ * Plan_60 D1: honest answers about handed context need no command, unlike the 2026-09-16
+ * dead sandbox; a marker must never excuse invented addresses or an unsourced answer.
+ */
+import { QUESTION_KIND } from '../runner/question-kind.mjs';
+
+export function allStartupContext(questions) {
+  return Array.isArray(questions) && questions.length > 0
+    && questions.every((question) => question?.kind === QUESTION_KIND.STARTUP_CONTEXT);
+}
+
+export function contextOnlyGap({ questions, result, commandsExecuted }) {
+  const answers = Array.isArray(result?.answers) ? result.answers : [];
+  const byId = new Map();
+  for (const answer of answers) {
+    const id = String(answer?.question_id || '').trim().toUpperCase();
+    if (id && !byId.has(id)) byId.set(id, answer);
+  }
+  const unsourced = (Array.isArray(questions) ? questions : [])
+    .filter((question) => question?.kind === QUESTION_KIND.STARTUP_CONTEXT)
+    .filter((question) => {
+      const answer = byId.get(String(question.id || '').trim().toUpperCase());
+      return !Array.isArray(answer?.evidence)
+        || !answer.evidence.some((item) => /^startup:\s*\S/.test(String(item ?? '')));
+    })
+    .map((question) => question.id);
+  if (unsourced.length) {
+    return `responses to startup-context questions without a startup:<source> reference: ${unsourced.join(', ')}`;
+  }
+  if (commandsExecuted !== 0) return null;
+  const references = answers.flatMap((answer) => Array.isArray(answer?.evidence) ? answer.evidence : []);
+  references.push(...(Array.isArray(result?.findings) ? result.findings : []).map((finding) => finding?.where));
+  for (const reference of references) {
+    const text = String(reference ?? '');
+    if (text.startsWith('startup:')) continue;
+    const coordinate = text.match(/\S*\.[A-Za-z0-9]+:\d+/)?.[0];
+    if (coordinate) {
+      return `scout cited ${coordinate.slice(0, 60)} without executing a command: an address nobody read`;
+    }
+  }
+  return null;
+}

package/src/home/lib/meta/events.mjs

@@ -5,6 +5,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { safeSlice } from './paths.mjs';
 
 /**
  * Quota exhaustion, and nothing else that merely says "limit". A bare `limit` also appears in
@@ -13,10 +14,19 @@ import path from 'node:path';
  */
 const LIMIT_RE = /rate[\s_-]*limit|usage[\s_-]*limit|quota|too many requests|\b429\b/i;
 
+// Plan_60 D2: add a new measured sample only together with its verbatim fixture.
+const UNAVAILABLE_SAMPLES = [
+  {
+    cli: 'codex-cli 0.159.0',
+    measured: '2026-10-03',
+    pattern: /^unexpected status 401 Unauthorized: Missing bearer or basic authentication in header\b/,
+  },
+];
+
 const record = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
 const compact = (value, max = 300) =>
-  String(value ?? '').replace(/\s+/g, ' ').trim().slice(0, max);
+  safeSlice(String(value ?? '').replace(/\s+/g, ' ').trim(), max);
 
 /**
  * A broken final line is expected when the runner is stopped while Codex is writing.
@@ -128,6 +138,8 @@ function transportErrorOf(event) {
   const status = payload.status ?? nested.status ?? null;
   const marker = [errorType, message].join(' ');
   const quota = Number(status) === 429 || LIMIT_RE.test(marker);
+  const unavailable = !quota && event.type === 'turn.failed' &&
+    UNAVAILABLE_SAMPLES.some((sample) => sample.pattern.test(message));
   const reason = compact(
     [errorType, message, status === null || status === undefined ? '' : `status ${status}`]
       .filter(Boolean)
@@ -136,7 +148,7 @@ function transportErrorOf(event) {
       (typeof event.error?.message === 'string' ? event.error.message : '') ||
       event.type,
   );
-  return { event, payload, status, error_type: errorType, message, quota, reason };
+  return { event, payload, status, error_type: errorType, message, quota, unavailable, reason };
 }
 
 /**
@@ -149,7 +161,8 @@ export function readEvents(runDir) {
   const accounting = usageOf(events);
   const started = events.find((event) => event.type === 'thread.started' && event.thread_id);
   const errors = events.map(transportErrorOf).filter(Boolean);
-  const transport_error = errors.find((error) => error.quota) || errors[0] || null;
+  const transport_error = errors.find((error) => error.quota) ||
+    errors.find((error) => error.unavailable) || errors[0] || null;
   return {
     events,
     // The file was written, whatever it holds. Pass 2 judges a run by this: a stream the