@lyupro/codex-bridge 0.6.8 → 0.6.9

package/scripts/home-write-lexer.mjs

@@ -0,0 +1,182 @@
+/**
+ * Separates executable source from comments and literals for the home-write audit.
+ * Plan_65 B1b moves lexing here so a malformed mask cannot hide a home writer.
+ *
+ * Regex literals are lexed as literals because the first audit did not: the `"` inside the pattern
+ * at src/home/lib/config-edit.mjs:20 opened a "string" that masked the rest of that module, and the
+ * one module writing the operator's config.json into the home passed the audit unseen (2026-09-25).
+ */
+export function lexSource(source) {
+  const code = source.split('');
+  const withoutComments = source.split('');
+  const blank = (target, start, end) => {
+    for (let index = start; index < end; index += 1) {
+      if (source[index] !== '\n' && source[index] !== '\r') target[index] = ' ';
+    }
+  };
+  const regexKeywords = new Set([
+    'return', 'typeof', 'case', 'do', 'else', 'in', 'of', 'new', 'delete', 'void', 'throw', 'yield', 'await',
+  ]);
+  const expressionStart = new Set('([{,=:!&|?{};+-*%<>~^');
+
+  const regexEnd = (start) => {
+    let inClass = false;
+    let escapedChar = false;
+    for (let index = start + 1; index < source.length; index += 1) {
+      const char = source[index];
+      if (char === '\n' || char === '\r') return -1;
+      if (escapedChar) escapedChar = false;
+      else if (char === '\\') escapedChar = true;
+      else if (char === '[') inClass = true;
+      else if (char === ']') inClass = false;
+      else if (char === '/' && !inClass) {
+        while (/[A-Za-z]/.test(source[index + 1] ?? '')) index += 1;
+        return index + 1;
+      }
+    }
+    return -1;
+  };
+
+  const scanCode = (start, interpolation = false) => {
+    let index = start;
+    let braces = 0;
+    let canStartRegex = true;
+    const controlParens = [];
+    let previousWord = '';
+    while (index < source.length) {
+      const char = source[index];
+      const next = source[index + 1];
+      if (interpolation && char === '}') {
+        if (braces === 0) {
+          blank(code, index, index + 1);
+          return index + 1;
+        }
+        braces -= 1;
+      } else if (char === '{') {
+        braces += 1;
+      }
+
+      if (char === '/' && (next === '/' || next === '*')) {
+        const commentStart = index;
+        if (next === '/') {
+          index += 2;
+          while (index < source.length && source[index] !== '\n' && source[index] !== '\r') index += 1;
+        } else {
+          index += 2;
+          while (index < source.length && !(source[index] === '*' && source[index + 1] === '/')) index += 1;
+          index = index < source.length ? index + 2 : source.length;
+        }
+        blank(withoutComments, commentStart, index);
+        blank(code, commentStart, index);
+        if (source.slice(commentStart, index).includes('\n') || source.slice(commentStart, index).includes('\r')) {
+          canStartRegex = true;
+        }
+        continue;
+      }
+
+      if (char === '"' || char === "'") {
+        const quote = char;
+        const stringStart = index++;
+        let escapedChar = false;
+        while (index < source.length) {
+          const current = source[index++];
+          if (escapedChar) escapedChar = false;
+          else if (current === '\\') escapedChar = true;
+          else if (current === quote) break;
+        }
+        blank(code, stringStart, index);
+        canStartRegex = false;
+        previousWord = '';
+        continue;
+      }
+
+      if (char === '`') {
+        const scanTemplate = (templateStart) => {
+          let cursor = templateStart + 1;
+          blank(code, templateStart, cursor);
+          let escapedChar = false;
+          while (cursor < source.length) {
+            const current = source[cursor];
+            if (escapedChar) {
+              escapedChar = false;
+              blank(code, cursor, cursor + 1);
+              cursor += 1;
+            } else if (current === '\\') {
+              escapedChar = true;
+              blank(code, cursor, cursor + 1);
+              cursor += 1;
+            } else if (current === '`') {
+              blank(code, cursor, cursor + 1);
+              return cursor + 1;
+            } else if (current === '$' && source[cursor + 1] === '{') {
+              blank(code, cursor, cursor + 2);
+              cursor = scanCode(cursor + 2, true);
+              escapedChar = false;
+            } else {
+              blank(code, cursor, cursor + 1);
+              cursor += 1;
+            }
+          }
+          return cursor;
+        };
+        index = scanTemplate(index);
+        canStartRegex = false;
+        previousWord = '';
+        continue;
+      }
+
+      if (char === '/' && canStartRegex) {
+        const end = regexEnd(index);
+        if (end !== -1) {
+          blank(code, index, end);
+          index = end;
+          canStartRegex = false;
+          previousWord = '';
+          continue;
+        }
+      }
+
+      if (/\s/.test(char)) {
+        if (char === '\n' || char === '\r') canStartRegex = true;
+        index += 1;
+        continue;
+      }
+      if (/[A-Za-z_$]/.test(char)) {
+        const wordStart = index++;
+        while (/[\w$]/.test(source[index] ?? '')) index += 1;
+        previousWord = source.slice(wordStart, index);
+        canStartRegex = regexKeywords.has(previousWord);
+        continue;
+      }
+      if (/[0-9]/.test(char)) {
+        index += 1;
+        while (/[\w.]/.test(source[index] ?? '')) index += 1;
+        canStartRegex = false;
+        previousWord = '';
+        continue;
+      }
+
+      if (char === '(') {
+        controlParens.push(/^(?:if|while|for|with|switch|catch)$/.test(previousWord));
+        canStartRegex = true;
+      } else if (char === ')') {
+        canStartRegex = controlParens.pop() === true;
+      } else if (char === '[' || char === '{') {
+        canStartRegex = true;
+      } else if (char === ']') {
+        canStartRegex = false;
+      } else if (char === '/' && next === '=') {
+        canStartRegex = true;
+        index += 1;
+      } else {
+        canStartRegex = expressionStart.has(char);
+      }
+      previousWord = '';
+      index += 1;
+    }
+    return index;
+  };
+
+  scanCode(0);
+  return { code: code.join(''), withoutComments: withoutComments.join('') };
+}

package/scripts/isolated-roots.mjs

@@ -7,7 +7,12 @@
  * config, conventions and an obsolete-file fixture on 2026-08-11, where the stray config then
  * stood in the way of the seeded-file migration the release was about.
  *
+ * `CODEX_RUNS_ROOT` joined before a failure rather than after one (Plan_65 B12): the runs root
+ * falls back to the operator's `~/.claude/codex-runs`, so a runner test that did not name it
+ * filed its runs among real ones, and the purge liveness checks would read real live runs as the
+ * fixture's — a verdict that depends on what the operator happens to be running.
+ *
  * It sits in its own module because the isolation test imports it, and importing the runner would
  * start a second suite inside the first.
  */
-export const ISOLATED_ROOTS = Object.freeze(['CODEX_HOME', 'CODEX_BRIDGE_HOME']);
+export const ISOLATED_ROOTS = Object.freeze(['CODEX_HOME', 'CODEX_BRIDGE_HOME', 'CODEX_RUNS_ROOT']);

package/scripts/open-work/check.mjs

@@ -0,0 +1,180 @@
+/**
+ * Validates open-work rules and reciprocal document references, exposing them through the CLI.
+ * Plan_72: 15 of 20 handoff records dropped unfinished items because open work had no single home.
+ * Plan_72 R3 B2: with the checklist index absent even strict validation was green, so no live-step marker was
+ * ever judged; the index is now required wherever the workroom exists.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isInvokedDirectly } from '../../cli/invoked-directly.mjs';
+import { readRegister } from './register.mjs';
+import { checkLiveThresholds } from './live-thresholds.mjs';
+
+const REGISTER = 'docs/plans/open-work.md';
+const INDEX = 'docs/checklists/operator-checklists.md';
+const WORKROOM = ['docs/plans', 'docs/checklists'];
+const REQUIRED = ['состояние', 'владелец', 'источник', 'дом', 'следующий шаг'];
+const KNOWN = new Set([...REQUIRED, 'блокер', 'доказательство']);
+const STATES = new Set(['open', 'blocked', 'done', 'cancelled']);
+const OWNERS = new Set(['агент', 'оператор']);
+
+function markdownFiles(directory) {
+  const files = [];
+  if (!fs.existsSync(directory)) return files;
+  const entries = fs.readdirSync(directory, { withFileTypes: true })
+    .sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  for (const entry of entries) {
+    const file = path.join(directory, entry.name);
+    if (entry.isDirectory()) files.push(...markdownFiles(file));
+    else if (entry.isFile() && entry.name.endsWith('.md')) files.push(file);
+  }
+  return files;
+}
+
+function homePaths(value) {
+  const paths = new Set();
+  const prose = value.replace(/\[[^\]]*\]\((<[^>]+>|(?:[^()\r\n]|\([^()\r\n]*\))+)\)/g, (link, destination) => {
+    let target = destination.trim();
+    target = target.startsWith('<') ? target.slice(1, -1) : target.replace(/\s+["'].*$/, '');
+    if (!/^(?:[a-z][a-z\d+.-]*:|\/|#)/i.test(target)) {
+      target = target.split(/[?#]/)[0];
+      try { target = decodeURIComponent(target); } catch { /* Keep malformed targets visible. */ }
+      if (target.endsWith('.md')) paths.add(target);
+    }
+    // Link labels and remote destinations are text, not additional plain repository paths.
+    return ' '.repeat(link.length);
+  });
+  for (const match of prose.matchAll(/(?<![\w/.:\\-])docs\/[^\s`<>()[\],;]+?\.md(?=$|[\s`<>()[\],;#?.!:])/g)) {
+    paths.add(match[0]);
+  }
+  return paths;
+}
+
+export function validateOpenWork(root, { strict = false } = {}) {
+  if (typeof root !== 'string' || !root) throw new TypeError('A repository root is required');
+  root = path.resolve(root);
+  const violations = [];
+  const notices = [];
+  const report = (file, line, problem) => violations.push(`${file}:${line}: ${problem}`);
+  const present = WORKROOM.map((directory) => {
+    const absolute = path.join(root, directory);
+    return fs.existsSync(absolute) && fs.statSync(absolute).isDirectory();
+  });
+  if (!strict && present.every((exists) => !exists)) {
+    return { violations, notices, message: 'Workroom is absent; nothing was checked.' };
+  }
+  if (strict) {
+    WORKROOM.forEach((directory, index) => {
+      if (!present[index]) report(directory, 1, 'workroom folder is missing (strict mode)');
+    });
+  }
+  const registerFile = path.join(root, REGISTER);
+  const registerExists = fs.existsSync(registerFile);
+  if (!registerExists) {
+    report(REGISTER, 1, 'register is missing');
+  }
+
+  const { items, queue } = registerExists ? readRegister(registerFile) : { items: [], queue: [] };
+  const indexFile = path.join(root, INDEX);
+  if (!fs.existsSync(indexFile)) {
+    report(INDEX, 1, 'checklist index is missing');
+  } else {
+    let version;
+    try { version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version; }
+    catch { /* The threshold rule reports one package.json:1 violation for an unavailable version. */ }
+    const live = checkLiveThresholds({
+      indexText: fs.readFileSync(indexFile, 'utf8'), indexFile: INDEX,
+      version, versionFile: 'package.json', items,
+    });
+    for (const entry of live.violations) report(entry.file, entry.line, entry.text);
+    for (const entry of live.notices) notices.push(`${entry.file}:${entry.line}: ${entry.text}`);
+  }
+  if (!registerExists) return { violations, notices, message: null };
+  if (!items.length) report(REGISTER, 1, 'register must contain at least one item');
+  const byId = new Map();
+  const states = new Map();
+  for (const item of items) {
+    if (byId.has(item.id)) report(REGISTER, item.line, `duplicate item id ${item.id}`);
+    else byId.set(item.id, item);
+    const fields = new Map();
+    for (const field of item.fields) {
+      if (!KNOWN.has(field.key)) report(REGISTER, field.line, `${item.id}: unknown field ${field.key}`);
+      if (fields.has(field.key)) report(REGISTER, field.line, `${item.id}: repeated field ${field.key}`);
+      else fields.set(field.key, field);
+    }
+    for (const key of REQUIRED) {
+      if (!fields.get(key)?.value.trim()) {
+        report(REGISTER, fields.get(key)?.line ?? item.line, `${item.id}: required field ${key} is missing or empty`);
+      }
+    }
+    const state = fields.get('состояние')?.value.trim();
+    if (fields.has('состояние') && !STATES.has(state)) {
+      report(REGISTER, fields.get('состояние').line, `${item.id}: invalid состояние ${state}`);
+    }
+    if (!states.has(item.id)) states.set(item.id, state);
+    const owner = fields.get('владелец');
+    if (owner && !OWNERS.has(owner.value.trim())) {
+      report(REGISTER, owner.line, `${item.id}: invalid владелец ${owner.value.trim()}`);
+    }
+    const evidence = state === 'blocked' ? 'блокер' : ['done', 'cancelled'].includes(state) ? 'доказательство' : null;
+    if (evidence && !fields.get(evidence)?.value.trim()) {
+      report(REGISTER, fields.get(evidence)?.line ?? item.line, `${item.id}: ${state} requires ${evidence}`);
+    }
+    const home = fields.get('дом');
+    for (const source of home?.valueLines ?? []) {
+      for (const target of homePaths(source.value)) {
+        const absolute = target.startsWith('docs/')
+          ? path.resolve(root, target) : path.resolve(root, 'docs/plans', target);
+        const relative = path.relative(root, absolute);
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+          report(REGISTER, source.line, `${item.id}: home path is outside the repository: ${target}`);
+        } else if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile()) {
+          report(REGISTER, source.line, `${item.id}: home file does not exist: ${target}`);
+        }
+      }
+    }
+  }
+
+  const queued = new Set();
+  for (const entry of queue) {
+    if (queued.has(entry.id)) report(REGISTER, entry.line, `duplicate queue id ${entry.id}`);
+    queued.add(entry.id);
+    if (!byId.has(entry.id)) report(REGISTER, entry.line, `queue names unknown item ${entry.id}`);
+    else if (!['open', 'blocked'].includes(states.get(entry.id))) {
+      report(REGISTER, entry.line, `queue item ${entry.id} must be open or blocked`);
+    }
+  }
+
+  // D1 section 5: checking only outgoing links would let a deleted row strand a plan's work.
+  for (const directory of WORKROOM) {
+    for (const file of markdownFiles(path.join(root, directory))) {
+      if (file === registerFile) continue;
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      for (const [index, line] of fs.readFileSync(file, 'utf8').split(/\r?\n/).entries()) {
+        for (const match of line.matchAll(/OW-\d{3,}/g)) {
+          if (!byId.has(match[0])) report(relative, index + 1, `reference names unknown item ${match[0]}`);
+        }
+      }
+    }
+  }
+  return { violations, notices, message: null };
+}
+
+const scriptFile = fileURLToPath(import.meta.url);
+// The one same-file judge (.claude/context/contracts.md): comparing spellings silenced every guard once.
+if (isInvokedDirectly(process.argv[1], import.meta.url)) {
+  try {
+    const args = process.argv.slice(2);
+    if (args.some((arg) => arg !== '--strict')) throw new Error('Usage: node scripts/open-work/check.mjs [--strict]');
+    const root = path.resolve(path.dirname(scriptFile), '../..');
+    const result = validateOpenWork(root, { strict: args.includes('--strict') });
+    for (const violation of result.violations) console.log(violation);
+    for (const notice of result.notices) console.log(`note: ${notice}`);
+    if (result.message) console.log(result.message);
+    process.exitCode = result.violations.length ? 1 : 0;
+  } catch (error) {
+    console.error(`${REGISTER}:1: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/open-work/live-thresholds.mjs

@@ -0,0 +1,155 @@
+/**
+ * Checks pending live-step release thresholds and their exact open-work holds without I/O.
+ * Plan_72 R3 B1: releases 0.6.3…0.6.8 passed unnoticed while live steps still waited for them;
+ * on 2026-10-01 fifteen checklist-index lines were overdue.
+ */
+const VERSION = /^\d+\.\d+\.\d+$/;
+const STEP = /^\d+[a-zа-яё]?$/;
+const WORK = /^OW-\d{3,}$/;
+
+function matches(value, pattern) {
+  return typeof value === 'string' && value.match(pattern)?.[0] === value;
+}
+
+function compareVersions(left, right) {
+  const a = left.split('.').map(BigInt);
+  const b = right.split('.').map(BigInt);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function validateGroup(group, seen, report) {
+  if (group === null || typeof group !== 'object' || Array.isArray(group)) {
+    report('live group must be an object');
+    return false;
+  }
+  let valid = true;
+  const fail = (text) => { valid = false; report(text); };
+  for (const key of Object.keys(group)) {
+    if (!['steps', 'threshold', 'work'].includes(key)) fail(`unknown live group key: ${key}`);
+  }
+  if (!Array.isArray(group.steps) || !group.steps.length) {
+    fail('live group steps must be a non-empty array');
+  } else {
+    const local = new Set();
+    for (const step of group.steps) {
+      if (!matches(step, STEP)) fail('live group step must match digits with at most one lowercase letter');
+      else if (local.has(step)) fail(`duplicate step ${step} in live group`);
+      else if (seen.has(step)) fail(`step ${step} appears in more than one live group`);
+      local.add(step);
+      seen.add(step);
+    }
+  }
+  if (group.threshold !== 'none' && !matches(group.threshold, VERSION)) {
+    fail('live group threshold must be a three-integer version or none');
+  }
+  if (Object.hasOwn(group, 'work') && !matches(group.work, WORK)) {
+    fail('live group work must match OW- followed by at least three digits');
+  }
+  if (group.threshold === 'none' && !Object.hasOwn(group, 'work')) {
+    fail('live group with threshold none requires work');
+  }
+  return valid;
+}
+
+function validateHold(group, checklist, items, report) {
+  const item = items.find((candidate) => candidate.id === group.work);
+  if (!item) {
+    report(`hold ${group.work}: item does not exist`);
+    return { valid: false };
+  }
+  let valid = true;
+  const fail = (text) => { valid = false; report(`hold ${group.work}: ${text}`); };
+  const state = item.fields.find((field) => field.key === 'состояние')?.value.trim();
+  if (!['open', 'blocked'].includes(state)) fail('state must be open or blocked');
+
+  const expected = new Set(group.steps);
+  let matching = 0;
+  // Compare individual source lines: joining continuations would invent a hold for missing steps.
+  for (const home of item.fields.filter((field) => field.key === 'дом')) {
+    for (const source of home.valueLines) {
+      const binding = source.value.trim().match(/^(docs\/checklists\/\S+\.md) steps (.+)$/);
+      if (!binding || binding[1] !== checklist) continue;
+      const steps = binding[2].split(',').map((step) => step.trim());
+      const actual = new Set(steps);
+      if (actual.size !== steps.length) fail(`duplicate steps in binding for ${checklist}`);
+      if (actual.size !== expected.size || steps.some((step) => !expected.has(step))) {
+        fail(`binding for ${checklist} has steps ${steps.join(', ')}, expected ${group.steps.join(', ')}`);
+      } else if (actual.size === steps.length) matching++;
+    }
+  }
+  if (matching !== 1) fail(`home must contain exactly one binding for ${checklist} steps ${group.steps.join(', ')}`);
+
+  const reason = item.fields.find((field) => field.key === 'блокер')?.value.trim();
+  if (group.threshold === 'none' && !reason) fail('threshold none requires a non-empty blocker');
+  return { valid, reason };
+}
+
+export function checkLiveThresholds({ indexText, indexFile, version, versionFile, items }) {
+  const violations = [];
+  const notices = [];
+  // Register continuation values can contain newlines, but diagnostics must remain one line.
+  const entry = (file, line, text) => ({ file, line, text: text.replace(/[\r\n\u2028\u2029]+/g, ' ') });
+  const validVersion = matches(version, VERSION);
+  if (!validVersion) violations.push(entry(versionFile, 1, 'package version must be a three-integer version'));
+
+  let active = false;
+  let found = false;
+  for (const [index, textLine] of indexText.split(/\r?\n/).entries()) {
+    if (/^## Актуальные\s*$/.test(textLine)) {
+      active = true;
+      found = true;
+      continue;
+    }
+    if (textLine.startsWith('## ')) active = false;
+    if (!active || !textLine.startsWith('- [')) continue;
+
+    const line = index + 1;
+    const report = (text) => violations.push(entry(indexFile, line, text));
+    const link = textLine.match(/\[[^\]]*\]\(([^)\r\n]+)\)/);
+    if (!link) report('active checklist line must contain a markdown link');
+    const checklist = link ? `docs/checklists/${link[1]}` : null;
+    const marker = textLine.match(/ live=(\[.*\])\s*$/);
+    if ((textLine.match(/ live=/g) ?? []).length !== 1 || !marker) {
+      report('active checklist line must end with exactly one live= array marker');
+      continue;
+    }
+    let groups;
+    try { groups = JSON.parse(marker[1]); }
+    catch {
+      report('live marker contains invalid JSON');
+      continue;
+    }
+    if (!Array.isArray(groups)) {
+      report('live marker must be an array');
+      continue;
+    }
+    const seen = new Set();
+    for (const group of groups) {
+      if (!validateGroup(group, seen, report) || !checklist) continue;
+      const hold = Object.hasOwn(group, 'work') ? validateHold(group, checklist, items, report) : null;
+      if (!validVersion) continue;
+      const steps = group.steps.join(', ');
+      if (group.threshold === 'none') {
+        if (hold.valid) notices.push(entry(indexFile, line,
+          `no threshold, held by ${group.work}: ${checklist} steps ${steps}: ${hold.reason}`));
+        continue;
+      }
+      const compared = compareVersions(group.threshold, version);
+      if (compared > 0) continue;
+      if (compared === 0) {
+        notices.push(entry(indexFile, line,
+          `due: ${checklist} steps ${steps} wait for ${group.threshold}, the package is ${version}`));
+      } else if (hold?.valid) {
+        notices.push(entry(indexFile, line,
+          `overdue, held by ${group.work}: ${checklist} steps ${steps} waited for ${group.threshold}`));
+      } else {
+        report(`overdue: ${checklist} steps ${steps} waited for ${group.threshold}, the package is ${version}`);
+      }
+    }
+  }
+  if (!found) violations.push(entry(indexFile, 1, 'checklist index is missing the ## Актуальные section'));
+  return { violations, notices };
+}

package/scripts/open-work/register.mjs

@@ -0,0 +1,56 @@
+/**
+ * Reads the open-work register into source-located items and queue entries without judging them.
+ * Plan_72: 15 of 20 handoff records dropped unfinished items because open work had no single home.
+ */
+import fs from 'node:fs';
+
+export function parseRegister(text) {
+  const items = [];
+  const queue = [];
+  let item = null;
+  let field = null;
+  let inQueue = false;
+
+  for (const [index, textLine] of text.split(/\r?\n/).entries()) {
+    const line = index + 1;
+    const heading = textLine.match(/^### (OW-\d{3,}) — (.+)$/);
+    if (/^#{1,6}\s/.test(textLine)) {
+      item = null;
+      field = null;
+      if (/^#{1,2}\s/.test(textLine)) {
+        // The real D1 register labels its queue with a parenthetical explanation.
+        inQueue = /^## Очередь(?:\s+\(.*\))?\s*$/.test(textLine);
+      }
+      if (heading) {
+        item = { id: heading[1], title: heading[2], line, fields: [] };
+        items.push(item);
+      }
+      continue;
+    }
+
+    if (inQueue) {
+      const entry = textLine.match(/^\d+\. (OW-\d{3,})(?=\s|$)/);
+      if (entry) queue.push({ id: entry[1], line });
+    }
+    if (!item) continue;
+
+    const match = textLine.match(/^- ([^:]+):\s*(.*)$/);
+    if (match) {
+      field = { key: match[1], value: match[2], line, valueLines: [{ value: match[2], line }] };
+      item.fields.push(field);
+    } else if (field && /^ {2}/.test(textLine)) {
+      const value = textLine.slice(2);
+      field.value += `\n${value}`;
+      field.valueLines.push({ value, line });
+    } else {
+      field = null;
+      // Blank lines may separate fields; other prose ends the item's field block.
+      if (textLine.trim()) item = null;
+    }
+  }
+  return { items, queue };
+}
+
+export function readRegister(file) {
+  return parseRegister(fs.readFileSync(file, 'utf8'));
+}

package/scripts/root-guard/root-entries.mjs

@@ -0,0 +1,15 @@
+/**
+ * Names additions to a directory's direct filesystem entries without deleting anything.
+ * On 2026-09-24 a suite run left Microsoft/Windows/PowerShell/ModuleAnalysisCache in the
+ * repository root; git cannot witness ignored entries, so this guard reads the filesystem.
+ */
+import fs from 'node:fs';
+
+export function snapshotRoot(dir) {
+  return fs.readdirSync(dir).sort();
+}
+
+export function addedEntries(before, after) {
+  const previous = new Set(before);
+  return after.filter((name) => !previous.has(name));
+}

package/scripts/run-tests.mjs

@@ -12,6 +12,14 @@
  * straight into the operator's real `~/.lyupro/.codex-bridge/`, where the stray config then stood
  * in the way of the very migration the release was about. Roots live in one list here so a third
  * one cannot be added without this file being the place it is declared.
+ *
+ * Plan_62 D22 requires package-home writes to remain removable by artifact id. Plan_65 B1b runs
+ * the write audit here so the suite cannot forget to enforce the boundary before creating roots.
+ *
+ * On 2026-09-24 a PowerShell started with empty LOCALAPPDATA left
+ * Microsoft/Windows/PowerShell/ModuleAnalysisCache in the repository root during a suite run.
+ * Git cannot witness ignored entries, so filesystem snapshots name every new direct entry and
+ * fail the run without deleting it; another process may have created it while the suite ran.
  */
 import fs from 'node:fs';
 import os from 'node:os';
@@ -19,7 +27,10 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import { ISOLATED_ROOTS } from './isolated-roots.mjs';
+import { auditWrites } from './home-write-audit.mjs';
+import { HOME_WRITE_INVENTORY } from './home-write-inventory.mjs';
 import { readmeText, suiteCountMismatch } from './suite-count.mjs';
+import { snapshotRoot, addedEntries } from './root-guard/root-entries.mjs';
 
 // One pattern only: on 2026-09-25 three files passed as three arguments ran just the first, and a
 // verification reported green for two files it never touched. Refuse before any root is created.
@@ -28,6 +39,15 @@ if (process.argv.length > 3) {
   process.exit(2);
 }
 
+const repositoryRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const { violations } = auditWrites({ repositoryRoot, inventory: HOME_WRITE_INVENTORY });
+if (violations.length) {
+  for (const { module, sink, problem } of violations) {
+    process.stderr.write(`run-tests: home-write audit: ${module} ${sink} — ${problem}\n`);
+  }
+  process.exit(2);
+}
+
 const created = ISOLATED_ROOTS.map((name) => [
   name,
   fs.mkdtempSync(path.join(os.tmpdir(), `codex-bridge-test-${name.toLowerCase()}-`)),
@@ -40,7 +60,6 @@ const wholeSuite = !process.argv[2];
 const tapFile = wholeSuite
   ? path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'codex-bridge-test-summary-')), 'summary.tap')
   : null;
-const repositoryRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
 
 // The spec reporter is named explicitly because the second reporter would otherwise replace it,
 // and the operator would lose the live output this command exists to show.
@@ -50,11 +69,17 @@ const reporters = tapFile
   : [];
 
 try {
+  const before = snapshotRoot(repositoryRoot);
   const result = spawnSync(process.execPath, ['--test', ...reporters, pattern], {
     stdio: 'inherit',
     env: { ...process.env, ...Object.fromEntries(created), CODEX_BRIDGE_TEST_TMP: testTmpRoot },
   });
+  const additions = addedEntries(before, snapshotRoot(repositoryRoot));
   process.exitCode = result.status ?? 1;
+  for (const name of additions) {
+    process.stderr.write(`run-tests: the suite left ${name} in the repository root (or something else created it while the suite ran)\n`);
+  }
+  if (additions.length && process.exitCode === 0) process.exitCode = 1;
   if (tapFile && process.exitCode === 0) {
     let tap = null;
     try {