@lyupro/codex-bridge 0.6.9 → 0.6.11

package/src/home/hooks/live-runs.mjs

@@ -18,8 +18,6 @@ import { readJsonFileSync } from '../lib/json-file.mjs';
 import { runLiveness } from '../lib/meta/run-liveness.mjs';
 import { IDENTITY_ALIVE } from '../lib/process-identity.mjs';
 
-export const RECENT_RUN_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-
 /**
  * Match the package's repository comparison without resolving symlinks: Windows realpath adds
  * `\\?\\` and UNC spellings, turning equal paths into unequal ones. A null result is uncertainty,
@@ -98,45 +96,6 @@ export function liveRuns(runsDir, options = {}) {
   return result;
 }
 
-/**
- * Find runs recent enough to explain the current dispatcher reply, including completed runs.
- * The 24-hour window covers long and overnight dispatches without letting old project history
- * explain a new reply. This closes the August 13 incident where a fabricated FAIL hid a
- * finished/OK run simply by omitting its folder. Null means the disk could not be trusted.
- */
-export function recentRuns(runsDir, options = {}) {
-  if (typeof runsDir !== 'string' || !runsDir.trim()) return null;
-  const now = options.now ?? Date.now();
-  const maxAgeMs = options.maxAgeMs ?? RECENT_RUN_MAX_AGE_MS;
-  let entries;
-  try {
-    entries = fs.readdirSync(runsDir, { withFileTypes: true });
-  } catch (err) {
-    return err.code === 'ENOENT' ? [] : null;
-  }
-
-  const result = [];
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dir = path.join(runsDir, entry.name);
-    const statusPath = path.join(dir, 'status.json');
-    if (!fs.existsSync(statusPath)) continue;
-    let status;
-    try {
-      status = readJsonFileSync(statusPath);
-    } catch {
-      return null;
-    }
-    if (!status || typeof status !== 'object' || Array.isArray(status)) return null;
-    if (options.agent && status.agent !== options.agent) continue;
-    if (options.orderId && String(status.order_id ?? '').trim() !== options.orderId) continue;
-    const timestamp = Date.parse(status.finished_at || status.started_at || '');
-    if (!Number.isFinite(timestamp) || timestamp > now || now - timestamp > maxAgeMs) continue;
-    result.push({ dir, status, timestamp });
-  }
-  return result.sort((a, b) => b.timestamp - a.timestamp);
-}
-
 /** Scan every project under the configured runs root for worktree ownership. */
 export function allLiveRuns(runsRoot, options = {}) {
   if (typeof runsRoot !== 'string' || !runsRoot.trim()) return [];

package/src/home/hooks/order-gate.mjs

@@ -2,10 +2,10 @@
 /**
  * PreToolUse gate for the Codex dispatchers (codex-scout / codex-build / codex-review).
  *
- * The runner rejects a dispatcher immediately when order id (and scope for codex-build) is
- * absent, but the old requirement lived only in the prompt read by the dispatcher. The caller
- * therefore had no enforced place to provide it and codex-build died before doing work. This
- * gate checks the producer's task text while it can still be corrected.
+ * Plan_63 D9: the call carries only the task file; order id and grant come from its header.
+ * OW-054: validate the header and order before a grant can skip the order-owner diagnostic,
+ * so a `continue: none` line cannot disarm the check. The producer can still correct the order
+ * before the runner creates a run folder or spends quota.
  *
  * Input is Claude Code's hook JSON on stdin. The last payload is retained for diagnostics so a
  * future host schema change can be inspected instead of guessed at. Any uncertain shape passes
@@ -14,21 +14,22 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { modelLatch, readDispatcherModel } from '../lib/dispatcher-model.mjs';
+import { readDispatcherPin } from '../lib/dispatcher-pin.mjs';
 import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
+import { transcriptHostVersion } from '../lib/host-version.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
-import {
-  diagnoseInput,
-  extractValue,
-  missingInputs,
-  parseContinuationGrant,
-  shellUnsafeInputs,
-} from '../lib/required-inputs.mjs';
+import { parseDispatcherCall, renderCallRefusal } from '../lib/dispatcher-call.mjs';
+import { orderFromHeader, renderOrderProblems } from '../lib/order-schema.mjs';
 import { SUBAGENT_TOOLS } from '../lib/hook-definitions.mjs';
 import { taskFingerprint } from '../lib/meta/chain.mjs';
-import { conflictingOrderOwner } from '../lib/runner/order-owner.mjs';
+import { conflictingOrderOwner, orderOwnerConflictText } from '../lib/runner/order-owner.mjs';
 import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { parseTaskDocument } from '../lib/runner/task-file.mjs';
+import { parseTaskHeader, taskHeaderRefusal } from '../lib/task-header.mjs';
+import { envModelProblem } from '../lib/subagent-model-env.mjs';
 
 const GUARDED = new Set(Object.keys(AGENTS));
 /**
@@ -38,9 +39,14 @@ const GUARDED = new Set(Object.keys(AGENTS));
  */
 const SUBAGENT_TOOL_NAMES = new Set(SUBAGENT_TOOLS);
 
-const pass = () => process.exit(0);
+let systemMessage;
+const pass = () => {
+  if (systemMessage) process.stdout.write(JSON.stringify({ systemMessage }));
+  process.exit(0);
+};
 const deny = (reason) => {
   process.stdout.write(JSON.stringify({
+    ...(systemMessage ? { systemMessage } : {}),
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
       permissionDecision: 'deny',
@@ -64,7 +70,37 @@ if (!SUBAGENT_TOOL_NAMES.has(input.tool_name)) pass();
 
 const toolInput = input.tool_input;
 if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) pass();
-if (!GUARDED.has(toolInput.subagent_type) || typeof toolInput.prompt !== 'string') pass();
+if (!GUARDED.has(toolInput.subagent_type)) pass();
+
+// Plan_67 D6: one installed model contract; refuse even matching aliases before prompt exits.
+const agentType = toolInput.subagent_type;
+if (Object.hasOwn(toolInput, 'model')) {
+  deny(
+    "Order gate denied the Agent call because it passes `model`: a dispatcher's model is set in one place, "
+      + `its installed agent file. Call ${agentType} without model. `
+      + 'The run folder was not created; quota was not spent.',
+  );
+}
+try {
+  const hostVersion = await transcriptHostVersion(input.transcript_path).catch(() => null);
+  const pin = readDispatcherPin({ brandRoot: BRAND_HOME.root, agentType });
+  const problem = envModelProblem({ env: process.env, hostVersion, pinFamily: pin.family });
+  if (problem) deny(problem);
+} catch {
+  // D6 (b): uncertain host/env evidence is diagnostic only; the stop observer still checks it.
+}
+try {
+  const latch = modelLatch({ ledger: readDispatcherModel({ stateDir: BRAND_STATE_DIR }), agentType });
+  if (latch.active) {
+    const { data, at } = latch.violation;
+    systemMessage = `codex-bridge: the last ${agentType} ran on ${data.parsed.join(', ')} `
+      + `while the installed contract pins ${data.pinFamily} (${data.hostVersion ?? 'unknown'}, ${at}); `
+      + 'the cause is outside this call — another hook or the host; run codex-bridge doctor.';
+  }
+} catch {
+  // D4 (a): a corrupt ledger must not turn a diagnostic warning into a refusal.
+}
+if (typeof toolInput.prompt !== 'string') pass();
 
 /**
  * Plan_62 D7: with agent teams enabled, a registered dispatcher launched with `name` or `team_name`
@@ -82,28 +118,9 @@ if (teammateField) {
   );
 }
 
-const missing = missingInputs(toolInput.subagent_type, toolInput.prompt);
-const unsafe = shellUnsafeInputs(toolInput.subagent_type, toolInput.prompt);
-if (missing.length || unsafe.length) {
-  const reason = missing.length
-    ? [
-        'Order gate denied the Agent call because required dispatcher input(s) are missing or still placeholders.',
-        'Write each value in tool_input.prompt using `label: value` before launching the dispatcher:',
-        ...missing.flatMap((entry) => {
-          const lines = [`- ${entry.label}: ${entry.explanation} Example: \`${entry.example}\`.`];
-          const diagnosis = diagnoseInput(toolInput.prompt, entry.label);
-          if (diagnosis) lines.push(`  found \`${diagnosis.line}\`, ${diagnosis.reason}`);
-          return lines;
-        }),
-      ].join('\n')
-    : [
-        'Order gate denied the Agent call because labelled dispatcher input(s) contain forbidden shell sequences.',
-        'Correct each field before launching the dispatcher:',
-        ...unsafe.map(({ entry, sequence }) =>
-          `- ${entry.label}: found ${JSON.stringify(sequence)}; put free text in the task file and pass only a short command-line value.`),
-      ].join('\n');
-  deny(reason);
-}
+// Plan_76 D1: exact registry labels prevent the scope-new and repository-prose incident of 2026-10-04.
+const call = parseDispatcherCall(toolInput.subagent_type, toolInput.prompt);
+if (call.problems.length) deny(renderCallRefusal(toolInput.subagent_type, call.problems));
 
 const readStatus = (file) => {
   try {
@@ -113,13 +130,34 @@ const readStatus = (file) => {
   }
 };
 
-const orderId = extractValue(toolInput.prompt, 'order id');
-const taskFile = extractValue(toolInput.prompt, 'task file');
-if (!orderId || !taskFile || parseContinuationGrant(toolInput.prompt)) pass();
+const taskFile = call.inputs.get('task file');
+
+let rawTask;
+try {
+  rawTask = fs.readFileSync(taskFile, 'utf8');
+} catch {
+  pass();
+}
+// Plan_75 D5, 2026-10-03 20:42: malformed metadata must not disappear into the disk-state guard.
+const parsed = parseTaskHeader(rawTask);
+const headerRefusal = taskHeaderRefusal(parsed);
+if (headerRefusal) deny(headerRefusal);
+const { order, problems } = orderFromHeader(toolInput.subagent_type, parsed);
+if (problems.length) {
+  deny(`${renderOrderProblems(toolInput.subagent_type, problems)}\nThe run folder was not created; quota was not spent.`);
+}
+const orderId = order.get('order id');
+// Plan_63 D9 / OW-054: only a validated header grant reaches the runner's grant rules.
+if (parsed.grant) pass();
+let taskHash;
+try {
+  taskHash = taskFingerprint(parseTaskDocument(parsed.body).task);
+} catch {
+  // A malformed Questions or Verify section is the runner's refusal to issue, with its own text.
+  pass();
+}
 
 try {
-  const taskDocument = parseTaskDocument(fs.readFileSync(taskFile, 'utf8'));
-  const taskHash = taskFingerprint(taskDocument.task);
   const projectRunsDir = resolveProjectRunsDir(runsRoot(), input.cwd, { create: false }).dir;
   // Per folder, not per directory: a run folder created a moment before its status.json, or any
   // leftover beside the runs, would otherwise throw out of the whole check and silently disarm the
@@ -131,12 +169,7 @@ try {
   const owner = conflictingOrderOwner(runs, orderId, taskHash);
   if (owner) {
     const ownerDir = path.join(projectRunsDir, owner.run);
-    deny(
-      `Order gate denied the Agent call because order id ${JSON.stringify(orderId)} already belongs ` +
-        `to run folder ${ownerDir} (slug ${owner.status.slug}, started_at ${owner.status.started_at}) ` +
-        'with a different task. Use a new order id, or provide an explicit continuation grant if ' +
-        'this is another pass of that order.',
-    );
+    deny(orderOwnerConflictText(owner, ownerDir, orderId));
   }
 } catch {
   // The 2026-08-15 collision guard is diagnostic: uncertain disk state must not block real work.

package/src/home/hooks/reply-guard.mjs

@@ -24,6 +24,7 @@
  * In the handback era, SubagentHandback delivers the caller-visible answer before SubagentStop.
  * Alarms name the host by its transcript version: on 2026-09-25 the SDK variable proved inherited.
  * Plan_62 makes this hook yield after delivery and audit every transcript tool call against gate receipts.
+ * Plan_63 D10 identifies this run only by the host-keyed gate's immutable runner receipt.
  *
  * Input is JSON on stdin. The fields used here (`agent_type`, `last_assistant_message`)
  * come from Claude Code; the last payload is kept in state/diagnostics/reply-guard.last.json
@@ -32,20 +33,21 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
-import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { BRAND_HOME, BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { recordHookDiagnostic } from '../lib/hook-diagnostics.mjs';
-import { runOrderMismatch, transcriptOrderId } from '../lib/dispatcher-order.mjs';
 import { decideDispatcherStop, transcriptToolUses } from '../lib/dispatcher-stop.mjs';
+import { observeDispatcherModelStop } from '../lib/dispatcher-model.mjs';
 import { recognizeHostRefusal } from '../lib/host-refusal.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 import { readDispatcherState, updateDispatcherState } from '../lib/dispatcher-state.mjs';
-import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { witnessHostVersion } from '../lib/handback-witness.mjs';
+import { untypedStopEvidence } from '../lib/untyped-stop.mjs';
 import { runLiveness } from '../lib/meta/run-liveness.mjs';
-import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
-import { runsRoot } from '../lib/runner/runs-root.mjs';
-import { liveRuns, normalizePath, recentRuns } from './live-runs.mjs';
+import { liveRuns, normalizePath } from './live-runs.mjs';
 import { FORM, MAX_STATE_BLOCKS, STATE, takeTry } from './guard-tries.mjs';
 import { parseReply } from './reply-parser.mjs';
+import { recordStopWitness, typedStopObservations, untypedStopObservation } from './reply-witness.mjs';
+import { decideReplyIdentity, missingIdsAlarm, readReceiptEvidence } from './reply-identity.mjs';
 import {
   abandonedRunReason,
   abandonedRunStop,
@@ -58,14 +60,11 @@ import {
   missingHostOrderIdReason,
   missingMetaReason,
   missingRunReason,
-  noRecentRunReason,
-  noRecentRunStop,
   nonexistentRunReason,
   omittedDiscoveredRunReason,
   omittedDiscoveredRunStop,
   omittedSiblingReason,
   omittedSiblingStop,
-  orderMismatchStop,
   statusMismatchReason,
   statusMismatchStop,
 } from './reply-verdicts.mjs';
@@ -114,20 +113,24 @@ try {
 
 recordHookDiagnostic('reply-guard', input);
 
-// A host that stops sending agent_type would let every dispatcher past the gate and this
-// audit without a word (Plan_66 D2 (c)); say so instead of passing silently.
+// Plan_67 D9: only evidence bound to this stop can identify an untyped dispatcher.
 if (typeof input.agent_id === 'string' && input.agent_id.length > 0
   && !(typeof input.agent_type === 'string' && input.agent_type.length > 0)) {
+  let evidence;
   try {
-    await recordHandbackWitness({
-      stateDir: BRAND_STATE_DIR,
-      kind: 'alarm',
-      hostVersion: await witnessHostVersion(input),
-      detail: `host omitted agent_type for agent ${input.agent_id}`,
-    });
+    const state = typeof input.session_id === 'string' && input.session_id.length > 0
+      ? readDispatcherState({ stateDir: BRAND_STATE_DIR, sessionId: input.session_id, agentId: input.agent_id }) : null;
+    const transcript = transcriptToolUses(input.agent_transcript_path);
+    evidence = untypedStopEvidence({ state, toolUses: transcript?.toolUses ?? null });
   } catch {
-    // Plan_66 H2: the 2026-09-17..24 handback break showed host contract loss must alarm, but never block work.
+    // An unreadable state is no evidence either way; a guard failure must never break the stop.
+    evidence = { dispatcher: false, reason: 'state-unreadable' };
   }
+  const { observation, alarm } = untypedStopObservation({
+    evidence, hostVersion: await witnessHostVersion(input), agentId: input.agent_id,
+  });
+  await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: [observation] });
+  if (!alarm) pass();
   process.stdout.write(JSON.stringify({
     systemMessage: 'codex-bridge: the host did not report agent_type for a subagent — the dispatcher gate cannot recognise dispatchers, so their answers are unchecked; run codex-bridge doctor.',
   }));
@@ -137,32 +140,40 @@ if (typeof input.agent_id === 'string' && input.agent_id.length > 0
 // business — an earlier version inferred the agent from transcript text and blocked an
 // unrelated one, which cost a re-answer for nothing.
 if (!GUARDED.has(input.agent_type)) pass();
+try {
+  dispatcherSystemMessage = await observeDispatcherModelStop({
+    brandRoot: BRAND_HOME.root, stateDir: BRAND_STATE_DIR, input, hostVersion: await witnessHostVersion(input),
+  });
+} catch { /* Plan_67 D4: model diagnostics must never block a dispatcher stop. */ }
 
 const emitStop = (payload) => {
   process.stdout.write(JSON.stringify(payload));
   process.exit(0);
 };
+const hasIds = typeof input.session_id === 'string' && input.session_id.length > 0
+  && typeof input.agent_id === 'string' && input.agent_id.length > 0;
+let receipt = null;
+let receiptConflict = null;
 try {
-  if (typeof input.session_id === 'string' && input.session_id.length > 0
-    && typeof input.agent_id === 'string' && input.agent_id.length > 0) {
+  if (hasIds) {
     const ids = {
       stateDir: BRAND_STATE_DIR,
       sessionId: input.session_id,
       agentId: input.agent_id,
     };
     const state = readDispatcherState(ids);
-    const toolUses = transcriptToolUses(input.agent_transcript_path);
+    ({ receipt, receiptConflict } = readReceiptEvidence(state));
+    const transcript = transcriptToolUses(input.agent_transcript_path);
+    const toolUses = transcript?.toolUses ?? null;
     const stop = decideDispatcherStop({ state, toolUses });
     if (stop.unseen.length) {
       const names = stop.unseen.map((toolUse) => toolUse.name).join(', ');
-      dispatcherSystemMessage = `codex-bridge: dispatcher ${input.agent_type} used ${names} outside the dispatcher gate — do not trust its answer; run codex-bridge doctor.`;
-      await recordHandbackWitness({
-        stateDir: BRAND_STATE_DIR,
-        kind: 'alarm',
-        hostVersion: await witnessHostVersion(input),
-        detail: `${input.agent_type} ${input.agent_id}: ${names} outside the dispatcher gate`,
-      });
+      dispatcherSystemMessage = [dispatcherSystemMessage, `codex-bridge: dispatcher ${input.agent_type} used ${names} outside the dispatcher gate — do not trust its answer; run codex-bridge doctor.`].filter(Boolean).join(' ');
     }
+    await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: typedStopObservations({
+      agentType: input.agent_type, agentId: input.agent_id, hostVersion: await witnessHostVersion(input),
+      hasIds, state, toolUses, unseen: stop.unseen, transcriptComplete: transcript?.complete === true,
+    }) });
     if (stop.stateUpdate) {
       await updateDispatcherState(ids, (current) => ({
         ...(current.corrupt ? {} : current),
@@ -185,6 +196,14 @@ try {
   // The handback path is fail-open; the established reply checks remain the fallback.
 }
 
+if (!hasIds) {
+  await recordStopWitness({ stateDir: BRAND_STATE_DIR, observations: typedStopObservations({
+    agentType: input.agent_type, hostVersion: await witnessHostVersion(input),
+    hasIds, state: null, toolUses: null, unseen: [], transcriptComplete: false,
+  }) });
+  dispatcherSystemMessage ||= missingIdsAlarm(input.agent_type);
+}
+
 const reply = String(input.last_assistant_message || '').trim();
 if (!reply) pass();
 const emit = (payload) => {
@@ -220,48 +239,22 @@ const blockState = (reason, stopReason) => {
 
 const { runDirs, claimed } = parseReply(reply);
 let runDir = runDirs[0] || null;
-let discoveredRun = false;
-let discoveredStatus = null;
-let searchedRunsDir = null;
 
 if (runDir && !fs.existsSync(runDir)) {
   blockForm(nonexistentRunReason);
 }
 
-const orderedOrderId = transcriptOrderId(input.agent_transcript_path);
-
 if (!runDir && !claimed) {
   // A reply that pronounces nothing cannot contradict the disk. It stays on the old, softer path:
   // three tries about the SHAPE of the answer and then through, which is what a quoted refusal
-  // needs. Only a reply that hands down a verdict earns the disk search below.
+  // needs. Only a reply that hands down a verdict earns the receipt checks below.
   blockForm(missingRunReason);
 }
 
-if (!runDir) {
-  let candidates;
-  try {
-    searchedRunsDir = resolveProjectRunsDir(runsRoot(), input.cwd, { create: false }).dir;
-    // Plan_62 r2: on 2026-09-24 the newest run of this agent type belonged to an earlier order, and the
-    // guard judged the reply against that stranger's folder. With the order id known, only its runs count.
-    candidates = recentRuns(searchedRunsDir, {
-      agent: input.agent_type,
-      ...(orderedOrderId ? { orderId: orderedOrderId } : {}),
-    });
-  } catch {
-    pass();
-  }
-  if (candidates === null) pass();
-
-  if (!candidates.length) {
-    blockState(
-      noRecentRunReason,
-      noRecentRunStop(MAX_STATE_BLOCKS, input.agent_type, searchedRunsDir),
-    );
-  }
-
-  ({ dir: runDir, status: discoveredStatus } = candidates[0]);
-  discoveredRun = true;
-}
+const identity = decideReplyIdentity({ runDir, hasIds, receipt, receiptConflict, agentType: input.agent_type });
+if (identity.block) blockState(identity.block.reason, identity.block.stop);
+const { discoveredRun, discoveredStatus } = identity;
+runDir = identity.runDir;
 
 /**
  * The dispatcher must name every WRITING run the project has live, not just the one it chose to
@@ -307,12 +300,6 @@ if (fs.existsSync(statusPath)) {
   } catch {
     runStatus = null;
   }
-  const mismatch = runOrderMismatch(orderedOrderId, runStatus, runDir);
-
-  if (mismatch) {
-    blockState(mismatch.reason, orderMismatchStop(MAX_STATE_BLOCKS, mismatch, runStatus, runDir));
-  }
-
   if (runStatus?.state === 'running') {
     // Plan_57 D5/D27: a bare pid mistook a reused foreign process for this run's worker.
     // The shared judge uses run identity and keeps unverified processes live (fail open).

package/src/home/hooks/reply-identity.mjs

@@ -0,0 +1,64 @@
+/** Decides which run a dispatcher reply answers for, from the gate's receipt (Plan_63 D10; 2026-09-24 stranger-run incident). */
+import path from 'node:path';
+import { readJsonFileSync } from '../lib/json-file.mjs';
+import { normalizePath } from './live-runs.mjs';
+import { MAX_STATE_BLOCKS } from './guard-tries.mjs';
+import {
+  noReceiptReason,
+  noReceiptStop,
+  receiptConflictReason,
+  receiptConflictStop,
+  receiptMismatchReason,
+  receiptMismatchStop,
+} from './reply-verdicts.mjs';
+
+export function readReceiptEvidence(state) {
+  return {
+    receipt: typeof state?.runReceipt === 'string' && state.runReceipt.length > 0 ? state.runReceipt : null,
+    receiptConflict: typeof state?.runReceiptConflict === 'string' && state.runReceiptConflict.length > 0
+      ? state.runReceiptConflict : null,
+  };
+}
+
+export function missingIdsAlarm(agentType) {
+  return `codex-bridge: the host did not report session_id and agent_id for dispatcher ${agentType} — whose run this answer quotes cannot be checked; run codex-bridge doctor.`;
+}
+
+// Plan_63 D10: a recent stranger is never evidence for this reply; only the gate receipt is.
+// Form checks stay in the caller before this decision, preserving their softer try budget.
+export function decideReplyIdentity({ runDir, hasIds, receipt, receiptConflict, agentType }) {
+  if (hasIds && receiptConflict) {
+    return { block: {
+      reason: receiptConflictReason(receipt, receiptConflict),
+      stop: receiptConflictStop(MAX_STATE_BLOCKS, agentType, receipt, receiptConflict),
+    } };
+  }
+
+  if (!runDir) {
+    if (!(hasIds && receipt)) {
+      return { block: { reason: noReceiptReason, stop: noReceiptStop(MAX_STATE_BLOCKS, agentType) } };
+    }
+    let discoveredStatus = null;
+    try {
+      discoveredStatus = readJsonFileSync(path.join(receipt, 'status.json'));
+    } catch {
+      discoveredStatus = null;
+    }
+    return { runDir: receipt, discoveredRun: true, discoveredStatus };
+  }
+
+  if (hasIds) {
+    if (!receipt) {
+      return { block: { reason: noReceiptReason, stop: noReceiptStop(MAX_STATE_BLOCKS, agentType) } };
+    }
+    if (normalizePath(runDir) !== normalizePath(receipt)) {
+      return { block: {
+        reason: receiptMismatchReason(runDir, receipt),
+        stop: receiptMismatchStop(MAX_STATE_BLOCKS, agentType, runDir, receipt),
+      } };
+    }
+  }
+  // Review 2026-10-05_201513_plan63-r-review-20261005 and Plan_66 H2: missing ids alarm
+  // in the caller; named folders retain disk checks because host contract loss must never block work.
+  return { runDir, discoveredRun: false, discoveredStatus: null };
+}

package/src/home/hooks/reply-parser.mjs

@@ -1,5 +1,5 @@
 /** Parses dispatcher replies into guard facts. */
-const STATUSES = ['OK', 'FAIL', 'LIMIT'];
+const STATUSES = ['OK', 'FAIL', 'LIMIT', 'UNAVAILABLE'];
 
 /**
  * Either line names the run folder. `RUN=` is printed by the call that starts a run, `ATTACH=`

package/src/home/hooks/reply-verdicts.mjs

@@ -39,7 +39,7 @@ export const stopText = (headline, observed, runStatus, folder) => {
     'The run will close itself: the worker outlives every caller and completes meta.json and ' +
       'status.json without the dispatcher. Wait for state to change and reread status.json — the ' +
       'verdict will be there; there is no need to ask the dispatcher again. Repeating the same ' +
-      'command with the same --order-id attaches to this run rather than starting another.',
+      'command with the same task file attaches to this run rather than starting another.',
   ].join(' ');
 };
 
@@ -62,18 +62,29 @@ export const handbackDemandReason =
   'exactly the command its refusal quotes and hand back again; the gate replaces the message with the ' +
   "runner's output.";
 
-export const noRecentRunReason =
-  'Contract violated: the response has no RUN= or ATTACH= line, and no recent run for this ' +
-  'dispatcher was found on disk. Run codex-bridge run and return its stdout verbatim; your own ' +
-  'analysis instead of Codex is prohibited in all outcomes.';
+export const noReceiptReason =
+  'Contract violated: no run receipt is recorded for this dispatcher. Run the canonical ' +
+  "codex-bridge run command and return that run's stdout verbatim; another run on disk cannot identify this run.";
 
-export const noRecentRunStop = (maxBlocks, agentType, runsDir) => stopText(
+export const noReceiptStop = (maxBlocks, agentType) =>
   `The reply guard stopped the session: the dispatcher responded ${maxBlocks} times ` +
-    'without naming a run and no recent matching run was found on disk.',
-  `No run for agent ${agentType} was found in the last 24 hours.`,
-  null,
-  runsDir,
-);
+  `without a run receipt for agent ${agentType}. The answer was not checked.`;
+
+export const receiptMismatchReason = (runDir, receipt) =>
+  `Contract violated: the response names run folder ${runDir}, but this dispatcher's run receipt ` +
+  `names ${receipt}. Run the canonical codex-bridge run command and return that run's stdout verbatim.`;
+
+export const receiptMismatchStop = (maxBlocks, agentType, runDir, receipt) =>
+  `The reply guard stopped the session: dispatcher ${agentType} returned run folder ${runDir} ` +
+  `${maxBlocks} times while its run receipt names ${receipt}. The answer was not checked.`;
+
+export const receiptConflictReason = (receipt, conflict) =>
+  `Contract violated: this dispatcher's run receipt names ${fact(receipt)}, but a contradictory ` +
+  `receipt names ${conflict}. Run the canonical codex-bridge run command and return that run's stdout verbatim.`;
+
+export const receiptConflictStop = (maxBlocks, agentType, receipt, conflict) =>
+  `The reply guard stopped the session: dispatcher ${agentType} responded ${maxBlocks} times ` +
+  `with conflicting run receipts ${fact(receipt)} and ${conflict}. The answer was not checked.`;
 
 export const omittedSiblingReason = (runDir, dir, status) =>
   `Contract violated: the response names ${runDir} but omits live run folder ${dir}; report every ` +
@@ -87,17 +98,10 @@ export const omittedSiblingStop = (maxBlocks, dir, status) => stopText(
   dir,
 );
 
-export const orderMismatchStop = (maxBlocks, mismatch, runStatus, runDir) => stopText(
-  `The reply guard stopped the session: the dispatcher returned another order's run ${maxBlocks} times.`,
-  mismatch.observed,
-  runStatus,
-  runDir,
-);
-
 export const liveRunReason =
   'Contract violated: status.json says state=running and the process is alive — the run is ' +
   'not finished, but you are already responding. The STARTED output of the starting call ' +
-  'is not a result. Repeat the identical codex-bridge run command, same --order-id, with ' +
+  'is not a result. Repeat the identical codex-bridge run command, same task file, with ' +
   'timeout 1800000: it attaches to this same run, costs no quota, and prints the verdict.';
 
 export const liveRunStop = (maxBlocks, runStatus, runDir) => stopText(
@@ -111,7 +115,7 @@ export const liveRunStop = (maxBlocks, runStatus, runDir) => stopText(
 export const deadRunReason =
   'Contract violated: status.json says state=running, but the process with this pid is dead ' +
   'and meta.json is missing — the run is abandoned. Repeat the identical codex-bridge run ' +
-  'command, same --order-id, with timeout of at least 1800000 and return its stdout verbatim.';
+  'command, same task file, with timeout of at least 1800000 and return its stdout verbatim.';
 
 export const deadRunStop = (maxBlocks, runStatus, runDir) => stopText(
   `The reply guard stopped the session: the dispatcher responded ${maxBlocks} times for a run it did not complete.`,
@@ -125,7 +129,7 @@ export const deadRunStop = (maxBlocks, runStatus, runDir) => stopText(
 
 export const abandonedRunReason =
   'Contract violated: status.json says state=abandoned — the runner died without a verdict. ' +
-  'Repeat the identical codex-bridge run command, same --order-id, with timeout of at least ' +
+  'Repeat the identical codex-bridge run command, same task file, with timeout of at least ' +
   '1800000 and return its stdout verbatim.';
 
 export const abandonedRunStop = (maxBlocks, runStatus, runDir) => stopText(
@@ -144,7 +148,7 @@ export const missingMetaReason = (runDir) =>
 
 export const missingDiscoveredMetaStop = (maxBlocks, discoveredStatus, runDir) => stopText(
   `The reply guard stopped the session: the dispatcher responded ${maxBlocks} times ` +
-    'without naming the recent run found on disk.',
+    'without naming the run its receipt names.',
   `status.json says state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}, ` +
     'but the adjacent meta.json is missing.',
   discoveredStatus,
@@ -158,8 +162,8 @@ export const statusMismatchReason = (claimed, meta, discoveredStatus, runDir) =>
   'its output verbatim without substituting your own judgment.';
 
 export const statusMismatchStop = (maxBlocks, claimed, meta, discoveredStatus, runDir) => stopText(
-  `The reply guard stopped the session: the dispatcher contradicted the recent run on disk ${maxBlocks} times.`,
-  `status.json says state=${fact(discoveredStatus.state)}, status=${fact(discoveredStatus.status)}; ` +
+  `The reply guard stopped the session: the dispatcher contradicted the run its receipt names ${maxBlocks} times.`,
+  `status.json says state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}; ` +
     `meta.json says status=${meta.status}, but the reply says ${claimed}.`,
   discoveredStatus,
   runDir,
@@ -167,12 +171,12 @@ export const statusMismatchStop = (maxBlocks, claimed, meta, discoveredStatus, r
 
 export const omittedDiscoveredRunReason = (meta, discoveredStatus, runDir) =>
   `Contract violated: the response omitted RUN=${runDir}; status.json says ` +
-  `state=${fact(discoveredStatus.state)}, status=${fact(discoveredStatus.status)}, and meta.json ` +
+  `state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}, and meta.json ` +
   `says status=${fact(meta.status)}. Return the runner stdout verbatim.`;
 
 export const omittedDiscoveredRunStop = (maxBlocks, meta, discoveredStatus, runDir) => stopText(
-  `The reply guard stopped the session: the dispatcher omitted the recent run found on disk ${maxBlocks} times.`,
-  `status.json says state=${fact(discoveredStatus.state)}, status=${fact(discoveredStatus.status)}; ` +
+  `The reply guard stopped the session: the dispatcher omitted the run its receipt names ${maxBlocks} times.`,
+  `status.json says state=${fact(discoveredStatus?.state)}, status=${fact(discoveredStatus?.status)}; ` +
     `meta.json says status=${fact(meta.status)}.`,
   discoveredStatus,
   runDir,