docs(reports): archive v4.4.3 unanimous PASS review reports (Issues #10, #11, #13, #15)

Final-round reports of the fix/issue-10-11-13-15 review loop: planner-reviewer-claude-01
(aa16fa5c), reviewer-agy-01 (0f41ea47), reviewer-grok-01 (3ea06fb6) and
planner-reviewer-codex-01 (79204d61), all [VERDICT: PASS] on fae70c1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VCgu9Fa9iT7TbJUSzdq4Ff

.agents/reports/planner-reviewer-codex-01/report-79204d61.md

@@ -0,0 +1,44 @@
+# Round 2 review — fix/issue-10-11-13-15
+
+Job: `79204d61`. Reviewer: `planner-reviewer-codex-01`.
+Base: `bd3df89`. Reviewed HEAD: `fae70c13d9a7fb9df50e1bfe759f39e35d3e1500`.
+
+PASS. Both findings from job `f315859f` are resolved. No additional blocking defect was found in this review.
+
+## Scope and findings
+
+Reviewed the branch diff from `bd3df89` and all five commits (`c82ea75`, `0282312`, `7610258`, `f5a6575`, `fae70c1`). Previously reviewed, unchanged sections received regression checks; the self-session protection, randomized fixtures, and artifact-resolution changes received detailed inspection.
+
+| Requested area | Assessment |
+|---|---|
+| Prior R1: held presence lock | Fixed. The agy override passes DB, sidecars, brain directory, annotation, and presence lock to the shared detector. An independent temporary-home probe with an exclusively locked presence file returned `True` while held and `False` after release. The new CLI regression also verifies refusal and preservation of artifacts. |
+| Prior R2: orphan artifacts | Fixed. The agy adapter's `has_artifacts` recognizes known auxiliary paths even without a DB. Independent explicit-agy resolution succeeded with only a presence file. The new auto-resolution test purges orphan WAL, annotation, and lock files and checks empty residuals. |
+| Other adapters/shared DB | The default `has_artifacts` preserves the previous `uuid in artifact_path and exists` predicate. Verification still runs before fallback, and opencode remains last. Controlled-path checks for claude/hermes/grok/codex/opencode confirmed UUID-bearing paths are accepted and an unrelated shared path is rejected. These were predicate checks, not destructive backend operations. |
+| Self-session protection | Session environment values are checked before process inspection. The excluded helper chain stops at the nearest recognized agent CLI, allowing that ancestor's UUID to count. Ordinary helper ancestors remain excluded; non-helper process matches count as holders. The passing tests cover helper ancestry, agent ancestry, and all five listed session variables. |
+| Onboarding flow | Purge precedes registry mutation; CLI in-use exit 4 maps to onboarding exit 5, missing confirmation returns 4, and dry-run exits before purge. The corrected `added`/`removed` wording remains intact. |
+| Registry isolation | CLI/service defaults retain explicit override → existing WORKSPACE_ROOT → cwd precedence. The subscriber now uses `default_registry_dir()`. An independent parser check intercepted subscriber execution before network access and confirmed the workspace-derived path. Sandbox isolation and the adjusted R1/B-9/snapshot expectations remain consistent. |
+| Version/docs | Shell and eager constants, eight frontmatters, matrix and current documentation remain 4.4.3. The release commit subject is exactly `release(v4.4.3): bump framework and eight skills to 4.4.3 in lockstep`. Remaining 4.4.2 text in checked current documents is the historical changelog heading. The skill and release notes describe the held-lock and orphan fixes. |
+
+The process detector remains heuristic: UUID text in unrelated processes can cause a conservative refusal, as documented, and agent-name token parsing recognizes the supported command forms rather than every possible interpreter launcher. File-descriptor detection depends on working `lsof`; the current run exercised it successfully. These limits do not reopen the two reproduced findings. WORKSPACE_ROOT remains an authoritative override, so callers changing workspaces must supply the intended root or explicit directories.
+
+## Validation
+
+Fresh run at the reviewed HEAD: **250 passed in 178.94 seconds**.
+
+```text
+tests/test_issue10_13_purge.py
+tests/test_issue15_registry_isolation.py
+tests/test_orc_onboard.py
+tests/test_a4_adapter_contract.py
+tests/test_issue5_phase1_delegation.py
+tests/test_tier1_unit.py
+tests/test_loop_cli.py
+tests/test_issue5_phase4_runtime.py
+tests/test_version_consistency.py
+```
+
+Full-branch `git diff --check` passed. Individual `bash -n` checks passed for lib.sh, onboarding, create, and stop scripts. `verify_framework_version()` passed with MAM_VERSION read from lib.sh and the imported eager constant. Final inspection confirmed the same HEAD and a clean tracked worktree. The full repository suite was not rerun.
+
+Only this review report was added. No source edits, commits, pushes, merges, real-home purges, registered-orchestrator removals, or operations in the excluded second worktree were performed. Independent fixtures used temporary homes and fresh UUID4 identifiers. Progress events were published during review and testing.
+
+[VERDICT: PASS]