fix(codex): resolve peer-review findings R1-R6 and T1-T2

- R1: use herdr send-keys C-c for graceful stop
- R2: preserve JSONL fallback discovery when database is empty
- R3: apply workspace-scoped SQLite query before bounding results
- R4: tighten artifact validation to fail closed on missing/invalid metadata
- R5: verify actual rollout presence before reporting resumable in status
- R6: remove unconditional drift-B backend command fallback
- T1: parameterize artifact metadata regression with verified finder fixture
- T2: seed unmanaged and managed sessions in mock herdr for drift-B testing
- Add final loop review reports (100% PASS)

.agents/reports/creator-agy-01/report-155f5092.md

@@ -0,0 +1,60 @@
+# Job 155f5092 Final Report: Resolution of Follow-Up Findings T1 & T2
+
+- **Job ID**: 155f5092
+- **Reviewer Target**: `planner-reviewer-codex-01` (`ff721ed1`)
+- **Status**: Completed (Both regression test findings T1 and T2 resolved and mutation-verified)
+
+---
+
+## 1. Summary of Changes
+
+### T1 (P2): Invalid-metadata assertions only exercise "file not found"
+- **Problem**: In `test_codex_verify_artifact_metadata_fail_closed`, the fixture file was placed outside the discovery path without the finder override being active for cases 1–5. Consequently, `verify_artifact` returned `False` on file existence before reaching metadata parsing, which allowed the old buggy verifier (from commit `76f10b2`) to pass the test.
+- **Fix**:
+  - In `tests/test_a4_adapter_contract.py`, updated `test_codex_verify_artifact_metadata_fail_closed` to use pytest `monkeypatch`.
+  - Installed `adapter._find_rollout` monkeypatch override *before* running all assertions.
+  - Added an explicit assertion verifying that `adapter._find_rollout(uuid, ctx)` resolves the fixture file before evaluating malformed contents.
+  - Parameterized invalid metadata cases:
+    - `{}` (empty dict - R4 defect)
+    - `{"payload": {"cwd": ws}}` (missing `payload.id`)
+    - `{"payload": {"id": uuid}}` (missing `payload.cwd`)
+    - `{"payload": {"id": "other-id", "cwd": ws}}` (mismatched session ID)
+    - `{"payload": {"id": uuid, "cwd": "/wrong/path"}}` (mismatched workspace cwd)
+    - `"not-valid-json"` (malformed JSON syntax)
+    - `[]` (non-dict JSON)
+    - `{"payload": "not-a-dict"}` (non-dict payload)
+  - Added database/transcript metadata inconsistency test: DB has conflicting cwd, asserting fail-closed behavior even if rollout matches workspace.
+  - Retained a valid control case with matching DB cwd and transcript cwd, asserting `True`.
+- **Mutation Verification**:
+  - Bound `old_verify_artifact` from commit `76f10b2` in memory: test **FAILED** with `AssertionError: Expected False for payload: {} (assert True is False)`.
+  - With current implementation: test **PASSED**.
+
+### T2 (P2): Unmanaged-session test never supplies a session to drift-B
+- **Problem**: `test_reconcile_drift_b_unmanaged_session_ignored` used a minimal custom mock script that did not support the `herdr ls -F "#{session_name}|#{session_created}"` or `herdr list-panes -F` query shapes used by `reconcile.sh`, meaning drift-B was never evaluated for the session.
+- **Fix**:
+  - In `tests/test_tier1_unit.py`, updated `test_reconcile_drift_b_unmanaged_session_ignored` to use the contract-compatible `mock_herdr` fixture.
+  - Seeded `mock_herdr_state.json` with two sessions running `codex` in the workspace:
+    1. Unmanaged candidate: `"personal-session"` (unmanaged name, no `MAM_MANAGED` env marker).
+    2. Managed positive control: `"test-proj-creator-codex"` (standard managed name pattern).
+  - Asserted that both sessions are discoverable via `herdr ls -F "#{session_name}|#{session_created}"` and `herdr list-panes -t <name> -F "#{pane_pid}|#{pane_current_path}|#{pane_current_command}"` before running reconcile.
+  - Ran `reconcile.sh --once --emit-diff`.
+  - Asserted that `"personal-session"` is ignored (not present in `drifts` as class B, not in `agent-sessions.yaml`).
+  - Asserted that `"test-proj-creator-codex"` is registered as drift class B and added to `agent-sessions.yaml`.
+- **Mutation Verification**:
+  - Temporarily restored the old fallback (`if not agent: if pm_check and pm_check.get("cmd") in ...: agent = ...`): test **FAILED** with `AssertionError: assert not any(d.get("name") == "personal-session" for d in drifts)` (because `"personal-session"` was incorrectly registered).
+  - With current implementation (fallback removed): test **PASSED**.
+
+---
+
+## 2. Validation & Verification
+
+1. `git diff --check`: Clean (exit code 0).
+2. T1 Mutation Check:
+   - Against `76f10b2` `verify_artifact`: FAILED (`AssertionError: Expected False for payload: {}`).
+   - Against current `verify_artifact`: PASSED.
+3. T2 Mutation Check:
+   - Against `76f10b2` fallback in `reconcile.sh`: FAILED (`assert not True` on personal-session registration).
+   - Against current `reconcile.sh`: PASSED.
+4. Focused Test Execution:
+   - `pytest tests/test_a4_adapter_contract.py tests/test_tier1_unit.py -q -k "codex or adapter or facts_bridge or delegate_agent or cli_bridge"`: **39 passed, 61 deselected in 46.23s**.
+   - `pytest tests/test_tier1_unit.py::test_reconcile_drift_b_unmanaged_session_ignored tests/test_version_consistency.py tests/test_tier2_component.py::test_comp_codex_create_and_reconcile_and_stop -q`: **4 passed in 40.15s**.