fix(driver-diagnostic): publish the record exclusively at 0600, and delete five unreachable items (#502)

The diagnostic publisher was the only one of the ten publication helpers
in the tree that used `File::create` on a *predictable* temp name in an
agent-writable directory: no `O_EXCL`, no mode, symlink-followable, and
no parent-directory fsync — while its sibling in `delivery_ledger`
documents exactly why each of those matters. Four defects, one fix: the
staging sibling is now created exclusively at `0600` under
`.driver-diagnostic.tmp-<pid>-<counter>`, so a planted symlink is refused
instead of followed, the record is not world-readable, two writes to one
agent directory cannot collide, and the directory entry is synced.
Pinned by `a_planted_staging_symlink_is_refused_and_the_record_is_owner_only`.

T1-DEAD, each verified by an exhaustive search over `src`, `tests` and
`crates`:

- `pretrust::pretrust_codex` — 0 callers; its own doc says reconciliation
  does not call it. The live entry is `pretrust_codex_at`.
- `context::append_decision` — a one-line forwarder with no production
  caller; the CLI already calls `append_decision_to_dir`. Its 5 unit-test
  callers now call that directly.
- `agent_author::resource::add_resource` — an 8-argument forwarder
  superseded by `add_resource_with_selector`, which production already
  uses. Its 17 unit-test callers pass the `None` the forwarder passed.
- `identity::AddressBookEntry::bus_address` — 0 callers. Every other
  `bus_address` in the tree is `AgentSpec::bus_address(this_host)`, a
  different method with an argument.
- `ding::observed_poke` — the repo's only `#[allow(dead_code)]` in `src`,
  superseded by `observed_poke_with_window`.
- `resource_profile::relative_path` — 0 callers anywhere. The deep-clean
  report filed it as test-only; it is dead.

Narrowed only where it is warning-free: `CodexHoldReason` and
`CodexTerminalError` to `pub(crate)`, and the two codex control-state
loaders to `#[cfg(test)]`. Narrowing the other five codex items and
`resource_profile::last_commit` wakes `dead_code` on their test-only
accessors, which is exactly why they are `pub` today — reverted rather
than papered over with an allow.

Also: `hooks::tests::omp_launch_classification_is_exact` carried a
duplicated `#[test]` and, above it, the doc comment belonging to the pi
test whose `#[test]` was missing (#501 restored that). Attribute
de-duplicated, doc moved to the test it describes.

agent-identity: dev3.direct.omp.43sz6ujq
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.1.7
agent-runtime: OMP 18.1.7
tooling-profile: dotfiles@39a19af

Author: schickling-assistant

src/agent_author.rs

@@ -1263,7 +1263,7 @@ mod tests {
             &declaration("worker", "h", None, "catalog"),
         );
 
-        let added = add_resource(
+        let added = add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1272,13 +1272,14 @@ mod tests {
             "github-issue://example/project/123",
             "release work item",
             None,
+            None,
         )
         .unwrap();
         assert_eq!(added.result, AuthorOutcome::Changed);
         assert_eq!(added.identity, "h.worker");
         assert_eq!(added.inactive_reason, None);
 
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1287,13 +1288,14 @@ mod tests {
             "worktree://github.com/example/project/change",
             "primary checkout",
             None,
+            None,
         )
         .unwrap();
         let two_bindings = fs::read_to_string(&path).unwrap();
 
         // An identical request proves the binding rather than rewriting the declaration.
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.worker",
                 "h",
@@ -1302,6 +1304,7 @@ mod tests {
                 "github-issue://example/project/123",
                 "release work item",
                 None,
+                None,
             )
             .unwrap()
             .result,
@@ -1311,7 +1314,7 @@ mod tests {
 
         // Re-declaring an existing name updates it in place, keeping its position and siblings.
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.worker",
                 "h",
@@ -1320,6 +1323,7 @@ mod tests {
                 "github-issue://example/project/456",
                 "follow-up work item",
                 Some("superseded by the follow-up"),
+                None,
             )
             .unwrap()
             .result,
@@ -1345,7 +1349,7 @@ mod tests {
 
         // The request declares the complete binding, so an omitted inactive-reason clears it.
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.worker",
                 "h",
@@ -1354,6 +1358,7 @@ mod tests {
                 "github-issue://example/project/456",
                 "follow-up work item",
                 None,
+                None,
             )
             .unwrap()
             .result,
@@ -1379,7 +1384,7 @@ mod tests {
 
         // Hand-authored property order and spacing are proven, not re-rendered.
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.worker",
                 "h",
@@ -1388,6 +1393,7 @@ mod tests {
                 "github-issue://example/project/123",
                 "release work item",
                 None,
+                None,
             )
             .unwrap()
             .result,
@@ -1405,7 +1411,7 @@ mod tests {
             "h/worker/agent.kdl",
             &declaration("worker", "h", None, "catalog"),
         );
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1414,9 +1420,10 @@ mod tests {
             "github-issue://example/project/123",
             "release work item",
             None,
+            None,
         )
         .unwrap();
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1425,6 +1432,7 @@ mod tests {
             "worktree://github.com/example/project/change",
             "primary checkout",
             None,
+            None,
         )
         .unwrap();
 
@@ -1461,7 +1469,7 @@ mod tests {
             "h/worker/agent.kdl",
             &declaration("worker", "h", None, "catalog"),
         );
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1470,9 +1478,10 @@ mod tests {
             "github-issue://example/project/123",
             "release work item",
             Some("merged and retained for traceability"),
+            None,
         )
         .unwrap();
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1481,6 +1490,7 @@ mod tests {
             "worktree://github.com/example/project/change",
             "primary checkout",
             None,
+            None,
         )
         .unwrap();
         let before = fs::read_to_string(&path).unwrap();
@@ -1561,7 +1571,7 @@ mod tests {
         );
         let untouched = fs::read_to_string(&nix_owned).unwrap();
 
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.child",
             "h",
@@ -1570,11 +1580,12 @@ mod tests {
             "github-issue://example/project/1",
             "supervised work item",
             None,
+            None,
         )
         .unwrap();
 
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.sibling",
                 "h",
@@ -1583,6 +1594,7 @@ mod tests {
                 "github-issue://example/project/1",
                 "reaching across the fleet",
                 None,
+                None,
             )
             .unwrap_err()
             .code(),
@@ -1595,7 +1607,7 @@ mod tests {
             "resource-not-authorized"
         );
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.nix",
                 "h",
@@ -1604,6 +1616,7 @@ mod tests {
                 "github-issue://example/project/1",
                 "Nix owns this declaration",
                 None,
+                None,
             )
             .unwrap_err()
             .code(),
@@ -1625,7 +1638,7 @@ mod tests {
                 Some(""),
             ),
         ] {
-            let error = add_resource(
+            let error = add_resource_with_selector(
                 root,
                 "h.child",
                 "h",
@@ -1634,6 +1647,7 @@ mod tests {
                 uri,
                 reason,
                 inactive_reason,
+                None,
             )
             .unwrap_err();
             assert_eq!(error.code(), "invalid-resource", "{name}: {error}");
@@ -1647,7 +1661,7 @@ mod tests {
         );
 
         // #345 widened the envelope: a catalog-relative carrier path is a valid binding uri.
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.child",
             "h",
@@ -1656,6 +1670,7 @@ mod tests {
             "carriers/goal.md",
             "Catalog-relative carrier.",
             None,
+            None,
         )
         .expect("a catalog-relative carrier path is admitted");
         assert_eq!(fs::read_to_string(&nix_owned).unwrap(), untouched);
@@ -1672,7 +1687,7 @@ mod tests {
         );
         let exact = "vendor+Thing://Authority.Example/Exact%20Identity?Query=A%2Fb#Frag%20Ment";
 
-        add_resource(
+        add_resource_with_selector(
             root,
             "h.worker",
             "h",
@@ -1681,6 +1696,7 @@ mod tests {
             exact,
             "exact vendor identity",
             None,
+            None,
         )
         .unwrap();
         assert_eq!(bound(root, "worker", "subject").uri(), exact);
@@ -1691,7 +1707,7 @@ mod tests {
 
         // A byte-identical re-declaration is a proven no-op, not a rewrite.
         assert_eq!(
-            add_resource(
+            add_resource_with_selector(
                 root,
                 "h.worker",
                 "h",
@@ -1700,6 +1716,7 @@ mod tests {
                 exact,
                 "exact vendor identity",
                 None,
+                None,
             )
             .unwrap()
             .result,

src/agent_author/resource.rs

@@ -39,30 +39,6 @@ pub struct ResourceRenameReceipt {
 ///
 /// st2 preserves the binding for readers; it resolves nothing and grants nothing. `uri` is the
 /// exact absolute identity and is stored byte for byte with no normalization.
-#[allow(clippy::too_many_arguments)]
-pub fn add_resource(
-    catalog_root: &Path,
-    selector: &str,
-    this_host: &str,
-    actor: Option<&str>,
-    name: &str,
-    uri: &str,
-    reason: &str,
-    inactive_reason: Option<&str>,
-) -> Result<ResourceAddReceipt, AuthorError> {
-    add_resource_with_selector(
-        catalog_root,
-        selector,
-        this_host,
-        actor,
-        name,
-        uri,
-        reason,
-        inactive_reason,
-        None,
-    )
-}
-
 #[allow(clippy::too_many_arguments)]
 pub fn add_resource_with_selector(
     catalog_root: &Path,

src/codex_app_server.rs

@@ -234,7 +234,7 @@ pub enum CodexObservedState {
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub enum CodexHoldReason {
+pub(crate) enum CodexHoldReason {
     ActiveWithoutTurn,
     ConflictingTurn,
     Review,
@@ -249,7 +249,7 @@ pub enum CodexHoldReason {
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub enum CodexTerminalError {
+pub(crate) enum CodexTerminalError {
     SystemError,
     ProviderAuthRejected,
 }
@@ -3002,7 +3002,8 @@ fn atomic_json(path: &Path, value: &impl Serialize) -> Result<()> {
     result
 }
 
-pub fn load_current_binding(
+#[cfg(test)]
+fn load_current_binding(
     path: &Path,
     runtime: &CodexRuntime,
 ) -> Result<Option<CodexThreadBinding>> {
@@ -3025,7 +3026,8 @@ pub fn load_current_binding(
     Ok(Some(binding))
 }
 
-pub fn load_current_control_state(
+#[cfg(test)]
+fn load_current_control_state(
     path: &Path,
     runtime: &CodexRuntime,
     binding: &CodexThreadBinding,

src/context.rs

@@ -122,13 +122,6 @@ fn lock_now(context_dir: &Path) -> anyhow::Result<fs::File> {
         .context("acquire now.md writer lock")
 }
 
-/// Append one decision to the log. `decision` and `why` must be single non-empty lines (the log is a
-/// scannable list; multi-line reasoning belongs in a doc). Renders `- <ISO> <decision>. why: <why>.`
-/// into a fresh `decisions/<unix-ms>-<rand6>.md`. Returns the entry's filename.
-pub fn append_decision(context_dir: &Path, decision: &str, why: &str) -> anyhow::Result<String> {
-    append_decision_to_dir(&decisions_dir(context_dir), decision, why)
-}
-
 pub fn append_decision_to_dir(dir: &Path, decision: &str, why: &str) -> anyhow::Result<String> {
     let decision = decision.trim();
     let why = why.trim();
@@ -285,14 +278,14 @@ mod tests {
     fn append_decisions_are_ordered_bullets() {
         let tmp = tempfile::tempdir().unwrap();
         let dir = context_dir(tmp.path());
-        append_decision(
-            &dir,
+        append_decision_to_dir(
+            &decisions_dir(&dir),
             "use hook-enforced perms",
             "never prompts an autonomous pty",
         )
         .unwrap();
         std::thread::sleep(std::time::Duration::from_millis(2));
-        append_decision(&dir, "defer shims", "scope enforcement is follow-on").unwrap();
+        append_decision_to_dir(&decisions_dir(&dir), "defer shims", "scope enforcement is follow-on").unwrap();
 
         let dec = read(&dir, View::Decisions);
         let lines: Vec<&str> = dec.lines().collect();
@@ -315,8 +308,8 @@ mod tests {
     fn append_rejects_empty_or_multiline() {
         let tmp = tempfile::tempdir().unwrap();
         let dir = context_dir(tmp.path());
-        assert!(append_decision(&dir, "", "why").is_err());
-        assert!(append_decision(&dir, "d", "").is_err());
-        assert!(append_decision(&dir, "line1\nline2", "why").is_err());
+        assert!(append_decision_to_dir(&decisions_dir(&dir), "", "why").is_err());
+        assert!(append_decision_to_dir(&decisions_dir(&dir), "d", "").is_err());
+        assert!(append_decision_to_dir(&decisions_dir(&dir), "line1\nline2", "why").is_err());
     }
 }