diff --git a/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh b/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh
new file mode 100644
index 0000000..0387875
--- /dev/null
+++ b/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh
@@ -0,0 +1,141 @@
+#!/bin/bash
+# Regression coverage for Gitea PR diff construction and fail-closed review behavior.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+fail() {
+    echo "not ok - $*" >&2
+    exit 1
+}
+
+assert_contains() {
+    local haystack="$1" needle="$2"
+    [[ "$haystack" == *"$needle"* ]] || fail "expected output to contain: $needle"
+}
+
+# A fresh clone is on main, while PR #795's changes exist only at the provider PR ref.
+# The git stub returns the PR patch only when build_diff_context fetches and diffs that
+# explicit ref; diffing main...HEAD reproduces the empty/wrong-branch bug.
+if [[ "${1:-all}" != "fail-closed" ]]; then
+FETCH_LOG="$TMP_DIR/fetch.log"
+DIFF_LOG="$TMP_DIR/diff.log"
+export FETCH_LOG DIFF_LOG
+
+(
+    # shellcheck source=common.sh
+    source "$SCRIPT_DIR/common.sh"
+
+    detect_platform() {
+        PLATFORM=gitea
+        export PLATFORM
+    }
+
+    tea() {
+        if [[ "$*" == "pr list --fields index,base --output simple" ]]; then
+            printf '795 main\n'
+            return 0
+        fi
+        return 1
+    }
+
+    git() {
+        case "${1:-}" in
+            remote)
+                printf 'https://git.example.test/mosaicstack/stack.git\n'
+                ;;
+            fetch)
+                printf '%s\n' "$*" >> "$FETCH_LOG"
+                ;;
+            diff)
+                printf '%s\n' "$*" >> "$DIFF_LOG"
+                if [[ "$*" == *"refs/remotes/origin/pr/795/head"* && "$*" != *"HEAD"* ]]; then
+                    cat <<'DIFF'
+diff --git a/pr-change.ts b/pr-change.ts
+--- a/pr-change.ts
++++ b/pr-change.ts
+@@ -1 +1 @@
+-old
++actual-pr-change
+DIFF
+                fi
+                ;;
+            *)
+                return 1
+                ;;
+        esac
+    }
+
+    diff_context=$(build_diff_context pr 795)
+    assert_contains "$diff_context" "actual-pr-change"
+)
+
+assert_contains "$(cat "$FETCH_LOG" 2>/dev/null || true)" "refs/pull/795/head"
+assert_contains "$(cat "$DIFF_LOG" 2>/dev/null || true)" "refs/remotes/origin/pr/795/head"
+if grep -q 'HEAD' "$DIFF_LOG" 2>/dev/null; then
+    fail "Gitea PR diff used local HEAD"
+fi
+echo "ok - Gitea PR mode fetches and diffs the explicit PR head"
+fi
+
+# Exercise the CLI path with all provider/network mutations stubbed. An empty PR diff
+# must be an actionable nonzero failure before Codex runs and before auto-post can run.
+if [[ "${1:-all}" != "pr-head" ]]; then
+SANDBOX="$TMP_DIR/sandbox"
+mkdir -p "$SANDBOX/tools/codex/schemas" "$SANDBOX/tools/git" "$SANDBOX/bin"
+cp "$SCRIPT_DIR/common.sh" "$SCRIPT_DIR/codex-code-review.sh" "$SANDBOX/tools/codex/"
+cp "$SCRIPT_DIR/schemas/code-review-schema.json" "$SANDBOX/tools/codex/schemas/"
+
+cat > "$SANDBOX/tools/git/detect-platform.sh" <<'STUB'
+detect_platform() { PLATFORM=gitea; export PLATFORM; }
+get_repo_info() { printf 'mosaicstack/stack\n'; }
+STUB
+cat > "$SANDBOX/tools/git/pr-review.sh" <<'STUB'
+#!/bin/bash
+printf 'POST %s\n' "$*" >> "$POST_LOG"
+STUB
+chmod +x "$SANDBOX/tools/git/pr-review.sh"
+
+cat > "$SANDBOX/bin/git" <<'STUB'
+#!/bin/bash
+case "${1:-}" in
+    rev-parse) exit 0 ;;
+    remote) printf 'https://git.example.test/mosaicstack/stack.git\n' ;;
+    fetch) printf 'FETCH %s\n' "$*" >> "$FETCH_LOG" ;;
+    diff) exit 0 ;;
+    *) exit 1 ;;
+esac
+STUB
+cat > "$SANDBOX/bin/tea" <<'STUB'
+#!/bin/bash
+if [[ "$*" == "pr list --fields index,base --output simple" ]]; then
+    printf '795 main\n'
+    exit 0
+fi
+exit 1
+STUB
+cat > "$SANDBOX/bin/codex" <<'STUB'
+#!/bin/bash
+printf 'CODEX %s\n' "$*" >> "$CODEX_LOG"
+exit 99
+STUB
+chmod +x "$SANDBOX/bin/git" "$SANDBOX/bin/tea" "$SANDBOX/bin/codex"
+
+POST_LOG="$TMP_DIR/post.log"
+CODEX_LOG="$TMP_DIR/codex.log"
+export POST_LOG CODEX_LOG
+set +e
+PATH="$SANDBOX/bin:$PATH" "$SANDBOX/tools/codex/codex-code-review.sh" -n 795 \
+    >"$TMP_DIR/review.stdout" 2>"$TMP_DIR/review.stderr"
+review_status=$?
+set -e
+
+[[ "$review_status" -ne 0 ]] || fail "empty PR diff returned success instead of failing closed"
+[[ ! -s "$CODEX_LOG" ]] || fail "Codex ran for an empty PR diff"
+[[ ! -s "$POST_LOG" ]] || fail "review auto-post ran for an empty PR diff"
+assert_contains "$(cat "$TMP_DIR/review.stderr")" "Error:"
+assert_contains "$(cat "$TMP_DIR/review.stderr")" "PR #795"
+echo "ok - empty PR diff fails closed before Codex and auto-post"
+fi