@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/codex/chatgpt-refresh-failure.ts

@@ -0,0 +1,56 @@
+/** Closed diagnostic vocabulary; provider descriptions and unknown codes never escape. */
+const REFRESH_DIAGNOSTIC_CODES = [
+  "invalid_grant", "refresh_token_invalidated", "token_invalidated", "refresh_token_reused",
+  "refresh_token_expired", "invalid_client", "invalid_request", "server_error",
+  "temporarily_unavailable", "rate_limit_exceeded", "unsupported_grant_type", "invalid_scope",
+] as const;
+export type ChatgptRefreshDiagnosticCode = typeof REFRESH_DIAGNOSTIC_CODES[number];
+export type ChatgptRefreshFailure = {
+  reason: "expired" | "revoked" | "unknown";
+  code?: ChatgptRefreshDiagnosticCode;
+};
+
+/** HTTP availability failures cannot establish that a refresh grant was revoked. */
+export function classifyChatgptRefreshFailure(status: number, body: string): ChatgptRefreshFailure {
+  if (body.length > 16_384) return { reason: "unknown" };
+  let payload: unknown;
+  try { payload = JSON.parse(body); } catch { return { reason: "unknown" }; }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { reason: "unknown" };
+  const row = payload as Record<string, unknown>;
+  let exactCode: string | undefined;
+  let description = typeof row.error_description === "string" ? row.error_description : "";
+  if (typeof row.error === "string") {
+    exactCode = row.error.trim() || undefined;
+  } else if (row.error !== undefined) {
+    if (!row.error || typeof row.error !== "object" || Array.isArray(row.error)) return { reason: "unknown" };
+    const error = row.error as Record<string, unknown>;
+    if (error.code !== undefined && typeof error.code !== "string") return { reason: "unknown" };
+    exactCode = typeof error.code === "string" ? error.code.trim() || undefined : undefined;
+    if (typeof error.message === "string") description = `${error.message} ${description}`;
+  }
+  const code = (REFRESH_DIAGNOSTIC_CODES as readonly unknown[]).includes(exactCode)
+    ? exactCode as ChatgptRefreshDiagnosticCode : undefined;
+  let reason: ChatgptRefreshFailure["reason"] = "unknown";
+  if (status === 400 || status === 401 || status === 403) {
+    if (["invalid_grant", "refresh_token_invalidated", "token_invalidated", "refresh_token_reused"].includes(exactCode ?? "")) {
+      reason = "revoked";
+    } else if (exactCode === "refresh_token_expired") {
+      reason = "expired";
+    } else if (status === 400 && exactCode === undefined) {
+      // Preserve description-only OAuth 400 compatibility; a named code always wins.
+      if (description.includes("invalidated") || description.includes("revoked")) reason = "revoked";
+      else if (description.includes("expired")) reason = "expired";
+    }
+  }
+  return { reason, ...(code ? { code } : {}) };
+}
+
+/** Endpoint verdict only: no credential identity, body, or arbitrary upstream string. */
+export function noteChatgptRefreshFailure(
+  kind: "pool" | "native main",
+  status: number,
+  failure: ChatgptRefreshFailure,
+): void {
+  console.warn(`[codex] ${kind} refresh: ${failure.reason === "unknown" ? "transient" : "reauth"}`
+    + ` status=${status} code=${failure.code ?? "none"}`);
+}

package/src/codex/codex-home-owner.ts

@@ -0,0 +1,124 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { samePathIdentity } from "./user-identity";
+
+export const CODEX_HOME_JOURNAL_FILE = "opencodex-journal.json";
+const MAX_JOURNAL_BYTES = 1024 * 1024;
+
+/** K imports this module; keep it independent of the config barrel and journal writer. */
+export function currentOpencodexHome(): string {
+  const configured = getConfigDir();
+  try { return realpathSync.native(configured); }
+  catch { return resolve(configured); }
+}
+
+export type CodexHomeOwnership =
+  | { readonly kind: "unbound" }
+  | { readonly kind: "owned" }
+  | { readonly kind: "stale"; readonly boundHome: string }
+  | { readonly kind: "foreign"; readonly boundHome: string }
+  | { readonly kind: "unknown" };
+
+export type CodexHomeJournalInspection =
+  | { kind: "missing" }
+  | { kind: "read"; journal: Record<string, unknown> }
+  | { kind: "unknown" };
+
+function absent(error: unknown): boolean {
+  return (error as NodeJS.ErrnoException)?.code === "ENOENT";
+}
+
+/** ENOENT through a dangling link or an unresolvable ancestor is not proven absence. */
+function provenAbsent(path: string): boolean {
+  try { lstatSync(path); return false; }
+  catch (error) { if (!absent(error)) return false; }
+  const parent = dirname(path);
+  if (parent === path) return false;
+  try { return statSync(realpathSync.native(parent)).isDirectory(); }
+  catch (error) { return absent(error) && provenAbsent(parent); }
+}
+
+function validJournal(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const journal = value as Record<string, unknown>;
+  return journal.version === 1 && typeof journal.originalConfig === "string"
+    && (journal.originalProfile === null || typeof journal.originalProfile === "string")
+    && (journal.opencodexHome === undefined || (typeof journal.opencodexHome === "string"
+      && isAbsolute(journal.opencodexHome) && !journal.opencodexHome.includes("\0")));
+}
+
+/** Bounded, regular-file-only observation. Failure never supplies cleanup authority. */
+export function readCodexHomeJournal(journalPath: string): CodexHomeJournalInspection {
+  let fd: number | undefined;
+  try {
+    const before = lstatSync(journalPath);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_JOURNAL_BYTES) return { kind: "unknown" };
+    fd = openSync(journalPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    const opened = fstatSync(fd);
+    if (!opened.isFile() || opened.size > MAX_JOURNAL_BYTES || before.dev !== opened.dev || before.ino !== opened.ino) return { kind: "unknown" };
+    const bytes = Buffer.alloc(opened.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync(fd, bytes, length, bytes.length - length, null);
+      if (!count) break;
+      length += count;
+    }
+    const after = lstatSync(journalPath);
+    if (length !== opened.size || !after.isFile() || after.dev !== opened.dev || after.ino !== opened.ino
+      || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs) return { kind: "unknown" };
+    const journal: unknown = JSON.parse(bytes.subarray(0, length).toString("utf8"));
+    return validJournal(journal) ? { kind: "read", journal } : { kind: "unknown" };
+  } catch (error) {
+    return fd === undefined && absent(error) && provenAbsent(journalPath) ? { kind: "missing" } : { kind: "unknown" };
+  } finally { if (fd !== undefined) closeSync(fd); }
+}
+
+function inspectBinding(boundHome: string, current: string): CodexHomeOwnership {
+  let physical: string;
+  try {
+    physical = realpathSync.native(boundHome);
+    if (!statSync(physical).isDirectory()) return { kind: "unknown" };
+  } catch { return provenAbsent(boundHome) ? { kind: "stale", boundHome } : { kind: "unknown" }; }
+  try {
+    const own = realpathSync.native(current);
+    if (!statSync(own).isDirectory()) return { kind: "unknown" };
+    return samePathIdentity(physical, own) ? { kind: "owned" } : { kind: "foreign", boundHome };
+  } catch { return { kind: "unknown" }; }
+}
+
+export function inspectCodexHomeOwner(canonicalHome: string, current = currentOpencodexHome()): CodexHomeOwnership {
+  const read = readCodexHomeJournal(join(canonicalHome, CODEX_HOME_JOURNAL_FILE));
+  if (read.kind === "unknown") return { kind: "unknown" };
+  if (read.kind === "missing" || read.journal.opencodexHome === undefined) return { kind: "unbound" };
+  return inspectBinding(read.journal.opencodexHome as string, current);
+}
+
+/** Preserve extant and uncertain bindings; only legacy or proven stale records are adopted. */
+export function opencodexHomeForInjection(recorded: string | undefined, current = currentOpencodexHome()): string {
+  if (recorded === undefined) return current;
+  return inspectBinding(recorded, current).kind === "stale" ? current : recorded;
+}
+
+export type CodexHomeOwnerRefusalReason = "foreign-owner" | "owner-unknown";
+export class CodexHomeOwnerRefusal extends Error {
+  constructor(readonly reason: CodexHomeOwnerRefusalReason) {
+    super(reason === "foreign-owner"
+      ? "Codex home is bound to another OpenCodex home; configuration and journal were preserved. Restore from the owning home first."
+      : "Codex home ownership could not be verified; configuration and journal were preserved.");
+    this.name = "CodexHomeOwnerRefusal";
+  }
+}
+export function assertCodexHomeOwner(home: string): void {
+  const owner = inspectCodexHomeOwner(home);
+  if (owner.kind === "foreign" || owner.kind === "unknown") {
+    throw new CodexHomeOwnerRefusal(owner.kind === "foreign" ? "foreign-owner" : "owner-unknown");
+  }
+}
+
+/** Compensation must not replace evidence another home published during this operation. */
+export function codexHomeOwnerBlocksCompensation(home: string, error: unknown): boolean {
+  if (!(error instanceof CodexHomeOwnerRefusal)) return false;
+  const owner = inspectCodexHomeOwner(home);
+  return owner.kind === "foreign" || owner.kind === "unknown";
+}

package/src/codex/convergence.ts

@@ -1,4 +1,6 @@
+import { projectAntigravitySelectedModels } from "../providers/antigravity-effort-families";
 import { join } from "node:path";
+import { sameCatalogHealPath } from "./catalog/heal-observation";
 
 import { getConfigDir, saveConfigPreservingClaudeCode, websocketsEnabled, withExpectedConfigGenerationSync } from "../config";
 import { reconcileSuccessfulModelDiscoveries } from "../providers/new-model-policy";
@@ -82,11 +84,20 @@ import {
   type CodexModelEntitlementSnapshot,
 } from "./model-entitlements";
 import { resolveAdmittedCodexModelEntitlements } from "./model-entitlement-admission";
+import {
+  FOREIGN_CODEX_HOME_OWNER_MESSAGE,
+  UNKNOWN_CODEX_HOME_OWNER_MESSAGE,
+  routedRemovalBackedByConfigFile,
+  unbackedRoutedRemovalMessage,
+  unconfiguredRoutedRemoval,
+  type UnconfiguredRoutedRemoval,
+} from "./catalog/routed-removal";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "./catalog/native-models";
 import { providerCodexAccountMode } from "../providers/registry";
 import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { withCatalogWriteSerialization } from "./catalog-write-serialization";
 import {
+  auditRefusedCatalogReplacement,
   publishHashedCodexCatalogBackup,
   publishLegacyCodexCatalogBackup,
   replaceActiveCodexCatalog,
@@ -108,14 +119,20 @@ import type {
 export interface CatalogWriteReceipt {
   readonly keyedBackup: "written" | "preserved" | "not-requested";
   readonly legacyBackup: "written" | "preserved" | "not-requested";
-  readonly catalog: "written" | "not-written";
-  readonly cache: "written" | "not-written";
+  /** `unchanged`: the bytes on disk already matched, so nothing was rewritten. */
+  readonly catalog: "written" | "unchanged" | "not-written";
+  readonly cache: "written" | "unchanged" | "not-written";
 }
 
 export type CodexCatalogCommitResult =
   | { readonly kind: "committed"; readonly changed: boolean; readonly writes: CatalogWriteReceipt }
   | { readonly kind: "stale"; readonly reason: "generation" | "home-selection" | "source-observation" | "process-local" | "target-identity" | "candidate-consumed" | "account-entitlement" }
-  | { readonly kind: "refused"; readonly reason: "source-unreadable" | "source-ambiguous" | "target-unsafe" }
+  /**
+   * `unbacked-routed-removal`: the candidate drops routed namespaces config.json does not back, or
+   * clears every routed row while config.json is unreadable. `foreign-owner`: this Codex home is
+   * bound to another OPENCODEX_HOME (#6529).
+   */
+  | { readonly kind: "refused"; readonly reason: "source-unreadable" | "source-ambiguous" | "target-unsafe" | "unbacked-routed-removal" | "foreign-owner" | "owner-unknown" }
   | { readonly kind: "failed"; readonly surface: "disk"; readonly writes: CatalogWriteReceipt };
 
 declare const catalogCandidateBrand: unique symbol;
@@ -139,10 +156,11 @@ interface CandidateState {
   readonly cache: PreparedCatalogFileWrite;
   readonly keyedBackup?: PreparedCatalogFileWrite;
   readonly legacyBackup?: PreparedCatalogFileWrite;
-  readonly changed: boolean;
   readonly notices: readonly CatalogNotice[];
   readonly modelEntitlements: CodexModelEntitlementSnapshot;
   readonly discoveryConfig?: OcxConfig;
+  /** Routed namespaces this candidate empties only because the driving config lacks them. */
+  readonly routedRemoval: UnconfiguredRoutedRemoval | null;
 }
 
 const candidateStates = new WeakMap<object, CandidateState>();
@@ -347,7 +365,7 @@ function prepareCatalog(
   const selectedModelsByProvider = new Map<string, ReadonlySet<string>>(
     enabledProviders.flatMap(([name, provider]) => (
       Array.isArray(provider.selectedModels) && provider.selectedModels.length > 0
-        ? [[name, new Set(provider.selectedModels)] as const]
+        ? [[name, new Set(projectAntigravitySelectedModels(name, provider.selectedModels, routedModels))] as const]
         : []
     )),
   );
@@ -536,11 +554,10 @@ export async function gatherCodexCatalogCandidate(
       ...(pristineBytes ? { keyedBackup: { path: paths.keyedBackup, content: pristineBytes } } : {}),
       ...(pristineBytes && paths.legacyBackup
         ? { legacyBackup: { path: paths.legacyBackup, content: pristineBytes } } : {}),
-      changed: Buffer.from(activeBytes ?? []).toString("utf8") !== preparedCatalogBytes
-        || Buffer.from(cacheBytes ?? []).toString("utf8") !== preparedCacheBytes,
       notices: Object.freeze([...notices]),
       modelEntitlements,
       ...(discoveryChanged ? { discoveryConfig } : {}),
+      routedRemoval: unconfiguredRoutedRemoval(active, preparedCatalog, snapshot.config),
     });
     return { kind: "candidate", candidate };
   } catch (error) {
@@ -625,11 +642,14 @@ function fixedCommit(state: CandidateState, permit: Parameters<typeof replaceAct
     if (state.legacyBackup) {
       writes = { ...writes, legacyBackup: publishLegacyCodexCatalogBackup(permit, state.home, state.legacyBackup) };
     }
-    replaceActiveCodexCatalog(permit, state.home, state.catalog);
-    writes = { ...writes, catalog: "written" };
-    replaceCodexModelsCache(permit, state.home, state.cache);
-    writes = { ...writes, cache: "written" };
-    return { kind: "committed", changed: state.changed, writes };
+    const catalog = replaceActiveCodexCatalog(permit, state.home, state.catalog);
+    // The funnel's backstop: every routed row would go while config.json is not a readable file.
+    // Nothing past the pristine backups was written, and the cache must not describe a catalog
+    // that was never published.
+    if (catalog.kind === "refused") return { kind: "refused", reason: "unbacked-routed-removal" };
+    writes = { ...writes, catalog: catalog.kind };
+    writes = { ...writes, cache: replaceCodexModelsCache(permit, state.home, state.cache).kind };
+    return { kind: "committed", changed: writes.catalog === "written" || writes.cache === "written", writes };
   } catch {
     return { kind: "failed", surface: "disk", writes };
   }
@@ -638,6 +658,7 @@ function fixedCommit(state: CandidateState, permit: Parameters<typeof replaceAct
 export async function commitCodexCatalogCandidate(
   candidate: CodexCatalogCandidate,
   deadlineMs: number,
+  lifecycle: Readonly<{ beforeCommit?: () => boolean; expectedCatalogPath?: string }> = {},
 ): Promise<CommitAttempt> {
   const state = candidateStates.get(candidate as object);
   if (!state) return { kind: "refused", reason: "source-ambiguous" };
@@ -648,13 +669,33 @@ export async function commitCodexCatalogCandidate(
       state.consumed = true;
       const guarded = withExpectedConfigGenerationSync(state.generation, () => {
         const invalid = revalidateCandidate(state);
-        return invalid ?? fixedCommit(state, permit);
+        if (invalid) return invalid;
+        if (lifecycle.expectedCatalogPath !== undefined && !sameCatalogHealPath(state.catalog.path, lifecycle.expectedCatalogPath)) {
+          return { kind: "stale", reason: "target-identity" } as const;
+        }
+        if (lifecycle.beforeCommit && lifecycle.beforeCommit() !== true) return { kind: "stale", reason: "process-local" } as const;
+        // A refresh may empty a routed namespace only when config.json on disk agrees it is gone.
+        // Read under K, so a config that fell back to defaults during a transient read failure,
+        // or that belongs to another OPENCODEX_HOME, cannot publish a native-only catalog (#6529).
+        if (state.routedRemoval !== null && !routedRemovalBackedByConfigFile(state.routedRemoval)) {
+          auditRefusedCatalogReplacement(permit, state.home, state.catalog, "unbacked-routed-removal");
+          console.warn(`[opencodex] ${unbackedRoutedRemovalMessage(state.routedRemoval.namespaces.length)}`);
+          return { kind: "refused", reason: "unbacked-routed-removal" } as const;
+        }
+        return fixedCommit(state, permit);
       });
       if (guarded.kind === "conflict") return { kind: "stale", reason: "generation" } as const;
       if (guarded.kind === "unavailable") return { kind: "busy" } as const;
       return guarded.value;
-    });
+    }, { intent: "refresh", writer: "convergence" });
     if (acquired.kind === "completed") return acquired.value;
+    if (acquired.reason === "foreign-owner" || acquired.reason === "owner-unknown") {
+      // Not retryable: another OPENCODEX_HOME owns this Codex home until it restores (#6529).
+      state.consumed = true;
+      console.warn(`[opencodex] ${acquired.reason === "foreign-owner"
+        ? FOREIGN_CODEX_HOME_OWNER_MESSAGE : UNKNOWN_CODEX_HOME_OWNER_MESSAGE}`);
+      return { kind: "refused", reason: acquired.reason };
+    }
     if (acquired.reason !== "busy" || Date.now() >= deadline) return { kind: "busy" };
     await Bun.sleep(Math.min(10, Math.max(1, deadline - Date.now())));
   }
@@ -675,7 +716,7 @@ function projectCommit(result: CommitAttempt, notices: readonly CatalogNotice[])
 export async function convergeCodexCatalog(
   snapshot: CatalogAdmissionSnapshot,
   request: ConvergeRequest,
-  lifecycle: Readonly<{ onCommitBegin?: () => void }> = {},
+  lifecycle: Readonly<{ onCommitBegin?: () => void; beforeCommit?: () => boolean; expectedCatalogPath?: string }> = {},
 ): Promise<Readonly<{ changed: boolean; catalogRefresh: CatalogDisposition }>> {
   if (request.scope !== "catalog" || request.action !== "converge") {
     return {
@@ -687,7 +728,7 @@ export async function convergeCodexCatalog(
   if (gathered.kind === "disposition") return { changed: false, catalogRefresh: gathered.disposition };
   const state = candidateStates.get(gathered.candidate as object)!;
   lifecycle.onCommitBegin?.();
-  const committed = await commitCodexCatalogCandidate(gathered.candidate, request.deadlineMs);
+  const committed = await commitCodexCatalogCandidate(gathered.candidate, request.deadlineMs, lifecycle);
   if (committed.kind === "committed" && state.discoveryConfig) {
     const mutable = snapshot.config as OcxConfig;
     mutable.modelDiscovery = state.discoveryConfig.modelDiscovery;

package/src/codex/features.ts

@@ -38,6 +38,7 @@ import { AtomicWriteResidualTempError, AtomicWriteSecretResidualError, atomicWri
 import { forgetEphemeralSecretPath } from "../lib/windows-secret-acl";
 import { CODEX_CONFIG_PATH } from "./paths";
 import { resolveAndPersistCodexRuntime } from "./runtime";
+import { decodeOverlayState } from "./shim-state-file";
 import { canonicalizeOpenCodexModeHint } from "./multi-agent-mode-policy";
 
 /** Upstream codex-rs feature key: allow `request_user_input` in Default mode. */
@@ -1232,13 +1233,19 @@ function codexNativeBinaryCandidates(command: string): string[] {
 /** Backing paths tied to this exact OCX shim entry in codex-shim.json. */
 function selectedShimBackingPaths(commandPath: string): string[] {
   try {
-    const state = JSON.parse(readFileSync(join(getConfigDir(), "codex-shim.json"), "utf8")) as {
+    const configDir = getConfigDir();
+    const state = JSON.parse(readFileSync(join(configDir, "codex-shim.json"), "utf8")) as {
+      schema?: unknown;
+      mode?: unknown;
       wrapperPath?: unknown;
       originalPath?: unknown;
       backupPath?: unknown;
       realPath?: unknown;
       wrappers?: Array<Record<string, unknown>>;
     };
+    const overlay = decodeOverlayState(state, configDir);
+    if (overlay) return resolve(overlay.wrapperPath) === resolve(commandPath) ? [overlay.launcherPath] : [];
+    if (state.schema !== undefined || state.mode !== undefined) return [];
     const entries = Array.isArray(state.wrappers) && state.wrappers.length > 0 ? state.wrappers : [state];
     const selected = resolve(commandPath);
     for (const entry of entries) {

package/src/codex/inject/restore.ts

@@ -1,8 +1,11 @@
+import { assertCodexHomeOwner, codexHomeOwnerBlocksCompensation, CodexHomeOwnerRefusal, type CodexHomeOwnerRefusalReason } from "../codex-home-owner";
 import { loadConfig } from "../../config";
 import { shouldSyncCodexOnStart } from "../desired-state";
 import { siblingOfLivePort, siblingSkipMessage } from "../sibling-start";
 import { withCatalogWriteSerialization } from "../catalog-write-serialization";
 import { restoreCodexCatalogWithPermit } from "../catalog/sync";
+import { readCodexCatalogPath } from "../catalog/parsing";
+import { notifyCatalogPublication } from "../catalog/publication-observer";
 import { withCodexWriteLock, CodexWriteLockSkipped } from "../codex-write-lock";
 import { inspectNativeCodexOwnership } from "../../integrations/native/ownership-preflight";
 import { resolveCodexHistoryTransition } from "../history-transition";
@@ -24,6 +27,7 @@ import {
 import {
   journaledInjectedCatalogPath,
   removeJournal,
+  releaseJournalHomeBinding,
   restoreJournalState,
 } from "../journal";
 import {
@@ -128,6 +132,7 @@ export interface CodexRestoreHistoryResult {
 }
 
 export interface CodexNativeRestoreResult {
+  ownershipRefusal?: CodexHomeOwnerRefusalReason;
   success: boolean;
   message: string;
   externalProvider?: string;
@@ -339,6 +344,9 @@ export interface RestoreConfigOptions {
 
 /** The config/profile half of a native restore, reported as one artifact. */
 function restoreCodexConfigInline(kind = "sync", options: RestoreConfigOptions = {}): CodexRestoreConfigResult {
+  assertCodexHomeOwner(getCodexHome());
+  beforeRestoreConfigForTests?.(kind);
+  assertCodexHomeOwner(getCodexHome());
   const preImages = captureCodexPreImages();
   const result = restoreCodexConfigInlineImpl(kind, options);
   if (result.state === "failed") {
@@ -350,7 +358,6 @@ function restoreCodexConfigInline(kind = "sync", options: RestoreConfigOptions =
 
 function restoreCodexConfigInlineImpl(kind: string, options: RestoreConfigOptions): CodexRestoreConfigResult {
   try {
-    beforeRestoreConfigForTests?.(kind);
     const disposition = resolveRestoreHistoryDisposition(options.removeProviderTable);
     if (disposition.kind === "refuse") {
       return { state: "failed", changed: false, action: "failed", message: `Codex configuration and journal preserved: ${disposition.reason}.` };
@@ -368,12 +375,20 @@ function restoreCodexConfigInlineImpl(kind: string, options: RestoreConfigOption
     // accepting that tagged conversations stop opening.
     const capturedBlock = options.removeProviderTable === true ? null : readOcxProviderTableBlock();
     const journal = restoreJournalState();
+    if (journal.ownershipRefusal) throw new CodexHomeOwnerRefusal(journal.ownershipRefusal);
     if (journal.unverified) {
       return {
         state: "failed", changed: false, action: "failed",
         message: "Codex journal recovery was not verified; current configuration files and the journal were preserved.",
       };
     }
+    if (journal.profileRestoreFailed) {
+      return {
+        state: "failed", changed: false, action: "failed",
+        message: "Codex profile could not be restored; native files and the journal binding were preserved.",
+      };
+    }
+    assertCodexHomeOwner(getCodexHome());
     const restored = journal.configRestored
       ? { success: true, message: "Codex config restored from opencodex journal.", retainedProviderTable: undefined as string[] | undefined }
       : removeCodexConfig({
@@ -403,6 +418,9 @@ function restoreCodexConfigInlineImpl(kind: string, options: RestoreConfigOption
       if (settled.kind === "stand-down" && settled.retainProviderTable && capturedBlock !== null) {
         retainedLines = retainOcxProviderTableOnDisk(capturedBlock) ?? retainedLines;
       }
+      // All native work and the final migration check succeeded. A field-level
+      // fallback retains its snapshot, but no longer owns this Codex home.
+      releaseJournalHomeBinding();
     }
     if (restored.success && retainedLines !== null) {
       return {
@@ -430,6 +448,7 @@ function restoreCodexConfigInlineImpl(kind: string, options: RestoreConfigOption
         }
       : { state: "failed", changed: false, action: "failed", message: restored.message };
   } catch (error) {
+    if (error instanceof CodexHomeOwnerRefusal) throw error;
     return { state: "failed", changed: false, action: "failed", message: error instanceof Error ? error.message : String(error) };
   }
 }
@@ -451,7 +470,8 @@ function restoreCodexCatalogArtifact(
     const restored = withCatalogWriteSerialization(owningCodexHome, permit =>
       revalidateDesiredState && shouldSyncCodexOnStart(loadConfig())
         ? null
-        : restoreCodexCatalogWithPermit(permit, owningCodexHome, journaledCatalogPath));
+        : restoreCodexCatalogWithPermit(permit, owningCodexHome, journaledCatalogPath),
+      { intent: "restore", writer: "codex-restore" });
     return restored.kind === "completed" && restored.value !== null
       ? { state: "ok", changed: restored.value.removed > 0, ...restored.value, message: "Codex catalog restored." }
       : restored.kind === "completed"
@@ -487,8 +507,10 @@ export async function restoreNativeCodexAsync(
   const sibling = siblingRestoreSkip();
   if (sibling) return sibling;
   try {
+    assertCodexHomeOwner(getCodexHome());
     return await restoreNativeCodexAsyncImpl(options);
   } catch (error) {
+    if (error instanceof CodexHomeOwnerRefusal) return homeOwnerRestoreRefusal(error);
     if (!(error instanceof CodexRestoreRefusal)) throw error;
     return failedConfigRestoreEnvelope(error.config);
   }
@@ -533,7 +555,7 @@ async function restoreNativeCodexAsyncImpl(
   // Captured before the config half: a successful journal restore DELETES the journal, and
   // restoring the config can drop `model_catalog_json`. Either one would hide the routed
   // catalog we actually wrote (#1798).
-  const journaledCatalogPath = journaledInjectedCatalogPath();
+  const journaledCatalogPath = journaledInjectedCatalogPath() ?? readCodexCatalogPath();
   let config: CodexRestoreConfigResult;
   let transitionReceipt: { nativeGeneration: number; currentTxId: string } | undefined;
 
@@ -549,6 +571,7 @@ async function restoreNativeCodexAsyncImpl(
         readAdmissionUnderLock: () => witness,
       },
       (ctx) => {
+        assertCodexHomeOwner(getCodexHome());
         if (options.revalidateDesiredState && shouldSyncCodexOnStart(loadConfig())) {
           throw new CodexWriteLockSkipped("desired_enabled");
         }
@@ -576,6 +599,7 @@ async function restoreNativeCodexAsyncImpl(
           // Throw inside N so the published remove transition rolls back too.
           if (restored.state === "failed") throw new CodexRestoreRefusal(restored);
         } catch (error) {
+          if (codexHomeOwnerBlocksCompensation(getCodexHome(), error)) throw error;
           const compensated = restoreCodexPreImages(preImages);
           if (!compensated.complete) throw new CodexPartialWriteError(compensated.unrestored);
           throw error;
@@ -619,6 +643,7 @@ async function restoreNativeCodexAsyncImpl(
   }
 
   if (config.state === "failed") return failedConfigRestoreEnvelope(config);
+  notifyCatalogPublication({ kind: "native-released", path: journaledCatalogPath });
   const catalog = restoreCodexCatalogArtifact(options.revalidateDesiredState === true, journaledCatalogPath);
   // Re-asked after the config half, because the store can paginate mid-transaction. Deciding
   // the history job from the pre-write answer alone would spawn a Worker whose own preflight
@@ -681,11 +706,27 @@ async function restoreNativeCodexAsyncImpl(
   };
 }
 
+function homeOwnerRestoreRefusal(error: CodexHomeOwnerRefusal): CodexNativeRestoreResult {
+  return { ...skippedRestoreEnvelope(false, error.message), ownershipRefusal: error.reason };
+}
+
 export function restoreNativeCodex(
   options: { skipHistory?: boolean; revalidateDesiredState?: boolean; removeProviderTable?: boolean } = {},
 ): CodexNativeRestoreResult {
   const sibling = siblingRestoreSkip();
   if (sibling) return sibling;
+  try {
+    assertCodexHomeOwner(getCodexHome());
+    return restoreNativeCodexImpl(options);
+  } catch (error) {
+    if (error instanceof CodexHomeOwnerRefusal) return homeOwnerRestoreRefusal(error);
+    throw error;
+  }
+}
+
+function restoreNativeCodexImpl(
+  options: { skipHistory?: boolean; revalidateDesiredState?: boolean; removeProviderTable?: boolean } = {},
+): CodexNativeRestoreResult {
   const activeProvider = currentExternalCodexModelProvider();
   if (activeProvider) {
     removeJournal();
@@ -700,9 +741,10 @@ export function restoreNativeCodex(
   // Captured before the config half: a successful journal restore DELETES the journal, and
   // restoring the config can drop `model_catalog_json`. Either one would hide the routed
   // catalog we actually wrote (#1798).
-  const journaledCatalogPath = journaledInjectedCatalogPath();
+  const journaledCatalogPath = journaledInjectedCatalogPath() ?? readCodexCatalogPath();
   const config = restoreCodexConfigInline("sync", options);
   if (config.state === "failed") return failedConfigRestoreEnvelope(config);
+  notifyCatalogPublication({ kind: "native-released", path: journaledCatalogPath });
   // Same mid-transaction pagination re-check as the async path.
   const historyStoodDown = historyStandsDown
     || resolveRestoreHistoryDisposition(options.removeProviderTable).kind === "stand-down";

package/src/codex/inject.ts

@@ -7,6 +7,7 @@ import {
   readConfigAdmissionSnapshot,
   withConfigMutationLockSync,
 } from "../config";
+import { assertCodexHomeOwner, codexHomeOwnerBlocksCompensation, CodexHomeOwnerRefusal, type CodexHomeOwnerRefusalReason } from "./codex-home-owner";
 import { CodexWriteLockSkipped, withCodexWriteLock } from "./codex-write-lock";
 import {
   localClientSkipMessage,
@@ -134,6 +135,7 @@ function runClientWriteGuard(guard: InjectCodexOptions["beforeClientWrite"]): vo
 
 
 export interface CodexInjectResult {
+  ownershipRefusal?: CodexHomeOwnerRefusalReason;
   success: boolean;
   message: string;
   /** False when injection intentionally preserves configuration owned by another provider. */
@@ -192,8 +194,9 @@ export async function injectCodexConfig(
   if (siblingOfLivePort() !== null) {
     return { success: true, status: "skipped", skippedReason: "sibling", message: siblingSkipMessage() };
   }
-  try { return await injectCodexConfigImpl(port, config, options); }
+  try { assertCodexHomeOwner(getCodexHome()); return await injectCodexConfigImpl(port, config, options); }
   catch (error) {
+    if (error instanceof CodexHomeOwnerRefusal) return { success: false, ownershipRefusal: error.reason, message: error.message };
     if (error instanceof CodexHistoryPreflightRefusal) return { success: false, historyPreflightFailureReason: error.message, message: `Codex config injection refused: ${error.message}. Existing configuration and history were preserved.` };
     if (error instanceof CodexInjectRefusal) return error.result;
     throw error;
@@ -415,6 +418,7 @@ async function injectCodexConfigImpl(
    * flip included — before the result is reported.
    */
   const reconcileAndDerivePlan = (): { plan: CodexInjectionPlanOk; nativeInput: string } => {
+    assertCodexHomeOwner(getCodexHome());
     if (missingConfig) createEmptyCodexConfigInBoundary();
     let nativeInput = rawContent;
     let plan = admittedPlan;
@@ -453,6 +457,7 @@ async function injectCodexConfigImpl(
     beforeHistoryArtifactCommitForTests?.(eligibility.kind);
     plan.historyRelabelRefusal = observeHistoryRefusalOrThrow(plan);
     historyArtifactStageForTests?.("after-preflight");
+    assertCodexHomeOwner(getCodexHome());
     writeJournal({
       currentStateIsNative: journalBaselineIsNative(nativeInput),
       configContent: plan.baselineContent,
@@ -463,6 +468,7 @@ async function injectCodexConfigImpl(
     if (hasUnverifiedJournalBaseline(plan.baselineContent, readCurrentProfile())) throw new Error(unverifiedJournalMessage);
     atomicWriteFile(CODEX_CONFIG_PATH, plan.content);
     historyArtifactStageForTests?.("after-config");
+    assertCodexHomeOwner(getCodexHome());
     atomicWriteFile(CODEX_PROFILE_PATH, plan.profileContent);
     markJournalInjectedState(plan.content, plan.profileContent, {
       // A root override is ours whenever we wrote one and no user-owned value won. That is
@@ -526,6 +532,7 @@ async function injectCodexConfigImpl(
         };
       }
       runClientWriteGuard(options.beforeClientWrite);
+      assertCodexHomeOwner(getCodexHome());
       /*
        * One preimage covers the reconcile and the artifact commit together: a
        * refusal after the feature transition hands back the exact bytes the
@@ -537,6 +544,7 @@ async function injectCodexConfigImpl(
         applyNativeArtifacts(resolved.plan, resolved.nativeInput);
         effectivePlan = resolved.plan;
       } catch (error) {
+        if (codexHomeOwnerBlocksCompensation(getCodexHome(), error)) throw error;
         const restored = restoreCodexPreImages(preImages);
         if (!restored.complete) throw new CodexPartialWriteError(restored.unrestored);
         throw error;
@@ -582,6 +590,7 @@ async function injectCodexConfigImpl(
         // transition or capturing preimages; rejection must not compensate over
         // a disconnect's restored files.
         runClientWriteGuard(options.beforeClientWrite);
+        assertCodexHomeOwner(getCodexHome());
         /*
          * Exact pre-images, captured under the lock and used for compensation.
          *
@@ -630,6 +639,7 @@ async function injectCodexConfigImpl(
           }
           applyNativeArtifacts(resolved.plan, resolved.nativeInput);
         } catch (error) {
+          if (codexHomeOwnerBlocksCompensation(getCodexHome(), error)) throw error;
           // Compensate, then ALWAYS throw. Returning a partial result would let the
           // lock commit a row describing an apply that did not finish.
           const restored = restoreCodexPreImages(preImages);