@lyupro/codex-bridge 0.6.10 → 0.6.12

package/CHANGELOG.md

@@ -4,6 +4,121 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.12] - 2026-10-07
+
+### Added
+
+- `codex-bridge inventory confirm [--scope user|project] [--host <path>] [--dry-run]` lets the
+  operator declare that the recorded hosts are all the hosts using this home. An old installation
+  record migrated to format 2 without a terminal stays `inventory: incomplete`: later updates do
+  not ask again, and since 0.6.11 every dispatcher model observation leaves the pin undetermined.
+  The package cannot prove that no unrecorded host uses the home; only the operator can.
+  The command shows the home, recorded host roots and Codex rules registry hints, marking missing
+  folders because the registry can retain deleted scratchpads. Enroll an unlisted host with
+  `codex-bridge install --host "<path>"` before confirming. A terminal "yes" changes only
+  `inventory` to `complete` and removes `legacy`; owners, fingerprints and every other field are
+  left as read. This permits ordinary shared-image cleanup when the last recorded host uninstalls;
+  it does not record a model match or clear a violation. No, EOF or a non-TTY exits 1 without changes;
+  Ctrl+C exits 130; a valid dry run shows the declaration without writing and exits 0. Confirmation
+  and an already-complete inventory without `legacy` exit 0. The `doctor` owner rows and the
+  incomplete-inventory pin reason now name this command.
+
+### Changed
+
+- `doctor` judges handback witness and dispatcher model state for every host whose dispatchers
+  ran in the last 24 hours. On 2026-10-07 two VS Code windows ran 2.1.291 and 2.1.292: an observation
+  on the non-newest host appeared only as history, and a model violation there would have printed
+  `ok`. Active witness violations identify their host with `host <version>:`, and each active
+  host's model entries have their own rows with that prefix. A model `fail` on any active host
+  reaches exit code 1. Older unresolved entries remain in one history sentence, without active
+  warning rows. The newest-host selector still serves contracts, `otherHost:*` and install.
+
+### Fixed
+
+- Dispatcher model rows no longer print a doubled period after a pin reason: the live `doctor`
+  output had added its own period to a reason that already ended with one.
+
+## [0.6.11] - 2026-10-07
+
+### Changed
+
+- **Breaking for orchestrator prompts:** the order gate refuses an explicit `model` on a dispatcher
+  call, even one matching the installed pin or `inherit`. Migration cost: drop `model` from dispatcher
+  calls in orchestrator prompts; the installed agent definition owns that setting. It also refuses a
+  foreign-family `CLAUDE_CODE_SUBAGENT_MODEL` on hosts where the environment overrides the pin
+  (before 2.1.251, or with `CLAUDE_CODE_SUBAGENT_MODEL_FORCE=1` from 2.1.257). Unknown host versions or
+  unparseable families are left to the stop observation. These checks precede prompt and grant exits,
+  so a continuation cannot bypass them.
+
+- **Breaking for orchestrator prompts:** a dispatcher call is exactly one line, `task file: <absolute
+  path>`. The order — `order id`, `scope`, `scope new`, `phase`, `continue`/`retry`, `slug`, `effort`,
+  `changeset`, `repository` — goes in the header at the top of that file, and the dispatcher runs
+  `codex-bridge run --agent <type> --task-file "<path>"`. Any former label in the call is refused for
+  free with "moved to the task-file header" and the agent's header template. Migration cost: move the
+  label lines from the call into the task file's first lines. A task-file path containing `$`, `\\` or a
+  final `\` is refused, because the shell would rewrite it inside the command's double quotes and the
+  runner would open a different file than the one the gate checked; write it with forward slashes.
+
+- The four dispatcher prompts share one protocol section rendered at install from the same command
+  assembler the order gate uses: the call is `task file:` only and the command is
+  `codex-bridge run --agent <type> --task-file "<path>"`. The hand-written label-to-flag tables and the
+  instruction to add a continuation flag are gone; the header labels are listed in each agent's
+  description. Migration cost: none beyond `codex-bridge update`, which reinstalls the prompts. A
+  first call that prints no `RUN=` line (a refusal or `UNAVAILABLE`) is itself the dispatcher's answer.
+
+- A dispatcher call contains only exact `label: value` lines from the agent's input registry, in any
+  order, with blank lines allowed. Prose, unknown or another agent's labels, decorated or hyphenated
+  spellings, `--flag value` lines, duplicates, empty values, missing required labels, placeholders,
+  relative task-file paths and shell-unsafe values are refused for free before the dispatcher starts.
+  The refusal names the line, the exact spelling and every label of the agent, and says "Free text
+  belongs in the task file." Of 405 measured past calls, 47 began with prose, 112 carried lines outside
+  the registry, 18 passed values as `--order-id x`, and 1 duplicated a label.
+  Migration cost: a call written in an older form gets one free refusal naming the fix.
+
+### Added
+
+- The reply guard observes `message.model` in the dispatcher's assistant transcript entries at
+  `SubagentStop`, before its handback exits, and compares model families against the installed
+  contract agreed by every recorded owner. On 2026-09-25 a hook's `(inherit)` label was mistaken for
+  the model used, and the VS Code panel showed the parent model while transcripts showed the pinned
+  family; neither display is model evidence. A mismatch raises an alarm in the same turn and enters
+  `state/dispatcher-model.json`.
+  The order gate warns on every later call of that dispatcher type until a later match on any host;
+  uncertainty does not clear the warning. It warns rather than refusing work for a leak whose cause
+  may be another hook or the host.
+- `doctor` reports `dispatcherModel:<type>` rows for the current observed session host: the latest
+  violation is `fail` with exit 1, an undetermined observation is `warn`, and a match is `ok`, including
+  recovery after a violation. No observations is `ok`; recovered incidents and other hosts remain
+  history, without a permanent warning. An incomplete, unreadable or disagreeing installed contract
+  makes the comparison undetermined, rather than guessing which agent definition the host selected.
+
+### Fixed
+
+- The handback witness keeps per-cause observations and violation history without a permanent
+  warning. Only later evidence disproving that cause clears it, and only the current observed session
+  host contributes active warnings. Intercepted handbacks, including refused attempts, are not proof
+  of recovery. Existing witness files migrate on their next write: old untyped alarms become
+  `legacy-untyped-unverified` history, not confirmed violations; `doctor` reads them without rewriting
+  the file. This fixes the 2026-09-27 case where clean handbacks on a newer host still left an old alarm
+  as the only visible signal.
+- A subagent stop without `agent_type` alarms only with dispatcher evidence bound to that stop:
+  healthy, active dispatcher-gate state or an assistant Bash call running the standalone runner command
+  for a registered role. The 13 older alarms across nine host versions lacked that evidence. Without
+  it, a stop is undetermined, neither an accusation nor recovery, and a command's `--agent` does not
+  invent the missing host type.
+
+- The reply guard identifies a dispatcher's run by a receipt — the run folder the runner itself
+  printed to that dispatcher, recorded once by the dispatcher gate — instead of the order id in the
+  call or the newest run on disk. A reply naming another folder, a reply with a verdict but no
+  receipt, and two different folders reported to one dispatcher are blocked; the last one also turns
+  the handback into a `FAIL`.
+- `changeset:` reaches the runner, so `base:<branch>` and `commit:<sha>` review the requested changes
+  instead of silently reviewing uncommitted work.
+- `scope-new:` is refused with the exact `scope new:` spelling; it can no longer be dropped or read as
+  `scope`.
+- A `Repository root:` line is refused before the haiku dispatcher starts. It used to make the
+  dispatcher prepend `cd … &&` and leave without delegating.
+
 ## [0.6.10] - 2026-10-04
 
 ### Added

package/README.md

@@ -62,7 +62,7 @@ If a global install and a clone coexist, you have two package copies. `codex-bri
 - **Every run leaves an audit folder.** The verbatim task, scope, before/after git state, events, report, verdict, and reason remain together.
 - **Zero runtime dependencies and zero build steps.** The package is plain `.mjs` on the Node.js standard library.
 
-The current suite contains **2848 automated tests: 2847 passing and 1 skipped**.
+The current suite contains **3267 automated tests: 3266 passing and 1 skipped**.
 
 ## Verify
 
@@ -93,12 +93,23 @@ Output on a healthy host (trimmed):
 
 `doctor` reports the selected host, package source, installed files and guards, Codex availability, retention policy, permissions, live runs, and the current repository's run folder. It judges contracts against the newest host version observed in a session transcript, not `claude` on `PATH`: on 2026-09-25 the VS Code extension ran sessions on 2.1.282 while `PATH` resolved to 2.1.281, and the extension's `CLAUDE_CODE_EXECPATH` and `CLAUDE_AGENT_SDK_VERSION` were inherited by every descendant `claude`. The transcript entry's `version` identifies the host. The dispatcher gate records it once per session in `state/host-observations.json` (sessions kept 7 days, hosts 30); `doctor` and `install` judge the newest observed host. `doctor` prints `sessionHost` and one `otherHost:<version>` line for each other observed version, with `ok`, `warn` and a probe command, or `fail` with exit 1. If no session has been observed, they say so instead of using `PATH`. Refusal and dispatcher contract records keep one verdict per host version, so a measurement of version V applies to every host of version V; older single-version records count only for their recorded version.
 
-`doctor` also reports `handbackWitness` and the four dispatcher contract lines (`dispatcherContract:agentIdentity`, `dispatcherContract:shellStdout`, `dispatcherContract:shellFailure`, and `dispatcherContract:agentTranscript`): verified contracts are `ok`, unknown, unprobed, or stale contracts are `warn`, and a measured change is `fail` with exit 1. Handback sightings and alarms carry the transcript version, and sightings match only that exact version; an older SDK-based record counts as no sighting while preserving its alarms. If a subagent stop has an `agent_id` but no `agent_type`, the reply guard records an alarm and tells the session that the dispatcher gate cannot recognise dispatchers. The `agents` line is a read, not a file count: each installed definition is parsed and its `name` checked against the dispatcher it claims to be, because a definition the host cannot read is a dispatcher that does not exist while every other line still says `[ok]`. Content that drifts from the packaged definition is a failure, not a warning: `doctor` exits 1 and names `codex-bridge update --force`, because a host running someone else's agent files may be calling the runner in a form no permission rule matches.
+`doctor` also reports `handbackWitness`, `dispatcherModel:<type>` rows, and the four dispatcher contract lines (`dispatcherContract:agentIdentity`, `dispatcherContract:shellStdout`, `dispatcherContract:shellFailure`, and `dispatcherContract:agentTranscript`): verified contracts are `ok`, unknown, unprobed, or stale contracts are `warn`, and a measured change is `fail` with exit 1. Witness and model checks cover every host whose dispatchers ran in the last 24 hours; two VS Code windows on 2.1.291 and 2.1.292 on 2026-10-07 showed why the newest host alone could hide an active host's violation in history. The witness warns for unresolved causes on any active host; later disproving evidence clears the warning while retaining history. Intercepted handbacks are not recovery evidence, and old untyped alarms without dispatcher evidence remain unverified history. A stop missing `agent_type` alarms only with dispatcher evidence for that stop. Each active host's model entries have their own rows prefixed `host <version>:`, comparing transcript-observed families with the installed contract: a latest violation on any active host is `fail` with exit 1, uncertainty is `warn`, and a match, including recovery, is `ok`; no model entries for active hosts is also `ok`. Hosts outside the 24-hour window and recovered incidents remain history, not permanent warnings. Contracts, `otherHost:*` and install still use the newest observed host selector. See [Response guard](docs/overview.md#response-guard) for the evidence rules. The `agents` line is a read, not a file count: each installed definition is parsed and its `name` checked against the dispatcher it claims to be, because a definition the host cannot read is a dispatcher that does not exist while every other line still says `[ok]`. Content that drifts from the packaged definition is a failure, not a warning: `doctor` exits 1 and names `codex-bridge update --force`, because a host running someone else's agent files may be calling the runner in a form no permission rule matches.
 
 If a session answers `Agent type 'codex-build' not found`, a run can still be started without the dispatcher — the agent is a wrapper that types one command:
 
+The task file starts with the order header, a blank line, and the task text:
+
+```text
+order id: order-42
+repository: /abs/path/to/repository
+scope: src/auth/**,tests/auth/**
+advice: mechanical
+
+Implement the authentication change and verify it with the tests named in the task.
+```
+
 ```bash
-codex-bridge run --agent codex-build --repo <repository> --order-id <id> --scope <globs> --task-file <absolute path>
+codex-bridge run --agent codex-build --task-file "/abs/path/to/task.md"
 ```
 
 The trade-off is explicit: `order-gate` and `reply-guard` sit on the dispatcher call, so a direct run is unguarded and its result is judged by the worktree and the suite.
@@ -130,8 +141,9 @@ Transport files from runs at least **30 days** old are pruned automatically when
 | `update [--scope user\|project] [--host <path>] [--dry-run] [--force]` | Refresh a recorded installation. |
 | `permissions [add\|remove] [--scope user\|project] [--host <path>]` | Inspect or manage optional shell rules. |
 | `uninstall [--scope user\|project] [--host <path>] [--dry-run] [--purge]` | Remove recorded package files while preserving run artifacts; `--purge` also deletes your data and the home after one preflight and two consents (see [Uninstall and purge](docs/overview.md#uninstall-and-purge)). |
+| `inventory confirm [--scope user\|project] [--host <path>] [--dry-run]` | Confirm in a terminal that the recorded hosts are all the hosts using this home; until then the dispatcher model pin stays undetermined and `doctor` names this command. Changes only the inventory mark of the installation record. |
 | `doctor [--scope user\|project] [--host <path>] [--probe-contract] [--probe-executable <path>]` | Diagnose the selected host and Codex connection, including the handback witness and four dispatcher contract lines. `--probe-contract` targets the newest observed host, accepting `CLAUDE_CODE_EXECPATH` or `claude` on `PATH` only when each reports that version with `--version`; use `--probe-executable <path>` to name an executable (`--host` selects the Claude Code configuration). The probe prints its target and records nothing if the completed host run reports another transcript version. |
-| `run <runner options> --task-file <abs path>` | Start or attach to a delegated run through the permission-stable package command. The task file carries the statement, the scout questions and the verification command; its path must be absolute. Piping the statement on stdin is the alternative channel, and the two cannot be combined. |
+| `run --agent <type> --task-file "<abs path>" [--no-wait]` | Start or attach to a delegated run through the permission-stable package command. The task-file header carries the whole order; its body carries the statement, scout questions and verification command. Its path must be absolute and use forward slashes; `$`, doubled backslashes and a final backslash are refused. Every other runner flag is a free refusal; stdin is not an input channel. |
 | `model [list\|set\|unset\|speed]` | Show the model, effort, pinned speed tier and provenance of each role, with the config path; `model list` prints the live catalogue from Codex, hidden models included and marked; `model set <role> <model> [effort]` checks the pair and any retained speed tier against that model's catalogue entry, and `model unset <role>` removes the profile. `model speed <role> <tier>` previews a live accelerated tier and its quoted cost description; repeat with trailing `confirm` to pin it. `model speed <role> unset` removes only speed, without confirmation. The profile is machine-wide, shared by every project on this machine. |
 | `projects [<name>] [--json]` | List projects or runs in the run store. |
 | `prune <project> [<run>] [--purge] [--older-than <age>] [-f] [--json]`<br>`prune --all-projects [--older-than <age>] [-f] [--json]` | Plan or perform operator-confirmed cleanup, for one project or across the whole run store. |

package/cli/active-hosts.mjs

@@ -0,0 +1,44 @@
+/** Names the hosts whose dispatchers ran in the last 24 hours, the hosts whose witness and model state is active;
+ * Plan_67 D12: concurrent VS Code hosts 2.1.291 and 2.1.292 on 2026-10-07 must both be judged, regardless of session liveness.
+ */
+export const ACTIVE_HOST_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+export function activeHostVersions({ observations, witnessRecord, modelRecord, now = new Date() }) {
+  const currentTime = new Date(now).getTime();
+  const activity = new Map();
+  function recordActivity(version, at) {
+    if (typeof version !== 'string' || !version || version === 'unknown') return;
+    if (typeof at !== 'string'
+      || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(at)) return;
+    const time = Date.parse(at);
+    const date = Date.parse(`${at.slice(0, 10)}T00:00:00Z`);
+    if (!Number.isFinite(time) || !Number.isFinite(date)
+      || new Date(date).toISOString().slice(0, 10) !== at.slice(0, 10)) return;
+    // Plan_67 R2: future evidence must not hide a valid past source for the same host.
+    if (time > currentTime) return;
+    if (!activity.has(version) || time > activity.get(version)) activity.set(version, time);
+  }
+  function ledgerActivity(ledger) {
+    if (!ledger || ledger.corrupt) return;
+    for (const entry of Object.values(ledger.entries || {})) {
+      if (!entry || entry.corrupt || entry.lastObservation?.corrupt) continue;
+      const observation = entry.lastObservation;
+      recordActivity(observation?.data?.hostVersion, observation?.at);
+    }
+  }
+  if (observations && !observations.corrupt) {
+    for (const [version, host] of Object.entries(observations.hosts || {})) {
+      if (host && !host.corrupt) recordActivity(version, host.lastSeen);
+    }
+    for (const session of Object.values(observations.sessions || {})) {
+      if (session && !session.corrupt) recordActivity(session.version, session.at);
+    }
+  }
+  if (witnessRecord && !witnessRecord.corrupt) {
+    for (const [version, at] of Object.entries(witnessRecord.intercepted || {})) recordActivity(version, at);
+    ledgerActivity(witnessRecord.ledger);
+  }
+  ledgerActivity(modelRecord);
+  return [...activity].filter(([, at]) => currentTime - at >= 0 && currentTime - at <= ACTIVE_HOST_WINDOW_MS)
+    .sort((a, b) => b[1] - a[1]).map(([version]) => version);
+}

package/cli/command-registry.mjs

@@ -9,7 +9,8 @@ import { resolveProbeTarget } from './probe-target.mjs';
 import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import { hook } from './hook.mjs';
 import { resolveHost } from './hosts.mjs';
-import { install } from './install.mjs';
+import { install } from './install.mjs';
+import { inventoryConfirm } from './inventory-confirm.mjs';
 import { model } from './model.mjs';
 import { projects } from './projects.mjs';
 import { read } from './read.mjs';
@@ -25,7 +26,8 @@ import { update } from './update.mjs';
 export function commandOptions(command, argv) {
   const options = {};
   const booleanFlags = command === 'install' || command === 'update' ? new Set(['--dry-run', '--force'])
-    : command === 'uninstall' ? new Set(['--dry-run', '--purge'])
+    : command === 'uninstall' ? new Set(['--dry-run', '--purge'])
+      : command === 'inventory' ? new Set(['--dry-run'])
       : command === 'doctor' ? new Set(['--probe-contract']) : new Set();
   const flagNames = new Map([
     ['--dry-run', 'dryRun'],
@@ -123,6 +125,20 @@ export const COMMANDS = [
     },
   },
   {
+    name: 'inventory',
+    summary: 'Confirm that the recorded hosts are all the hosts using this home',
+    usage: ['codex-bridge inventory confirm [--scope user|project] [--host <path>] [--dry-run]'],
+    section: 'public',
+    async handler(argv, io) {
+      if (argv[0] !== 'confirm') throw new Error(`unknown inventory action "${argv[0] ?? ''}"`);
+      const options = commandOptions('inventory', argv.slice(1));
+      const host = resolveHost(options);
+      const result = await inventoryConfirm({ host, dryRun: options.dryRun });
+      io.log(result.output);
+      return result.exitCode;
+    },
+  },
+  {
     name: 'doctor',
     summary: 'Diagnose the selected Claude Code host (--probe-contract measures on a live host)',
     usage: ['codex-bridge doctor [--scope user|project] [--host <path>] [--probe-contract] [--probe-executable <path>]'],

package/cli/dispatcher-model-check.mjs

@@ -0,0 +1,61 @@
+/** turns the dispatcher-model ledger into doctor rows; Plan_67 D4/D8/D12 judge every recently active host. */
+import path from 'node:path';
+import { DISPATCHER_MODEL_FILE } from '../src/home/lib/dispatcher-model.mjs';
+import { entryState } from '../src/home/lib/observation-ledger.mjs';
+import { check } from './doctor-format.mjs';
+
+function observationSummary({ data, at }) {
+  return `${data.agentType}: observed families ${data.parsed.join(', ')}, pinned family ${data.pinFamily} at ${at}`;
+}
+
+function entryCheck(entry) {
+  const observation = entry.lastObservation;
+  const { data, verdict, at } = observation;
+  const key = `dispatcherModel:${data.agentType}`;
+  const prefix = `host ${data.hostVersion}: `;
+  const state = entryState(entry);
+  // D4: only the latest confirmed violation fails; D8 keeps uncertainty from erasing history.
+  if (verdict === 'violation') {
+    return check(key, 'fail', `${prefix}${observationSummary(observation)}; Claude quota was spent on this dispatcher; see Plan_67.`);
+  }
+  if (verdict === 'undetermined') {
+    const reason = data.pinReasons?.length
+      // Reasons are sentences ending in a period; the row adds its own (live doctor printed "record..").
+      ? data.pinReasons.map((text) => text.replace(/\.$/, '')).join('; ') : 'no model family could be read from the transcript';
+    const unresolved = state === 'violation'
+      ? `; earlier violation (${observationSummary(entry.lastViolation)}) is not yet disproved` : '';
+    return check(key, 'warn', `${prefix}${data.agentType}: model observation undetermined at ${at}: ${reason}${unresolved}.`);
+  }
+  const history = state === 'recovered'
+    ? `; recovered from earlier violation (${observationSummary(entry.lastViolation)})` : '';
+  return check(key, 'ok', `${prefix}${observationSummary(observation)}; matches the installed contract${history}.`);
+}
+
+export function dispatcherModelChecks({ record, activeHosts, stateDir }) {
+  if (record?.corrupt) {
+    return [check('dispatcherModel', 'warn',
+      `The dispatcher model record is unreadable; delete ${path.join(stateDir, DISPATCHER_MODEL_FILE)} to reset it.`)];
+  }
+  const entries = Object.values(record?.entries || {});
+  const current = entries.filter((entry) => activeHosts.includes(entry.lastObservation.data.hostVersion));
+  const rows = current.map(entryCheck);
+  if (!rows.length) {
+    rows.push(check('dispatcherModel', 'ok', 'Not observed in the last 24 hours — recorded when a dispatcher stops.'));
+  }
+  const hosts = new Map();
+  for (const entry of entries) {
+    const version = entry.lastObservation.data.hostVersion;
+    if (activeHosts.includes(version)) continue;
+    const counts = hosts.get(version) || { entries: 0, violations: 0 };
+    counts.entries += 1;
+    if (entryState(entry) === 'violation') counts.violations += 1;
+    hosts.set(version, counts);
+  }
+  // D12: inactive hosts are one history sentence, never additional active warning rows.
+  if (hosts.size) {
+    const history = [...hosts].map(([version, counts]) =>
+      `${version ?? 'unknown host'}: ${counts.entries} entries, ${counts.violations} unresolved violations`);
+    rows[0].value += ` History on hosts without dispatcher activity in the last 24 hours (historical, not current): ${history.join('; ')}.`;
+  }
+  return rows;
+}

package/cli/doctor-host-side.mjs

@@ -1,110 +1,117 @@
-/**
- * Reports host marks separately from home ownership (Plan_65 D10 item 6): WHAT lies in a host
- * comes from its marks, while WHO uses the home comes only from its owner rows. A single
- * "installation: not installed" line hid a host that plainly carried our agents and hooks, and it
- * never said which hosts the home record names or whether its inventory is complete.
- * Owners in sync keeps lagging hosts visible because install/update named them only once (Plan_65 D11 item 3).
- */
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
-import { check } from './doctor-format.mjs';
-import { hasPackageMarks } from './host-inspection.mjs';
-import { imageFingerprint, isFormat2 } from './install-owners.mjs';
-
-// Format 1 is not migrated here: asFormat2 would record this host as the owner, and doctor only reads.
-export function ownerEntry(rawRecord, host) {
-  if (rawRecord === null || !isFormat2(rawRecord)) return null;
-  return rawRecord.owners[normalizeRepoPath(host.root)] ?? null;
-}
-
-export function hostSideCheck(host, inspection) {
-  if (inspection.settingsError) {
-    return check('host files', 'fail', `settings could not be read: ${inspection.settingsError}`);
-  }
-  if (!hasPackageMarks(inspection)) {
-    return check('host files', 'warn', `no codex-bridge files or hooks in ${host.root}`);
-  }
-
-  const kept = inspection.files.filter((file) => file.disposition === 'keep'
-    && ['changed', 'unknown'].includes(file.reason));
-  const counts = `${inspection.files.length} package file(s) and ${inspection.hooks.length} own hook(s) in ${host.root}`;
-  const keptText = kept.map((file) => `${file.relativeToHost} (${file.reason})`).join(', ');
-  return kept.length
-    ? check('host files', 'warn', `${counts}; kept by uninstall: ${keptText}`)
-    : check('host files', 'ok', counts);
-}
-
-async function homeImageExists(host) {
-  try {
-    await fs.access(path.join(host.brandRoot, 'lib'));
-    return true;
-  } catch (error) {
-    if (error.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-export async function homeOwnersCheck(host, rawRecord, inspection) {
-  if (rawRecord === null) {
-    return await homeImageExists(host)
-      ? check('home owners', 'warn', `no installation record in ${host.brandRoot}; the image has no record`)
-      : check('home owners', 'ok', `no installation record in ${host.brandRoot}`);
-  }
-  if (!isFormat2(rawRecord)) {
-    return check(
-      'home owners',
-      'warn',
-      'old record format; the hosts using this home are unknown until the next install or update',
-    );
-  }
-
-  const roots = Object.values(rawRecord.owners).map((owner) => owner.root);
-  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
-  const hostRecorded = Object.hasOwn(rawRecord.owners, normalizeRepoPath(host.root));
-  const unrecordedMarks = hasPackageMarks(inspection) && !hostRecorded;
-  const parts = [
-    `recorded: ${roots.length ? roots.join(', ') : 'none'}`,
-    inventoryComplete ? 'inventory complete' : 'inventory incomplete: an old record did not name every host',
-    ...(unrecordedMarks
-      ? [`${host.root} has package files or hooks but is not recorded: run codex-bridge install --host "${host.root}"`]
-      : []),
-  ];
-  return check('home owners', inventoryComplete && !unrecordedMarks ? 'ok' : 'warn', parts.join('; '));
-}
-
-export function ownersInSyncCheck(rawRecord) {
-  if (rawRecord === null || !isFormat2(rawRecord)) {
-    return check('owners in sync', 'ok', 'no format-2 record; nothing to compare');
-  }
-
-  const owners = Object.values(rawRecord.owners);
-  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
-  if (!owners.length) {
-    return check('owners in sync', 'warn',
-      `no recorded owners${inventoryComplete ? '' : '; inventory incomplete'}`);
-  }
-
-  const fingerprint = imageFingerprint(rawRecord.image);
-  const parts = [];
-  const unstamped = [];
-  for (const owner of owners) {
-    if (owner.imageFingerprint != null) {
-      if (owner.imageFingerprint === fingerprint) continue;
-    } else if (owner.version === rawRecord.image.version) {
-      unstamped.push(owner.root);
-      continue;
-    }
-    // The same version on both sides is the clone case the stamp exists for; say so instead of "0.6.9, image 0.6.9".
-    const why = owner.version === rawRecord.image.version
-      ? `verified against an earlier image of ${owner.version}`
-      : `recorded ${owner.version}, image ${rawRecord.image.version}`;
-    parts.push(`${owner.root} (${why}): run codex-bridge update --host "${owner.root}"`);
-  }
-  if (unstamped.length) parts.push(`not yet verified by image fingerprint: ${unstamped.join(', ')}`);
-  if (!inventoryComplete) parts.push('inventory incomplete');
-  const warning = parts.length > 0;
-  if (!warning) parts.push(`all ${owners.length} owner(s) verified against the current image`);
-  return check('owners in sync', warning ? 'warn' : 'ok',
-    `${parts.join('; ')} (recorded verification; host files and reachability not inspected)`);
-}
+/**
+ * Reports host marks separately from home ownership (Plan_65 D10 item 6): WHAT lies in a host
+ * comes from its marks, while WHO uses the home comes only from its owner rows. A single
+ * "installation: not installed" line hid a host that plainly carried our agents and hooks, and it
+ * never said which hosts the home record names or whether its inventory is complete.
+ * Owners in sync keeps lagging hosts visible because install/update named them only once (Plan_65 D11 item 3).
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
+import { check } from './doctor-format.mjs';
+import { hasPackageMarks } from './host-inspection.mjs';
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
+import { imageFingerprint } from './install-owners.mjs';
+import { INVENTORY_CONFIRM_COMMAND } from './inventory-confirm.mjs';
+
+const inventoryRepair = `; run ${INVENTORY_CONFIRM_COMMAND} if the recorded hosts are all of them`;
+
+const ownerRepair = '; install into each host first: run codex-bridge install --host "<path>"';
+
+// Format 1 is not migrated here: asFormat2 would record this host as the owner, and doctor only reads.
+export function ownerEntry(rawRecord, host) {
+  if (rawRecord === null || !isFormat2(rawRecord)) return null;
+  return rawRecord.owners[normalizeRepoPath(host.root)] ?? null;
+}
+
+export function hostSideCheck(host, inspection) {
+  if (inspection.settingsError) {
+    return check('host files', 'fail', `settings could not be read: ${inspection.settingsError}`);
+  }
+  if (!hasPackageMarks(inspection)) {
+    return check('host files', 'warn', `no codex-bridge files or hooks in ${host.root}`);
+  }
+
+  const kept = inspection.files.filter((file) => file.disposition === 'keep'
+    && ['changed', 'unknown'].includes(file.reason));
+  const counts = `${inspection.files.length} package file(s) and ${inspection.hooks.length} own hook(s) in ${host.root}`;
+  const keptText = kept.map((file) => `${file.relativeToHost} (${file.reason})`).join(', ');
+  return kept.length
+    ? check('host files', 'warn', `${counts}; kept by uninstall: ${keptText}`)
+    : check('host files', 'ok', counts);
+}
+
+async function homeImageExists(host) {
+  try {
+    await fs.access(path.join(host.brandRoot, 'lib'));
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+export async function homeOwnersCheck(host, rawRecord, inspection) {
+  if (rawRecord === null) {
+    return await homeImageExists(host)
+      ? check('home owners', 'warn', `no installation record in ${host.brandRoot}; the image has no record`)
+      : check('home owners', 'ok', `no installation record in ${host.brandRoot}`);
+  }
+  if (!isFormat2(rawRecord)) {
+    return check(
+      'home owners',
+      'warn',
+      'old record format; the hosts using this home are unknown until the next install or update',
+    );
+  }
+
+  const roots = Object.values(rawRecord.owners).map((owner) => owner.root);
+  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
+  const hostRecorded = Object.hasOwn(rawRecord.owners, normalizeRepoPath(host.root));
+  const unrecordedMarks = hasPackageMarks(inspection) && !hostRecorded;
+  const parts = [
+    `recorded: ${roots.length ? roots.join(', ') : 'none'}`,
+    inventoryComplete ? 'inventory complete'
+      : `inventory incomplete: an old record did not name every host${roots.length ? inventoryRepair : ownerRepair}`,
+    ...(unrecordedMarks
+      ? [`${host.root} has package files or hooks but is not recorded: run codex-bridge install --host "${host.root}"`]
+      : []),
+  ];
+  return check('home owners', inventoryComplete && !unrecordedMarks ? 'ok' : 'warn', parts.join('; '));
+}
+
+export function ownersInSyncCheck(rawRecord) {
+  if (rawRecord === null || !isFormat2(rawRecord)) {
+    return check('owners in sync', 'ok', 'no format-2 record; nothing to compare');
+  }
+
+  const owners = Object.values(rawRecord.owners);
+  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
+  if (!owners.length) {
+    return check('owners in sync', 'warn',
+      `no recorded owners${inventoryComplete ? '' : `; inventory incomplete${ownerRepair}`}`);
+  }
+
+  const fingerprint = imageFingerprint(rawRecord.image);
+  const parts = [];
+  const unstamped = [];
+  for (const owner of owners) {
+    if (owner.imageFingerprint != null) {
+      if (owner.imageFingerprint === fingerprint) continue;
+    } else if (owner.version === rawRecord.image.version) {
+      unstamped.push(owner.root);
+      continue;
+    }
+    // The same version on both sides is the clone case the stamp exists for; say so instead of "0.6.9, image 0.6.9".
+    const why = owner.version === rawRecord.image.version
+      ? `verified against an earlier image of ${owner.version}`
+      : `recorded ${owner.version}, image ${rawRecord.image.version}`;
+    parts.push(`${owner.root} (${why}): run codex-bridge update --host "${owner.root}"`);
+  }
+  if (unstamped.length) parts.push(`not yet verified by image fingerprint: ${unstamped.join(', ')}`);
+  if (!inventoryComplete) parts.push(`inventory incomplete${inventoryRepair}`);
+  const warning = parts.length > 0;
+  if (!warning) parts.push(`all ${owners.length} owner(s) verified against the current image`);
+  return check('owners in sync', warning ? 'warn' : 'ok',
+    `${parts.join('; ')} (recorded verification; host files and reachability not inspected)`);
+}