@lyupro/codex-bridge 0.6.11 → 0.6.12

package/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.12] - 2026-10-07
+
+### Added
+
+- `codex-bridge inventory confirm [--scope user|project] [--host <path>] [--dry-run]` lets the
+  operator declare that the recorded hosts are all the hosts using this home. An old installation
+  record migrated to format 2 without a terminal stays `inventory: incomplete`: later updates do
+  not ask again, and since 0.6.11 every dispatcher model observation leaves the pin undetermined.
+  The package cannot prove that no unrecorded host uses the home; only the operator can.
+  The command shows the home, recorded host roots and Codex rules registry hints, marking missing
+  folders because the registry can retain deleted scratchpads. Enroll an unlisted host with
+  `codex-bridge install --host "<path>"` before confirming. A terminal "yes" changes only
+  `inventory` to `complete` and removes `legacy`; owners, fingerprints and every other field are
+  left as read. This permits ordinary shared-image cleanup when the last recorded host uninstalls;
+  it does not record a model match or clear a violation. No, EOF or a non-TTY exits 1 without changes;
+  Ctrl+C exits 130; a valid dry run shows the declaration without writing and exits 0. Confirmation
+  and an already-complete inventory without `legacy` exit 0. The `doctor` owner rows and the
+  incomplete-inventory pin reason now name this command.
+
+### Changed
+
+- `doctor` judges handback witness and dispatcher model state for every host whose dispatchers
+  ran in the last 24 hours. On 2026-10-07 two VS Code windows ran 2.1.291 and 2.1.292: an observation
+  on the non-newest host appeared only as history, and a model violation there would have printed
+  `ok`. Active witness violations identify their host with `host <version>:`, and each active
+  host's model entries have their own rows with that prefix. A model `fail` on any active host
+  reaches exit code 1. Older unresolved entries remain in one history sentence, without active
+  warning rows. The newest-host selector still serves contracts, `otherHost:*` and install.
+
+### Fixed
+
+- Dispatcher model rows no longer print a doubled period after a pin reason: the live `doctor`
+  output had added its own period to a reason that already ended with one.
+
 ## [0.6.11] - 2026-10-07
 
 ### Changed

package/README.md

@@ -62,7 +62,7 @@ If a global install and a clone coexist, you have two package copies. `codex-bri
 - **Every run leaves an audit folder.** The verbatim task, scope, before/after git state, events, report, verdict, and reason remain together.
 - **Zero runtime dependencies and zero build steps.** The package is plain `.mjs` on the Node.js standard library.
 
-The current suite contains **3199 automated tests: 3198 passing and 1 skipped**.
+The current suite contains **3267 automated tests: 3266 passing and 1 skipped**.
 
 ## Verify
 
@@ -93,7 +93,7 @@ Output on a healthy host (trimmed):
 
 `doctor` reports the selected host, package source, installed files and guards, Codex availability, retention policy, permissions, live runs, and the current repository's run folder. It judges contracts against the newest host version observed in a session transcript, not `claude` on `PATH`: on 2026-09-25 the VS Code extension ran sessions on 2.1.282 while `PATH` resolved to 2.1.281, and the extension's `CLAUDE_CODE_EXECPATH` and `CLAUDE_AGENT_SDK_VERSION` were inherited by every descendant `claude`. The transcript entry's `version` identifies the host. The dispatcher gate records it once per session in `state/host-observations.json` (sessions kept 7 days, hosts 30); `doctor` and `install` judge the newest observed host. `doctor` prints `sessionHost` and one `otherHost:<version>` line for each other observed version, with `ok`, `warn` and a probe command, or `fail` with exit 1. If no session has been observed, they say so instead of using `PATH`. Refusal and dispatcher contract records keep one verdict per host version, so a measurement of version V applies to every host of version V; older single-version records count only for their recorded version.
 
-`doctor` also reports `handbackWitness`, `dispatcherModel:<type>` rows, and the four dispatcher contract lines (`dispatcherContract:agentIdentity`, `dispatcherContract:shellStdout`, `dispatcherContract:shellFailure`, and `dispatcherContract:agentTranscript`): verified contracts are `ok`, unknown, unprobed, or stale contracts are `warn`, and a measured change is `fail` with exit 1. The witness warns only for unresolved causes on the current observed session host; later disproving evidence clears the warning while retaining history. Intercepted handbacks are not recovery evidence, and old untyped alarms without dispatcher evidence remain unverified history. A stop missing `agent_type` alarms only with dispatcher evidence for that stop. Dispatcher model rows compare transcript-observed families with the installed contract: a latest violation is `fail` with exit 1, uncertainty is `warn`, and a match, including recovery, is `ok`; no observations is also `ok`. Other hosts and recovered incidents are history, not permanent warnings. See [Response guard](docs/overview.md#response-guard) for the evidence rules. The `agents` line is a read, not a file count: each installed definition is parsed and its `name` checked against the dispatcher it claims to be, because a definition the host cannot read is a dispatcher that does not exist while every other line still says `[ok]`. Content that drifts from the packaged definition is a failure, not a warning: `doctor` exits 1 and names `codex-bridge update --force`, because a host running someone else's agent files may be calling the runner in a form no permission rule matches.
+`doctor` also reports `handbackWitness`, `dispatcherModel:<type>` rows, and the four dispatcher contract lines (`dispatcherContract:agentIdentity`, `dispatcherContract:shellStdout`, `dispatcherContract:shellFailure`, and `dispatcherContract:agentTranscript`): verified contracts are `ok`, unknown, unprobed, or stale contracts are `warn`, and a measured change is `fail` with exit 1. Witness and model checks cover every host whose dispatchers ran in the last 24 hours; two VS Code windows on 2.1.291 and 2.1.292 on 2026-10-07 showed why the newest host alone could hide an active host's violation in history. The witness warns for unresolved causes on any active host; later disproving evidence clears the warning while retaining history. Intercepted handbacks are not recovery evidence, and old untyped alarms without dispatcher evidence remain unverified history. A stop missing `agent_type` alarms only with dispatcher evidence for that stop. Each active host's model entries have their own rows prefixed `host <version>:`, comparing transcript-observed families with the installed contract: a latest violation on any active host is `fail` with exit 1, uncertainty is `warn`, and a match, including recovery, is `ok`; no model entries for active hosts is also `ok`. Hosts outside the 24-hour window and recovered incidents remain history, not permanent warnings. Contracts, `otherHost:*` and install still use the newest observed host selector. See [Response guard](docs/overview.md#response-guard) for the evidence rules. The `agents` line is a read, not a file count: each installed definition is parsed and its `name` checked against the dispatcher it claims to be, because a definition the host cannot read is a dispatcher that does not exist while every other line still says `[ok]`. Content that drifts from the packaged definition is a failure, not a warning: `doctor` exits 1 and names `codex-bridge update --force`, because a host running someone else's agent files may be calling the runner in a form no permission rule matches.
 
 If a session answers `Agent type 'codex-build' not found`, a run can still be started without the dispatcher — the agent is a wrapper that types one command:
 
@@ -141,6 +141,7 @@ Transport files from runs at least **30 days** old are pruned automatically when
 | `update [--scope user\|project] [--host <path>] [--dry-run] [--force]` | Refresh a recorded installation. |
 | `permissions [add\|remove] [--scope user\|project] [--host <path>]` | Inspect or manage optional shell rules. |
 | `uninstall [--scope user\|project] [--host <path>] [--dry-run] [--purge]` | Remove recorded package files while preserving run artifacts; `--purge` also deletes your data and the home after one preflight and two consents (see [Uninstall and purge](docs/overview.md#uninstall-and-purge)). |
+| `inventory confirm [--scope user\|project] [--host <path>] [--dry-run]` | Confirm in a terminal that the recorded hosts are all the hosts using this home; until then the dispatcher model pin stays undetermined and `doctor` names this command. Changes only the inventory mark of the installation record. |
 | `doctor [--scope user\|project] [--host <path>] [--probe-contract] [--probe-executable <path>]` | Diagnose the selected host and Codex connection, including the handback witness and four dispatcher contract lines. `--probe-contract` targets the newest observed host, accepting `CLAUDE_CODE_EXECPATH` or `claude` on `PATH` only when each reports that version with `--version`; use `--probe-executable <path>` to name an executable (`--host` selects the Claude Code configuration). The probe prints its target and records nothing if the completed host run reports another transcript version. |
 | `run --agent <type> --task-file "<abs path>" [--no-wait]` | Start or attach to a delegated run through the permission-stable package command. The task-file header carries the whole order; its body carries the statement, scout questions and verification command. Its path must be absolute and use forward slashes; `$`, doubled backslashes and a final backslash are refused. Every other runner flag is a free refusal; stdin is not an input channel. |
 | `model [list\|set\|unset\|speed]` | Show the model, effort, pinned speed tier and provenance of each role, with the config path; `model list` prints the live catalogue from Codex, hidden models included and marked; `model set <role> <model> [effort]` checks the pair and any retained speed tier against that model's catalogue entry, and `model unset <role>` removes the profile. `model speed <role> <tier>` previews a live accelerated tier and its quoted cost description; repeat with trailing `confirm` to pin it. `model speed <role> unset` removes only speed, without confirmation. The profile is machine-wide, shared by every project on this machine. |

package/cli/active-hosts.mjs

@@ -0,0 +1,44 @@
+/** Names the hosts whose dispatchers ran in the last 24 hours, the hosts whose witness and model state is active;
+ * Plan_67 D12: concurrent VS Code hosts 2.1.291 and 2.1.292 on 2026-10-07 must both be judged, regardless of session liveness.
+ */
+export const ACTIVE_HOST_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+export function activeHostVersions({ observations, witnessRecord, modelRecord, now = new Date() }) {
+  const currentTime = new Date(now).getTime();
+  const activity = new Map();
+  function recordActivity(version, at) {
+    if (typeof version !== 'string' || !version || version === 'unknown') return;
+    if (typeof at !== 'string'
+      || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(at)) return;
+    const time = Date.parse(at);
+    const date = Date.parse(`${at.slice(0, 10)}T00:00:00Z`);
+    if (!Number.isFinite(time) || !Number.isFinite(date)
+      || new Date(date).toISOString().slice(0, 10) !== at.slice(0, 10)) return;
+    // Plan_67 R2: future evidence must not hide a valid past source for the same host.
+    if (time > currentTime) return;
+    if (!activity.has(version) || time > activity.get(version)) activity.set(version, time);
+  }
+  function ledgerActivity(ledger) {
+    if (!ledger || ledger.corrupt) return;
+    for (const entry of Object.values(ledger.entries || {})) {
+      if (!entry || entry.corrupt || entry.lastObservation?.corrupt) continue;
+      const observation = entry.lastObservation;
+      recordActivity(observation?.data?.hostVersion, observation?.at);
+    }
+  }
+  if (observations && !observations.corrupt) {
+    for (const [version, host] of Object.entries(observations.hosts || {})) {
+      if (host && !host.corrupt) recordActivity(version, host.lastSeen);
+    }
+    for (const session of Object.values(observations.sessions || {})) {
+      if (session && !session.corrupt) recordActivity(session.version, session.at);
+    }
+  }
+  if (witnessRecord && !witnessRecord.corrupt) {
+    for (const [version, at] of Object.entries(witnessRecord.intercepted || {})) recordActivity(version, at);
+    ledgerActivity(witnessRecord.ledger);
+  }
+  ledgerActivity(modelRecord);
+  return [...activity].filter(([, at]) => currentTime - at >= 0 && currentTime - at <= ACTIVE_HOST_WINDOW_MS)
+    .sort((a, b) => b[1] - a[1]).map(([version]) => version);
+}

package/cli/command-registry.mjs

@@ -9,7 +9,8 @@ import { resolveProbeTarget } from './probe-target.mjs';
 import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import { hook } from './hook.mjs';
 import { resolveHost } from './hosts.mjs';
-import { install } from './install.mjs';
+import { install } from './install.mjs';
+import { inventoryConfirm } from './inventory-confirm.mjs';
 import { model } from './model.mjs';
 import { projects } from './projects.mjs';
 import { read } from './read.mjs';
@@ -25,7 +26,8 @@ import { update } from './update.mjs';
 export function commandOptions(command, argv) {
   const options = {};
   const booleanFlags = command === 'install' || command === 'update' ? new Set(['--dry-run', '--force'])
-    : command === 'uninstall' ? new Set(['--dry-run', '--purge'])
+    : command === 'uninstall' ? new Set(['--dry-run', '--purge'])
+      : command === 'inventory' ? new Set(['--dry-run'])
       : command === 'doctor' ? new Set(['--probe-contract']) : new Set();
   const flagNames = new Map([
     ['--dry-run', 'dryRun'],
@@ -123,6 +125,20 @@ export const COMMANDS = [
     },
   },
   {
+    name: 'inventory',
+    summary: 'Confirm that the recorded hosts are all the hosts using this home',
+    usage: ['codex-bridge inventory confirm [--scope user|project] [--host <path>] [--dry-run]'],
+    section: 'public',
+    async handler(argv, io) {
+      if (argv[0] !== 'confirm') throw new Error(`unknown inventory action "${argv[0] ?? ''}"`);
+      const options = commandOptions('inventory', argv.slice(1));
+      const host = resolveHost(options);
+      const result = await inventoryConfirm({ host, dryRun: options.dryRun });
+      io.log(result.output);
+      return result.exitCode;
+    },
+  },
+  {
     name: 'doctor',
     summary: 'Diagnose the selected Claude Code host (--probe-contract measures on a live host)',
     usage: ['codex-bridge doctor [--scope user|project] [--host <path>] [--probe-contract] [--probe-executable <path>]'],

package/cli/dispatcher-model-check.mjs

@@ -1,4 +1,4 @@
-/** turns the dispatcher-model ledger into doctor rows; Plan_67 D4/D8 and D8 clarification 2026-10-07. */
+/** turns the dispatcher-model ledger into doctor rows; Plan_67 D4/D8/D12 judge every recently active host. */
 import path from 'node:path';
 import { DISPATCHER_MODEL_FILE } from '../src/home/lib/dispatcher-model.mjs';
 import { entryState } from '../src/home/lib/observation-ledger.mjs';
@@ -12,48 +12,50 @@ function entryCheck(entry) {
   const observation = entry.lastObservation;
   const { data, verdict, at } = observation;
   const key = `dispatcherModel:${data.agentType}`;
+  const prefix = `host ${data.hostVersion}: `;
   const state = entryState(entry);
   // D4: only the latest confirmed violation fails; D8 keeps uncertainty from erasing history.
   if (verdict === 'violation') {
-    return check(key, 'fail', `${observationSummary(observation)}; Claude quota was spent on this dispatcher; see Plan_67.`);
+    return check(key, 'fail', `${prefix}${observationSummary(observation)}; Claude quota was spent on this dispatcher; see Plan_67.`);
   }
   if (verdict === 'undetermined') {
     const reason = data.pinReasons?.length
-      ? data.pinReasons.join('; ') : 'no model family could be read from the transcript';
+      // Reasons are sentences ending in a period; the row adds its own (live doctor printed "record..").
+      ? data.pinReasons.map((text) => text.replace(/\.$/, '')).join('; ') : 'no model family could be read from the transcript';
     const unresolved = state === 'violation'
       ? `; earlier violation (${observationSummary(entry.lastViolation)}) is not yet disproved` : '';
-    return check(key, 'warn', `${data.agentType}: model observation undetermined at ${at}: ${reason}${unresolved}.`);
+    return check(key, 'warn', `${prefix}${data.agentType}: model observation undetermined at ${at}: ${reason}${unresolved}.`);
   }
   const history = state === 'recovered'
     ? `; recovered from earlier violation (${observationSummary(entry.lastViolation)})` : '';
-  return check(key, 'ok', `${observationSummary(observation)}; matches the installed contract${history}.`);
+  return check(key, 'ok', `${prefix}${observationSummary(observation)}; matches the installed contract${history}.`);
 }
 
-export function dispatcherModelChecks({ record, hostVersion, stateDir }) {
+export function dispatcherModelChecks({ record, activeHosts, stateDir }) {
   if (record?.corrupt) {
     return [check('dispatcherModel', 'warn',
       `The dispatcher model record is unreadable; delete ${path.join(stateDir, DISPATCHER_MODEL_FILE)} to reset it.`)];
   }
   const entries = Object.values(record?.entries || {});
-  const current = entries.filter((entry) => entry.lastObservation.data.hostVersion === hostVersion);
+  const current = entries.filter((entry) => activeHosts.includes(entry.lastObservation.data.hostVersion));
   const rows = current.map(entryCheck);
   if (!rows.length) {
-    rows.push(check('dispatcherModel', 'ok', 'Not observed yet — recorded when a dispatcher stops on this host.'));
+    rows.push(check('dispatcherModel', 'ok', 'Not observed in the last 24 hours — recorded when a dispatcher stops.'));
   }
   const hosts = new Map();
   for (const entry of entries) {
     const version = entry.lastObservation.data.hostVersion;
-    if (version === hostVersion) continue;
+    if (activeHosts.includes(version)) continue;
     const counts = hosts.get(version) || { entries: 0, violations: 0 };
     counts.entries += 1;
     if (entryState(entry) === 'violation') counts.violations += 1;
     hosts.set(version, counts);
   }
-  // D8: other hosts are one history sentence, never additional active warning rows.
+  // D12: inactive hosts are one history sentence, never additional active warning rows.
   if (hosts.size) {
     const history = [...hosts].map(([version, counts]) =>
       `${version ?? 'unknown host'}: ${counts.entries} entries, ${counts.violations} unresolved violations`);
-    rows[0].value += ` History on other hosts (historical, not current): ${history.join('; ')}.`;
+    rows[0].value += ` History on hosts without dispatcher activity in the last 24 hours (historical, not current): ${history.join('; ')}.`;
   }
   return rows;
-}
+}

package/cli/doctor-host-side.mjs

@@ -1,111 +1,117 @@
-/**
- * Reports host marks separately from home ownership (Plan_65 D10 item 6): WHAT lies in a host
- * comes from its marks, while WHO uses the home comes only from its owner rows. A single
- * "installation: not installed" line hid a host that plainly carried our agents and hooks, and it
- * never said which hosts the home record names or whether its inventory is complete.
- * Owners in sync keeps lagging hosts visible because install/update named them only once (Plan_65 D11 item 3).
- */
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
-import { check } from './doctor-format.mjs';
-import { hasPackageMarks } from './host-inspection.mjs';
-import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
-import { imageFingerprint } from './install-owners.mjs';
-
-// Format 1 is not migrated here: asFormat2 would record this host as the owner, and doctor only reads.
-export function ownerEntry(rawRecord, host) {
-  if (rawRecord === null || !isFormat2(rawRecord)) return null;
-  return rawRecord.owners[normalizeRepoPath(host.root)] ?? null;
-}
-
-export function hostSideCheck(host, inspection) {
-  if (inspection.settingsError) {
-    return check('host files', 'fail', `settings could not be read: ${inspection.settingsError}`);
-  }
-  if (!hasPackageMarks(inspection)) {
-    return check('host files', 'warn', `no codex-bridge files or hooks in ${host.root}`);
-  }
-
-  const kept = inspection.files.filter((file) => file.disposition === 'keep'
-    && ['changed', 'unknown'].includes(file.reason));
-  const counts = `${inspection.files.length} package file(s) and ${inspection.hooks.length} own hook(s) in ${host.root}`;
-  const keptText = kept.map((file) => `${file.relativeToHost} (${file.reason})`).join(', ');
-  return kept.length
-    ? check('host files', 'warn', `${counts}; kept by uninstall: ${keptText}`)
-    : check('host files', 'ok', counts);
-}
-
-async function homeImageExists(host) {
-  try {
-    await fs.access(path.join(host.brandRoot, 'lib'));
-    return true;
-  } catch (error) {
-    if (error.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-export async function homeOwnersCheck(host, rawRecord, inspection) {
-  if (rawRecord === null) {
-    return await homeImageExists(host)
-      ? check('home owners', 'warn', `no installation record in ${host.brandRoot}; the image has no record`)
-      : check('home owners', 'ok', `no installation record in ${host.brandRoot}`);
-  }
-  if (!isFormat2(rawRecord)) {
-    return check(
-      'home owners',
-      'warn',
-      'old record format; the hosts using this home are unknown until the next install or update',
-    );
-  }
-
-  const roots = Object.values(rawRecord.owners).map((owner) => owner.root);
-  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
-  const hostRecorded = Object.hasOwn(rawRecord.owners, normalizeRepoPath(host.root));
-  const unrecordedMarks = hasPackageMarks(inspection) && !hostRecorded;
-  const parts = [
-    `recorded: ${roots.length ? roots.join(', ') : 'none'}`,
-    inventoryComplete ? 'inventory complete' : 'inventory incomplete: an old record did not name every host',
-    ...(unrecordedMarks
-      ? [`${host.root} has package files or hooks but is not recorded: run codex-bridge install --host "${host.root}"`]
-      : []),
-  ];
-  return check('home owners', inventoryComplete && !unrecordedMarks ? 'ok' : 'warn', parts.join('; '));
-}
-
-export function ownersInSyncCheck(rawRecord) {
-  if (rawRecord === null || !isFormat2(rawRecord)) {
-    return check('owners in sync', 'ok', 'no format-2 record; nothing to compare');
-  }
-
-  const owners = Object.values(rawRecord.owners);
-  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
-  if (!owners.length) {
-    return check('owners in sync', 'warn',
-      `no recorded owners${inventoryComplete ? '' : '; inventory incomplete'}`);
-  }
-
-  const fingerprint = imageFingerprint(rawRecord.image);
-  const parts = [];
-  const unstamped = [];
-  for (const owner of owners) {
-    if (owner.imageFingerprint != null) {
-      if (owner.imageFingerprint === fingerprint) continue;
-    } else if (owner.version === rawRecord.image.version) {
-      unstamped.push(owner.root);
-      continue;
-    }
-    // The same version on both sides is the clone case the stamp exists for; say so instead of "0.6.9, image 0.6.9".
-    const why = owner.version === rawRecord.image.version
-      ? `verified against an earlier image of ${owner.version}`
-      : `recorded ${owner.version}, image ${rawRecord.image.version}`;
-    parts.push(`${owner.root} (${why}): run codex-bridge update --host "${owner.root}"`);
-  }
-  if (unstamped.length) parts.push(`not yet verified by image fingerprint: ${unstamped.join(', ')}`);
-  if (!inventoryComplete) parts.push('inventory incomplete');
-  const warning = parts.length > 0;
-  if (!warning) parts.push(`all ${owners.length} owner(s) verified against the current image`);
-  return check('owners in sync', warning ? 'warn' : 'ok',
-    `${parts.join('; ')} (recorded verification; host files and reachability not inspected)`);
-}
+/**
+ * Reports host marks separately from home ownership (Plan_65 D10 item 6): WHAT lies in a host
+ * comes from its marks, while WHO uses the home comes only from its owner rows. A single
+ * "installation: not installed" line hid a host that plainly carried our agents and hooks, and it
+ * never said which hosts the home record names or whether its inventory is complete.
+ * Owners in sync keeps lagging hosts visible because install/update named them only once (Plan_65 D11 item 3).
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
+import { check } from './doctor-format.mjs';
+import { hasPackageMarks } from './host-inspection.mjs';
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
+import { imageFingerprint } from './install-owners.mjs';
+import { INVENTORY_CONFIRM_COMMAND } from './inventory-confirm.mjs';
+
+const inventoryRepair = `; run ${INVENTORY_CONFIRM_COMMAND} if the recorded hosts are all of them`;
+
+const ownerRepair = '; install into each host first: run codex-bridge install --host "<path>"';
+
+// Format 1 is not migrated here: asFormat2 would record this host as the owner, and doctor only reads.
+export function ownerEntry(rawRecord, host) {
+  if (rawRecord === null || !isFormat2(rawRecord)) return null;
+  return rawRecord.owners[normalizeRepoPath(host.root)] ?? null;
+}
+
+export function hostSideCheck(host, inspection) {
+  if (inspection.settingsError) {
+    return check('host files', 'fail', `settings could not be read: ${inspection.settingsError}`);
+  }
+  if (!hasPackageMarks(inspection)) {
+    return check('host files', 'warn', `no codex-bridge files or hooks in ${host.root}`);
+  }
+
+  const kept = inspection.files.filter((file) => file.disposition === 'keep'
+    && ['changed', 'unknown'].includes(file.reason));
+  const counts = `${inspection.files.length} package file(s) and ${inspection.hooks.length} own hook(s) in ${host.root}`;
+  const keptText = kept.map((file) => `${file.relativeToHost} (${file.reason})`).join(', ');
+  return kept.length
+    ? check('host files', 'warn', `${counts}; kept by uninstall: ${keptText}`)
+    : check('host files', 'ok', counts);
+}
+
+async function homeImageExists(host) {
+  try {
+    await fs.access(path.join(host.brandRoot, 'lib'));
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+export async function homeOwnersCheck(host, rawRecord, inspection) {
+  if (rawRecord === null) {
+    return await homeImageExists(host)
+      ? check('home owners', 'warn', `no installation record in ${host.brandRoot}; the image has no record`)
+      : check('home owners', 'ok', `no installation record in ${host.brandRoot}`);
+  }
+  if (!isFormat2(rawRecord)) {
+    return check(
+      'home owners',
+      'warn',
+      'old record format; the hosts using this home are unknown until the next install or update',
+    );
+  }
+
+  const roots = Object.values(rawRecord.owners).map((owner) => owner.root);
+  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
+  const hostRecorded = Object.hasOwn(rawRecord.owners, normalizeRepoPath(host.root));
+  const unrecordedMarks = hasPackageMarks(inspection) && !hostRecorded;
+  const parts = [
+    `recorded: ${roots.length ? roots.join(', ') : 'none'}`,
+    inventoryComplete ? 'inventory complete'
+      : `inventory incomplete: an old record did not name every host${roots.length ? inventoryRepair : ownerRepair}`,
+    ...(unrecordedMarks
+      ? [`${host.root} has package files or hooks but is not recorded: run codex-bridge install --host "${host.root}"`]
+      : []),
+  ];
+  return check('home owners', inventoryComplete && !unrecordedMarks ? 'ok' : 'warn', parts.join('; '));
+}
+
+export function ownersInSyncCheck(rawRecord) {
+  if (rawRecord === null || !isFormat2(rawRecord)) {
+    return check('owners in sync', 'ok', 'no format-2 record; nothing to compare');
+  }
+
+  const owners = Object.values(rawRecord.owners);
+  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
+  if (!owners.length) {
+    return check('owners in sync', 'warn',
+      `no recorded owners${inventoryComplete ? '' : `; inventory incomplete${ownerRepair}`}`);
+  }
+
+  const fingerprint = imageFingerprint(rawRecord.image);
+  const parts = [];
+  const unstamped = [];
+  for (const owner of owners) {
+    if (owner.imageFingerprint != null) {
+      if (owner.imageFingerprint === fingerprint) continue;
+    } else if (owner.version === rawRecord.image.version) {
+      unstamped.push(owner.root);
+      continue;
+    }
+    // The same version on both sides is the clone case the stamp exists for; say so instead of "0.6.9, image 0.6.9".
+    const why = owner.version === rawRecord.image.version
+      ? `verified against an earlier image of ${owner.version}`
+      : `recorded ${owner.version}, image ${rawRecord.image.version}`;
+    parts.push(`${owner.root} (${why}): run codex-bridge update --host "${owner.root}"`);
+  }
+  if (unstamped.length) parts.push(`not yet verified by image fingerprint: ${unstamped.join(', ')}`);
+  if (!inventoryComplete) parts.push(`inventory incomplete${inventoryRepair}`);
+  const warning = parts.length > 0;
+  if (!warning) parts.push(`all ${owners.length} owner(s) verified against the current image`);
+  return check('owners in sync', warning ? 'warn' : 'ok',
+    `${parts.join('; ')} (recorded verification; host files and reachability not inspected)`);
+}

package/cli/doctor.mjs

@@ -19,15 +19,16 @@ import {
 } from './doctor-installation.mjs';
 import { hookChecks } from './doctor-hooks.mjs';
 import { contractStatus, readHostContract } from './host-contract.mjs';
-import { handbackWitnessStatus } from './handback-witness-check.mjs';
+import { handbackWitnessStatus } from './handback-witness-check.mjs';
 import { dispatcherModelChecks } from './dispatcher-model-check.mjs';
 import { dispatcherContractStatus } from './dispatcher-contract.mjs';
 import { DISPATCHER_CONTRACT_FILE, readDispatcherContract } from './dispatcher-contract-record.mjs';
 import { PROBE_COMMAND } from './host-contract.mjs';
-import { readHandbackWitness } from '../src/home/lib/handback-witness.mjs';
+import { readHandbackWitness } from '../src/home/lib/handback-witness.mjs';
 import { readDispatcherModel } from '../src/home/lib/dispatcher-model.mjs';
 import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import { readHostObservations } from '../src/home/lib/host-observations.mjs';
+import { activeHostVersions } from './active-hosts.mjs';
 import { otherHostCheck, sessionHostCheck, sessionHostVersions } from './session-hosts.mjs';
 import { liveRunsCheck, projectRunsCheck, retentionCheck } from './doctor-runs.mjs';
 
@@ -84,10 +85,12 @@ export async function diagnose({
   launcherProbe,
   currentPackage,
   contractRecord,
-  handbackWitnessRecord,
+  handbackWitnessRecord,
   dispatcherModelRecord,
   dispatcherContractRecord,
   hostVersion,
+  activeHosts: injectedActiveHosts,
+  now,
   observations,
 } = {}) {
   const checks = [sourceCheck()];
@@ -150,6 +153,10 @@ export async function diagnose({
   const hostObservations = observations === undefined ? readHostObservations({ stateDir }) : observations;
   const observedVersions = sessionHostVersions(hostObservations);
   const detectedHostVersion = hostVersion === undefined ? observedVersions[0] ?? null : hostVersion;
+  const witnessRecord = handbackWitnessRecord === undefined ? readHandbackWitness({ stateDir }) : handbackWitnessRecord;
+  const modelRecord = dispatcherModelRecord === undefined ? readDispatcherModel({ stateDir }) : dispatcherModelRecord;
+  const activeHosts = injectedActiveHosts ?? (hostVersion !== undefined ? [hostVersion].filter(Boolean)
+    : activeHostVersions({ observations: hostObservations, witnessRecord, modelRecord, now }));
   checks.push(sessionHostCheck(observedVersions, hostObservations));
   const refusalRecord = contractRecord === undefined ? await readHostContract(host) : contractRecord;
   const hostContract = contractStatus({
@@ -161,15 +168,15 @@ export async function diagnose({
     : hostContract.state === 'ignored' ? 'fail' : 'warn';
   checks.push(check('hostContract', hostContractStatus, hostContract.message));
   const witness = handbackWitnessStatus({
-    record: handbackWitnessRecord === undefined ? readHandbackWitness({ stateDir }) : handbackWitnessRecord,
-    hostVersion: detectedHostVersion,
+    record: witnessRecord,
+    activeHosts,
     stateDir,
   });
-  checks.push(check('handbackWitness', ['violation', 'unreadable'].includes(witness.state) ? 'warn' : 'ok', witness.message));
-  checks.push(...dispatcherModelChecks({
-    record: dispatcherModelRecord === undefined ? readDispatcherModel({ stateDir }) : dispatcherModelRecord,
-    hostVersion: detectedHostVersion,
-    stateDir,
+  checks.push(check('handbackWitness', ['violation', 'unreadable'].includes(witness.state) ? 'warn' : 'ok', witness.message));
+  checks.push(...dispatcherModelChecks({
+    record: modelRecord,
+    activeHosts,
+    stateDir,
   }));
   const dispatcherRecord = dispatcherContractRecord === undefined ? readDispatcherContract({ stateDir }) : dispatcherContractRecord;
   checks.push(...dispatcherContractChecks({

package/cli/handback-witness-check.mjs

@@ -1,37 +1,41 @@
-/** Surfaces handback drift; 2026-09-25 established exact host transcript versions as identity. */
+/** Surfaces handback drift; Plan_67 D12 judges every host with recent dispatcher activity. */
 import path from 'node:path';
 import { WITNESS_FILE } from '../src/home/lib/handback-witness.mjs';
 import { entryState } from '../src/home/lib/observation-ledger.mjs';
 
-export function handbackWitnessStatus({ record, hostVersion, stateDir }) {
+export function handbackWitnessStatus({ record, activeHosts, stateDir }) {
   if (record?.corrupt) {
     return { state: 'unreadable', message: `The handback witness is unreadable; delete ${path.join(stateDir, WITNESS_FILE)} to reset it.` };
   }
   const entries = Object.values(record?.ledger?.entries || {});
+  let history = '';
+  const recovered = entries.filter((entry) => entryState(entry) === 'recovered').length;
+  const historical = entries.filter((entry) => entryState(entry) === 'violation'
+    && !activeHosts.includes(entry.lastObservation.data.hostVersion)).length;
+  const legacy = record?.legacy || [];
+  if (recovered || historical || legacy.length) {
+    const untyped = legacy.filter((entry) => entry.disposition === 'legacy-untyped-unverified').length;
+    const unclassified = legacy.filter((entry) => entry.disposition === 'unclassified').length;
+    history = ` History: ${recovered} recovered entries; ${historical} unresolved entries on hosts without dispatcher activity in the last 24 hours (history); ${untyped} older alarms without dispatcher evidence, kept for history (legacy-untyped-unverified); ${unclassified} unclassified legacy entries.`;
+  }
   const violations = entries.filter((entry) => entryState(entry) === 'violation'
-    && entry.lastObservation.data.hostVersion === hostVersion);
+    && activeHosts.includes(entry.lastObservation.data.hostVersion));
   if (violations.length > 0) {
     const details = violations.map((entry) => {
       const { data, detail, at } = entry.lastViolation;
-      return `${data.cause}${data.agentType ? ` / ${data.agentType}` : ''}: ${detail} at ${at}`;
+      return `host ${data.hostVersion}: ${data.cause}${data.agentType ? ` / ${data.agentType}` : ''}: ${detail} at ${at}`;
     });
     return {
       state: 'violation',
-      message: `Dispatcher violation(s) on host ${hostVersion ?? 'unknown host'}: ${details.join('; ')}; do not trust a dispatcher answer from that time; see Plan_62 D15.`,
+      message: `Dispatcher violation(s): ${details.join('; ')}; do not trust a dispatcher answer from that time; see Plan_62 D15.${history}`,
     };
   }
-  const intercepted = record?.intercepted?.[hostVersion || 'unknown'];
-  let message = intercepted
-    ? `Newest intercepted handback on host ${hostVersion ?? 'unknown host'} at ${intercepted}.`
-    : 'Not observed yet — a handback is seen only when a dispatcher runs in an interactive session.';
-  const recovered = entries.filter((entry) => entryState(entry) === 'recovered').length;
-  const historical = entries.filter((entry) => entryState(entry) === 'violation'
-    && entry.lastObservation.data.hostVersion !== hostVersion).length;
-  const legacy = record?.legacy || [];
-  if (recovered || historical || legacy.length) {
-    const untyped = legacy.filter((entry) => entry.disposition === 'legacy-untyped-unverified').length;
-    const unclassified = legacy.filter((entry) => entry.disposition === 'unclassified').length;
-    message += ` History: ${recovered} recovered entries; ${historical} unresolved entries on other hosts (historical, not current); ${untyped} older alarms without dispatcher evidence, kept for history (legacy-untyped-unverified); ${unclassified} unclassified legacy entries.`;
-  }
-  return { state: 'ok', message };
+  const intercepted = activeHosts.filter((host) => record?.intercepted?.[host])
+    .map((host) => `host ${host} at ${record.intercepted[host]}`);
+  const message = !activeHosts.length
+    ? 'No dispatcher activity in the last 24 hours.'
+    : intercepted.length
+      ? `Newest intercepted handback on ${intercepted.join('; ')}.`
+      : 'Not observed yet — a handback is seen only when a dispatcher runs in an interactive session.';
+  return { state: 'ok', message: message + history };
 }

package/cli/install-record.mjs

@@ -307,6 +307,11 @@ async function publishInstallRecord(host, next) {
   await writer.rename('install-record', temporary, target);
 }
 
+/** Plan_67 D11 / A4: changing inventory must not rebuild owners or hide fingerprint lag. */
+export function publishInstallRecordOnly(host, next) {
+  return publishInstallRecord(host, next);
+}
+
 /**
  * Publishes the record whole through a temporary and a rename: a direct write left a half-written
  * record for every host sharing the home if the process died mid-write (advice A3, risk r3).

package/cli/inventory-confirm.mjs

@@ -0,0 +1,75 @@
+/** Lets the operator declare a shared home's installation inventory complete, the one statement the package cannot prove.
+ * Plan_67 D11, OW-047: only the operator can account for unrecorded hosts using this home.
+ */
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
+import { publishInstallRecordOnly, readInstallRecordFile } from './install-record.mjs';
+import { validateFormat2 } from './install-owners.mjs';
+import { registryHintLines } from './inventory-transition.mjs';
+import { withLifecycle } from './lifecycle-transaction.mjs';
+import { readRulesRegistry } from './rules-owners.mjs';
+import { askYesNo, isInteractive } from './terminal-question.mjs';
+
+export const INVENTORY_CONFIRM_COMMAND = 'codex-bridge inventory confirm';
+
+const question = 'Are these all the hosts using this home?';
+const updateHint = 'Run codex-bridge update to migrate the installation record.';
+
+async function confirmInRun(host, dryRun, questionOptions) {
+  let record;
+  try {
+    record = await readInstallRecordFile(host);
+    if (!isFormat2(record)) {
+      return { exitCode: 1, output: `No format-2 installation record was found. ${updateHint}` };
+    }
+    validateFormat2(record);
+  } catch (error) {
+    return { exitCode: 1, output: `Invalid installation record: ${error.message} ${updateHint}` };
+  }
+  const owners = Object.values(record.owners);
+  if (owners.length === 0) {
+    return { exitCode: 1, output: 'no recorded owners; install into each host first' };
+  }
+  if (record.inventory === 'complete' && !Object.hasOwn(record, 'legacy')) {
+    return { exitCode: 0, output: 'The inventory is already complete.' };
+  }
+
+  const screen = [
+    `Home: ${host.brandRoot}`,
+    'Recorded hosts:',
+    ...owners.map((owner) => `  ${owner.root}`),
+    ...registryHintLines(host, (await readRulesRegistry(host))?.owners ?? []),
+    "Confirming lets the last recorded host's uninstall remove the shared image. "
+      + 'A host that uses this home but is not listed must be enrolled first: '
+      + 'codex-bridge install --host "<path>".',
+  ].join('\n');
+  if (dryRun) return { exitCode: 0, output: `${screen}\nDry run: nothing changed.` };
+  const prompt = `${screen}\n${question}`;
+  if (!isInteractive(questionOptions)) {
+    return { exitCode: 1, output: `${prompt}\nRun this command in a terminal to answer.` };
+  }
+  const answer = await askYesNo(prompt, questionOptions);
+  if (answer === 'cancel') {
+    return { exitCode: 130, output: `${prompt}\nCancelled; nothing was changed.` };
+  }
+  if (answer !== 'yes') {
+    return { exitCode: 1, output: `${prompt}\nNothing changed: the inventory stays incomplete.` };
+  }
+
+  // A4 pre-mortem: the raw fields are evidence of lag, not material to regenerate on confirmation.
+  const next = { ...record, inventory: 'complete' };
+  delete next.legacy;
+  await publishInstallRecordOnly(host, next);
+  return { exitCode: 0, output: `${prompt}\nRecorded the inventory as complete.` };
+}
+
+export async function inventoryConfirm({ host, dryRun = false, ...questionOptions }) {
+  const action = (ticket) => {
+    // Plan_67 R2: a first install may create the home after the unlocked missing-home check.
+    if (!dryRun && ticket === undefined) {
+      return { exitCode: 1, output: `No format-2 installation record was found. ${updateHint}` };
+    }
+    return confirmInRun(host, dryRun, questionOptions);
+  };
+  // Plan_67 D11: dry-run only reads; a real declaration holds the lifecycle lock before reading.
+  return dryRun ? action() : withLifecycle(host, 'inventory', action);
+}

package/cli/inventory-transition.mjs

@@ -3,6 +3,7 @@
  * store nothing about a refusal.
  */
 import fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { askYesNo, isInteractive } from './terminal-question.mjs';
 import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
@@ -36,7 +37,8 @@ export function registryHintLines(host, candidates) {
   const otherCandidates = candidates.filter((root) => root !== owner);
   return [
     'Codex rules registry host roots are a hint only; they may be stale or belong to another home:',
-    ...(otherCandidates.length ? otherCandidates.map((root) => `  ${root}`) : ['  none found']),
+    ...(otherCandidates.length ? otherCandidates.map((root) =>
+      `  ${root}${existsSync(root) ? '' : ' (folder does not exist)'}`) : ['  none found']),
   ];
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.11",
-  "description": "Claude Code-to-Codex delegation with 7 guards, 3199 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.12",
+  "description": "Claude Code-to-Codex delegation with 7 guards, 3267 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",

package/src/home/lib/install-owner-roots.mjs

@@ -1,53 +1,55 @@
-/**
- * Reads which host roots own this home from the installation record, read-only, for hooks.
- * Plan_67 D10 needs every recorded owner; the home image has no cli/ modules.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import { homeArtifact } from './home-registry.mjs';
-import { parseJsonText } from './json-file.mjs';
-
-const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-
-export function isFormat2(parsed) {
-  return isObject(parsed) && parsed.format === 2;
-}
-
-export function readOwnerRoots({ brandRoot }) {
-  const file = path.join(brandRoot, homeArtifact('install-record').primary[0]);
-  let raw;
-  try {
-    raw = fs.readFileSync(file, 'utf8');
-  } catch (error) {
-    return error.code === 'ENOENT'
-      ? { problem: 'missing', detail: `Installation record at ${file} is missing.` }
-      : { problem: 'unreadable', detail: `Installation record at ${file} cannot be read.` };
-  }
-
-  let parsed;
-  try {
-    parsed = parseJsonText(file, raw);
-  } catch {
-    return { problem: 'unreadable', detail: `Installation record at ${file} contains invalid JSON.` };
-  }
-  if (!isFormat2(parsed)) {
-    return { problem: 'not-format-2', detail: `Installation record at ${file} is not format 2.` };
-  }
-  if (parsed.inventory !== 'complete') {
-    return { problem: 'inventory-incomplete', detail: `Installation record at ${file} has an incomplete inventory.` };
-  }
-  if (Object.hasOwn(parsed, 'legacy')) {
-    return { problem: 'legacy-partition', detail: `Installation record at ${file} contains a legacy partition.` };
-  }
-  if (!isObject(parsed.owners) || Object.keys(parsed.owners).length === 0) {
-    return { problem: 'no-owners', detail: `Installation record at ${file} has no owners.` };
-  }
-  const roots = [];
-  for (const owner of Object.values(parsed.owners)) {
-    if (typeof owner?.root !== 'string' || owner.root.trim().length === 0) {
-      return { problem: 'malformed-owner', detail: `Installation record at ${file} has an owner without a non-empty root.` };
-    }
-    roots.push(owner.root);
-  }
-  return { roots: roots.sort() };
-}
+/**
+ * Reads which host roots own this home from the installation record, read-only, for hooks.
+ * Plan_67 D10 needs every recorded owner; the home image has no cli/ modules.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { homeArtifact } from './home-registry.mjs';
+import { parseJsonText } from './json-file.mjs';
+
+const isObject = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+export function isFormat2(parsed) {
+  return isObject(parsed) && parsed.format === 2;
+}
+
+export function readOwnerRoots({ brandRoot }) {
+  const file = path.join(brandRoot, homeArtifact('install-record').primary[0]);
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    return error.code === 'ENOENT'
+      ? { problem: 'missing', detail: `Installation record at ${file} is missing.` }
+      : { problem: 'unreadable', detail: `Installation record at ${file} cannot be read.` };
+  }
+
+  let parsed;
+  try {
+    parsed = parseJsonText(file, raw);
+  } catch {
+    return { problem: 'unreadable', detail: `Installation record at ${file} contains invalid JSON.` };
+  }
+  if (!isFormat2(parsed)) {
+    return { problem: 'not-format-2', detail: `Installation record at ${file} is not format 2.` };
+  }
+  // Plan_67 R2: confirmation refuses ownerless records; enrollment must come first.
+  if (!isObject(parsed.owners) || Object.keys(parsed.owners).length === 0) {
+    return { problem: 'no-owners', detail: `Installation record at ${file} has no owners.` };
+  }
+  if (parsed.inventory !== 'complete') {
+    // Plan_67 D11: match cli/inventory-confirm.mjs INVENTORY_CONFIRM_COMMAND; hooks cannot import cli/.
+    return { problem: 'inventory-incomplete', detail: `Installation record at ${file} has an incomplete inventory; if the recorded hosts are all the hosts using this home, run codex-bridge inventory confirm.` };
+  }
+  if (Object.hasOwn(parsed, 'legacy')) {
+    return { problem: 'legacy-partition', detail: `Installation record at ${file} contains a legacy partition.` };
+  }
+  const roots = [];
+  for (const owner of Object.values(parsed.owners)) {
+    if (typeof owner?.root !== 'string' || owner.root.trim().length === 0) {
+      return { problem: 'malformed-owner', detail: `Installation record at ${file} has an owner without a non-empty root.` };
+    }
+    roots.push(owner.root);
+  }
+  return { roots: roots.sort() };
+}