@lyupro/codex-bridge 0.6.11 → 0.6.14

package/cli/doctor-host-side.mjs

@@ -1,111 +1,117 @@
-/**
- * Reports host marks separately from home ownership (Plan_65 D10 item 6): WHAT lies in a host
- * comes from its marks, while WHO uses the home comes only from its owner rows. A single
- * "installation: not installed" line hid a host that plainly carried our agents and hooks, and it
- * never said which hosts the home record names or whether its inventory is complete.
- * Owners in sync keeps lagging hosts visible because install/update named them only once (Plan_65 D11 item 3).
- */
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
-import { check } from './doctor-format.mjs';
-import { hasPackageMarks } from './host-inspection.mjs';
-import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
-import { imageFingerprint } from './install-owners.mjs';
-
-// Format 1 is not migrated here: asFormat2 would record this host as the owner, and doctor only reads.
-export function ownerEntry(rawRecord, host) {
-  if (rawRecord === null || !isFormat2(rawRecord)) return null;
-  return rawRecord.owners[normalizeRepoPath(host.root)] ?? null;
-}
-
-export function hostSideCheck(host, inspection) {
-  if (inspection.settingsError) {
-    return check('host files', 'fail', `settings could not be read: ${inspection.settingsError}`);
-  }
-  if (!hasPackageMarks(inspection)) {
-    return check('host files', 'warn', `no codex-bridge files or hooks in ${host.root}`);
-  }
-
-  const kept = inspection.files.filter((file) => file.disposition === 'keep'
-    && ['changed', 'unknown'].includes(file.reason));
-  const counts = `${inspection.files.length} package file(s) and ${inspection.hooks.length} own hook(s) in ${host.root}`;
-  const keptText = kept.map((file) => `${file.relativeToHost} (${file.reason})`).join(', ');
-  return kept.length
-    ? check('host files', 'warn', `${counts}; kept by uninstall: ${keptText}`)
-    : check('host files', 'ok', counts);
-}
-
-async function homeImageExists(host) {
-  try {
-    await fs.access(path.join(host.brandRoot, 'lib'));
-    return true;
-  } catch (error) {
-    if (error.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-export async function homeOwnersCheck(host, rawRecord, inspection) {
-  if (rawRecord === null) {
-    return await homeImageExists(host)
-      ? check('home owners', 'warn', `no installation record in ${host.brandRoot}; the image has no record`)
-      : check('home owners', 'ok', `no installation record in ${host.brandRoot}`);
-  }
-  if (!isFormat2(rawRecord)) {
-    return check(
-      'home owners',
-      'warn',
-      'old record format; the hosts using this home are unknown until the next install or update',
-    );
-  }
-
-  const roots = Object.values(rawRecord.owners).map((owner) => owner.root);
-  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
-  const hostRecorded = Object.hasOwn(rawRecord.owners, normalizeRepoPath(host.root));
-  const unrecordedMarks = hasPackageMarks(inspection) && !hostRecorded;
-  const parts = [
-    `recorded: ${roots.length ? roots.join(', ') : 'none'}`,
-    inventoryComplete ? 'inventory complete' : 'inventory incomplete: an old record did not name every host',
-    ...(unrecordedMarks
-      ? [`${host.root} has package files or hooks but is not recorded: run codex-bridge install --host "${host.root}"`]
-      : []),
-  ];
-  return check('home owners', inventoryComplete && !unrecordedMarks ? 'ok' : 'warn', parts.join('; '));
-}
-
-export function ownersInSyncCheck(rawRecord) {
-  if (rawRecord === null || !isFormat2(rawRecord)) {
-    return check('owners in sync', 'ok', 'no format-2 record; nothing to compare');
-  }
-
-  const owners = Object.values(rawRecord.owners);
-  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
-  if (!owners.length) {
-    return check('owners in sync', 'warn',
-      `no recorded owners${inventoryComplete ? '' : '; inventory incomplete'}`);
-  }
-
-  const fingerprint = imageFingerprint(rawRecord.image);
-  const parts = [];
-  const unstamped = [];
-  for (const owner of owners) {
-    if (owner.imageFingerprint != null) {
-      if (owner.imageFingerprint === fingerprint) continue;
-    } else if (owner.version === rawRecord.image.version) {
-      unstamped.push(owner.root);
-      continue;
-    }
-    // The same version on both sides is the clone case the stamp exists for; say so instead of "0.6.9, image 0.6.9".
-    const why = owner.version === rawRecord.image.version
-      ? `verified against an earlier image of ${owner.version}`
-      : `recorded ${owner.version}, image ${rawRecord.image.version}`;
-    parts.push(`${owner.root} (${why}): run codex-bridge update --host "${owner.root}"`);
-  }
-  if (unstamped.length) parts.push(`not yet verified by image fingerprint: ${unstamped.join(', ')}`);
-  if (!inventoryComplete) parts.push('inventory incomplete');
-  const warning = parts.length > 0;
-  if (!warning) parts.push(`all ${owners.length} owner(s) verified against the current image`);
-  return check('owners in sync', warning ? 'warn' : 'ok',
-    `${parts.join('; ')} (recorded verification; host files and reachability not inspected)`);
-}
+/**
+ * Reports host marks separately from home ownership (Plan_65 D10 item 6): WHAT lies in a host
+ * comes from its marks, while WHO uses the home comes only from its owner rows. A single
+ * "installation: not installed" line hid a host that plainly carried our agents and hooks, and it
+ * never said which hosts the home record names or whether its inventory is complete.
+ * Owners in sync keeps lagging hosts visible because install/update named them only once (Plan_65 D11 item 3).
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
+import { check } from './doctor-format.mjs';
+import { hasPackageMarks } from './host-inspection.mjs';
+import { isFormat2 } from '../src/home/lib/install-owner-roots.mjs';
+import { imageFingerprint } from './install-owners.mjs';
+import { INVENTORY_CONFIRM_COMMAND } from './inventory-confirm.mjs';
+
+const inventoryRepair = `; run ${INVENTORY_CONFIRM_COMMAND} if the recorded hosts are all of them`;
+
+const ownerRepair = '; install into each host first: run codex-bridge install --host "<path>"';
+
+// Format 1 is not migrated here: asFormat2 would record this host as the owner, and doctor only reads.
+export function ownerEntry(rawRecord, host) {
+  if (rawRecord === null || !isFormat2(rawRecord)) return null;
+  return rawRecord.owners[normalizeRepoPath(host.root)] ?? null;
+}
+
+export function hostSideCheck(host, inspection) {
+  if (inspection.settingsError) {
+    return check('host files', 'fail', `settings could not be read: ${inspection.settingsError}`);
+  }
+  if (!hasPackageMarks(inspection)) {
+    return check('host files', 'warn', `no codex-bridge files or hooks in ${host.root}`);
+  }
+
+  const kept = inspection.files.filter((file) => file.disposition === 'keep'
+    && ['changed', 'unknown'].includes(file.reason));
+  const counts = `${inspection.files.length} package file(s) and ${inspection.hooks.length} own hook(s) in ${host.root}`;
+  const keptText = kept.map((file) => `${file.relativeToHost} (${file.reason})`).join(', ');
+  return kept.length
+    ? check('host files', 'warn', `${counts}; kept by uninstall: ${keptText}`)
+    : check('host files', 'ok', counts);
+}
+
+async function homeImageExists(host) {
+  try {
+    await fs.access(path.join(host.brandRoot, 'lib'));
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+export async function homeOwnersCheck(host, rawRecord, inspection) {
+  if (rawRecord === null) {
+    return await homeImageExists(host)
+      ? check('home owners', 'warn', `no installation record in ${host.brandRoot}; the image has no record`)
+      : check('home owners', 'ok', `no installation record in ${host.brandRoot}`);
+  }
+  if (!isFormat2(rawRecord)) {
+    return check(
+      'home owners',
+      'warn',
+      'old record format; the hosts using this home are unknown until the next install or update',
+    );
+  }
+
+  const roots = Object.values(rawRecord.owners).map((owner) => owner.root);
+  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
+  const hostRecorded = Object.hasOwn(rawRecord.owners, normalizeRepoPath(host.root));
+  const unrecordedMarks = hasPackageMarks(inspection) && !hostRecorded;
+  const parts = [
+    `recorded: ${roots.length ? roots.join(', ') : 'none'}`,
+    inventoryComplete ? 'inventory complete'
+      : `inventory incomplete: an old record did not name every host${roots.length ? inventoryRepair : ownerRepair}`,
+    ...(unrecordedMarks
+      ? [`${host.root} has package files or hooks but is not recorded: run codex-bridge install --host "${host.root}"`]
+      : []),
+  ];
+  return check('home owners', inventoryComplete && !unrecordedMarks ? 'ok' : 'warn', parts.join('; '));
+}
+
+export function ownersInSyncCheck(rawRecord) {
+  if (rawRecord === null || !isFormat2(rawRecord)) {
+    return check('owners in sync', 'ok', 'no format-2 record; nothing to compare');
+  }
+
+  const owners = Object.values(rawRecord.owners);
+  const inventoryComplete = rawRecord.inventory === 'complete' && rawRecord.legacy === undefined;
+  if (!owners.length) {
+    return check('owners in sync', 'warn',
+      `no recorded owners${inventoryComplete ? '' : `; inventory incomplete${ownerRepair}`}`);
+  }
+
+  const fingerprint = imageFingerprint(rawRecord.image);
+  const parts = [];
+  const unstamped = [];
+  for (const owner of owners) {
+    if (owner.imageFingerprint != null) {
+      if (owner.imageFingerprint === fingerprint) continue;
+    } else if (owner.version === rawRecord.image.version) {
+      unstamped.push(owner.root);
+      continue;
+    }
+    // The same version on both sides is the clone case the stamp exists for; say so instead of "0.6.9, image 0.6.9".
+    const why = owner.version === rawRecord.image.version
+      ? `verified against an earlier image of ${owner.version}`
+      : `recorded ${owner.version}, image ${rawRecord.image.version}`;
+    parts.push(`${owner.root} (${why}): run codex-bridge update --host "${owner.root}"`);
+  }
+  if (unstamped.length) parts.push(`not yet verified by image fingerprint: ${unstamped.join(', ')}`);
+  if (!inventoryComplete) parts.push(`inventory incomplete${inventoryRepair}`);
+  const warning = parts.length > 0;
+  if (!warning) parts.push(`all ${owners.length} owner(s) verified against the current image`);
+  return check('owners in sync', warning ? 'warn' : 'ok',
+    `${parts.join('; ')} (recorded verification; host files and reachability not inspected)`);
+}

package/cli/doctor-installation.mjs

@@ -1,111 +1,132 @@
-/** Reports whether what this package installed into the host still matches the package. */
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import {
-  buildInstallPlan,
-  contentFingerprint,
-  fileFingerprint,
-} from './manifest.mjs';
-import { plannedContent } from './copy.mjs';
-import { RULE_LIST_NAMES, inspectPermissions } from './permissions.mjs';
-import { readRulesRegistry } from './rules-owners.mjs';
-import { parseFrontmatter } from '../src/home/lib/frontmatter.mjs';
-import { check } from './doctor-format.mjs';
-
-export async function exists(target) {
-  try {
-    await fs.access(target);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export async function isFile(target) {
-  try {
-    return (await fs.stat(target)).isFile();
-  } catch {
-    return false;
-  }
-}
-
-export async function agentsCheck(host, record) {
-  if (!record) return check('agents', 'warn', 'Agent definitions were not checked; run codex-bridge install');
-  const plan = await buildInstallPlan(host);
-  const agents = plan.filter((item) => /[\\/]src[\\/]agents[\\/][^\\/]+\.md$/.test(item.source));
-  const mismatches = [];
-  const unreadable = [];
-  for (const item of agents) {
-    const expected = contentFingerprint(await plannedContent(item, host.brandRoot));
-    if (await fileFingerprint(item.target) !== expected) mismatches.push(path.basename(item.target));
-    const expectedName = path.basename(item.source, '.md');
-    try {
-      const frontmatter = parseFrontmatter(await fs.readFile(item.target, 'utf8'));
-      if (!frontmatter) throw new Error('frontmatter is missing');
-      if (frontmatter.name !== expectedName) {
-        throw new Error(`name is ${JSON.stringify(frontmatter.name)}, expected ${JSON.stringify(expectedName)}`);
-      }
-    } catch (err) {
-      unreadable.push(`${path.basename(item.target)} (${err.message})`);
-    }
-  }
-  // The 2026-08-10 registration failure left files present but unreadable by Claude Code. Drift was
-  // advisory until a 2026-08-16 checklist run planted the pre-Plan_41 invocation — a path instead of
-  // the package command — in an installed definition: doctor kept exit 0 while every delegation
-  // would stop on a permission prompt. A definition that is not this package's is not judged healthy.
-  if (unreadable.length) {
-    return check('agents', 'fail', `Installed agent definitions cannot be read: ${unreadable.join(', ')}; run codex-bridge update --force`);
-  }
-  return mismatches.length
-    ? check('agents', 'fail', `Installed agent definitions differ from this package: ${mismatches.join(', ')}; run codex-bridge update --force`)
-    : check('agents', 'ok', `${agents.length} installed agent definition(s) match this package`);
-}
-
-export async function conventionsCheck(host) {
-  const file = host.brandConventionsPath;
-  let content;
-  try {
-    content = await fs.readFile(file, 'utf8');
-  } catch (err) {
-    if (err.code === 'ENOENT') return check('conventions', 'ok', `${file} (not found; optional)`);
-    return check('conventions', 'fail', `cannot read ${file}: ${err.message}`);
-  }
-  return content.trim()
-    ? check('conventions', 'ok', `${file} (found)`)
-    : check('conventions', 'warn', `${file} (found but empty)`);
-}
-
-export async function rulesCheck(host, record) {
-  if (!record) return check('rules', 'warn', 'cannot check before installation');
-  if (!record.rules) {
-    return check('rules', 'warn', 'rules were not installed by this installation; install or update will add them');
-  }
-  let registry;
-  try {
-    registry = await readRulesRegistry(host);
-  } catch (err) {
-    // Keep every diagnostic visible: package removal on a broken registry left the host without its watchdog.
-    return check('rules', 'fail', err.message);
-  }
-  const ownerNote = registry?.owners.length > 1 ? `; ${registry.owners.length} owners` : '';
-  const fingerprint = await fileFingerprint(record.rules.path);
-  if (!fingerprint) return check('rules', 'fail', `${record.rules.path}${ownerNote ? ` (${registry.owners.length} owners)` : ''}`);
-  return fingerprint === record.rules.fingerprint
-    ? check('rules', 'ok', `${record.rules.path} (matches record${ownerNote})`)
-    : check('rules', 'warn', `${record.rules.path} (modified after installation${ownerNote})`);
-}
-
-export async function permissionsCheck(host) {
-  try {
-    const status = await inspectPermissions(host.settingsPath);
-    // Permission rules are an optional operator action; Plan_22 keeps their absence a warning so
-    // doctor does not turn a healthy installation red merely because hardening was not requested.
-    // The ask count is part of the line because a full set shadowed by `ask` reads as working and
-    // is not: the live run of Plan_22-1 found this line saying `installed (24/24)` over it.
-    const shadow = status.askCount ? `, ${status.askCount} shadowed by ask` : '';
-    return check('permissions', status.state === 'installed' ? 'ok' : 'warn',
-      `${status.state} (${status.present}/${status.total} own strings in ${RULE_LIST_NAMES}${shadow})`);
-  } catch (err) {
-    return check('permissions', 'warn', `cannot inspect permission rules: ${err.message}`);
-  }
-}
+/** Reports whether what this package installed into the host still matches the package. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {
+  buildInstallPlan,
+  contentFingerprint,
+  fileFingerprint,
+} from './manifest.mjs';
+import { plannedContent } from './copy.mjs';
+import { RULE_LIST_NAMES, inspectPermissions } from './permissions.mjs';
+import { readRulesRegistry } from './rules-owners.mjs';
+import { parseFrontmatter } from '../src/home/lib/frontmatter.mjs';
+import { check } from './doctor-format.mjs';
+
+export async function exists(target) {
+  try {
+    await fs.access(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function isFile(target) {
+  try {
+    return (await fs.stat(target)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+export async function agentsCheck(host, record) {
+  if (!record) return check('agents', 'warn', 'Agent definitions were not checked; run codex-bridge install');
+  const plan = await buildInstallPlan(host);
+  // Selected by where the file lands, not by where it comes from: Plan_64 B1 moved the sources
+  // under src/claude/, a source-path pattern matched nothing, and this check reported
+  // "0 installed agent definition(s) match" as ok.
+  const agents = plan.filter((item) => path.dirname(item.target) === host.agentsDir && item.target.endsWith('.md'));
+  if (agents.length === 0) return check('agents', 'fail', 'This package plans no agent definitions; the package tree is broken');
+  const mismatches = [];
+  const unreadable = [];
+  for (const item of agents) {
+    const expected = contentFingerprint(await plannedContent(item, host.brandRoot));
+    if (await fileFingerprint(item.target) !== expected) mismatches.push(path.basename(item.target));
+    const expectedName = path.basename(item.source, '.md');
+    try {
+      const frontmatter = parseFrontmatter(await fs.readFile(item.target, 'utf8'));
+      if (!frontmatter) throw new Error('frontmatter is missing');
+      if (frontmatter.name !== expectedName) {
+        throw new Error(`name is ${JSON.stringify(frontmatter.name)}, expected ${JSON.stringify(expectedName)}`);
+      }
+    } catch (err) {
+      unreadable.push(`${path.basename(item.target)} (${err.message})`);
+    }
+  }
+  // The 2026-08-10 registration failure left files present but unreadable by Claude Code. Drift was
+  // advisory until a 2026-08-16 checklist run planted the pre-Plan_41 invocation — a path instead of
+  // the package command — in an installed definition: doctor kept exit 0 while every delegation
+  // would stop on a permission prompt. A definition that is not this package's is not judged healthy.
+  if (unreadable.length) {
+    return check('agents', 'fail', `Installed agent definitions cannot be read: ${unreadable.join(', ')}; run codex-bridge update --force`);
+  }
+  return mismatches.length
+    ? check('agents', 'fail', `Installed agent definitions differ from this package: ${mismatches.join(', ')}; run codex-bridge update --force`)
+    : check('agents', 'ok', `${agents.length} installed agent definition(s) match this package`);
+}
+
+export async function claudeRulesCheck(host, record) {
+  if (!record) return check('claudeRules', 'warn', 'Host rules were not checked; run codex-bridge install');
+  const plan = await buildInstallPlan(host);
+  // Plan_64 B1: source-path selection hid an empty plan as a healthy installation.
+  const rules = plan.filter((item) => path.dirname(item.target) === host.rulesDir);
+  if (rules.length === 0) return check('claudeRules', 'fail', 'This package plans no host rules; the package tree is broken');
+  const mismatches = [];
+  for (const item of rules) {
+    const expected = contentFingerprint(await plannedContent(item, host.brandRoot));
+    if (await fileFingerprint(item.target) !== expected) mismatches.push(path.basename(item.target));
+  }
+  // Plan_64 B3: equal bytes imply no paths frontmatter; tests/claude-rules-core.test.mjs guards the package core.
+  return mismatches.length
+    ? check('claudeRules', 'fail', `Host rules differ from this package or are missing: ${mismatches.join(', ')}; run codex-bridge update --force`)
+    : check('claudeRules', 'ok', `${rules.length} host rules file(s) match this package`);
+}
+
+export async function conventionsCheck(host) {
+  const file = host.brandConventionsPath;
+  let content;
+  try {
+    content = await fs.readFile(file, 'utf8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return check('conventions', 'ok', `${file} (not found; optional)`);
+    return check('conventions', 'fail', `cannot read ${file}: ${err.message}`);
+  }
+  return content.trim()
+    ? check('conventions', 'ok', `${file} (found)`)
+    : check('conventions', 'warn', `${file} (found but empty)`);
+}
+
+export async function rulesCheck(host, record) {
+  if (!record) return check('rules', 'warn', 'cannot check before installation');
+  if (!record.rules) {
+    return check('rules', 'warn', 'rules were not installed by this installation; install or update will add them');
+  }
+  let registry;
+  try {
+    registry = await readRulesRegistry(host);
+  } catch (err) {
+    // Keep every diagnostic visible: package removal on a broken registry left the host without its watchdog.
+    return check('rules', 'fail', err.message);
+  }
+  const ownerNote = registry?.owners.length > 1 ? `; ${registry.owners.length} owners` : '';
+  const fingerprint = await fileFingerprint(record.rules.path);
+  if (!fingerprint) return check('rules', 'fail', `${record.rules.path}${ownerNote ? ` (${registry.owners.length} owners)` : ''}`);
+  return fingerprint === record.rules.fingerprint
+    ? check('rules', 'ok', `${record.rules.path} (matches record${ownerNote})`)
+    : check('rules', 'warn', `${record.rules.path} (modified after installation${ownerNote})`);
+}
+
+export async function permissionsCheck(host) {
+  try {
+    const status = await inspectPermissions(host.settingsPath);
+    // Permission rules are an optional operator action; Plan_22 keeps their absence a warning so
+    // doctor does not turn a healthy installation red merely because hardening was not requested.
+    // The ask count is part of the line because a full set shadowed by `ask` reads as working and
+    // is not: the live run of Plan_22-1 found this line saying `installed (24/24)` over it.
+    const shadow = status.askCount ? `, ${status.askCount} shadowed by ask` : '';
+    return check('permissions', status.state === 'installed' ? 'ok' : 'warn',
+      `${status.state} (${status.present}/${status.total} own strings in ${RULE_LIST_NAMES}${shadow})`);
+  } catch (err) {
+    return check('permissions', 'warn', `cannot inspect permission rules: ${err.message}`);
+  }
+}

package/cli/doctor-load-witness.mjs

@@ -0,0 +1,75 @@
+/**
+ * Plan_64 D11: the 2026-10-10 live run proved memory_type and entrypoint unreliable;
+ * A6 showed a lost hook record cannot prove failure. Judge one host's rules-core load evidence.
+ */
+import path from 'node:path';
+import { buildInstallPlan, contentFingerprint } from './manifest.mjs';
+import { plannedContent } from './copy.mjs';
+import { check } from './doctor-format.mjs';
+import { LOAD_WITNESS_FILE, readLoadWitness } from '../src/home/lib/load-witness.mjs';
+import { transcriptHostVersion } from '../src/home/lib/host-version.mjs';
+
+function normalizedPath(target) {
+  const resolved = path.resolve(target).replaceAll('\\', '/');
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+export async function loadWitnessChecks({ host, record, stateDir, activeHosts, readVersion = transcriptHostVersion }) {
+  if (!record) return [check('claudeRulesLoad', 'warn', 'not checked before installation')];
+  const witness = readLoadWitness({ stateDir });
+  if (witness.corrupt) {
+    return [check('claudeRulesLoad', 'warn', `load witness is unreadable: ${path.join(stateDir, LOAD_WITNESS_FILE)}`)];
+  }
+  const plan = await buildInstallPlan(host);
+  const expected = new Map();
+  for (const item of plan.filter((item) => path.dirname(item.target) === host.rulesDir)) {
+    expected.set(normalizedPath(item.target), contentFingerprint(await plannedContent(item, host.brandRoot)));
+  }
+  const byVersion = new Map();
+  let pending = 0;
+  for (const [sessionId, session] of Object.entries(witness.sessions)) {
+    if (!Array.isArray(session?.loads)) continue;
+    const loads = session.loads.filter((load) => typeof load?.path === 'string'
+      && expected.has(normalizedPath(load.path)));
+    if (!loads.length) continue;
+    // D11: use the witness session, never a neighboring transcript entry or the current PATH host.
+    const version = await readVersion(session.transcriptPath, { sessionId });
+    if (version === null) {
+      if (loads.some((load) => load.sha256 === expected.get(normalizedPath(load.path)))) pending += 1;
+      continue;
+    }
+    const entries = byVersion.get(version) ?? [];
+    for (const load of loads) {
+      entries.push({ sessionId, at: load.at, matches: load.sha256 === expected.get(normalizedPath(load.path)),
+        hashSkippedReason: load.hashSkippedReason });
+    }
+    byVersion.set(version, entries);
+  }
+  const pendingNote = pending ? ` (${pending} session(s) awaiting their transcript)` : '';
+  const versions = activeHosts.length ? [...new Set(activeHosts)]
+    : [...byVersion].filter(([, entries]) => entries.some((entry) => entry.matches
+      || entry.hashSkippedReason === 'core-too-large')).map(([version]) => version);
+  if (!versions.length) {
+    return [check('claudeRulesLoad', 'warn',
+      `no session has witnessed the rules core loading yet; open a new Claude Code session${pendingNote}`)];
+  }
+  return versions.map((version) => {
+    const entries = byVersion.get(version) ?? [];
+    const verified = entries.filter((entry) => entry.matches);
+    const latest = [...entries].sort((a, b) => String(b.at).localeCompare(String(a.at)))[0];
+    // D15 / review B8: an oversized newest load cannot be proof, even after an older matching load.
+    if (latest?.hashSkippedReason === 'core-too-large') {
+      return check(`claudeRulesLoad:${version}`, 'warn',
+        `rules core hash skipped: core-too-large (host ${version}, latest ${latest.at})${pendingNote}`);
+    }
+    // D11: a newer load of another package hash invalidates the older positive witness.
+    if (latest?.matches && verified.length) {
+      const count = new Set(verified.map((entry) => entry.sessionId)).size;
+      return check(`claudeRulesLoad:${version}`, 'ok',
+        `rules core load witnessed (${count} session(s), latest ${latest.at})${pendingNote}`);
+    }
+    const stale = latest && !latest.matches ? '; witnessed core differs from this package (stale)' : '';
+    return check(`claudeRulesLoad:${version}`, 'warn',
+      `no session on host ${version} has witnessed the rules core loading yet${stale}; open a new Claude Code session, then rerun codex-bridge doctor${pendingNote}`);
+  });
+}