@principles/pd-cli 1.147.5 → 1.147.7

package/tests/commands/health-codex.test.ts

@@ -1,50 +1,123 @@
 /**
- * pd health --host codex command unit tests.
+ * pd health --host codex command tests — §15 health surface (Slice D).
+ *
+ * Module-boundary mock style (the handler is a read-model aggregator): every
+ * collaborator is mocked, the handler logic (§15 ready conjunction, consent
+ * states, blockers, exit codes) is exercised for real.
  *
  * Covers:
- * - cli-1: JSON mode outputs exactly one parseable JSON object.
- * - cli-2: exit paths stop execution (process.exitCode set, no later side effects).
- * - cli-5: failure paths do not mutate state (read-only).
- * - cli-6: every degraded result includes reason + nextAction.
- * - flag-off path (host.codex disabled → warning + exitCode).
- * - hooks trust undetectable (no ~/.codex) → reason + nextAction.
- * - dual registration detection (global hooks.json present → reason + nextAction).
- * - happy path (flag on, hooks trusted) → clean JSON, no warnings.
+ * - cli-1: --json outputs exactly one parseable JSON object.
+ * - §15 ready conjunction: full green ⇒ ready + exit 0.
+ * - "unknown is not healthy": a degraded section ⇒ not ready + blocker.
+ * - consent: flag_on_without_consent blocker; stale disclosure; decline.
+ * - admissions without task ⇒ blocker with `pd codex reconcile` nextAction.
+ * - hooks trust untrusted ⇒ blocker + exit 1.
+ * - legacy dual registration ⇒ migration nextAction (§17 retirement).
+ * - worker mode manual_action_required/degraded ⇒ not ready.
+ * - per-rollout lag detection from checkpoint + transcript stat.
  */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 const {
   mockResolveNearestPdWorkspace,
   mockLoadPdConfigForPlugin,
   mockComputeFeatureFlagsFromConfig,
   mockIsFeatureEnabled,
+  mockReadCodexIngestionConsent,
+  mockDeriveConsentState,
+  mockListGovernanceCheckpoints,
+  mockReadObservationStats,
+  mockReadAdmissionCounts,
+  mockComputeWorkerMode,
+  mockLocateTranscript,
+  mockGetInstallLayoutPaths,
+  mockParseInstallManifest,
   mockExistsSync,
   mockReadFileSync,
+  mockStatSync,
   mockHomedir,
   mockRequireResolve,
   mockConsoleLog,
   mockConsoleWarn,
-} = vi.hoisted(() => {
-  return {
-    mockResolveNearestPdWorkspace: vi.fn(),
-    mockLoadPdConfigForPlugin: vi.fn(),
-    mockComputeFeatureFlagsFromConfig: vi.fn(),
-    mockIsFeatureEnabled: vi.fn(),
-    mockExistsSync: vi.fn(),
-    mockReadFileSync: vi.fn(),
-    mockHomedir: vi.fn(),
-    mockRequireResolve: vi.fn(),
-    mockConsoleLog: vi.fn(),
-    mockConsoleWarn: vi.fn(),
-  };
-});
+} = vi.hoisted(() => ({
+  mockResolveNearestPdWorkspace: vi.fn(),
+  mockLoadPdConfigForPlugin: vi.fn(),
+  mockComputeFeatureFlagsFromConfig: vi.fn(),
+  mockIsFeatureEnabled: vi.fn(),
+  mockReadCodexIngestionConsent: vi.fn(),
+  mockDeriveConsentState: vi.fn(),
+  mockListGovernanceCheckpoints: vi.fn(),
+  mockReadObservationStats: vi.fn(),
+  mockReadAdmissionCounts: vi.fn(),
+  mockComputeWorkerMode: vi.fn(),
+  mockLocateTranscript: vi.fn(),
+  mockGetInstallLayoutPaths: vi.fn(),
+  mockParseInstallManifest: vi.fn(),
+  mockExistsSync: vi.fn(),
+  mockReadFileSync: vi.fn(),
+  mockStatSync: vi.fn(),
+  mockHomedir: vi.fn(),
+  mockRequireResolve: vi.fn(),
+  mockConsoleLog: vi.fn(),
+  mockConsoleWarn: vi.fn(),
+}));
 
 vi.mock('@principles/host-runtime', () => ({
-  resolveNearestPdWorkspace: mockResolveNearestPdWorkspace,
   loadPdConfigForPlugin: mockLoadPdConfigForPlugin,
+  resolveNearestPdWorkspace: mockResolveNearestPdWorkspace,
+  readCodexIngestionConsent: mockReadCodexIngestionConsent,
+  deriveCodexIngestionConsentState: mockDeriveConsentState,
+  listGovernanceCheckpoints: mockListGovernanceCheckpoints,
+  readGovernanceObservationStats: mockReadObservationStats,
+  readGovernanceAdmissionCounts: mockReadAdmissionCounts,
+  detectLegacyCodexHookRegistration: (hooksJsonPath?: string) => {
+    // Mirrors the host-runtime FS edge: read via the mocked fs, delegate the
+    // parse semantics (marker + legacy async PostToolUse) exactly as
+    // codex-legacy-registration.ts does over @principles/core/host.
+    try {
+      const parsed = JSON.parse(mockReadFileSync(hooksJsonPath ?? '/fake/home/.codex/hooks.json', 'utf8')) as Record<string, unknown>;
+      const result = { detected: false, legacyAsyncPostToolUse: false };
+      for (const eventName of ['PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'SessionStart']) {
+        const groups = parsed[eventName];
+        if (!Array.isArray(groups)) continue;
+        for (const group of groups) {
+          if (typeof group !== 'object' || group === null || !Object.hasOwn(group, '__pd_marker') || (group as Record<string, unknown>).__pd_marker !== 'pd-owned') continue;
+          result.detected = true;
+          const entries = (group as Record<string, unknown>).hooks;
+          if (Array.isArray(entries)) {
+            for (const entry of entries) {
+              if (typeof entry === 'object' && entry !== null && eventName === 'PostToolUse' && Object.hasOwn(entry, 'async') && (entry as Record<string, unknown>).async === true) {
+                result.legacyAsyncPostToolUse = true;
+              }
+            }
+          }
+        }
+      }
+      return result;
+    } catch {
+      return { detected: false, legacyAsyncPostToolUse: false };
+    }
+  },
+  CODEX_INGESTION_DISCLOSURE_VERSION: 'g2a-2026-08-28',
+}));
+
+vi.mock('@principles/codex-adapter', () => ({
+  computeCodexWorkerStatusMode: mockComputeWorkerMode,
+  locateCodexTranscriptByRolloutIdentity: mockLocateTranscript,
+  CODEX_INGESTION_MIN_VERSION: '0.148.0',
+  CODEX_INGESTION_VERIFIED_VERSION: '0.150.1',
+}));
+
+vi.mock('@principles/install-layout', () => ({
+  getInstallLayoutPaths: mockGetInstallLayoutPaths,
+  parseInstallManifest: mockParseInstallManifest,
 }));
 
 vi.mock('@principles/core/runtime-v2', () => ({
+  SqliteConnection: class {},
+  SqliteTaskStore: class {
+    listTasks = vi.fn().mockResolvedValue([]);
+  },
   computeFeatureFlagsFromConfig: mockComputeFeatureFlagsFromConfig,
   isFeatureEnabled: mockIsFeatureEnabled,
 }));
@@ -56,188 +129,221 @@ vi.mock('../../src/resolve-workspace.js', () => ({
 vi.mock('fs', () => ({
   existsSync: mockExistsSync,
   readFileSync: mockReadFileSync,
+  statSync: mockStatSync,
 }));
 
 vi.mock('os', () => ({
+  default: { homedir: mockHomedir, userInfo: vi.fn().mockReturnValue({ username: 'tester' }) },
   homedir: mockHomedir,
+  userInfo: vi.fn().mockReturnValue({ username: 'tester' }),
 }));
 
 vi.mock('module', () => ({
-  createRequire: () => ({
-    resolve: mockRequireResolve,
-  }),
+  createRequire: () => ({ resolve: mockRequireResolve }),
 }));
 
 import { handleHealthCodex } from '../../src/commands/health-codex.js';
 
-describe('pd health --host codex', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    process.exitCode = undefined;
-    mockHomedir.mockReturnValue('/fake/home');
-    mockRequireResolve.mockImplementation((name: string) => `/fake/node_modules/${name}/package.json`);
-    mockReadFileSync.mockImplementation((p: string) => {
-      if (typeof p === 'string' && p.includes('package.json')) {
-        return JSON.stringify({ version: '0.1.0' });
-      }
-      return '';
-    });
-    mockResolveNearestPdWorkspace.mockReturnValue({
-      ok: true,
-      workspaceDir: '/fake/workspace',
-      configPath: '/fake/workspace/.pd/config.yaml',
-      source: 'nearest',
-    });
-    mockLoadPdConfigForPlugin.mockReturnValue({
-      ok: true,
-      effective: {},
-      source: 'user_config',
-      configPath: '/fake/workspace/.pd/config.yaml',
-      warnings: [],
-      errors: [],
-    });
-    mockComputeFeatureFlagsFromConfig.mockReturnValue({ flags: {} });
-    mockIsFeatureEnabled.mockReturnValue(true);
-    // No ~/.codex by default → hooks trust undetectable
-    mockExistsSync.mockImplementation((p: string) => !p.includes('.codex'));
-    mockConsoleLog.mockImplementation(() => {});
-    mockConsoleWarn.mockImplementation(() => {});
-    vi.spyOn(console, 'log').mockImplementation(mockConsoleLog);
-    vi.spyOn(console, 'warn').mockImplementation(mockConsoleWarn);
-  });
-
-  afterEach(() => {
-    process.exitCode = undefined;
-    vi.restoreAllMocks();
+function flagMap(): Record<string, { enabled: boolean }> {
+  return {
+    'host.codex': { enabled: true },
+    codex_conversation_ingestion: { enabled: true },
+  };
+}
+
+function grantedConsentRecord(): Record<string, unknown> {
+  return { decision: 'granted', disclosureVersion: 'g2a-2026-08-28', decidedAt: '2026-09-06T00:00:00.000Z', decidedVia: 'pd_codex_setup', schemaVersion: '1' };
+}
+
+function greenSetup(): void {
+  mockResolveNearestPdWorkspace.mockReturnValue({ ok: true, workspaceDir: '/fake/workspace', configPath: '/fake/workspace/.pd/config.yaml', source: 'nearest' });
+  mockLoadPdConfigForPlugin.mockReturnValue({ ok: true, source: 'user_config', effective: {}, configPath: '/fake/workspace/.pd/config.yaml', warnings: [], errors: [] });
+  mockComputeFeatureFlagsFromConfig.mockReturnValue({ flags: flagMap() });
+  mockIsFeatureEnabled.mockImplementation((_flags: unknown, id: string) => (flagMap())[id]?.enabled ?? false);
+  mockReadCodexIngestionConsent.mockReturnValue({ ok: true, existed: true, record: grantedConsentRecord() });
+  mockDeriveConsentState.mockReturnValue('granted');
+  mockListGovernanceCheckpoints.mockReturnValue({ ok: true, checkpoints: [] });
+  mockReadObservationStats.mockReturnValue({ ok: true, stats: { operational: 3, promoted: 1, quarantined: 0, terminalOther: 0, nextExpiryAt: '2026-09-07T00:00:00.000Z', lastObservationAt: '2026-09-06T00:00:00.000Z' } });
+  mockReadAdmissionCounts.mockReturnValue({ ok: true, counts: { admitted: 1, admittedWithoutTask: 0, pendingTails: 0, staleTails: 0, completedTails: 1, lastAdmissionAt: '2026-09-06T00:00:00.000Z' } });
+  mockComputeWorkerMode.mockReturnValue({ mode: 'ready' });
+  mockLocateTranscript.mockReturnValue({ ok: false, reason: 'not_found' });
+  mockGetInstallLayoutPaths.mockReturnValue({ manifest: '/fake/manifest.json' });
+  mockParseInstallManifest.mockReturnValue({ manifest: { workspaces: ['/fake/workspace'] } });
+  // Green hooks environment: ~/.codex exists with config.toml hooks = true.
+  // NOTE: the handler joins paths with the REAL path module, so on Windows
+  // the separators are backslashes — match by suffix, never full equality.
+  mockHomedir.mockReturnValue('/fake/home');
+  mockExistsSync.mockImplementation((candidate: string | Buffer) => {
+    const value = String(candidate);
+    return value.endsWith('.codex') || value.endsWith('config.toml');
   });
-
-  it('cli-1: --json outputs exactly one parseable JSON object on stdout', async () => {
-    // ~/.codex exists with trusted hooks for happy path
-    mockExistsSync.mockImplementation((p: string) => true);
-    mockReadFileSync.mockImplementation((p: string) => {
-      if (typeof p === 'string' && p.includes('package.json')) return JSON.stringify({ version: '0.1.0' });
-      if (typeof p === 'string' && p.includes('config.toml')) return '[features]\nhooks = true\n';
-      return '';
-    });
-
-    await handleHealthCodex({ json: true });
-
-    expect(mockConsoleLog).toHaveBeenCalledTimes(1);
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.host).toBe('codex');
-    expect(parsed.adapterVersion).toBe('0.1.0');
-    expect(parsed.runtimeVersion).toBe('0.1.0');
-    expect(parsed.featureFlag.enabled).toBe(true);
-    expect(parsed.hooksTrust.detectable).toBe(true);
-    expect(parsed.hooksTrust.trusted).toBe(true);
-    expect(process.exitCode).toBeUndefined();
+  mockRequireResolve.mockImplementation((name: string) => `/fake/node_modules/${name}/package.json`);
+  mockReadFileSync.mockImplementation((candidate: string | Buffer) => {
+    const value = String(candidate);
+    if (value.endsWith('config.toml')) return '[features]\nhooks = true\n';
+    if (value.includes('package.json')) return JSON.stringify({ version: '0.1.0' });
+    return '';
   });
+  mockStatSync.mockReturnValue({ size: 0 });
+}
+
+async function runJson(): Promise<Record<string, unknown>> {
+  await handleHealthCodex({ json: true });
+  expect(mockConsoleLog).toHaveBeenCalledTimes(1);
+  return JSON.parse(mockConsoleLog.mock.calls[0]?.[0] as string) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  greenSetup();
+  vi.spyOn(console, 'log').mockImplementation(mockConsoleLog);
+  vi.spyOn(console, 'warn').mockImplementation(mockConsoleWarn);
+});
 
-  it('cli-6: when ~/.codex is missing, reports reason + nextAction', async () => {
-    mockExistsSync.mockImplementation((p: string) => !p.includes('.codex'));
-
-    await handleHealthCodex({ json: true });
+afterEach(() => {
+  process.exitCode = undefined;
+  vi.restoreAllMocks();
+});
 
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.hooksTrust.detectable).toBe(false);
-    expect(parsed.hooksTrust.reason).toBe('codex_config_dir_not_found');
-    expect(parsed.hooksTrust.nextAction).toContain('Install Codex CLI');
-    expect(parsed.warnings).toContainEqual(expect.stringContaining('hooks_trust'));
+describe('pd health --host codex — §15 ready semantics', () => {
+  it('cli-1 + full green ⇒ ready true, exit 0, one JSON object with §15 fields', async () => {
+    const report = await runJson();
+    expect(report.ready, JSON.stringify(report.readyBlockers)).toBe(true);
+    expect(report.readyBlockers).toHaveLength(0);
+    expect(report.host).toBe('codex');
+    expect(report.codexIngestionMinVersion).toBe('0.148.0');
+    expect((report.consent as { state: string }).state).toBe('granted');
+    expect((report.workspaceInit as { initialized: boolean }).initialized).toBe(true);
+    expect((report.observations as { operational: number }).operational).toBe(3);
+    expect((report.diagnosticianTasks as { pending: number }).pending).toBe(0);
+    expect(process.exitCode ?? 0).toBe(0);
   });
 
-  it('flag-off + hooks untrusted → exitCode 1', async () => {
-    mockIsFeatureEnabled.mockReturnValue(false);
-    mockExistsSync.mockImplementation((p: string) => !p.includes('.codex'));
-
-    await handleHealthCodex({ json: true });
-
+  it('untrusted hooks ⇒ not ready with blocker and exit 1', async () => {
+    mockExistsSync.mockImplementation((candidate: string | Buffer) => String(candidate).endsWith('config.toml'));
+    mockReadFileSync.mockImplementation((candidate: string | Buffer) => (String(candidate).endsWith('config.toml') ? '[features]\nhooks = false\n' : ''));
+    const report = await runJson();
+    expect(report.ready).toBe(false);
+    expect((report.readyBlockers as string[]).some((blocker) => blocker.startsWith('hooks_trust'))).toBe(true);
     expect(process.exitCode).toBe(1);
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.featureFlag.enabled).toBe(false);
   });
 
-  it('cli-6: config.toml exists but hooks setting missing → reason + nextAction', async () => {
-    mockExistsSync.mockImplementation((p: string) => true);
-    mockReadFileSync.mockImplementation((p: string) => {
-      if (typeof p === 'string' && p.includes('package.json')) return JSON.stringify({ version: '0.1.0' });
-      if (typeof p === 'string' && p.includes('config.toml')) return '[features]\nmodel = "gpt-4"\n';
-      return '';
-    });
-
-    await handleHealthCodex({ json: true });
-
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.hooksTrust.detectable).toBe(false);
-    expect(parsed.hooksTrust.reason).toBe('hooks_setting_not_found_in_config');
-    expect(parsed.hooksTrust.nextAction).toContain('/hooks');
+  it('degraded admission counts ⇒ unknown is not healthy (§15)', async () => {
+    mockReadAdmissionCounts.mockReturnValue({ ok: false, reason: 'governance_admission_counts_unavailable', nextAction: 'inspect trajectory.db' });
+    const report = await runJson();
+    expect(report.ready).toBe(false);
+    expect((report.readyBlockers as string[]).some((blocker) => blocker.startsWith('admissions'))).toBe(true);
+    expect((report.admissions as { reason: string }).reason).toBe('governance_admission_counts_unavailable');
   });
 
-  it('dual registration: global hooks.json present → detected + reason + nextAction', async () => {
-    mockExistsSync.mockImplementation((p: string) => true);
-    mockReadFileSync.mockImplementation((p: string) => {
-      if (typeof p === 'string' && p.includes('package.json')) return JSON.stringify({ version: '0.1.0' });
-      if (typeof p === 'string' && p.includes('config.toml')) return '[features]\nhooks = true\n';
-      return '';
-    });
-
-    await handleHealthCodex({ json: true });
-
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.dualRegistration.detected).toBe(true);
-    expect(parsed.dualRegistration.globalHooksPath).toContain('hooks.json');
-    expect(parsed.dualRegistration.reason).toBe('global_hooks_json_present');
-    expect(parsed.dualRegistration.nextAction).toContain('double-registration');
+  it('admitted pains without task ⇒ blocker recommending reconcile', async () => {
+    mockReadAdmissionCounts.mockReturnValue({ ok: true, counts: { admitted: 2, admittedWithoutTask: 1, pendingTails: 0, staleTails: 0, completedTails: 0, lastAdmissionAt: null } });
+    const report = await runJson();
+    expect(report.ready).toBe(false);
+    const blocker = (report.readyBlockers as string[]).find((entry) => entry.startsWith('admissions'));
+    expect(blocker).toContain('reconcile');
   });
 
-  it('cli-5: workspace not resolved does not mutate state, reports warning', async () => {
-    mockResolveNearestPdWorkspace.mockReturnValue({
-      ok: false,
-      cwd: '/fake/workspace',
-      reason: 'config_not_found',
-      nextAction: 'Create .pd/config.yaml',
-    });
+  it('worker degraded ⇒ not ready', async () => {
+    mockComputeWorkerMode.mockReturnValue({ mode: 'degraded', reason: 'workspace_missing', nextAction: 'restore the workspace' });
+    const report = await runJson();
+    expect(report.ready).toBe(false);
+    expect((report.worker as { mode: string }).mode).toBe('degraded');
+  });
 
-    await handleHealthCodex({ json: true });
+  it('no Companion worker ⇒ manual_action_required, never ready (no automatic closure)', async () => {
+    mockParseInstallManifest.mockReturnValue({ manifest: { workspaces: [] } });
+    mockComputeWorkerMode.mockReturnValue({ mode: 'manual_action_required', reason: 'workspace_not_in_install_manifest' });
+    const report = await runJson();
+    expect((report.worker as { mode: string }).mode).toBe('manual_action_required');
+    expect(report.ready).toBe(false);
+  });
 
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.workspace).toBe('/fake/workspace');
-    expect(parsed.featureFlag.enabled).toBe(false);
-    expect(parsed.featureFlag.source).toBe('defaults');
-    expect(parsed.warnings).toContainEqual(expect.stringContaining('workspace_not_resolved'));
+  it('diagnostician needs_human_review tasks ⇒ not ready with review blocker', async () => {
+    // Override the task store default via the mocked class instance.
+    const coreModule = (await vi.importMock('@principles/core/runtime-v2')) as { SqliteTaskStore: new () => { listTasks: (filter: { status: string }) => Promise<unknown[]> } };
+    const original = coreModule.SqliteTaskStore;
+    class FakeStore {
+      listTasks(filter: { status: string }): Promise<unknown[]> {
+        return Promise.resolve(filter.status === 'needs_human_review' ? [{ id: 't1' }] : []);
+      }
+    }
+    vi.doMock('@principles/core/runtime-v2', () => ({ SqliteConnection: class {}, SqliteTaskStore: FakeStore, computeFeatureFlagsFromConfig: mockComputeFeatureFlagsFromConfig, isFeatureEnabled: mockIsFeatureEnabled }));
+    void original;
+    vi.resetModules();
+    const { handleHealthCodex: freshHandler } = await import('../../src/commands/health-codex.js');
+    await freshHandler({ json: true });
+    const output = mockConsoleLog.mock.calls[mockConsoleLog.mock.calls.length - 1]?.[0] as string;
+    const report = JSON.parse(output) as { ready: boolean; readyBlockers: string[] };
+    expect(report.ready).toBe(false);
+    expect(report.readyBlockers.some((blocker) => blocker.includes('human review'))).toBe(true);
+    process.exitCode = undefined;
   });
+});
 
-  it('text output includes nextAction for degraded hooks trust', async () => {
-    mockExistsSync.mockImplementation((p: string) => !p.includes('.codex'));
+describe('pd health --host codex — consent surface (no captured text)', () => {
+  it('flag on without consent record ⇒ governance blocker with setup nextAction', async () => {
+    mockReadCodexIngestionConsent.mockReturnValue({ ok: true, existed: false, record: null });
+    mockDeriveConsentState.mockReturnValue('flag_on_without_grant');
+    const report = await runJson();
+    const consent = report.consent as { state: string; nextAction?: string };
+    expect(consent.state).toBe('flag_on_without_grant');
+    expect(consent.nextAction).toContain('pd codex setup');
+    expect(report.ready).toBe(false);
+  });
 
-    await handleHealthCodex({ json: false });
+  it('declined consent with flag off does not block readiness on consent', async () => {
+    mockIsFeatureEnabled.mockImplementation((_flags: unknown, id: string) => id === 'host.codex');
+    mockReadCodexIngestionConsent.mockReturnValue({ ok: true, existed: true, record: { ...grantedConsentRecord(), decision: 'revoked' } });
+    mockDeriveConsentState.mockReturnValue('revoked');
+    const report = await runJson();
+    expect((report.consent as { state: string }).state).toBe('revoked');
+    expect((report.readyBlockers as string[]).some((blocker) => blocker.startsWith('consent'))).toBe(false);
+  });
 
-    const calls = mockConsoleLog.mock.calls.map((c) => c[0] as string);
-    expect(calls.some((s) => s.includes('hooksTrust.nextAction:'))).toBe(true);
-    expect(calls.some((s) => s.includes('host: codex'))).toBe(true);
-    expect(mockConsoleWarn).toHaveBeenCalled();
+  it('stale disclosure version is surfaced as re-consent nextAction', async () => {
+    mockReadCodexIngestionConsent.mockReturnValue({ ok: true, existed: true, record: { ...grantedConsentRecord(), disclosureVersion: 'g2a-2020-01-01' } });
+    const report = await runJson();
+    expect((report.consent as { disclosureStale: boolean }).disclosureStale).toBe(true);
   });
+});
 
-  it('adapter/runtime version unknown when package.json unreadable', async () => {
-    mockRequireResolve.mockImplementation(() => {
-      throw new Error('not found');
+describe('pd health --host codex — legacy registration (§17 retirement)', () => {
+  it('legacy async PostToolUse registration ⇒ migration nextAction', async () => {
+    mockHomedir.mockReturnValue('/fake/home');
+    mockExistsSync.mockImplementation((candidate: string | Buffer) => {
+      const value = String(candidate);
+      return value.endsWith('.codex') || value.endsWith('hooks.json') || value.endsWith('config.toml');
     });
-    mockExistsSync.mockImplementation((p: string) => true);
-    mockReadFileSync.mockImplementation((p: string) => {
-      if (typeof p === 'string' && p.includes('config.toml')) return '[features]\nhooks = true\n';
+    mockReadFileSync.mockImplementation((candidate: string | Buffer) => {
+      const value = String(candidate);
+      if (value.endsWith('hooks.json')) {
+        return JSON.stringify({
+          PreToolUse: [{ matcher: 'Bash|apply_patch', hooks: [{ type: 'command', command: 'node pd-hook.cjs' }], __pd_marker: 'pd-owned' }],
+          PostToolUse: [{ matcher: '.*', hooks: [{ type: 'command', command: 'node pd-hook.cjs', timeout: 5, async: true }], __pd_marker: 'pd-owned' }],
+        });
+      }
+      if (value.endsWith('config.toml')) return '[features]\nhooks = true\n';
+      if (value.includes('package.json')) return JSON.stringify({ version: '0.1.0' });
       return '';
     });
+    const report = await runJson();
+    expect((report.dualRegistration as { detected: boolean; legacyAsyncPostToolUse: boolean }).legacyAsyncPostToolUse, JSON.stringify(report.dualRegistration)).toBe(true);
+    expect((report.dualRegistration as { nextAction?: string }).nextAction).toContain('Marketplace');
+  });
+});
 
-    await handleHealthCodex({ json: true });
-
-    const output = mockConsoleLog.mock.calls[0][0] as string;
-    const parsed = JSON.parse(output);
-    expect(parsed.adapterVersion).toBe('unknown');
-    expect(parsed.runtimeVersion).toBe('unknown');
+describe('pd health --host codex — per-rollout lag', () => {
+  it('checkpoint lag over zero ⇒ rollout blocker with byte lag', async () => {
+    mockListGovernanceCheckpoints.mockReturnValue({
+      ok: true,
+      checkpoints: [{ hostKind: 'codex', rolloutIdentity: 'r-1', byteOffset: 10, lastOrdinal: 1, cliVersion: null, rootSessionId: 'root', incompleteTail: false, lastDegradationReason: null, lastDegradationOrdinal: null, updatedAt: '2026-09-06T00:00:00.000Z' }],
+    });
+    mockLocateTranscript.mockReturnValue({ ok: true, transcriptPath: '/fake/home/.codex/sessions/r-1.jsonl' });
+    mockStatSync.mockReturnValue({ size: 512 });
+    const report = await runJson();
+    expect(report.ready).toBe(false);
+    expect(((report.rollouts as { checkpoints: { lagBytes: number | null }[] }).checkpoints[0]?.lagBytes) ?? -1).toBe(502);
+    expect((report.readyBlockers as string[]).some((blocker) => blocker.includes('r-1'))).toBe(true);
   });
 });