@@ -279,6 +279,18 @@ loopx extension enable openviking-semantic-preference --execute --format json
 loopx extension install --bundled loopx-lark --execute --format json
 ```
 
+After an install, update, or rollback changes the active LoopX release,
+revalidate all enabled extension runtimes as one bounded read-only batch:
+
+```bash
+loopx extension doctor --all-enabled --execute --format json
+```
+
+The local installer runs this batch automatically. A passing doctor refreshes
+only the local runtime-identity proof; it grants no new provider permission and
+performs no connector write. Failed providers remain fail closed and the batch
+names the exact repair command.
+
 For a separately distributed provider, pass `--manifest <extension.toml>`.
 `upgrade` validates and probes the new manifest before changing the active
 revision. `rollback` probes the previous revision before switching back. A
@@ -524,10 +536,11 @@ authorization.
 `disable` is reversible, but `enable` never trusts an earlier readiness result:
 it reruns the configured doctor and changes the enabled bit only after that
 probe succeeds. A successful doctor binds readiness to both the active manifest
-revision and the resolved runtime identity. Missing or replaced executables,
-interpreters, or Python module sources fail closed until a new executed doctor
-succeeds; a failed executed doctor clears the stale proof without switching
-revisions.
+revision and a content-addressed runtime identity. Moving an unchanged release
+to a new install root, inode, or equivalent interpreter path preserves that
+identity; changed executable, interpreter, or Python module content fails closed
+until a new executed doctor succeeds. A failed executed doctor clears the stale
+proof without switching revisions.
 
 An enabled implementation is resolved by capability id and versioned protocol,
 then checked against its declared permission, current revision, and current
 
@@ -1,26 +1,26 @@
 from __future__ import annotations
 
 import argparse
-from collections.abc import Callable
 import json
-from pathlib import Path
 import sys
+from collections.abc import Callable
+from pathlib import Path
 
 from ..extensions.bundled import BUNDLED_EXTENSION_IDS, bundled_extension_manifest
 from ..extensions.presentation import publish_extension_projection
-from ..extensions.scaffold import scaffold_extension
 from ..extensions.runtime import (
     MAX_EXTENSION_REQUEST_BYTES,
     default_extension_state_file,
     disable_extension,
+    doctor_enabled_extensions,
     doctor_installed_extension,
     enable_extension,
     extension_status,
     install_extension,
     rollback_extension,
     run_standalone_extension,
 )
-
+from ..extensions.scaffold import scaffold_extension
 
 PrintPayload = Callable[
     [dict[str, object], str, Callable[[dict[str, object]], str]],
@@ -128,10 +128,21 @@ def register_extension_commands(
     for command in ("enable", "disable", "rollback", "doctor"):
         operation = commands.add_parser(command)
         _add_common(operation, add_subcommand_format)
-        operation.add_argument("extension_id")
+        if command == "doctor":
+            operation.add_argument("extension_id", nargs="?")
+        else:
+            operation.add_argument("extension_id")
         if command != "doctor":
             operation.add_argument("--execute", action="store_true")
         else:
+            operation.add_argument(
+                "--all-enabled",
+                action="store_true",
+                help=(
+                    "Revalidate every enabled extension after an install, update, "
+                    "or rollback."
+                ),
+            )
             operation.add_argument(
                 "--execute",
                 action="store_true",
@@ -253,11 +264,22 @@ def handle_extension_command(
                 execute=args.execute,
             )
         else:
-            payload = doctor_installed_extension(
-                args.extension_id,
-                state_file=state_file,
-                execute=args.execute,
-            )
+            if bool(args.extension_id) == bool(args.all_enabled):
+                raise ValueError(
+                    "extension doctor requires exactly one extension_id or "
+                    "--all-enabled"
+                )
+            if args.all_enabled:
+                payload = doctor_enabled_extensions(
+                    state_file=state_file,
+                    execute=args.execute,
+                )
+            else:
+                payload = doctor_installed_extension(
+                    args.extension_id,
+                    state_file=state_file,
+                    execute=args.execute,
+                )
     except ValueError as exc:
         payload = {
             "ok": False,
 
@@ -1,18 +1,18 @@
 from __future__ import annotations
 
-from collections.abc import Mapping
-from dataclasses import dataclass
 import hashlib
 import importlib.util
 import json
-from pathlib import Path
 import shutil
 import subprocess
 import sys
+from collections.abc import Mapping
+from dataclasses import dataclass
+from pathlib import Path
 from typing import Any
 
-
 EXTENSION_DOCTOR_SCHEMA_VERSION = "loopx_extension_doctor_v0"
+RUNTIME_ENTRYPOINT_IDENTITY_SCHEMA_VERSION = "loopx_runtime_entrypoint_identity_v1"
 
 
 @dataclass(frozen=True)
@@ -39,11 +39,10 @@ def _file_identity(path: Path, *, executable: bool) -> tuple[Path, str] | None:
     except OSError:
         return None
     identity = {
-        "path": str(path),
-        "device": stat.st_dev,
-        "inode": stat.st_ino,
+        "schema_version": RUNTIME_ENTRYPOINT_IDENTITY_SCHEMA_VERSION,
+        "kind": "file_artifact",
+        "executable": executable,
         "size": stat.st_size,
-        "mtime_ns": stat.st_mtime_ns,
         "content_sha256": content_digest,
     }
     serialized = json.dumps(identity, sort_keys=True, separators=(",", ":"))
 
@@ -1,17 +1,17 @@
 from __future__ import annotations
 
-from collections.abc import Iterable, Mapping, Sequence
-from contextlib import nullcontext
-from copy import deepcopy
 import hashlib
 import json
 import os
+from collections.abc import Iterable, Mapping, Sequence
+from contextlib import nullcontext
+from copy import deepcopy
 from pathlib import Path
 from typing import Any
 
 from ..file_lock import exclusive_file_lock
-from .process_runtime import run_capped_process
 from .manifest import load_extension_manifest
+from .process_runtime import run_capped_process
 from .readiness import (
     EXTENSION_DOCTOR_SCHEMA_VERSION,
     ResolvedRuntimeEntrypoint,
@@ -20,12 +20,12 @@
     resolve_runtime_entrypoint,
 )
 
-
 EXTENSION_STATE_SCHEMA_VERSION = "loopx_extension_state_v0"
 EXTENSION_OPERATION_SCHEMA_VERSION = "loopx_extension_operation_v0"
 EXTENSION_BINDING_SCHEMA_VERSION = "loopx_extension_runtime_binding_v0"
 EXTENSION_ACTIVATION_SCHEMA_VERSION = "loopx_extension_activation_v0"
 EXTENSION_RUN_SCHEMA_VERSION = "loopx_extension_run_receipt_v0"
+EXTENSION_DOCTOR_BATCH_SCHEMA_VERSION = "loopx_extension_doctor_batch_v0"
 MAX_REVISIONS = 5
 MAX_EXTENSION_REQUEST_BYTES = 1_000_000
 MAX_EXTENSION_RESPONSE_BYTES = 1_000_000
@@ -443,6 +443,57 @@ def doctor_installed_extension(
     return doctor
 
 
+def doctor_enabled_extensions(
+    *,
+    state_file: str | Path,
+    execute: bool = False,
+) -> dict[str, Any]:
+    """Revalidate every enabled extension after a runtime release transition.
+
+    Extension doctors are declared read-only provider probes. Running them as
+    one bounded batch lets installers and rollback paths refresh the runtime
+    identity without weakening the fail-closed activation fence.
+    """
+
+    path = Path(state_file).expanduser()
+    state = _read_state(path)
+    extension_ids = sorted(
+        str(extension_id)
+        for extension_id, entry in state["extensions"].items()
+        if isinstance(entry, Mapping) and entry.get("enabled")
+    )
+    doctors = [
+        doctor_installed_extension(
+            extension_id,
+            state_file=path,
+            execute=execute,
+        )
+        for extension_id in extension_ids
+    ]
+    verified_count = sum(bool(doctor.get("verified")) for doctor in doctors)
+    blocked_count = len(doctors) - verified_count if execute else 0
+    return {
+        "ok": blocked_count == 0,
+        "schema_version": EXTENSION_DOCTOR_BATCH_SCHEMA_VERSION,
+        "status": (
+            "ready"
+            if execute and blocked_count == 0
+            else "blocked"
+            if execute
+            else "probe_required"
+            if doctors
+            else "ready"
+        ),
+        "execute": execute,
+        "enabled_count": len(doctors),
+        "verified_count": verified_count,
+        "blocked_count": blocked_count,
+        "extensions": doctors,
+        "local_state_write_performed": execute and bool(doctors),
+        "external_writes_performed": False,
+    }
+
+
 def _verified_entrypoint(
     entry: Mapping[str, Any],
 ) -> ResolvedRuntimeEntrypoint | None:
@@ -577,7 +628,10 @@ def _resolved_active_extension(
     active_revision = str(entry.get("active_revision") or "")
     verified_entrypoint = _verified_entrypoint(entry)
     if verified_entrypoint is None:
-        raise ValueError(f"extension `{extension_id}` doctor readiness is stale")
+        raise ValueError(
+            f"extension `{extension_id}` doctor readiness is stale; run "
+            f"`loopx extension doctor {extension_id} --execute`"
+        )
     manifest = _active_manifest(entry)
     return active_revision, verified_entrypoint, manifest
 
 
@@ -623,11 +623,44 @@ def execute_update_plan(payload: dict[str, Any], *, timeout_seconds: int = 600)
         "doctor_stdout_tail": doctor_result.stdout[-2000:],
         "doctor_stderr_tail": doctor_result.stderr[-2000:],
     }
+    extension_doctor_result = None
+    if install_result.returncode == 0 and doctor_result.returncode == 0:
+        extension_doctor_result = subprocess.run(
+            [
+                str(loopx_bin),
+                "--format",
+                "json",
+                "extension",
+                "doctor",
+                "--all-enabled",
+                "--execute",
+            ],
+            text=True,
+            capture_output=True,
+            env=env,
+            timeout=timeout_seconds,
+        )
+        execution.update(
+            {
+                "extension_doctor_returncode": extension_doctor_result.returncode,
+                "extension_doctor_stdout_tail": extension_doctor_result.stdout[-2000:],
+                "extension_doctor_stderr_tail": extension_doctor_result.stderr[-2000:],
+            }
+        )
+    else:
+        execution["extension_doctor_status"] = "skipped_release_update_failed"
     updated = dict(payload)
     updated["execution"] = execution
-    updated["ok"] = install_result.returncode == 0 and doctor_result.returncode == 0
+    updated["ok"] = (
+        install_result.returncode == 0
+        and doctor_result.returncode == 0
+        and extension_doctor_result is not None
+        and extension_doctor_result.returncode == 0
+    )
     if not updated["ok"]:
-        updated["recommended_action"] = "inspect update execution tails and restore from rollback plan if needed"
+        updated["recommended_action"] = (
+            "inspect update execution tails and restore from rollback plan if needed"
+        )
         return updated
     execution["restarted_services"] = restart_managed_loopx_services()
     return updated
@@ -686,8 +719,37 @@ def execute_rollback_plan(
                 "doctor_stderr_tail": doctor_result.stderr[-2000:],
             }
         )
-        updated["ok"] = doctor_result.returncode == 0
-        if not updated["ok"] and previous_link_target:
+        if doctor_result.returncode == 0:
+            extension_doctor_result = subprocess.run(
+                [
+                    str(loopx_bin),
+                    "--format",
+                    "json",
+                    "extension",
+                    "doctor",
+                    "--all-enabled",
+                    "--execute",
+                ],
+                text=True,
+                capture_output=True,
+                timeout=timeout_seconds,
+            )
+            execution.update(
+                {
+                    "extension_doctor_returncode": extension_doctor_result.returncode,
+                    "extension_doctor_stdout_tail": extension_doctor_result.stdout[
+                        -2000:
+                    ],
+                    "extension_doctor_stderr_tail": extension_doctor_result.stderr[
+                        -2000:
+                    ],
+                }
+            )
+            updated["ok"] = extension_doctor_result.returncode == 0
+        else:
+            execution["extension_doctor_status"] = "skipped_core_doctor_failed"
+            updated["ok"] = False
+        if doctor_result.returncode != 0 and previous_link_target:
             restore_link = loopx_bin.with_name(f".{loopx_bin.name}.rollback.restore.{os.getpid()}")
             if restore_link.exists() or restore_link.is_symlink():
                 restore_link.unlink()
@@ -713,11 +775,21 @@ def execute_rollback_plan(
         if "restore_link" in locals() and (restore_link.exists() or restore_link.is_symlink()):
             restore_link.unlink()
     updated["execution"] = execution
-    updated["recommended_action"] = (
-        "rollback complete; review doctor output"
-        if updated["ok"]
-        else "rollback failed; inspect execution error before retrying"
-    )
+    if updated["ok"]:
+        updated["recommended_action"] = "rollback complete; review doctor output"
+    elif (
+        execution.get("doctor_returncode") == 0
+        and execution.get("extension_doctor_returncode") not in {None, 0}
+    ):
+        updated["recommended_action"] = (
+            "rollback activated, but one or more enabled extensions remain fail "
+            "closed; repair the provider and run `loopx extension doctor "
+            "--all-enabled --execute`"
+        )
+    else:
+        updated["recommended_action"] = (
+            "rollback failed; inspect execution error before retrying"
+        )
     return updated
 
 
 
@@ -769,6 +769,10 @@ fi
 
 export PATH="$bin_dir:$PATH"
 "$bin_dir/loopx" doctor >/dev/null
+if ! "$bin_dir/loopx" --format json extension doctor --all-enabled --execute >/dev/null; then
+  echo "loopx installer warning: one or more enabled extensions failed post-install doctor revalidation" >&2
+  echo "Run 'loopx extension doctor --all-enabled --execute' after repairing the provider." >&2
+fi
 if [[ "$install_canary" != "0" ]]; then
   "$bin_dir/loopx-canary" doctor >/dev/null
 fi
 
@@ -47,6 +47,12 @@ try {
     $env:PYTHONPATH = $previousPythonPath
 }
 
+$loopxLauncher = Join-Path $BinDir "loopx.ps1"
+& $loopxLauncher --format json extension doctor --all-enabled --execute *> $null
+if ($LASTEXITCODE -ne 0) {
+    Write-Warning "One or more enabled extensions failed post-install doctor revalidation. Run 'loopx extension doctor --all-enabled --execute' after repairing the provider."
+}
+
 if ($AddToUserPath) {
     $userPath = [Environment]::GetEnvironmentVariable("Path", "User")
     $entries = @($userPath -split ";" | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })