@junghanacs/entwurf 0.12.4 → 0.12.6

package/scripts/meta-bridge-install.sh

@@ -4,7 +4,8 @@
 # needs, so a user never hand-edits hook/plugin settings or passes --plugin-dir.
 #
 # Mechanism (all proven on 2026-06-05):
-#   1. ASSEMBLE a self-contained plugin under pi/meta-bridge/.assembled/ (gitignored):
+#   1. ASSEMBLE a self-contained plugin under the version-stable XDG data dir
+#      ($XDG_DATA_HOME/entwurf/meta-bridge/.assembled) — NEVER inside the checkout:
 #      copy the committed skeleton, copy the entry shell + its lib (so
 #      ${CLAUDE_PLUGIN_ROOT} self-locates them), and BAKE the node abspath into
 #      hooks.json. The node path is the ONLY templated surface — the mailbox /
@@ -13,8 +14,10 @@
 #      entwurf_inbox_read tool comes from USER-scope entwurf-bridge MCP wiring
 #      (`claude mcp add -s user ...`). Project-scoped .mcp.json is deliberately
 #      not enough: a /tmp native session would wake without a receipt tool.
-#   2. marketplace add <repo-stable .assembled>  (NOT /tmp — ephemeral source
-#      would break `claude plugin marketplace update`).
+#   2. marketplace add <stable XDG .assembled>  (both dev clone and installed
+#      package assemble into the same version-stable XDG data dir; NOT /tmp —
+#      ephemeral source would break `claude plugin marketplace update`, and NOT
+#      the checkout — repo housekeeping must never cut the live user-scope wiring).
 #   3. install entwurf-meta-receive@meta-bridge-local --scope user  (= global:
 #      every native session auto-loads it; no manual --plugin-dir).
 #   4. install/update USER-scope entwurf-bridge MCP, so every native session has
@@ -30,7 +33,32 @@ REPO="$(cd "$HERE/.." && pwd)"
 MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 SRC="$REPO/pi/meta-bridge"
-ASM="$SRC/.assembled"
+# The live marketplace artifact ALWAYS assembles under the version-stable XDG data
+# dir — dev clone and installed package alike. Claude settings store this directory
+# path and package-manager upgrades do not rewrite it (a pnpm-store path would go
+# stale on version/peer churn). Critically it lives OUTSIDE the checkout, so repo
+# housekeeping (git clean -xfd, check/smoke) can never cut the global user-scope
+# wiring: dev vs installed is a difference of SOURCE ORIGIN (repo tree vs npm
+# package we assemble FROM), never of where the live artifact lands.
+ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
+# The hook ARTIFACT form still splits by install shape (0.12.5): an installed
+# package lives below node_modules, where Node REFUSES `--experimental-strip-types`
+# on `.ts` (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING), so it runs the tsc-emitted
+# `meta-bridge-hook.js` closure (mirrors start.sh/store-doctor). A dev clone lives
+# outside node_modules — and so does the XDG artifact — so it runs the `.ts` source
+# directly. HOOK_ENTRY is baked into hooks.json.
+case "$REPO" in
+  */node_modules/@junghanacs/entwurf)
+    HOOK_ENTRY="meta-bridge-hook.js"
+    HOOK_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    LIB_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+    LIB_EXT="js" ;;
+  *)
+    HOOK_ENTRY="meta-bridge-hook.ts"
+    HOOK_SRC="$REPO/pi-extensions/meta-bridge-hook.ts"
+    LIB_SRC="$REPO/pi-extensions/lib/meta-session.ts"
+    LIB_EXT="ts" ;;
+esac
 
 die() { echo "meta-bridge-install: $*" >&2; exit 1; }
 
@@ -65,9 +93,12 @@ mkdir -p "$ASM"
 cp -r "$SRC/.claude-plugin" "$ASM/.claude-plugin"
 cp -r "$SRC/$PLUGIN" "$ASM/$PLUGIN"
 # entry shell + its lib travel WITH the plugin so the install copy is self-contained.
-cp "$REPO/pi-extensions/meta-bridge-hook.ts" "$ASM/$PLUGIN/meta-bridge-hook.ts"
+# Installed → tsc-emitted JS (dist, node_modules-safe); dev clone → strip-types .ts.
+[ -f "$HOOK_SRC" ] || die "hook artifact missing: $HOOK_SRC (installed package ships it via prepack build-bridge → dist; reinstall @junghanacs/entwurf, or run 'pnpm run build-bridge' in a dev clone)."
+[ -f "$LIB_SRC" ]  || die "hook lib artifact missing: $LIB_SRC (same build-bridge dist closure)."
+cp "$HOOK_SRC" "$ASM/$PLUGIN/$HOOK_ENTRY"
 mkdir -p "$ASM/$PLUGIN/lib"
-cp "$REPO/pi-extensions/lib/meta-session.ts" "$ASM/$PLUGIN/lib/meta-session.ts"
+cp "$LIB_SRC" "$ASM/$PLUGIN/lib/meta-session.$LIB_EXT"
 cp "$REPO/pi-extensions/lib/session-id.js" "$ASM/$PLUGIN/lib/session-id.js"
 # v2 writer (3D-3+) reads the capability registry at runtime
 # (loadMetaCapabilityRegistry). It MUST travel at the plugin ROOT — meta-session's
@@ -76,23 +107,29 @@ cp "$REPO/pi-extensions/lib/session-id.js" "$ASM/$PLUGIN/lib/session-id.js"
 # Without this, a v2 writer throws on every mint/parse. doctor-meta-bridge asserts it.
 cp "$REPO/pi/entwurf-capabilities.json" "$ASM/$PLUGIN/entwurf-capabilities.json"
 chmod +x "$ASM/$PLUGIN/scripts/doorbell.sh"
-# Bake the node abspath into hooks.json — the ONLY templated surface. mailbox /
-# meta-record dirs resolve at runtime inside entry.ts (<pi-agent-dir>, fixed ~/).
+# Bake the node abspath AND the hook entry filename into hooks.json — the two
+# templated surfaces (0.12.5: HOOK_ENTRY is meta-bridge-hook.js when installed,
+# .ts in a dev clone). mailbox / meta-record dirs resolve at runtime inside the
+# hook itself (<pi-agent-dir>, fixed ~/).
 # The plugin owns ONLY the wake/record hooks; the receiver-side entwurf_inbox_read
 # tool is NOT the plugin's job. It comes from USER-scope entwurf-bridge MCP
 # wiring (`claude mcp add -s user ...`), never a plugin .mcp.json duplicate.
 HOOKS="$ASM/$PLUGIN/hooks/hooks.json"
-HOOKS_PATH="$HOOKS" NODE_PATH_TO_BAKE="$NODE_BIN" python3 - <<'PY'
+HOOKS_PATH="$HOOKS" NODE_PATH_TO_BAKE="$NODE_BIN" HOOK_ENTRY_TO_BAKE="$HOOK_ENTRY" python3 - <<'PY'
 from pathlib import Path
 import os
 hooks = Path(os.environ["HOOKS_PATH"])
 node = os.environ["NODE_PATH_TO_BAKE"]
+hook_entry = os.environ["HOOK_ENTRY_TO_BAKE"]
 text = hooks.read_text(encoding="utf-8")
-if "__NODE_BIN__" not in text:
-    raise SystemExit(f"node-path bake failed before replacement (placeholder absent in {hooks})")
-hooks.write_text(text.replace("__NODE_BIN__", node), encoding="utf-8")
+for placeholder in ("__NODE_BIN__", "__HOOK_ENTRY__"):
+    if placeholder not in text:
+        raise SystemExit(f"hooks bake failed before replacement ({placeholder} absent in {hooks})")
+hooks.write_text(text.replace("__NODE_BIN__", node).replace("__HOOK_ENTRY__", hook_entry), encoding="utf-8")
 PY
-grep -q "__NODE_BIN__" "$HOOKS" && die "node-path bake failed (placeholder still present in $HOOKS)."
+for placeholder in "__NODE_BIN__" "__HOOK_ENTRY__"; do
+  grep -q "$placeholder" "$HOOKS" && die "hooks bake failed ($placeholder still present in $HOOKS)."
+done
 echo "[meta-bridge-install] assembled $ASM (node baked, entry+lib bundled; MCP wiring is NOT plugin-owned)"
 
 # --- validate the manifests before touching user config ---------------------

package/scripts/meta-bridge-state.py

@@ -306,6 +306,12 @@ def desired_mcp(repo: Path) -> dict[str, Any]:
 
 
 def desired_statusline(repo: Path) -> dict[str, Any]:
+    if is_installed_package(repo):
+        # Installed package: mirror the MCP stable-bin pattern. The statusLine is
+        # executed at render time, so a bare bin shim lets npm/pnpm update the
+        # target on package upgrade without rewriting Claude settings. Dev clones
+        # stay pinned to their checkout below.
+        return {"type": "command", "command": "entwurf-statusline"}
     return {"type": "command", "command": str((repo / "scripts" / "meta-bridge-statusline.sh").resolve())}
 
 
@@ -507,9 +513,33 @@ def check(repo: Path, asm: Path) -> None:
         failures.append(f"{claude_root_config_path()} root is not an object")
         root = {}
 
+    # The marketplace source path in settings was written by apply() from the
+    # RECORDED assembledMarketplacePath. Compare against that recorded value, not the
+    # --asm passed here: a doctor/check run under a different XDG_DATA_HOME than
+    # install must not false-FAIL a correctly-wired marketplace. Fall back to --asm
+    # only if the recorded field is somehow absent.
+    recorded_asm = state.get("assembledMarketplacePath")
+    # Shape-validate the recorded path (basename included). Every state our code
+    # writes carries this field (init_state/prepare/apply), so a missing/empty/
+    # non-string value is itself corruption — NOT a reason to fall back to --asm and
+    # PASS. And a malformed value that matches a same-malformed settings entry (both
+    # hand-corrupted) would otherwise slip the comparison below and greenlight a
+    # bogus marketplace source. This mirrors the uninstall.sh honest-inverse guard:
+    # only the exact install suffix …/entwurf/meta-bridge/.assembled is valid.
+    ASM_SUFFIX = "/entwurf/meta-bridge/.assembled"
+    if not isinstance(recorded_asm, str) or not recorded_asm.endswith(ASM_SUFFIX):
+        failures.append(
+            f"install-state assembledMarketplacePath is missing/malformed ('{recorded_asm}'); "
+            f"must end in {ASM_SUFFIX} — repair state or re-run install-meta-bridge"
+        )
+    marketplace_expected = (
+        {"source": {"source": "directory", "path": recorded_asm}}
+        if recorded_asm
+        else desired_marketplace(asm)
+    )
     checks = [
         (["enabledPlugins", PLUGIN_REF], True, "enabled plugin"),
-        (["extraKnownMarketplaces", MARKETPLACE], desired_marketplace(asm), "known marketplace"),
+        (["extraKnownMarketplaces", MARKETPLACE], marketplace_expected, "known marketplace"),
         (["statusLine"], desired_statusline(repo), "statusLine"),
     ] + [(path_, desired, name) for name, path_, desired in MANAGED_SETTINGS_SCALARS]
     for path_, expected, label in checks:
@@ -543,13 +573,29 @@ def main() -> int:
     parser = argparse.ArgumentParser(description="entwurf meta-bridge state manager")
     parser.add_argument(
         "command",
-        choices=["prepare", "apply", "preflight-uninstall", "uninstall", "check", "managed-keys", "desired-mcp"],
+        choices=[
+            "prepare",
+            "apply",
+            "preflight-uninstall",
+            "uninstall",
+            "assembled-path",
+            "check",
+            "managed-keys",
+            "desired-mcp",
+            "desired-statusline",
+        ],
     )
     parser.add_argument("--repo", default=Path(__file__).resolve().parents[1], type=Path)
     parser.add_argument("--asm", default=None, type=Path)
     args = parser.parse_args()
     repo = args.repo.resolve()
-    asm = (args.asm or (repo / "pi" / "meta-bridge" / ".assembled")).resolve()
+    # The live artifact always lives under the XDG data dir — dev clone and
+    # installed package alike (mirror meta-bridge-install.sh's ASM resolution).
+    # install/doctor pass --asm explicitly; this default is the same XDG path so a
+    # bare invocation never falls back to a repo-internal marketplace source.
+    xdg_data = Path(os.environ.get("XDG_DATA_HOME") or (Path.home() / ".local" / "share"))
+    default_asm = xdg_data / "entwurf" / "meta-bridge" / ".assembled"
+    asm = (args.asm or default_asm).resolve()
     try:
         if args.command == "prepare":
             prepare(repo, asm)
@@ -559,6 +605,13 @@ def main() -> int:
             preflight_uninstall()
         elif args.command == "uninstall":
             uninstall()
+        elif args.command == "assembled-path":
+            # Print the RECORDED assembled marketplace path so the honest inverse
+            # (uninstall) removes exactly what install created — not a path
+            # recomputed from a possibly-changed XDG_DATA_HOME. Requires state.
+            state = load_state(required=True)
+            assert state is not None  # load_state(required=True) dies otherwise
+            print(state.get("assembledMarketplacePath", ""))
         elif args.command == "check":
             check(repo, asm)
         elif args.command == "managed-keys":
@@ -568,6 +621,10 @@ def main() -> int:
             # write for --repo. Lets a deterministic guard assert the installed-vs-clone
             # dual-mode without spinning up a real `claude` CLI. --repo need not exist.
             print(json.dumps(desired_mcp(repo), indent=2))
+        elif args.command == "desired-statusline":
+            # Same guard surface for the statusLine dual-mode: dev clones pin the
+            # checkout path; installed packages use the stable bin shim.
+            print(json.dumps(desired_statusline(repo), indent=2))
     except StateError as exc:
         print(f"meta-bridge-state: {exc}", file=sys.stderr)
         return 1

package/scripts/meta-bridge-uninstall.sh

@@ -26,6 +26,23 @@ command -v python3 >/dev/null || die "'python3' not on PATH. It is required for
 # delete live plugin/MCP entries before failing — guessing by side effect.
 python3 "$REPO/scripts/meta-bridge-state.py" preflight-uninstall --repo "$REPO"
 
+# Read + shape-validate the RECORDED assembled path BEFORE any side effect. The
+# honest inverse must remove exactly what install created; recomputing from
+# ${XDG_DATA_HOME} would orphan the real artifact if it changed since install. If
+# the recorded path is missing/corrupt we CANNOT safely remove the artifact, so we
+# fail loud HERE — before touching any Claude registration or the state file (no
+# guessing, no partial uninstall, no side-effect-then-WARN).
+ASM_RECORDED="$(python3 "$REPO/scripts/meta-bridge-state.py" assembled-path --repo "$REPO")"
+# Validate the FULL recorded path — basename included, not just the parent dir. The
+# rm below targets MB_DIR (the parent meta-bridge dir), so a parent-only check would
+# let a corrupt basename (…/entwurf/meta-bridge/not-assembled) pass as "well-formed"
+# and still nuke the real .assembled + Claude registrations. Only the exact install
+# suffix …/entwurf/meta-bridge/.assembled is a safe honest-inverse target.
+case "$ASM_RECORDED" in
+  */entwurf/meta-bridge/.assembled) MB_DIR="$(dirname "$ASM_RECORDED")" ;;   # …/entwurf/meta-bridge
+  *) die "install-state assembledMarketplacePath is missing/corrupt ('$ASM_RECORDED'); refusing to uninstall so the live artifact is not orphaned. Repair the state file or re-run install-meta-bridge, then uninstall." ;;
+esac
+
 if command -v claude >/dev/null; then
   claude plugin uninstall "$PLUGIN@$MKT_NAME" >/dev/null 2>&1 || true
   claude plugin marketplace remove "$MKT_NAME" >/dev/null 2>&1 || true
@@ -36,4 +53,11 @@ else
 fi
 
 python3 "$REPO/scripts/meta-bridge-state.py" uninstall --repo "$REPO"
+
+# Remove the assembled marketplace source (validated above): the parent meta-bridge
+# dir of the RECORDED .assembled, then the now-empty entwurf dir. This rm can NEVER
+# reach inside the checkout, so repo housekeeping and this uninstall are structurally
+# disjoint (the 0.12.x statusline-`?` impurity class is extinct, not guarded).
+rm -rf "$MB_DIR"
+rmdir "$(dirname "$MB_DIR")" 2>/dev/null || true   # …/entwurf if empty
 echo "[meta-bridge-uninstall] DONE"

package/scripts/register-pi-package.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""Register (or --remove) entwurf in a pi settings.json packages[].
+
+The SINGLE predicate / idempotency / fail-loud SSOT shared by BOTH scopes and by
+remove, so install and uninstall can never drift to different meanings:
+  - project  <repo>/.pi/settings.json     (run.sh install_local_package / remove_local_package)
+  - user     ~/.pi/agent/settings.json    (run.sh register_user_scope_citizen)
+
+Register is idempotent: absent → append REPO_DIR; already the sole canonical
+entry → no-op (file not rewritten, mtime stable); any other entwurf entry (object
+form, stale path, duplicate) collapses into one canonical string form. Remove
+drops every entwurf entry. Both use is_entwurf_source(), so a look-alike repo
+(entwurf-notes, openclaw-entwurf) is neither wrongly registered-over nor wrongly
+removed. Every non-entwurf package and every other settings key is preserved.
+
+This wiring (user scope) dropped when `pi install` was removed from setup
+(2026-07-03: `--entwurf-control` unknown in a foreign cwd). Extracting it here
+lets run.sh (both scopes + remove) and smoke-user-scope-citizen share ONE
+implementation — mirrors the meta-bridge-state.py split.
+
+Usage: register-pi-package.py <settings.json> <repo_dir> [--remove]
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+
+def source_of(item: object) -> object:
+    """The package spec of a packages[] entry — string form or {"source": …}."""
+    return item.get("source") if isinstance(item, dict) else item
+
+
+def is_entwurf_source(source: str, repo_dir: str) -> bool:
+    """True iff this package entry points at THIS entwurf — the only entries
+    register/remove may touch. Strict on purpose: user-scope settings are GLOBAL,
+    so a substring "entwurf" match would wrongly eat unrelated repos like
+    entwurf-notes, openclaw-entwurf, or somebody else's git repo named entwurf.
+
+    Managed shapes:
+      - the exact resolved repo dir;
+      - an npm install path ending in node_modules/@junghanacs/entwurf;
+      - an explicit npm package source for @junghanacs/entwurf;
+      - a local filesystem path whose final directory is literally "entwurf"
+        (dev clone / stale move). Remote URL/git-like strings are NOT treated as
+        local paths merely because their last segment is "entwurf".
+    """
+    p = source.rstrip("/")
+    if p == repo_dir or p.endswith("/node_modules/@junghanacs/entwurf"):
+        return True
+    if p == "npm:@junghanacs/entwurf" or p.startswith("npm:@junghanacs/entwurf@"):
+        return True
+    local_like = p.startswith(("/", "./", "../", "~"))
+    return local_like and Path(p).name == "entwurf"
+
+
+def _load(settings_path: Path) -> dict:
+    if settings_path.exists():
+        data = json.loads(settings_path.read_text())
+        if not isinstance(data, dict):
+            raise SystemExit(f"{settings_path} is not a JSON object")
+        return data
+    return {}
+
+
+def _packages(settings_path: Path, data: dict) -> list:
+    packages = data.get("packages")
+    if packages is None:
+        return []
+    if not isinstance(packages, list):
+        # A settings file with a corrupt packages shape must NOT be silently
+        # coerced to [] — that would drop the operator's real packages.
+        raise SystemExit(f"{settings_path}: packages is not a JSON array")
+    return packages
+
+
+def _entwurf_matches(packages: list, repo_dir: str) -> list:
+    return [
+        item for item in packages
+        if isinstance(source_of(item), str) and is_entwurf_source(source_of(item), repo_dir)  # type: ignore[arg-type]
+    ]
+
+
+def register(settings_path: Path, repo_dir_arg: str) -> str:
+    """"noop" if entwurf is already the sole canonical entry (file untouched),
+    else "registered" (rewritten with a single canonical entry)."""
+    repo_dir = str(Path(repo_dir_arg).resolve())
+    settings_path.parent.mkdir(parents=True, exist_ok=True)
+    data = _load(settings_path)
+    packages = _packages(settings_path, data)
+
+    entwurf_entries = _entwurf_matches(packages, repo_dir)
+    # Already correct iff exactly ONE entwurf entry and it is the canonical string
+    # form at repo_dir. Order-insensitive; no rewrite → mtime stable.
+    if len(entwurf_entries) == 1 and entwurf_entries[0] == repo_dir:
+        return "noop"
+
+    filtered = [item for item in packages if item not in entwurf_entries]
+    data["packages"] = filtered + [repo_dir]
+    settings_path.write_text(json.dumps(data, indent=2) + "\n")
+    return "registered"
+
+
+def remove(settings_path: Path, repo_dir_arg: str) -> int:
+    """Drop every entwurf entry (any shape/path). Returns the count removed."""
+    repo_dir = str(Path(repo_dir_arg).resolve())
+    if not settings_path.exists():
+        return 0
+    data = _load(settings_path)
+    packages = _packages(settings_path, data)
+
+    entwurf_entries = _entwurf_matches(packages, repo_dir)
+    if not entwurf_entries:
+        return 0
+    data["packages"] = [item for item in packages if item not in entwurf_entries]
+    settings_path.write_text(json.dumps(data, indent=2) + "\n")
+    return len(entwurf_entries)
+
+
+def main(argv: list[str]) -> int:
+    args = [a for a in argv[1:] if a != "--remove"]
+    do_remove = "--remove" in argv[1:]
+    if len(args) != 2:
+        raise SystemExit("usage: register-pi-package.py <settings.json> <repo_dir> [--remove]")
+    settings_path = Path(args[0])
+    repo_dir_arg = args[1]
+    resolved = str(Path(repo_dir_arg).resolve())
+
+    if do_remove:
+        n = remove(settings_path, repo_dir_arg)
+        if n:
+            print(f"remove: removed {n} entwurf packages[] entr{'y' if n == 1 else 'ies'} from {settings_path}")
+        else:
+            print(f"remove: no entwurf packages[] entry to remove ({settings_path})")
+        return 0
+
+    result = register(settings_path, repo_dir_arg)
+    if result == "noop":
+        print(f"install: entwurf package already registered (no-op) -> {resolved}")
+    else:
+        print(f"install: registered entwurf package -> {settings_path}")
+        print(f"install: package source -> {resolved}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))

package/scripts/smoke-meta-install-state.sh

@@ -22,10 +22,58 @@ TMP="$(mktemp -d -t psa-meta-install-state.XXXXXX)"
 cleanup() { rm -rf "$TMP"; }
 trap cleanup EXIT
 
+# ⓪ 설치 경계 봉쇄 (2026-07-03 `?` 사건의 구조적 소멸): source origin(repo/npm)과
+# live artifact(XDG)를 분리한다. dev clone과 installed 소비자는 같은 user-scope
+# install이고, 둘 다 marketplace source를 XDG data dir에 조립한다 — 절대 checkout
+# 내부가 아니다. 이 smoke의 어떤 단계도 repo 안에 live source를 만들지 않음을
+# top/bottom fingerprint로 감싸 증명하고, 아래 fake-install로 "install → XDG"를 직접 건다.
+# present/absent만 보면 present→present 덮어쓰기를 놓치므로 내용 해시까지 비교한다.
+asm_fingerprint() {
+  if [ -e "$REPO/pi/meta-bridge/.assembled" ]; then (cd "$REPO/pi/meta-bridge/.assembled" && find . -type f -exec sha256sum {} + 2>/dev/null | sort); else echo ABSENT; fi
+}
+REPO_ASM_FP_START="$(asm_fingerprint)"
+
+# 실제 meta-bridge-install.sh를 격리된 HOME + XDG_DATA_HOME + fake claude로 돌려
+# live marketplace source가 XDG 아래에 조립되고 `plugin marketplace add`가 그 XDG
+# 경로를 받는지 직접 증명한다(오프라인: 실제 claude 없음).
+INS_HOME="$TMP/ins-home"; INS_XDG="$TMP/ins-xdg"; INS_BIN="$TMP/ins-bin"
+mkdir -p "$INS_HOME/.claude" "$INS_BIN"
+echo '{}' > "$INS_HOME/.claude/settings.json"
+echo '{}' > "$INS_HOME/.claude.json"
+INS_LOG="$TMP/ins-claude.log"
+cat > "$INS_BIN/claude" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
+case "$1${2:+ $2}" in
+  "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
+  "mcp get")     printf '%s\n' "Scope: User config" "Status: Connected" ;;
+  *) : ;;
+esac
+exit 0
+SH
+chmod +x "$INS_BIN/claude"
+if env HOME="$INS_HOME" CLAUDE_CONFIG_DIR="$INS_HOME/.claude" XDG_DATA_HOME="$INS_XDG" \
+       FAKE_CLAUDE_LOG="$INS_LOG" PATH="$INS_BIN:$PATH" \
+       bash "$REPO/scripts/meta-bridge-install.sh" >/dev/null 2>&1; then
+  if [ -e "$INS_XDG/entwurf/meta-bridge/.assembled/entwurf-meta-receive" ]; then ok "dev install assembles the live marketplace source under XDG (not the checkout)"; else bad "dev install did not assemble under XDG_DATA_HOME"; fi
+  MKT_ADD="$(grep '^plugin marketplace add ' "$INS_LOG" | head -1 || true)"
+  if printf '%s' "$MKT_ADD" | grep -Fq "$INS_XDG/entwurf/meta-bridge/.assembled"; then ok "claude plugin marketplace add received the XDG artifact path"; else bad "marketplace add did not point at XDG: $MKT_ADD"; fi
+else
+  bad "real install-meta-bridge failed under isolated HOME/XDG/fake-claude:"$'\n'"$(cat "$INS_LOG" 2>/dev/null)"
+fi
+
 export HOME="$TMP/home"
+# The wrapper-uninstall below removes ${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/
+# meta-bridge. Pin XDG_DATA_HOME into the sandbox too, so a developer who runs this
+# smoke with XDG_DATA_HOME set in their shell can never have their real live
+# artifact removed — the boundary that keeps check/smoke off global user wiring.
+export XDG_DATA_HOME="$TMP/xdg"
 export CLAUDE_CONFIG_DIR="$HOME/.claude"
 mkdir -p "$CLAUDE_CONFIG_DIR"
-ASM="$TMP/assembled-marketplace"
+# Canonical-suffix asm: production install ALWAYS records a path ending in
+# …/entwurf/meta-bridge/.assembled, and state.py check now shape-validates that
+# suffix — so the survival harness must use a realistic path, not a bare stub.
+ASM="$TMP/asm-xdg/entwurf/meta-bridge/.assembled"
 export ASM
 mkdir -p "$ASM"
 
@@ -71,6 +119,12 @@ JSON
 
 py() { python3 "$STATE" "$@" --repo "$REPO" --asm "$ASM"; }
 
+DEV_STATUSLINE="$(python3 "$STATE" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin)["command"])')"
+if [ "$DEV_STATUSLINE" = "$REPO/scripts/meta-bridge-statusline.sh" ]; then ok "dev statusLine pins the checkout script"; else bad "dev statusLine command drifted: $DEV_STATUSLINE"; fi
+FAKE_INSTALLED_REPO="$TMP/npmroot/node_modules/@junghanacs/entwurf"
+INSTALLED_STATUSLINE="$(python3 "$STATE" desired-statusline --repo "$FAKE_INSTALLED_REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin)["command"])')"
+if [ "$INSTALLED_STATUSLINE" = "entwurf-statusline" ]; then ok "installed statusLine uses the stable bin shim"; else bad "installed statusLine command drifted: $INSTALLED_STATUSLINE"; fi
+
 py prepare >/dev/null
 STATE_FILE="$CLAUDE_CONFIG_DIR/entwurf.install-state.json"
 [ -f "$STATE_FILE" ] && ok "prepare writes install-state before any merge" || bad "state file missing after prepare"
@@ -207,8 +261,10 @@ then ok "uninstall restores scalars/maps and removes only managed array addition
 
 if py uninstall >/dev/null 2>&1; then bad "state manager uninstall without state should not guess"; else ok "state manager uninstall without state fails instead of guessing"; fi
 
-# The wrapper must ALSO refuse before side effects. A fake claude records whether
-# plugin/MCP removals were attempted; no state means the log must stay empty.
+# ⓪ 봉쇄: wrapper-uninstall을 실제 $REPO 스크립트로 직접 돌린다. 이제 uninstall이
+# 지우는 live artifact는 ${XDG_DATA_HOME}/entwurf/meta-bridge 하나뿐이고, 위에서
+# HOME + XDG_DATA_HOME를 샌드박스로 고정했으므로 실제 개발자 배선/체크아웃에는
+# 닿을 수 없다(2026-07-03 `?` 사건의 구조적 소멸 — 사본 repo 우회가 더는 불필요).
 FAKE_BIN="$TMP/fake-bin"; mkdir -p "$FAKE_BIN"
 cat > "$FAKE_BIN/claude" <<'SH'
 #!/usr/bin/env bash
@@ -216,6 +272,9 @@ printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
 exit 0
 SH
 chmod +x "$FAKE_BIN/claude"
+
+# The wrapper must refuse before side effects. A fake claude records whether
+# plugin/MCP removals were attempted; no state means the log must stay empty.
 FAKE_CLAUDE_LOG="$TMP/fake-claude-nostate.log"
 if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
   bad "wrapper uninstall without state should fail"
@@ -223,10 +282,14 @@ else
   if [ ! -s "$FAKE_CLAUDE_LOG" ]; then ok "wrapper uninstall without state has zero Claude side effects"; else bad "wrapper uninstall without state touched Claude: $(cat "$FAKE_CLAUDE_LOG")"; fi
 fi
 
-# With valid state, the wrapper may remove Claude registrations and then restore
-# JSON state. This proves the preflight gate is ordered before side effects.
-py prepare >/dev/null
-py apply >/dev/null
+# With valid state, the wrapper removes Claude registrations, restores JSON state,
+# AND removes the XDG live artifact RECORDED in state — never the checkout, never a
+# path recomputed from the env. Record an XDG-structured assembled path and seed the
+# sentinel artifact so we can prove uninstall drops exactly the recorded tree.
+WASM="$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$WASM" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$WASM" >/dev/null
+mkdir -p "$WASM"; : > "$WASM/.sentinel"
 FAKE_CLAUDE_LOG="$TMP/fake-claude-state.log"
 if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
   if grep -q 'plugin uninstall entwurf-meta-receive@meta-bridge-local' "$FAKE_CLAUDE_LOG" && grep -q 'mcp remove entwurf-bridge -s user' "$FAKE_CLAUDE_LOG" && [ ! -f "$STATE_FILE" ]; then
@@ -234,10 +297,97 @@ if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts
   else
     bad "wrapper uninstall with state missed expected side effects/state removal"
   fi
+  # 봉쇄가 회피가 아니라 구조임을 증명: uninstall이 지우는 건 recorded XDG artifact뿐.
+  if [ ! -e "$XDG_DATA_HOME/entwurf/meta-bridge" ]; then ok "wrapper removes the recorded XDG live artifact tree, not the checkout"; else bad "wrapper did not remove the recorded XDG live artifact"; fi
 else
   bad "wrapper uninstall with valid state failed"
 fi
 
+# Honest inverse under a CHANGED XDG_DATA_HOME (GPT hardening): uninstall must remove
+# the RECORDED artifact path, never one recomputed from the current env. Record A,
+# run uninstall with the env pointing at B, and prove A is gone while B is untouched.
+XDGA="$TMP/xdgA"; XDGB="$TMP/xdgB"
+ASM_A="$XDGA/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$ASM_A" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$ASM_A" >/dev/null
+mkdir -p "$ASM_A"; : > "$ASM_A/.sentinel"
+mkdir -p "$XDGB/entwurf/meta-bridge/.assembled"; : > "$XDGB/entwurf/meta-bridge/.assembled/.sentinel"
+if XDG_DATA_HOME="$XDGB" PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$TMP/fake-claude-mismatch.log" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+  if [ ! -e "$XDGA/entwurf/meta-bridge" ]; then ok "uninstall removes the RECORDED artifact (XDG A) even when env XDG_DATA_HOME differs"; else bad "uninstall did not remove the recorded artifact A — recomputed from env instead"; fi
+  if [ -e "$XDGB/entwurf/meta-bridge/.assembled/.sentinel" ]; then ok "uninstall leaves the current-env XDG (B) untouched (no env recompute)"; else bad "uninstall wrongly removed the current-env XDG B"; fi
+else
+  bad "wrapper uninstall (recorded-path mismatch case) failed"
+fi
+
+# GPT hardening: a corrupt recorded assembledMarketplacePath must fail the wrapper
+# uninstall LOUD and BEFORE any side effect — no Claude removal, state file intact
+# (honest inverse never guesses / never partially uninstalls / never WARN-then-DONE).
+# Two corrupt shapes: a trivially-bad "/" AND the basename-corrupt case that a
+# PARENT-ONLY guard would silently pass (…/entwurf/meta-bridge/not-assembled) — the
+# rm targets the parent meta-bridge dir, so that shape must be refused by the FULL
+# suffix guard or it nukes the real artifact + Claude registrations (2026-07-03).
+for CORRUPT in "/" "$XDG_DATA_HOME/entwurf/meta-bridge/not-assembled"; do
+  python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+  python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+  # seed the real artifact so an over-broad rm would be observable as its removal
+  mkdir -p "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"; : > "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel"
+  CORRUPT="$CORRUPT" python3 - <<'PY'
+import json, os
+p = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(p)); s['assembledMarketplacePath'] = os.environ['CORRUPT']
+json.dump(s, open(p, 'w'), indent=2)
+PY
+  FAKE_CLAUDE_LOG="$TMP/fake-claude-corrupt.log"; : > "$FAKE_CLAUDE_LOG"
+  if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+    bad "wrapper uninstall with corrupt recorded path '$CORRUPT' should fail loud"
+  elif [ -s "$FAKE_CLAUDE_LOG" ] || [ ! -f "$STATE_FILE" ] || [ ! -e "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel" ]; then
+    bad "corrupt-path uninstall '$CORRUPT' leaked side effects/removed artifact: claude_log=[$(cat "$FAKE_CLAUDE_LOG")] state_exists=$([ -f "$STATE_FILE" ] && echo yes || echo no) artifact=$([ -e "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel" ] && echo intact || echo REMOVED)"
+  else
+    ok "corrupt recorded path '$CORRUPT' → uninstall fails BEFORE side effects (no Claude removal, state + artifact intact)"
+  fi
+  rm -f "$STATE_FILE"; rm -rf "$XDG_DATA_HOME/entwurf/meta-bridge"
+done
+
+# GPT hardening: state.py check must compare the RECORDED marketplace path, not the
+# --asm handed in. Install/apply with A, then check with a DIFFERENT --asm B: it must
+# still PASS (Claude settings + state both hold A; only the caller's XDG differs).
+CKA="$TMP/ck-xdgA/entwurf/meta-bridge/.assembled"
+CKB="$TMP/ck-xdgB/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$CKA" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$CKA" >/dev/null
+if python3 "$STATE" check --repo "$REPO" --asm "$CKB" >/dev/null 2>&1; then ok "state.py check passes when --asm differs from the recorded path (compares recorded, no XDG false-fail)"; else bad "state.py check false-FAILed on a recorded≠--asm mismatch"; fi
+rm -f "$STATE_FILE"
+
+# GPT hardening: check must shape-validate the recorded path, not just compare it to
+# settings. Corrupt BOTH state + settings to the same basename-bad value: a pure
+# consistency compare would PASS (both agree) and greenlight a bogus marketplace
+# source. The suffix guard must FAIL it instead.
+python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 - <<'PY'
+import json, os
+xdg = os.environ['XDG_DATA_HOME']; corrupt = xdg + '/entwurf/meta-bridge/not-assembled'
+sp = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(sp)); s['assembledMarketplacePath'] = corrupt; json.dump(s, open(sp, 'w'), indent=2)
+cp = os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+c = json.load(open(cp)); c['extraKnownMarketplaces']['meta-bridge-local'] = {'source': {'source': 'directory', 'path': corrupt}}; json.dump(c, open(cp, 'w'), indent=2)
+PY
+if python3 "$STATE" check --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null 2>&1; then bad "state.py check greenlit a both-corrupt (state+settings) malformed marketplace path"; else ok "state.py check fails a malformed recorded path even when settings agree (shape guard, not just consistency)"; fi
+rm -f "$STATE_FILE"
+
+# GPT hardening: a MISSING/empty recorded path is corruption too — every state our
+# code writes carries the field, so check must NOT fall back to --asm and PASS.
+# Delete the field with settings still valid; the shape guard must FAIL, not greenlight.
+python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 - <<'PY'
+import json, os
+sp = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(sp)); s.pop('assembledMarketplacePath', None); json.dump(s, open(sp, 'w'), indent=2)
+PY
+if python3 "$STATE" check --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null 2>&1; then bad "state.py check PASSed with a MISSING recorded assembledMarketplacePath (fell back to --asm)"; else ok "state.py check fails a missing/empty recorded path (no --asm fallback greenlight)"; fi
+rm -f "$STATE_FILE"
+
 # Doctor hook-log recovery predicate: only a later `INFO armed watch` clears an
 # ERROR. A UserPromptSubmit `INFO attach record` is degraded backfill, not wake
 # recovery.
@@ -359,7 +509,7 @@ if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; the
 # chain to its final summary line — i.e. no early set -e death anywhere.
 DOC_HOME="$TMP/doctor-home"; DOC_CFG="$DOC_HOME/.claude"
 DOC_AGENT="$TMP/doctor-agent"; DOC_STORE="$DOC_AGENT/meta-sessions"
-DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$REPO/pi/meta-bridge/.assembled"  # SAME asm the doctor's check uses, so only the MCP drifts
+DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"  # SAME asm the doctor computes (XDG), so only the MCP drifts
 mkdir -p "$DOC_CFG" "$DOC_STORE" "$DOC_BIN"
 echo '{}' > "$DOC_CFG/settings.json"
 echo '{}' > "$DOC_HOME/.claude.json"
@@ -399,5 +549,11 @@ if printf '%s\n' "$DOC_OUT" | grep -q 'user MCP entwurf-bridge'; then ok "doctor
 if printf '%s\n' "$DOC_OUT" | grep -q '\[plugin install'; then ok "doctor continues to a later section after the drift (no early set -e death)"; else bad "doctor did not reach a later section header after the drift:"$'\n'"$DOC_OUT"; fi
 if printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: FAIL'; then ok "doctor runs the whole chain to its final summary line"; else bad "doctor did not reach its final summary line (mid-run death):"$'\n'"$DOC_OUT"; fi
 
+# ⓪ 경계 종료 단언: 이 smoke 전체(install 조립 + state + wrapper-uninstall + doctor)가
+# 끝난 뒤에도 checkout 안에는 live marketplace source가 생기지 않았다 — source
+# origin(repo)과 live artifact(XDG)가 구조적으로 분리됐다는 최종 증명. 미래 회귀가
+# repo 내부 ASM을 되살리거나 덮어쓰면(내용 해시 변화 포함) 여기서 잡힌다.
+if [ "$(asm_fingerprint)" = "$REPO_ASM_FP_START" ]; then ok "checkout-internal marketplace source is byte-identical before/after — no op created or mutated \$REPO/.assembled (source origin ≠ live artifact)"; else bad "a meta-bridge operation created/mutated \$REPO/pi/meta-bridge/.assembled — repo boundary breached"; fi
+
 echo
 if [ "$fail" -eq 0 ]; then echo "smoke-meta-install-state: PASS"; else echo "smoke-meta-install-state: FAIL (see above)"; exit 1; fi