@junghanacs/entwurf 0.13.1 → 0.14.1

package/scripts/smoke-entwurf-chain-live.ts

@@ -161,6 +161,14 @@ async function main(): Promise<void> {
 		ENTWURF_META_MAILBOX_DIR: mailboxDir,
 		ENTWURF_META_RECEIVERS_DIR: receiversDir,
 	};
+	// The MCP bridge prefers PI_SESSION_ID+PI_AGENT_ID over a meta-sender marker when both
+	// are present. A runner that is itself a pi --entwurf-control session (release-gate,
+	// an agent preparing a cut) would otherwise stamp every Claude hop with the RUNNER's
+	// garden id — hop 1 then fails "B saw A's real garden id" while the payload still
+	// traverses. Strip the carriers so A's SessionStart marker is the only authority.
+	const childEnv: NodeJS.ProcessEnv = { ...process.env, ...worldEnv };
+	delete childEnv.PI_SESSION_ID;
+	delete childEnv.PI_AGENT_ID;
 
 	const nonce = `ENTWURF-CHAIN-${crypto.randomBytes(5).toString("hex").toUpperCase()}`;
 	console.error(`[smoke-entwurf-chain-live] repo:   ${REPO_ROOT}`);
@@ -194,7 +202,7 @@ async function main(): Promise<void> {
 		const c = spawn(
 			"pi",
 			[...REPO_EXTENSION_ARGS, "--entwurf-control", "--provider", acpProvider, "--model", acpModel, "--mode", "rpc"],
-			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...worldEnv } },
+			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: childEnv },
 		);
 		children.push(c);
 		c.stdout?.on("data", (b: Buffer) => {
@@ -215,7 +223,7 @@ async function main(): Promise<void> {
 		const b = spawn(
 			"pi",
 			[...REPO_EXTENSION_ARGS, "--entwurf-control", "--provider", gptProvider, "--model", gptModel, "--mode", "rpc"],
-			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...worldEnv } },
+			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: childEnv },
 		);
 		children.push(b);
 		b.stdout?.on("data", (x: Buffer) => {
@@ -265,7 +273,7 @@ async function main(): Promise<void> {
 			cwd: world,
 			encoding: "utf8",
 			timeout: CLAUDE_TURN_TIMEOUT_MS,
-			env: { ...process.env, ...worldEnv },
+			env: childEnv,
 		});
 		const claudeOut = `${claudeRun.stdout ?? ""}\n${claudeRun.stderr ?? ""}`;
 		ok("A's native Claude Code turn ran", claudeRun.status === 0);

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -260,7 +260,7 @@ async function main(): Promise<void> {
 			const up = await waitForSocket(sockPath, BOOT_TIMEOUT_MS);
 			ok("C1b real record-less `pi --entwurf-control` stood up a control socket", up);
 
-			for (const intent of ["fire-and-forget", "owned-outcome"] as const) {
+			for (const intent of ["fire-and-forget"] as const) {
 				const result: EntwurfV2RunResult = await runEntwurfV2(
 					{ target: c1bGid, intent, message: `matrix-live C1b record-less probe (${intent})` },
 					prodDeps(smokeSender(c1bGid, tmp)),

package/scripts/smoke-meta-honesty.sh

@@ -17,7 +17,7 @@
 #     alarm), and must log sender-marker evidence so send-side replyable identity
 #     is not silently lost.
 #
-# Deterministic + offline (no `claude -p`, no network). Safe for pnpm check /
+# Deterministic + offline (no `claude -p`, no network). Safe for pnpm run check:full /
 # pre-commit. Isolates its store via PI_CODING_AGENT_DIR in a temp dir.
 #
 # RUNTIME DEPS: bash + node (the hook runs under `node --experimental-strip-types`)

package/scripts/smoke-meta-install-state.sh

@@ -6,6 +6,7 @@ set -euo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO="$(cd "$HERE/.." && pwd)"
 export REPO
+export PYTHONDONTWRITEBYTECODE=1
 STATE="$REPO/scripts/meta-bridge-state.py"
 STORE_DOCTOR="$REPO/scripts/meta-bridge-store-doctor.ts"
 # shellcheck source=scripts/meta-bridge-hook-log.sh
@@ -192,6 +193,136 @@ JSON
 
 py() { python3 "$STATE" "$@" --repo "$REPO" --asm "$ASM"; }
 
+# #71 retirement cells: drive the production leaf directly so JSON scalar type,
+# malformed provenance and one-shot convergence cannot hide inside the larger
+# install fixture below. Three cells carry [QK:] claims backed by exact-once
+# mutants in scripts/mutants/meta-retire.json; each prints its token on the
+# FAILURE line, because signatureOnFailureLine ignores any line starting with
+# `ok`. Cells keep running after a failure so one planted defect reddens exactly
+# its own claim instead of masking the ones behind it.
+if python3 - "$STATE" <<'PY'
+import copy, importlib.util, sys
+
+spec = importlib.util.spec_from_file_location("meta_bridge_state", sys.argv[1])
+assert spec and spec.loader
+m = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+NAME = "skipDangerousModePermissionPrompt"
+PATH = [NAME]
+MISSING = object()
+
+def entry(existed, value):
+    return {"kind": "scalar", "path": PATH, "original": {"existed": existed, "value": value}}
+
+def fixture(current=MISSING, old_entry=MISSING):
+    settings = {} if current is MISSING else {NAME: current}
+    keys = {} if old_entry is MISSING else {NAME: copy.deepcopy(old_entry)}
+    state = {"files": {"settings": {"keys": keys}}}
+    return state, settings
+
+def run(current=MISSING, old_entry=MISSING):
+    state, settings = fixture(current, old_entry)
+    m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+    return state, settings
+
+failed = 0
+
+def cell(sig, label, fn):
+    global failed
+    text = f"{sig} {label}".strip()
+    try:
+        fn()
+    except Exception as exc:
+        print(f"  FAIL  {text}: {exc!r}")
+        failed = 1
+        return
+    print(f"  ok    {text}")
+
+def compare_type_cells():
+    assert NAME not in run(True, entry(False, None))[1]
+    assert run(True, entry(True, False))[1][NAME] is False
+    assert run(True, entry(True, True))[1][NAME] is True
+    assert run(False, entry(True, False))[1][NAME] is False
+    assert NAME not in run(MISSING, entry(True, False))[1]
+    value = run(1, entry(True, False))[1][NAME]
+    assert type(value) is int and value == 1
+
+cell(
+    "[QK:META-RETIRE-COMPARE-TYPE]",
+    "only an exact bool true with proven provenance is restored; 1 is not true",
+    compare_type_cells,
+)
+
+def malformed_cells():
+    for bad_entry in [
+        {"kind": "map-entry", "path": PATH, "original": {"existed": False, "value": None}},
+        {"kind": "scalar", "path": PATH, "original": {"existed": "no", "value": None}},
+    ]:
+        state, settings = fixture(True, bad_entry)
+        before = copy.deepcopy((state, settings))
+        try:
+            m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+        except m.StateError:
+            pass
+        else:
+            raise AssertionError("malformed retired provenance was accepted")
+        assert (state, settings) == before
+
+cell(
+    "[QK:META-RETIRE-MALFORMED-SILENT]",
+    "malformed provenance fails loud and mutates neither settings nor state",
+    malformed_cells,
+)
+
+def fresh_cells():
+    for current in [True, False, 1, MISSING]:
+        state, settings = run(current)
+        expected = {} if current is MISSING else {NAME: current}
+        assert settings == expected and NAME not in state["files"]["settings"]["keys"]
+
+cell(
+    "[QK:META-RETIRE-FRESH-TOUCH]",
+    "a provenance-less value is the operator's and is never touched",
+    fresh_cells,
+)
+
+def one_shot_cells():
+    state, settings = fixture(True, entry(True, False))
+    m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+    assert settings[NAME] is False and NAME not in state["files"]["settings"]["keys"]
+    before = copy.deepcopy((state, settings))
+    m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+    assert (state, settings) == before
+
+# Recommended, not claimed: one-shot convergence and the disjoint-set guard ride
+# along as ordinary cells so the proof budget stays at the three claims above.
+cell("", "relinquishment consumes the entry once, so a re-run cannot restore again", one_shot_cells)
+
+def structural_cells():
+    assert not m._managed_scalar_names & m._retired_scalar_names
+    # settings_state_keys is the sole reader of the ownership ledger, and
+    # load_state validates only the envelope. A corrupt files/settings/keys shape
+    # must stop with an operator diagnostic BEFORE any write — never a bare
+    # KeyError raised from inside apply(), and never a silent pass that would let
+    # relinquishment reason about ownership it cannot actually read.
+    for broken in [{}, {"files": {}}, {"files": {"settings": {}}}, {"files": {"settings": {"keys": []}}}]:
+        settings = {NAME: True}
+        before = copy.deepcopy((broken, settings))
+        try:
+            m.relinquish_retired_scalar(broken, settings, NAME, PATH, True)
+        except m.StateError:
+            pass
+        else:
+            raise AssertionError(f"corrupt state ledger accepted: {broken!r}")
+        assert (broken, settings) == before
+
+cell("", "retired/managed sets stay disjoint and a corrupt key ledger fails closed", structural_cells)
+sys.exit(failed)
+PY
+then ok "#71 retirement leaf: provenance, bool strictness, malformed refusal, one-shot convergence"
+else bad "#71 retirement leaf cells failed (traceback above)"
+fi
+
 DEV_STATUSLINE="$(python3 "$STATE" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin)["command"])')"
 if [ "$DEV_STATUSLINE" = "$REPO/scripts/meta-bridge-statusline.sh" ]; then ok "dev statusLine pins the checkout script"; else bad "dev statusLine command drifted: $DEV_STATUSLINE"; fi
 FAKE_INSTALLED_REPO="$TMP/npmroot/node_modules/@junghanacs/entwurf"
@@ -212,10 +343,26 @@ assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['va
 assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
 assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
 assert s['files']['settings']['keys']['autoCompactEnabled']['original']['existed'] is False
+assert 'skipDangerousModePermissionPrompt' not in s['files']['settings']['keys']
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
 PY
-then ok "state captures original scalar/map values and is mode 0600"; else bad "state did not capture original values / mode 0600"; fi
+then ok "state captures original scalar/map values, excludes the retired scalar, and is mode 0600"; else bad "state did not capture original values / retirement / mode 0600"; fi
 
+# Simulate an upgrade from 0.14.0: the old state proves entwurf changed false→true.
+# New apply must restore false and consume that ownership exactly once.
+python3 - <<'PY'
+import json, os
+cfg=os.environ['CLAUDE_CONFIG_DIR']
+sp=cfg + '/settings.json'; stp=cfg + '/entwurf.install-state.json'
+settings=json.load(open(sp)); state=json.load(open(stp))
+settings['skipDangerousModePermissionPrompt']=True
+state['files']['settings']['keys']['skipDangerousModePermissionPrompt']={
+  'kind':'scalar', 'path':['skipDangerousModePermissionPrompt'],
+  'original':{'existed':True, 'value':False}
+}
+json.dump(settings, open(sp,'w'), indent=2); open(sp,'a').write('\n')
+json.dump(state, open(stp,'w'), indent=2); open(stp,'a').write('\n')
+PY
 py apply >/dev/null
 if python3 - <<'PY'
 import json, os
@@ -231,7 +378,9 @@ assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
 for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert settings[key] is False, key
-assert settings['skipDangerousModePermissionPrompt'] is True
+assert settings['skipDangerousModePermissionPrompt'] is False
+state=json.load(open(cfg + '/entwurf.install-state.json'))
+assert 'skipDangerousModePermissionPrompt' not in state['files']['settings']['keys']
 for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
     assert item in settings['permissions']['allow'], item
 assert settings['permissions']['allow'].count('Read') == 1
@@ -249,7 +398,24 @@ then ok "apply installs managed keyset without clobbering unrelated keys"; else
 # (agent-config merge, hand edit) overwrites a pi-owned key, check must fail loud
 # AND name the drifted key so doctor can surface which one. Adversarial flips
 # below; restore with apply afterward so the later cases see a clean keyset.
-if py check >/dev/null 2>&1; then ok "survival check passes on a freshly applied keyset"; else bad "survival check failed right after apply"; fi
+if py check >/dev/null 2>&1; then ok "survival check passes after relinquishing the retired scalar"; else bad "survival check failed right after retirement apply"; fi
+MANAGED_JSON="$(py managed-keys)"
+if printf '%s' "$MANAGED_JSON" | grep -q 'skipDangerousModePermissionPrompt'; then bad "managed-keys still claims the retired operator key"; else ok "managed-keys returns skipDangerousModePermissionPrompt to the operator"; fi
+# A provenance-less true cannot be changed safely, but doctor/check must make it visible.
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['skipDangerousModePermissionPrompt']=True
+json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')
+PY
+RETIRED_NOTE="$(py check)"
+if printf '%s' "$RETIRED_NOTE" | grep -q 'operator-owned'; then ok "check advises on a provenance-less true without claiming ownership"; else bad "check hid the provenance-less retired true"; fi
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['skipDangerousModePermissionPrompt']=False
+json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')
+PY
 SURVIVAL_SNAP="$TMP/settings-survival-snapshot.json"
 cp "$CLAUDE_CONFIG_DIR/settings.json" "$SURVIVAL_SNAP"  # exact restore point (array-replace below would drop user items)
 python3 - <<'PY'

package/scripts/smoke-mux-fresh-call-live.ts

@@ -0,0 +1,365 @@
+/**
+ * smoke-mux-fresh-call-live — the ONE axis a deterministic gate cannot reach: a real window, a
+ * real runtime, a real first turn, and a real callback arriving on a real inbound surface.
+ *
+ * OUT of `pnpm check`. Needs `LIVE=1`. Costs two model turns (one pi, one Claude Code).
+ *
+ * ── Isolate the WRITES, keep the runtimes real ──
+ *
+ * The obvious fence — redirect HOME and everything under it — is wrong here, and wrongly GREEN
+ * is worse than red: a pi with no `PI_CODING_AGENT_DIR` and a Claude with no config dir are
+ * unauthenticated runtimes that fail for a reason this smoke is not testing. So the split is:
+ *
+ *   REAL (runtime-owned)               the authenticated runtime config — the real pi agent dir
+ *                                      for Pi, and canonical HOME/optional CLAUDE_CONFIG_DIR for
+ *                                      Claude. Native session transcripts remain there as evidence.
+ *   FIXTURE (entwurf-owned writes)     XDG roots, the four meta roots, the v2 lock dir, and the
+ *                                      working directory. Pi also receives fixture HOME so its
+ *                                      control socket cannot touch the operator's directory.
+ *
+ * Be honest about what that means: this smoke READS the operator's real runtime config, and the
+ * two siblings it opens will write their own session transcripts into the real pi agent dir the
+ * same way any pi session does. What it must never do is mint a garden record, a control socket,
+ * a mailbox or a lock outside the fixture — that is what the proof at the end checks.
+ *
+ * The siblings inherit the fixture through the private tmux server we start inside it, so their
+ * records land in the fixture store too: born, observed, discarded, and the garden never sees
+ * them.
+ */
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	assessLauncherCleanup,
+	restoreOriginalXdg,
+	snapshotClaudeLauncher,
+	snapshotOriginalXdg,
+	verifyClaudeLauncher,
+} from "./lib/claude-launcher-fence.ts";
+import { skipLive } from "./lib/live-skip.ts";
+
+const LABEL = "smoke-mux-fresh-call-live";
+const CALLBACK_WAIT_MS = 180_000;
+const LIVE_MODEL = {
+	pi: "openai-codex/gpt-5.6-terra",
+	"claude-code": "claude-sonnet-5",
+} as const;
+
+// Captured BEFORE any redirect: these name the operator's world and must stay untouched.
+const REAL_HOME = os.homedir();
+const REAL_PI_AGENT_DIR = process.env.PI_CODING_AGENT_DIR?.trim() || path.join(REAL_HOME, ".pi", "agent");
+const ORIGINAL_CLAUDE_CONFIG_DIR = process.env.CLAUDE_CONFIG_DIR?.trim() || null;
+const REAL_CLAUDE_CONFIG_DIR = ORIGINAL_CLAUDE_CONFIG_DIR || path.join(REAL_HOME, ".claude");
+const REAL_META_SESSIONS =
+	process.env.ENTWURF_META_SESSIONS_DIR?.trim() || path.join(REAL_PI_AGENT_DIR, "meta-sessions");
+const REAL_CONTROL_DIR = path.join(REAL_HOME, ".pi", "entwurf-control");
+// The four XDG roots as the OPERATOR has them — presence and value, captured before any redirect,
+// so the real-HOME Claude cell can be given exact operator-env parity (issue #67).
+const ORIGINAL_XDG = snapshotOriginalXdg(process.env);
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	if (!cond) throw new Error(`${LABEL}: FAILED — ${label}`);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+/**
+ * The entry SET of a directory we must not write to. A missing directory is a valid answer
+ * (ENOENT); anything else — EACCES above all — is a real failure and must not be laundered into
+ * "absent", which would turn an unreadable store into a passing proof.
+ *
+ * This is an ENTRY-SET comparison, not a byte comparison: it detects a record/socket/lock that
+ * appeared or vanished, which is exactly the residue class this smoke can create. It does not
+ * claim file contents are unchanged.
+ */
+function entrySet(dir: string): string {
+	try {
+		return fs.readdirSync(dir).sort().join("\n");
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code === "ENOENT") return "<absent>";
+		throw err;
+	}
+}
+
+function tmux(socket: string, args: string[], env: NodeJS.ProcessEnv): { status: number | null; stdout: string } {
+	const r = spawnSync("tmux", ["-S", socket, ...args], { env, encoding: "utf8" });
+	return { status: r.status, stdout: (r.stdout ?? "").trim() };
+}
+
+function pidIsAlive(pid: number): boolean {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code === "ESRCH") return false;
+		throw err;
+	}
+}
+
+function waitForPidsGone(pids: ReadonlySet<number>, timeoutMs = 10_000): boolean {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if ([...pids].every((pid) => !pidIsAlive(pid))) return true;
+		spawnSync("sleep", ["0.1"]);
+	}
+	return [...pids].every((pid) => !pidIsAlive(pid));
+}
+
+async function main(): Promise<void> {
+	if (process.env.LIVE !== "1")
+		skipLive(LABEL, "LIVE=1 not set — this smoke opens real windows and spends model turns");
+	if (spawnSync("tmux", ["-V"], { encoding: "utf8" }).status !== 0) skipLive(LABEL, "tmux is not installed on PATH");
+	if (spawnSync("sh", ["-c", "command -v claude"], { encoding: "utf8" }).status !== 0)
+		skipLive(LABEL, "the claude runtime is not on PATH — the fixed claude-code backend cannot be opened");
+	if (!fs.existsSync(REAL_PI_AGENT_DIR))
+		skipLive(LABEL, `no pi agent dir at ${REAL_PI_AGENT_DIR} — an unauthenticated pi would fail for the wrong reason`);
+	if (!fs.existsSync(REAL_CLAUDE_CONFIG_DIR))
+		skipLive(
+			LABEL,
+			`no Claude config dir at ${REAL_CLAUDE_CONFIG_DIR} — an unauthenticated claude would fail likewise`,
+		);
+
+	const root = fs.mkdtempSync(path.join(os.tmpdir(), "mux-fresh-call-live-"));
+	const scratch = path.join(root, "cwd");
+	const beforeRealStore = entrySet(REAL_META_SESSIONS);
+	const beforeRealSockets = entrySet(REAL_CONTROL_DIR);
+	const originalCwd = process.cwd();
+	// FAIL-CLOSED launcher preflight (issue #67): pin the real claude launcher — path, kind, link,
+	// resolved target and content — before ANY Claude-capable child starts. Throws if it cannot.
+	const launcherSnapshot = snapshotClaudeLauncher({ env: process.env, fixtureRoot: root });
+
+	// ── Every WRITE axis into the fixture; the two auth roots stay real ──────
+	const fenced: Record<string, string> = {
+		HOME: path.join(root, "home"),
+		XDG_CONFIG_HOME: path.join(root, "xdg-config"),
+		XDG_DATA_HOME: path.join(root, "xdg-data"),
+		XDG_STATE_HOME: path.join(root, "xdg-state"),
+		XDG_CACHE_HOME: path.join(root, "xdg-cache"),
+		XDG_RUNTIME_DIR: path.join(root, "xdg-runtime"),
+		ENTWURF_META_SESSIONS_DIR: path.join(root, "meta-sessions"),
+		ENTWURF_META_RECEIVERS_DIR: path.join(root, "meta-receivers"),
+		ENTWURF_META_SENDERS_DIR: path.join(root, "meta-senders"),
+		ENTWURF_META_MAILBOX_DIR: path.join(root, "meta-mailbox"),
+		ENTWURF_V2_LOCK_DIR: path.join(root, "v2-locks"),
+	};
+	const referenced: Record<string, string> = {
+		PI_CODING_AGENT_DIR: REAL_PI_AGENT_DIR,
+	};
+	for (const dir of Object.values(fenced)) fs.mkdirSync(dir, { recursive: true });
+	fs.mkdirSync(scratch, { recursive: true });
+	// A runtime dir is a private surface by convention and tmux checks it.
+	fs.chmodSync(fenced.XDG_RUNTIME_DIR, 0o700);
+	for (const [k, v] of Object.entries(fenced)) process.env[k] = v;
+	for (const [k, v] of Object.entries(referenced)) process.env[k] = v;
+	delete process.env.CLAUDE_CONFIG_DIR;
+	process.chdir(scratch);
+
+	// Import the meta layer only AFTER the redirects — a module that resolved its roots at import
+	// time would have captured the operator's.
+	const meta = await import("../pi-extensions/lib/meta-session.ts");
+	const { freshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
+
+	const siblingGids = new Set<string>();
+	const siblingPids = new Set<number>();
+	const privateSockets = new Set<string>();
+	let cleanupError: Error | null = null;
+	let runError: unknown = null;
+	try {
+		ok(
+			"fence: every entwurf-owned WRITE root is inside the fixture and none is the operator's home",
+			Object.values(fenced).every((d) => d.startsWith(root)) && !Object.values(fenced).includes(REAL_HOME),
+		);
+		ok(
+			"fence: runtime auth roots are real — this smoke tests configured runtimes, not empty ones",
+			referenced.PI_CODING_AGENT_DIR === REAL_PI_AGENT_DIR &&
+				!referenced.PI_CODING_AGENT_DIR.startsWith(root) &&
+				!REAL_CLAUDE_CONFIG_DIR.startsWith(root),
+		);
+		ok(
+			"fence: the meta layer resolved its roots to the fixture, and cwd is the scratch dir",
+			meta.defaultMetaSessionsDir().startsWith(root) &&
+				meta.defaultMetaMailboxDir().startsWith(root) &&
+				process.cwd().startsWith(root),
+		);
+		ok("fence: XDG_RUNTIME_DIR is 0700", (fs.statSync(fenced.XDG_RUNTIME_DIR).mode & 0o777) === 0o700);
+
+		// ── The caller: a self-fetch citizen whose mailbox we can drain ──────────
+		const nativeSessionId = `mux-fresh-call-live-${process.pid}`;
+		const caller = meta.upsertMetaSession({
+			input: { backend: "claude-code", nativeSessionId, cwd: scratch },
+		});
+		const callerGid = caller.record.gardenId;
+		// A record proves identity; only an ARMED receiver marker makes the mailbox deliverable —
+		// without it the callbacks would be refused as mailbox-undeliverable and this smoke would
+		// measure nothing.
+		meta.writeMetaReceiverMarker({
+			gardenId: callerGid,
+			backend: "claude-code",
+			nativeSessionId,
+			ownerPid: process.pid,
+			armProvenance: "session-start",
+		});
+		ok(
+			"fixture: the caller citizen was minted INSIDE the fixture store and its mailbox is armed",
+			Boolean(callerGid) && caller.path.startsWith(root),
+		);
+
+		// ── One private tmux server per backend ──────────────────────────────────
+		// Pi needs fixture HOME so its control socket is isolated. Claude needs canonical
+		// operator HOME (and the operator's optional CLAUDE_CONFIG_DIR) or it enters first-run
+		// onboarding instead of exercising the configured runtime. Separate servers preserve
+		// those backend-native environments without adding an env carrier to the product.
+		const nonces = new Map<string, string>();
+		for (const backend of ["pi", "claude-code"] as const) {
+			const socket = path.join(root, `${backend}.sock`);
+			privateSockets.add(socket);
+			const env = { ...process.env } as NodeJS.ProcessEnv;
+			delete env.TMUX;
+			delete env.TMUX_PANE;
+			if (backend === "claude-code") {
+				env.HOME = REAL_HOME;
+				// EXACT operator-env parity on the four XDG roots (issue #67): real HOME plus a
+				// fixture XDG_DATA_HOME is the measured state in which Claude's self-update rewrote
+				// the operator's real launcher into the fixture tree and teardown dangled it. Each
+				// variable is restored to its original value; an originally absent one is DELETED,
+				// never filled with a canonical default.
+				restoreOriginalXdg(env, ORIGINAL_XDG);
+				if (ORIGINAL_CLAUDE_CONFIG_DIR) env.CLAUDE_CONFIG_DIR = ORIGINAL_CLAUDE_CONFIG_DIR;
+				else delete env.CLAUDE_CONFIG_DIR;
+			}
+			if (tmux(socket, ["new-session", "-d", "-s", "fixture", "-c", scratch, "-n", "anchor"], env).status !== 0) {
+				throw new Error(`${LABEL}: could not start the private ${backend} tmux server at ${socket}`);
+			}
+			const anchorPane = tmux(socket, ["display-message", "-p", "-t", "fixture:anchor", "#{pane_id}"], env).stdout;
+			const inherited: NodeJS.ProcessEnv = { ...env, TMUX: `${socket},0,0`, TMUX_PANE: anchorPane };
+			ok(`${backend}: tmux server is a private socket, never the operator's`, String(inherited.TMUX).startsWith(root));
+
+			const result = freshCall(
+				{
+					backend,
+					model: LIVE_MODEL[backend],
+					task: "Reply with the single word ACK and then stop. Do not read files.",
+					callerGardenId: callerGid,
+				},
+				inherited,
+			);
+			ok(`${backend}: launch receipt is ok`, result.ok);
+			if (!result.ok) return;
+			nonces.set(backend, result.receipt.nonce);
+			siblingPids.add(Number(result.receipt.panePid));
+			ok(
+				`${backend}: the receipt carries tmux coordinates, requested model and nonce, and nothing about delivery`,
+				Boolean(
+					result.receipt.windowId &&
+						result.receipt.paneId &&
+						result.receipt.model === LIVE_MODEL[backend] &&
+						result.receipt.nonce,
+				) && !("gardenId" in result.receipt),
+			);
+		}
+
+		// The sender envelope rides INSIDE the mailbox body (`  session:     <gid> (…)`) — that line
+		// is the whole point of this smoke, so it is parsed rather than assumed. `readMetaInbox`
+		// drains, so every arrival must be recorded on the pass that saw it.
+		const deadline = Date.now() + CALLBACK_WAIT_MS;
+		const arrived = new Map<string, string>();
+		while (Date.now() < deadline && arrived.size < nonces.size) {
+			for (const msg of meta.readMetaInbox({ gardenId: callerGid }).messages) {
+				const sender = /^\s*session:\s+(\S+)/m.exec(msg.body)?.[1] ?? "";
+				for (const [backend, nonce] of nonces) if (msg.body.includes(nonce) && sender) arrived.set(backend, sender);
+			}
+			if (arrived.size < nonces.size) spawnSync("sleep", ["3"]);
+		}
+
+		for (const backend of nonces.keys()) {
+			const sender = arrived.get(backend);
+			ok(
+				`${backend}: the nonce came back and its SENDER ENVELOPE carries a garden id — correlation without asking the sibling`,
+				Boolean(sender) && /^\d{8}T\d{6}-[0-9a-f]{6}$/.test(String(sender)),
+			);
+			if (sender) siblingGids.add(sender);
+		}
+		ok(
+			"correlation: the two siblings reported DIFFERENT garden ids — the envelope identifies each one, not the launcher",
+			siblingGids.size === arrived.size && !siblingGids.has(callerGid),
+		);
+		ok(
+			"fence: those sibling records live in the FIXTURE store",
+			[...siblingGids].every(
+				(gid) => fs.existsSync(meta.defaultMetaSessionsDir()) && entrySet(meta.defaultMetaSessionsDir()).includes(gid),
+			),
+		);
+	} catch (err) {
+		// Captured, not rethrown here: the teardown below must run and its findings must AGGREGATE
+		// with the run error — neither may hide the other.
+		runError = err;
+	} finally {
+		for (const socket of privateSockets) tmux(socket, ["kill-server"], process.env);
+		const panesGone = waitForPidsGone(siblingPids);
+		process.chdir(originalCwd);
+		const problems: string[] = [];
+		// Launcher integrity BEFORE fixture removal, on success and failure alike (issue #67).
+		// Removal happens only when it is PROVEN non-destructive: the launcher demonstrably does
+		// not reference the fixture tree AND every TRACKED launched pane process is proven gone —
+		// a live pane could still rewrite the launcher after the check. (Tracked-pane quiescence
+		// only; this claims nothing about untracked detached descendants.) An unproven state
+		// blocks removal loudly rather than guessing.
+		const launcherProblems = verifyClaudeLauncher(launcherSnapshot);
+		const cleanup = assessLauncherCleanup(launcherSnapshot);
+		for (const p of cleanup.problems) problems.push(`launcher cleanup: ${p}`);
+		if (!panesGone) {
+			problems.push(
+				`tracked sibling pane processes were not proven gone after private tmux teardown: ${[...siblingPids].join(", ")}`,
+			);
+		}
+		if (!cleanup.safeToRemove || !panesGone) {
+			problems.push(
+				`fixture removal of ${root} is BLOCKED — ${
+					cleanup.safeToRemove
+						? "tracked pane processes are not proven gone"
+						: "the real claude launcher references the fixture tree or could not be proven safe"
+				}; resolve the named problems above, then remove the tree by hand`,
+			);
+		} else {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+		for (const p of launcherProblems) problems.push(`launcher integrity: ${p}`);
+		if (problems.length > 0) cleanupError = new Error(problems.join("\n  "));
+	}
+	if (runError || cleanupError) {
+		const parts: string[] = [];
+		if (runError) parts.push(`RUN: ${runError instanceof Error ? runError.message : String(runError)}`);
+		if (cleanupError) parts.push(`CLEANUP:\n  ${cleanupError.message}`);
+		throw new Error(`${LABEL}: run did not complete cleanly —\n\n${parts.join("\n\n")}`);
+	}
+
+	// ── Prove the fence held, by name and by entry set ───────────────────────
+	ok(
+		"self-fence: the operator's meta-session store has the same entry set as before",
+		entrySet(REAL_META_SESSIONS) === beforeRealStore,
+	);
+	ok(
+		"self-fence: the operator's control-socket dir has the same entry set as before",
+		entrySet(REAL_CONTROL_DIR) === beforeRealSockets,
+	);
+	const realStoreNow = entrySet(REAL_META_SESSIONS);
+	const realSocketsNow = entrySet(REAL_CONTROL_DIR);
+	ok(
+		"self-fence: not one fixture sibling garden id appears in the operator's store or leaves a control-socket residue",
+		[...siblingGids].every((gid) => !realStoreNow.includes(gid) && !realSocketsNow.includes(gid)),
+	);
+	ok(
+		"self-fence: the real claude launcher, its link and its resolved target are exactly as pinned before launch",
+		verifyClaudeLauncher(launcherSnapshot).length === 0,
+	);
+
+	console.log(`\n${LABEL}: ${passed} checks passed`);
+}
+
+main().catch((err) => {
+	console.error(`${LABEL}: ${err instanceof Error ? err.message : String(err)}`);
+	process.exit(1);
+});