@junghanacs/entwurf 0.14.0 → 0.14.2

package/scripts/smoke-entwurf-chain-live.ts

@@ -63,7 +63,7 @@ const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 
-const GPT_TARGET = process.env.ENTWURF_CHAIN_GPT_TARGET?.trim() || "openai-codex/gpt-5.4";
+const GPT_TARGET = process.env.ENTWURF_CHAIN_GPT_TARGET?.trim() || "openai-codex/gpt-5.6-luna";
 const ACP_TARGET = process.env.ENTWURF_CHAIN_ACP_TARGET?.trim() || "entwurf/claude-sonnet-5";
 const BOOT_TIMEOUT_MS = 45_000;
 const CLAUDE_TURN_TIMEOUT_MS = Number(process.env.ENTWURF_CHAIN_CLAUDE_TIMEOUT_MS) || 240_000;
@@ -161,6 +161,14 @@ async function main(): Promise<void> {
 		ENTWURF_META_MAILBOX_DIR: mailboxDir,
 		ENTWURF_META_RECEIVERS_DIR: receiversDir,
 	};
+	// The MCP bridge prefers PI_SESSION_ID+PI_AGENT_ID over a meta-sender marker when both
+	// are present. A runner that is itself a pi --entwurf-control session (release-gate,
+	// an agent preparing a cut) would otherwise stamp every Claude hop with the RUNNER's
+	// garden id — hop 1 then fails "B saw A's real garden id" while the payload still
+	// traverses. Strip the carriers so A's SessionStart marker is the only authority.
+	const childEnv: NodeJS.ProcessEnv = { ...process.env, ...worldEnv };
+	delete childEnv.PI_SESSION_ID;
+	delete childEnv.PI_AGENT_ID;
 
 	const nonce = `ENTWURF-CHAIN-${crypto.randomBytes(5).toString("hex").toUpperCase()}`;
 	console.error(`[smoke-entwurf-chain-live] repo:   ${REPO_ROOT}`);
@@ -194,7 +202,7 @@ async function main(): Promise<void> {
 		const c = spawn(
 			"pi",
 			[...REPO_EXTENSION_ARGS, "--entwurf-control", "--provider", acpProvider, "--model", acpModel, "--mode", "rpc"],
-			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...worldEnv } },
+			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: childEnv },
 		);
 		children.push(c);
 		c.stdout?.on("data", (b: Buffer) => {
@@ -215,7 +223,7 @@ async function main(): Promise<void> {
 		const b = spawn(
 			"pi",
 			[...REPO_EXTENSION_ARGS, "--entwurf-control", "--provider", gptProvider, "--model", gptModel, "--mode", "rpc"],
-			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...worldEnv } },
+			{ cwd: world, stdio: ["pipe", "pipe", "pipe"], env: childEnv },
 		);
 		children.push(b);
 		b.stdout?.on("data", (x: Buffer) => {
@@ -265,7 +273,7 @@ async function main(): Promise<void> {
 			cwd: world,
 			encoding: "utf8",
 			timeout: CLAUDE_TURN_TIMEOUT_MS,
-			env: { ...process.env, ...worldEnv },
+			env: childEnv,
 		});
 		const claudeOut = `${claudeRun.stdout ?? ""}\n${claudeRun.stderr ?? ""}`;
 		ok("A's native Claude Code turn ran", claudeRun.status === 0);

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -36,7 +36,7 @@
  *
  * LIVE-only (spawns a real pi, opens a real socket) — kept OUT of `pnpm check`; honest skip when
  * LIVE!=1 (a release-gate that hard-fails without auth/model is unrunnable unattended). Model:
- *   ENTWURF_LIVE_TARGET   = "<provider>/<model>"  (default "openai-codex/gpt-5.4")
+ *   ENTWURF_LIVE_TARGET   = "<provider>/<model>"  (default "openai-codex/gpt-5.6-luna")
  *   (or split: ENTWURF_LIVE_PROVIDER + ENTWURF_LIVE_MODEL)
  *   LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
  *
@@ -101,7 +101,7 @@ function resolveTarget(): { provider: string; model: string } {
 	}
 	return {
 		provider: process.env.ENTWURF_LIVE_PROVIDER?.trim() || "openai-codex",
-		model: process.env.ENTWURF_LIVE_MODEL?.trim() || "gpt-5.4",
+		model: process.env.ENTWURF_LIVE_MODEL?.trim() || "gpt-5.6-luna",
 	};
 }
 

package/scripts/smoke-meta-install-state.sh

@@ -6,6 +6,7 @@ set -euo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO="$(cd "$HERE/.." && pwd)"
 export REPO
+export PYTHONDONTWRITEBYTECODE=1
 STATE="$REPO/scripts/meta-bridge-state.py"
 STORE_DOCTOR="$REPO/scripts/meta-bridge-store-doctor.ts"
 # shellcheck source=scripts/meta-bridge-hook-log.sh
@@ -192,6 +193,136 @@ JSON
 
 py() { python3 "$STATE" "$@" --repo "$REPO" --asm "$ASM"; }
 
+# #71 retirement cells: drive the production leaf directly so JSON scalar type,
+# malformed provenance and one-shot convergence cannot hide inside the larger
+# install fixture below. Three cells carry [QK:] claims backed by exact-once
+# mutants in scripts/mutants/meta-retire.json; each prints its token on the
+# FAILURE line, because signatureOnFailureLine ignores any line starting with
+# `ok`. Cells keep running after a failure so one planted defect reddens exactly
+# its own claim instead of masking the ones behind it.
+if python3 - "$STATE" <<'PY'
+import copy, importlib.util, sys
+
+spec = importlib.util.spec_from_file_location("meta_bridge_state", sys.argv[1])
+assert spec and spec.loader
+m = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+NAME = "skipDangerousModePermissionPrompt"
+PATH = [NAME]
+MISSING = object()
+
+def entry(existed, value):
+    return {"kind": "scalar", "path": PATH, "original": {"existed": existed, "value": value}}
+
+def fixture(current=MISSING, old_entry=MISSING):
+    settings = {} if current is MISSING else {NAME: current}
+    keys = {} if old_entry is MISSING else {NAME: copy.deepcopy(old_entry)}
+    state = {"files": {"settings": {"keys": keys}}}
+    return state, settings
+
+def run(current=MISSING, old_entry=MISSING):
+    state, settings = fixture(current, old_entry)
+    m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+    return state, settings
+
+failed = 0
+
+def cell(sig, label, fn):
+    global failed
+    text = f"{sig} {label}".strip()
+    try:
+        fn()
+    except Exception as exc:
+        print(f"  FAIL  {text}: {exc!r}")
+        failed = 1
+        return
+    print(f"  ok    {text}")
+
+def compare_type_cells():
+    assert NAME not in run(True, entry(False, None))[1]
+    assert run(True, entry(True, False))[1][NAME] is False
+    assert run(True, entry(True, True))[1][NAME] is True
+    assert run(False, entry(True, False))[1][NAME] is False
+    assert NAME not in run(MISSING, entry(True, False))[1]
+    value = run(1, entry(True, False))[1][NAME]
+    assert type(value) is int and value == 1
+
+cell(
+    "[QK:META-RETIRE-COMPARE-TYPE]",
+    "only an exact bool true with proven provenance is restored; 1 is not true",
+    compare_type_cells,
+)
+
+def malformed_cells():
+    for bad_entry in [
+        {"kind": "map-entry", "path": PATH, "original": {"existed": False, "value": None}},
+        {"kind": "scalar", "path": PATH, "original": {"existed": "no", "value": None}},
+    ]:
+        state, settings = fixture(True, bad_entry)
+        before = copy.deepcopy((state, settings))
+        try:
+            m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+        except m.StateError:
+            pass
+        else:
+            raise AssertionError("malformed retired provenance was accepted")
+        assert (state, settings) == before
+
+cell(
+    "[QK:META-RETIRE-MALFORMED-SILENT]",
+    "malformed provenance fails loud and mutates neither settings nor state",
+    malformed_cells,
+)
+
+def fresh_cells():
+    for current in [True, False, 1, MISSING]:
+        state, settings = run(current)
+        expected = {} if current is MISSING else {NAME: current}
+        assert settings == expected and NAME not in state["files"]["settings"]["keys"]
+
+cell(
+    "[QK:META-RETIRE-FRESH-TOUCH]",
+    "a provenance-less value is the operator's and is never touched",
+    fresh_cells,
+)
+
+def one_shot_cells():
+    state, settings = fixture(True, entry(True, False))
+    m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+    assert settings[NAME] is False and NAME not in state["files"]["settings"]["keys"]
+    before = copy.deepcopy((state, settings))
+    m.relinquish_retired_scalar(state, settings, NAME, PATH, True)
+    assert (state, settings) == before
+
+# Recommended, not claimed: one-shot convergence and the disjoint-set guard ride
+# along as ordinary cells so the proof budget stays at the three claims above.
+cell("", "relinquishment consumes the entry once, so a re-run cannot restore again", one_shot_cells)
+
+def structural_cells():
+    assert not m._managed_scalar_names & m._retired_scalar_names
+    # settings_state_keys is the sole reader of the ownership ledger, and
+    # load_state validates only the envelope. A corrupt files/settings/keys shape
+    # must stop with an operator diagnostic BEFORE any write — never a bare
+    # KeyError raised from inside apply(), and never a silent pass that would let
+    # relinquishment reason about ownership it cannot actually read.
+    for broken in [{}, {"files": {}}, {"files": {"settings": {}}}, {"files": {"settings": {"keys": []}}}]:
+        settings = {NAME: True}
+        before = copy.deepcopy((broken, settings))
+        try:
+            m.relinquish_retired_scalar(broken, settings, NAME, PATH, True)
+        except m.StateError:
+            pass
+        else:
+            raise AssertionError(f"corrupt state ledger accepted: {broken!r}")
+        assert (broken, settings) == before
+
+cell("", "retired/managed sets stay disjoint and a corrupt key ledger fails closed", structural_cells)
+sys.exit(failed)
+PY
+then ok "#71 retirement leaf: provenance, bool strictness, malformed refusal, one-shot convergence"
+else bad "#71 retirement leaf cells failed (traceback above)"
+fi
+
 DEV_STATUSLINE="$(python3 "$STATE" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin)["command"])')"
 if [ "$DEV_STATUSLINE" = "$REPO/scripts/meta-bridge-statusline.sh" ]; then ok "dev statusLine pins the checkout script"; else bad "dev statusLine command drifted: $DEV_STATUSLINE"; fi
 FAKE_INSTALLED_REPO="$TMP/npmroot/node_modules/@junghanacs/entwurf"
@@ -212,10 +343,26 @@ assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['va
 assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
 assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
 assert s['files']['settings']['keys']['autoCompactEnabled']['original']['existed'] is False
+assert 'skipDangerousModePermissionPrompt' not in s['files']['settings']['keys']
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
 PY
-then ok "state captures original scalar/map values and is mode 0600"; else bad "state did not capture original values / mode 0600"; fi
+then ok "state captures original scalar/map values, excludes the retired scalar, and is mode 0600"; else bad "state did not capture original values / retirement / mode 0600"; fi
 
+# Simulate an upgrade from 0.14.0: the old state proves entwurf changed false→true.
+# New apply must restore false and consume that ownership exactly once.
+python3 - <<'PY'
+import json, os
+cfg=os.environ['CLAUDE_CONFIG_DIR']
+sp=cfg + '/settings.json'; stp=cfg + '/entwurf.install-state.json'
+settings=json.load(open(sp)); state=json.load(open(stp))
+settings['skipDangerousModePermissionPrompt']=True
+state['files']['settings']['keys']['skipDangerousModePermissionPrompt']={
+  'kind':'scalar', 'path':['skipDangerousModePermissionPrompt'],
+  'original':{'existed':True, 'value':False}
+}
+json.dump(settings, open(sp,'w'), indent=2); open(sp,'a').write('\n')
+json.dump(state, open(stp,'w'), indent=2); open(stp,'a').write('\n')
+PY
 py apply >/dev/null
 if python3 - <<'PY'
 import json, os
@@ -231,7 +378,9 @@ assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
 for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert settings[key] is False, key
-assert settings['skipDangerousModePermissionPrompt'] is True
+assert settings['skipDangerousModePermissionPrompt'] is False
+state=json.load(open(cfg + '/entwurf.install-state.json'))
+assert 'skipDangerousModePermissionPrompt' not in state['files']['settings']['keys']
 for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
     assert item in settings['permissions']['allow'], item
 assert settings['permissions']['allow'].count('Read') == 1
@@ -249,7 +398,24 @@ then ok "apply installs managed keyset without clobbering unrelated keys"; else
 # (agent-config merge, hand edit) overwrites a pi-owned key, check must fail loud
 # AND name the drifted key so doctor can surface which one. Adversarial flips
 # below; restore with apply afterward so the later cases see a clean keyset.
-if py check >/dev/null 2>&1; then ok "survival check passes on a freshly applied keyset"; else bad "survival check failed right after apply"; fi
+if py check >/dev/null 2>&1; then ok "survival check passes after relinquishing the retired scalar"; else bad "survival check failed right after retirement apply"; fi
+MANAGED_JSON="$(py managed-keys)"
+if printf '%s' "$MANAGED_JSON" | grep -q 'skipDangerousModePermissionPrompt'; then bad "managed-keys still claims the retired operator key"; else ok "managed-keys returns skipDangerousModePermissionPrompt to the operator"; fi
+# A provenance-less true cannot be changed safely, but doctor/check must make it visible.
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['skipDangerousModePermissionPrompt']=True
+json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')
+PY
+RETIRED_NOTE="$(py check)"
+if printf '%s' "$RETIRED_NOTE" | grep -q 'operator-owned'; then ok "check advises on a provenance-less true without claiming ownership"; else bad "check hid the provenance-less retired true"; fi
+python3 - <<'PY'
+import json, os
+p=os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+d=json.load(open(p)); d['skipDangerousModePermissionPrompt']=False
+json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')
+PY
 SURVIVAL_SNAP="$TMP/settings-survival-snapshot.json"
 cp "$CLAUDE_CONFIG_DIR/settings.json" "$SURVIVAL_SNAP"  # exact restore point (array-replace below would drop user items)
 python3 - <<'PY'

package/scripts/smoke-mux-fresh-call-live.ts

@@ -43,7 +43,7 @@ import { skipLive } from "./lib/live-skip.ts";
 const LABEL = "smoke-mux-fresh-call-live";
 const CALLBACK_WAIT_MS = 180_000;
 const LIVE_MODEL = {
-	pi: "openai-codex/gpt-5.6-terra",
+	pi: "openai-codex/gpt-5.6-luna",
 	"claude-code": "claude-sonnet-5",
 } as const;
 

package/scripts/smoke-mux-lifecycle-live.ts

@@ -108,7 +108,7 @@ const BRIDGE_LAUNCHER = path.join(REPO, "mcp", "entwurf-bridge", "start.sh");
 
 /** The two pi shapes. They differ in exactly one thing that matters here — whether the record
  * carries `provider=entwurf`, which is what makes the resume argv re-inject the bridge (#29). */
-const PI_NATIVE_MODEL = "openai-codex/gpt-5.6-terra";
+const PI_NATIVE_MODEL = "openai-codex/gpt-5.6-luna";
 const PI_ACP_MODEL = "entwurf/claude-sonnet-5";
 const CLAUDE_MODEL = "claude-sonnet-5";
 

package/scripts/smoke-pi-provider-state.sh

@@ -31,6 +31,14 @@ REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
 
 SB="$(mktemp -d)"
 trap 'rm -rf "$SB"' EXIT
+# This smoke drives register-pi-provider.py, which imports the sibling pi_settings_io module — and
+# CPython writes scripts/__pycache__/*.pyc for that import, INSIDE the checkout. The purity cell
+# below never caught it because those bytes are gitignored, so `git status --porcelain` stays clean
+# while the working tree is not. That difference is invisible here and load-bearing under gate
+# qualification, whose snapshot judges tree cleanliness rather than porcelain output. Write no
+# bytecode instead of cleaning it up afterwards: a smoke that leaves artifacts and then sweeps them
+# is one early `exit` away from leaving them for real.
+export PYTHONDONTWRITEBYTECODE=1
 export HOME="$SB/home"
 export XDG_DATA_HOME="$SB/xdg"
 GLOBAL="$SB/global.json"
@@ -46,8 +54,52 @@ LEGACY_CMD="$FAKE_REPO/mcp/entwurf-bridge/start.sh"
 # authoritative: drop EVERY original PATH dir that carries a real entwurf-bridge. A maintainer
 # can have both the managed dev link and the registry package shim; filtering only command -v's
 # first hit lets the second one mask the dangling-command cell.
-printf '#!/usr/bin/env bash\necho fake-bridge\n' > "$SB/bin/entwurf-bridge"
-chmod +x "$SB/bin/entwurf-bridge"
+#
+# #81: the doctor no longer stops at resolvability — it BOOTS the effective command and requires
+# the entwurf MCP tool surface back. So the healthy fake must actually speak MCP: answer the
+# `tools/list` frame (id 2) with a tools array carrying entwurf_v2. A fake that only echoed a word
+# would now (correctly) read as "resolves but does not serve MCP", which is the NEGATIVE cell
+# below — keeping the two fakes distinct is what makes this an A/B rather than a rename.
+write_mcp_fake() {   # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+# minimal MCP stdio server: enough frames for the boot probe, nothing else.
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+# A launcher that RESOLVES and dies on exec — the shape of a relocated package-manager shim whose
+# $0-derived target is gone (observed: exit 127 with a "No such file or directory" on stderr).
+write_dead_fake() {  # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+echo "bash: /nonexistent/../global/v11/deadbeef/node_modules/@junghanacs/entwurf/mcp/entwurf-bridge/start.sh: No such file or directory" >&2
+exit 127
+FAKE
+  chmod +x "$1"
+}
+# A launcher that boots and speaks MCP but is NOT this bridge: it serves entwurf_v2 while missing
+# entwurf_self. This is the shape of the observed #81 session (its schema had no entwurf_self) and
+# of a stale build or a foreign binary that happens to own the name — a probe keyed on one tool
+# would call it healthy, which is why identity is the exact verb SET.
+write_stale_fake() {  # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"stale-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+write_mcp_fake "$SB/bin/entwurf-bridge"
 _clean_path=""
 while IFS= read -r _dir; do
   [ -n "$_dir" ] || continue
@@ -136,14 +188,91 @@ printf '{}\n' > "$PROJECT"; rm -f "$STATE"
 OUT="$(doctor)"; RC=$?
 want "doctor(user-only bare): exits 0" "[ '$RC' -eq 0 ]"
 want "doctor(user-only bare): ok — bare bin resolves" "printf '%s' \"\$OUT\" | grep -q 'bare stable bin'"
+# The green must be about BOOTING, not about resolving — anchored on the verdict word so a doctor
+# that regressed to the resolvability-only ok cannot keep this cell green.
+want "doctor(user-only bare): green says the bin BOOTS (#81), not merely resolves" "printf '%s' \"\$OUT\" | grep -q 'and it BOOTS'"
+
+# ── H-merge: the doctor normalizes what PRODUCTION normalizes, not what each FILE holds ──
+# resolveProviderConfig merges the two mcpServers maps per-name and normalizes the RESULT once. A
+# doctor that normalized each file separately would validate entries production never sees: a
+# malformed global entry the project map shadows is gone before pi ever looks, yet the per-file
+# doctor throws and calls a healthy session red. Both directions are pinned here.
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":123}}}}, open(sys.argv[1],"w"))' "$GLOBAL"
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$PROJECT"
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "doctor(invalid global SHADOWED by valid project): green — production never sees the bad entry" "[ '$RC' -eq 0 ]"
+want "doctor(invalid global shadowed): EFFECTIVE scope is project" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
+# An unrelated malformed server in the global map is likewise production's problem only if it
+# survives the merge — here the project map does not shadow it, so it MUST stay red.
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"},"other":{"command":[]}}}}, open(sys.argv[1],"w"))' "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+if doctor >/dev/null 2>&1; then die "doctor(unshadowed malformed sibling): should FAIL — the merged map is what production normalizes"; fi
+ok "doctor(unshadowed malformed sibling): FAILS — an invalid entry that SURVIVES the merge is red"
+# The effective entry itself malformed → red regardless of which scope wrote it.
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":123}}}}, open(sys.argv[1],"w"))' "$PROJECT"
+if doctor >/dev/null 2>&1; then die "doctor(effective malformed): should FAIL"; fi
+ok "doctor(effective malformed in project): FAILS — shadowing cannot rescue the EFFECTIVE entry"
+# restore the H-1 baseline for the cells below
+printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+printf '{}\n' > "$PROJECT"
+
+# ── H-boot: #81 A/B — a bare bin that RESOLVES but does not serve MCP ─────────
+# This is the whole defect in one cell: before #81 the doctor printed ok here, and a host in this
+# exact state ran Pi ACP turns with NO mcp__entwurf-bridge__* tool at all. PATH/HOME/XDG are the
+# sandbox's, so the operator's real launcher is never touched by this A/B.
+write_dead_fake "$SB/bin/entwurf-bridge"
+# `set -e` is on: a doctor that (correctly) exits non-zero here would kill the smoke before it could
+# judge the failure. Fence just the drive, never the assertions — a silently swallowed rc is how a
+# negative cell turns into decoration.
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "[QK:PI-DOCTOR-BOOT-NEGATIVE] doctor(bare resolves, does not boot): FAILS instead of printing ok" "[ '$RC' -ne 0 ]"
+want "doctor(bare resolves, does not boot): names the boot failure reason" "printf '%s' \"\$OUT\" | grep -q 'does NOT serve MCP \[exited-before-tools-list\]'"
+want "doctor(bare resolves, does not boot): carries the launcher's own stderr" "printf '%s' \"\$OUT\" | grep -q 'No such file or directory'"
+# Remediation must NOT be a fix-all: entwurf may not clobber a launcher it does not own, so the
+# foreign case has to be named as the operator's repair.
+want "doctor(bare resolves, does not boot): refuses to clobber a foreign launcher" "printf '%s' \"\$OUT\" | grep -q 'will not overwrite'"
+want "doctor(bare resolves, does not boot): still distinguishes 'resolves' from 'boots'" "printf '%s' \"\$OUT\" | grep -q 'RESOLVES — probing'"
+# A bridge that BOOTS and speaks MCP but is not this one — the #81 symptom exactly.
+write_stale_fake "$SB/bin/entwurf-bridge"
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "doctor(boots, wrong verb set): FAILS — booting an MCP server is not being THIS bridge" "[ '$RC' -ne 0 ]"
+want "doctor(boots, wrong verb set): names the missing verb (#81 symptom was entwurf_self)" "printf '%s' \"\$OUT\" | grep -q 'missing entwurf_self'"
+want "doctor(boots, wrong verb set): reason is the tool-set mismatch, not a boot failure" "printf '%s' \"\$OUT\" | grep -q 'tool-set-mismatch'"
 
-# H-2: project STALE (user bare, project legacy) → effective=project=legacy note (green-runtime-red guard)
+write_mcp_fake "$SB/bin/entwurf-bridge"
+OUT="$(doctor)"; RC=$?
+want "doctor(after repair): the SAME unchanged doctor goes green once the launcher boots" "[ '$RC' -eq 0 ]"
+want "doctor(after repair): green names the exact verb set as the evidence" "printf '%s' \"\$OUT\" | grep -q 'exact entwurf verb set'"
+
+# The review A/B: an unowned/non-bare override shadows the healthy user bridge in production.
+# Ownership remains the operator's, but runtime truth cannot become a green note merely because
+# entwurf will not overwrite it. Keep this QK cell before the healthy legacy override: a mutant
+# that skips all non-bare runtime probes must be attributed to THIS failure, not the later positive.
+write_dead_fake "$SB/bin/dead-override"
 printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"entwurf-bridge"}}}}\n' > "$GLOBAL"
+python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2],"args":[]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$SB/bin/dead-override"
+set +e
+OUT="$(doctor 2>&1)"; RC=$?
+set -e
+want "[QK:PI-DOCTOR-PROBES-OVERRIDE] doctor(dead unowned override): FAILS runtime independently of ownership" "[ '$RC' -ne 0 ]"
+want "doctor(dead unowned override): names the exact invocation failure" "printf '%s' \"\$OUT\" | grep -q 'effective invocation does NOT serve MCP'"
+
+# H-2: project legacy override still gets an independent runtime verdict before its ownership note.
+mkdir -p "$(dirname "$LEGACY_CMD")"
+write_mcp_fake "$LEGACY_CMD"
 python3 -c 'import json,sys; json.dump({"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":sys.argv[2]}}}}, open(sys.argv[1],"w"))' "$PROJECT" "$LEGACY_CMD"
 OUT="$(doctor)"; RC=$?
-want "doctor(project-stale): exits 0 (honest note, not a crash)" "[ '$RC' -eq 0 ]"
-want "doctor(project-stale): EFFECTIVE is project (shadows user)" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
-want "doctor(project-stale): flags legacy managed path (not adopted)" "printf '%s' \"\$OUT\" | grep -q 'LEGACY managed repo path'"
+want "doctor(project-legacy): exits 0 when the exact override boots" "[ '$RC' -eq 0 ]"
+want "doctor(project-legacy): EFFECTIVE is project (shadows user)" "printf '%s' \"\$OUT\" | grep -q 'EFFECTIVE (project)'"
+want "doctor(project-legacy): runtime BOOTS before the ownership note" "printf '%s' \"\$OUT\" | grep -q 'configured override BOOTS'"
+want "doctor(project-legacy): flags legacy managed path (not adopted)" "printf '%s' \"\$OUT\" | grep -q 'LEGACY managed repo path'"
 
 # H-3: state-owned DRIFT → FAIL (state says managed but effective is foreign)
 printf '{"entwurfProvider":{"mcpServers":{"entwurf-bridge":{"command":"/foreign/thing"}}}}\n' > "$GLOBAL"

package/scripts/smoke-resident-garden-guard.sh

@@ -70,7 +70,7 @@ fi
 SESSIONS_BASE="$RGG_AGENT_DIR/sessions"
 cleanup() { rm -rf "$RGG_AGENT_DIR"; }
 trap cleanup EXIT
-# Default target stays pi-native (openai-codex/gpt-5.4), but honor the SAME target
+# Default target stays pi-native (openai-codex/gpt-5.6-luna), but honor the SAME target
 # knob as the other live smokes: ENTWURF_LIVE_TARGET="<provider>/<model>". On
 # acp-on-v2 the ACP `entwurf` provider is back, and `./run.sh smoke-acp-rgg-live`
 # drives THIS runner against it (deterministic half) — the citizen logic (record +
@@ -83,7 +83,7 @@ if [ -n "${ENTWURF_LIVE_TARGET:-}" ]; then
 	esac
 else
 	_rgg_provider="${ENTWURF_LIVE_PROVIDER:-openai-codex}"
-	_rgg_model="${ENTWURF_LIVE_MODEL:-gpt-5.4}"
+	_rgg_model="${ENTWURF_LIVE_MODEL:-gpt-5.6-luna}"
 fi
 PROVIDER="${SMOKE_RGG_PROVIDER:-$_rgg_provider}"
 MODEL="${SMOKE_RGG_MODEL:-$_rgg_model}"