@junghanacs/entwurf 0.14.0 → 0.14.2

package/scripts/check-acp-prompt-lifecycle.ts

@@ -172,6 +172,19 @@ function makeHarness(recordDir: string) {
 		settle(stopReason: string) {
 			pending?.resolve({ stopReason });
 		},
+		/**
+		 * The TRANSPORT ends under the pending request — the real SDK's own
+		 * rejection, and the one production actually sees FIRST.
+		 *
+		 * Distinct from `close()` on purpose: the SDK does not route this through
+		 * an explicit close call. Its read loop hits stdout EOF and rejects every
+		 * pending response with `closeSignal.reason ?? new Error("ACP connection
+		 * closed")` — a GENERIC message, because a clean EOF carries no reason.
+		 * That verbatim text is the subject of the cells below.
+		 */
+		transportClosed(reason?: string) {
+			pending?.reject(new Error(reason ?? "ACP connection closed"));
+		},
 		/** the agent streams something mid-turn (proof the turn is progressing) */
 		async progress(text: string) {
 			await notifier?.({ sessionUpdate: "agent_message_chunk", content: { type: "text", text } });
@@ -524,6 +537,187 @@ try {
 		await t2.done;
 	}
 
+	// ----------------------------------------------------------------------
+	// CELL 9 — THE OTHER TEMPORAL ORDER: EOF first, exit one tick later.
+	//
+	// CELLS 4/5 drive the lifecycle-FIRST order: the child's `exit` event fires
+	// while the prompt is still pending, so `notifyChildGone` wins the race and
+	// reports the exit status. Those cells stay — that order remains possible and
+	// must keep working. This cell covers the order the FIELD showed.
+	//
+	// Measured with the production shape (piped stdio, detached, `Readable.toWeb`)
+	// on Linux, the child's stdout EOF landed ~1ms BEFORE node emitted `exit` —
+	// for a clean exit(0) and for SIGKILL alike (numbers preserved in issue #72).
+	//
+	// In that order the SDK's generic rejection settles the turn first,
+	// `awaitAcpPromptTurn`'s `finally` clears `notifyChildGone`, and the exit
+	// status arriving one tick later has nowhere to go. Issue #72's field sample
+	// is exactly that: `ACP connection closed` plus a stderr tail, naming neither
+	// exit code nor signal — while the backend HAD an exit status the whole time.
+	//
+	// The order here is scheduled EXPLICITLY (reject, then `die` on a later tick)
+	// rather than borrowed from a production helper: the claim IS the ordering,
+	// so the oracle must state it, not inherit it from the subject.
+	// ----------------------------------------------------------------------
+	let eofFirstMessage = "";
+	{
+		const h = makeHarness(recordDir);
+		const t1 = startTurn(backend, userCtx("first NONCE-E1"), { sessionId: "life-eof-first" }, h.deps);
+		await delay(20);
+		h.settle("end_turn");
+		await t1.done;
+		assert.equal(sealed(t1.events)[0].type, "done", "turn 1 completes so the session is retained for reuse");
+
+		// Turn 2 is the field shape: a retained child, a completed tool phase, and
+		// then the transport ends before the final answer.
+		const t2 = startTurn(
+			backend,
+			reuseCtx("first NONCE-E1", "second NONCE-E2"),
+			{ sessionId: "life-eof-first" },
+			h.deps,
+		);
+		await delay(30);
+		assert.equal(h.children.length, 1, "turn 2 reused the live child (no respawn)");
+		h.children[0].writeStderr(
+			"(node:501006) [CLAUDE_SDK_CAN_USE_TOOL_SHADOWED] Warning: canUseTool will not be invoked\n",
+		);
+		// EOF first …
+		h.transportClosed();
+		// … and the exit status one tick later, exactly as measured.
+		await delay(1);
+		h.children[0].die(0, null);
+		await t2.done;
+
+		eofFirstMessage = String(sealed(t2.events)[0].error.errorMessage);
+		assert.ok(
+			eofFirstMessage.includes("ACP connection closed"),
+			"the backend's own first words are preserved verbatim, not swapped out for ours — " +
+				`a reader must still be able to match the transport's text. Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		assert.ok(
+			eofFirstMessage.includes("exit code 0"),
+			"[QK:EOF-FIRST-CARRIES-CHILD-END] when the transport closes BEFORE node reports the child's exit — the order " +
+				"the field sample exhibited — the sealed error must still name how the child ended. Losing it to that " +
+				"~1ms race is what left issue #72's field sample with no exit code and no signal. " +
+				`Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		assert.ok(
+			eofFirstMessage.includes("while the prompt was still in flight"),
+			"the sealed error names the PHASE that died — a closure during bootstrap and one under a live prompt are " +
+				`different failures. Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		// NARROW on purpose: this proves the tail collected BEFORE the seal is not
+		// cut short by our own cleanup. It does NOT claim the child's last words —
+		// nothing here waits for the stderr pipe to drain, and node's `exit` can
+		// precede that drain. Draining is a separate lever; see backend.ts.
+		assert.ok(
+			eofFirstMessage.includes("CLAUDE_SDK_CAN_USE_TOOL_SHADOWED"),
+			`the stderr tail collected before the seal rides the sealed error. Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		// Cleanup still runs after the seal — settling first DELAYS teardown, it
+		// does not skip it. The signal itself is not the evidence here: the child
+		// is already dead by now, and `teardownChild` correctly declines to signal
+		// a corpse. The connection close is the part that always runs.
+		assert.ok(
+			h.closes.length > 0,
+			"the uncertain connection is still closed after the seal — an error path must never leave it reusable",
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 10 — a SIGKILL under the same order is told apart from a clean exit.
+	//
+	// exit(0) and SIGKILL are the two candidate deaths behind #72 — a backend
+	// that chose to shut down (claude-agent-acp's index.js exits 0 when its ACP
+	// connection closes, silently) versus one killed from outside. They are
+	// distinguishable ONLY by this field, which is why CELL 9's claim is not
+	// enough on its own: a report that always said "exit code 0" would satisfy it
+	// while telling the operator nothing.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("killed from outside"), { sessionId: "life-eof-kill" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("KILLED-STDERR-MARK\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(null, "SIGKILL");
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("signal SIGKILL") && !message.includes("exit code"),
+			"a child killed from outside must read as a SIGNAL, never as a clean exit — a report that always said " +
+				`"exit code 0" would satisfy the previous cell while telling the operator nothing. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("KILLED-STDERR-MARK"),
+			`the stderr tail rides the signal case too. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 11 — a child that never reports an end says SO, bounded.
+	//
+	// A closed transport does not prove a dead child: the connection can end
+	// while the process lives. The honest report then is that we waited and it
+	// never said — NOT a guessed exit code, and NOT an unbounded wait. Silence
+	// must be reported as silence.
+	// ----------------------------------------------------------------------
+	let noEndMessage = "";
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("transport closes, child lives"), { sessionId: "life-eof-noend" }, h.deps);
+		await delay(30);
+		const closedAt = Date.now();
+		h.transportClosed();
+		await turn.done;
+		const waited = Date.now() - closedAt;
+
+		noEndMessage = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			noEndMessage.includes("reported no exit status within") &&
+				!noEndMessage.includes("exit code") &&
+				!noEndMessage.includes("signal "),
+			"when the transport closed but the child never reported an end, the turn must SAY so and invent nothing — " +
+				`a guessed exit status would be worse than the bare closure. Got: ${JSON.stringify(noEndMessage)}`,
+		);
+		// The window is BOTH real and bounded. The lower bound is what stops a
+		// mutant from passing by never waiting at all (it would then report silence
+		// for a child that was about to answer); the upper bound is what stops the
+		// wait from growing into the wall clock this gate exists to keep out. The
+		// shipped bound is CHILD_END_SETTLE_MS (500ms) — not imported, since the
+		// gate must not widen the backend's module surface — so the range allows a
+		// loaded host some slack while refusing multi-second drift.
+		assert.ok(
+			waited >= 400 && waited < 1_500,
+			"[QK:CHILD-END-SILENCE-BOUNDED] the post-mortem wait must actually happen AND be bounded — a failing turn may " +
+				`neither skip the window nor hang in it. Waited ${waited}ms`,
+		);
+	}
+
+	// A closure that CARRIES A REASON already explains itself, so it must not be
+	// given the post-mortem window: only the SDK's bare, reason-less text earns
+	// it. Without this, a broadened match would tax unrelated prompt errors with a
+	// delay — and the near-miss below is exactly what a substring test would catch
+	// by mistake.
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("closure with a reason"), { sessionId: "life-near-match" }, h.deps);
+		await delay(30);
+		const closedAt = Date.now();
+		h.transportClosed("ACP connection closed by the operator's proxy");
+		await turn.done;
+		const waited = Date.now() - closedAt;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			!message.includes("[acp] lifecycle:"),
+			`a closure that named its own reason must not be re-diagnosed. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(waited < 300, `…and must not pay the post-mortem wait either. Waited ${waited}ms`);
+	}
+
 	// ----------------------------------------------------------------------
 	// CELL 8 — our prompt-phase failure text is not transient, judged by pi.
 	// ----------------------------------------------------------------------
@@ -533,12 +727,28 @@ try {
 		"positive control: pi still classifies the RETIRED 600s cutoff text as transient — that classification is " +
 			"exactly why one wall-clock kill cost four full cold turns",
 	);
-	assert.equal(
-		isRetryableAssistantError({ stopReason: "error", errorMessage: childDeathMessage } as any),
-		false,
-		"[QK:PROMPT-ERROR-NOT-TRANSIENT] pi must NOT classify a prompt-phase lifecycle failure we authored as a " +
-			"transient provider error — a retry here is a cold replay of the whole prompt, not a cheap retry. " +
-			`Judged text: ${JSON.stringify(childDeathMessage)}`,
+	// EVERY prompt-phase failure text this backend authors, judged together by pi's
+	// own classifier. One aggregate assertion rather than three: the claim is the
+	// same for all of them, and the token that names it must appear exactly once.
+	//
+	// The two closure diagnoses are the ones that carry real risk — they are
+	// APPENDED to the SDK's own message, and the first draft said "within 500ms",
+	// which pi read as an HTTP 500 and classified as transient.
+	const authoredFailureTexts = [
+		["mid-prompt child death", childDeathMessage],
+		["EOF-first child end", eofFirstMessage],
+		["no child end within the bound", noEndMessage],
+	] as const;
+	const transientlyWorded = authoredFailureTexts.filter(([, text]) =>
+		isRetryableAssistantError({ stopReason: "error", errorMessage: text } as any),
+	);
+	assert.deepEqual(
+		transientlyWorded.map(([label]) => label),
+		[],
+		"[QK:PROMPT-ERROR-NOT-TRANSIENT] pi must NOT classify any prompt-phase lifecycle failure we authored as a " +
+			"transient provider error — a retry here is a cold replay of the whole prompt, and the tool side effects " +
+			"this turn already produced make that the expensive failure, not the cheap one. Offending texts: " +
+			JSON.stringify(transientlyWorded),
 	);
 } finally {
 	rmSync(TMP_EMIT, { recursive: true, force: true });
@@ -559,7 +769,9 @@ console.log(
 		"session/cancel first and seals cancelled→aborted without signalling a cooperating child; a wedged agent is torn " +
 		"down after the bounded grace and still returns promptly with no new child; a child that dies mid-prompt is " +
 		"reported with its exit status AND stderr tail on BOTH the new and the reuse path; a death BETWEEN turns is " +
-		"announced once by the next turn while a teardown WE performed stays silent; and pi's own " +
-		"isRetryableAssistantError refuses " +
-		"to classify that failure as transient while still matching the retired 600s text",
+		"announced once by the next turn while a teardown WE performed stays silent; the child's end survives the " +
+		"temporal order the field showed too (transport EOF first, exit one tick later, alongside the opposite order), " +
+		"telling a clean exit apart from a signal and reporting silence AS silence within a bounded window; and pi's " +
+		"own isRetryableAssistantError refuses to classify any of those failures as transient while still matching " +
+		"the retired 600s text",
 );

package/scripts/check-entwurf-bridge-boot.ts

@@ -25,6 +25,7 @@
 import { spawn } from "node:child_process";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { EXPECTED_TOOLS } from "./probe-bridge-command.ts";
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const START_SH = path.join(REPO_DIR, "mcp", "entwurf-bridge", "start.sh");
@@ -246,6 +247,33 @@ async function main(): Promise<void> {
 		`--- want ---\n${expectedSurface.join(",")}\n--- got ---\n${publicSurface.join(",")}`,
 	);
 
+	// G1g (#81) — bind probe-bridge-command's identity constant to the REAL runtime surface. That
+	// probe decides whether a configured launcher is this bridge by comparing tools/list against
+	// EXPECTED_TOOLS, so a verb added or retired without updating the constant would silently make
+	// every doctor red (or, worse, bless a stale build). The constant has exactly one oracle: the
+	// server booting right here. Add or retire a verb → update the constant in the same commit.
+	//
+	// Compared as SORTED ARRAYS, not as sets: set comparison would hide a duplicate on either side —
+	// including one inside the constant itself, a copy-paste that makes the probe's own length report
+	// lie. The length check here catches a runtime duplicate too; G1f ABOVE owns that as its named
+	// subject, so a duplicated verb turns BOTH red. Judging the same fact twice from two artifacts is
+	// the point, not an overlap to trim.
+	//
+	// POSITION IS LOAD-BEARING: this runs AFTER every named assertion. `ok()` exits on the first
+	// failure, so a cell placed earlier swallows the reds below it — when this block sat next to
+	// G1a, planting a defect in the resume-call or public-surface contracts turned THIS cell red
+	// first and gate qualification read WRONG-REASON for two claims that were in fact working.
+	// A gate that hides which contract broke is worse than the one it was added to strengthen.
+	// Keep unnamed/derived checks last; anything carrying a [QK:…] claim comes first.
+	const runtimeNames = tools.map((t) => t?.name).filter((n): n is string => typeof n === "string");
+	const runtimeSorted = [...runtimeNames].sort();
+	const constantSorted = [...EXPECTED_TOOLS].sort();
+	ok(
+		"G1g: probe-bridge-command EXPECTED_TOOLS equals the runtime tools/list exactly (sorted, duplicates included)",
+		runtimeSorted.length === constantSorted.length && runtimeSorted.every((n, i) => n === constantSorted[i]),
+		`--- runtime tools/list (sorted) ---\n${runtimeSorted.join(", ")}\n--- EXPECTED_TOOLS (sorted) ---\n${constantSorted.join(", ")}`,
+	);
+
 	console.log(`\ncheck-entwurf-bridge-boot: ${passed} checks passed`);
 }
 

package/scripts/check-gate-qualification.ts

@@ -800,20 +800,22 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"acp-augment": 10,
 		"acp-cortex": 12,
 		"acp-overlay": 1,
-		"acp-prompt-lifecycle": 8,
+		"acp-prompt-lifecycle": 10,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
 		"agy-permission": 6,
 		"bridge-boot-resume": 3,
+		"bridge-command-boot": 9,
 		"meta-facts": 4,
 		"meta-identity": 4,
+		"meta-retire": 3,
 		"mux-boundary": 14,
-		"mux-fresh-call": 15,
+		"mux-fresh-call": 19,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
 		"mux-resume-call": 12,
 		"probe-ordering": 1,
-		"release-gate": 11,
+		"release-gate": 12,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 3,

package/scripts/check-mux-resume-call.ts

@@ -8,7 +8,8 @@
  *
  * Every cwd claim below is a MEASURED tmux 3.6a behaviour, not a precaution. They were taken on a
  * private server on 2026-08-06, and each one is a way a resume would look successful while being
- * wrong:
+ * wrong. Since #73 the classification itself lives in the shared `classify-tmux-cwd.ts` leaf
+ * (fresh-call consumes the same rules), so the CWD claims here are asserted against that leaf:
  *
  *   MUXRESUME-CWD-MISSING-REFUSED   a nonexistent `-c` does NOT fail: tmux exits 0, opens the
  *                                   window, and the child lands in $HOME. Nothing downstream can
@@ -31,10 +32,10 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { classifyTmuxCwd } from "../pi-extensions/lib/classify-tmux-cwd.ts";
 import type { Placement } from "../pi-extensions/lib/mux-placement.ts";
 import {
 	buildResumeCallArgs,
-	classifyResumeCwd,
 	RESUME_CALL_REJECT_HINT,
 	RESUME_CALL_RUNTIME,
 	type ResumeCallRejectReason,
@@ -77,32 +78,32 @@ function main(): void {
 
 	try {
 		// ── cwd classification ────────────────────────────────────────────────────────
-		ok("an existing absolute directory is accepted", classifyResumeCwd(realDir) === null);
+		ok("an existing absolute directory is accepted", classifyTmuxCwd(realDir) === null);
 
 		ok(
 			"[QK:MUXRESUME-CWD-MISSING-REFUSED] a cwd that no longer exists is refused HERE, because tmux would not refuse it — measured: rc=0, the window opens, and the child silently falls back to $HOME, so the resume would land a visible citizen in the wrong project and look successful",
-			classifyResumeCwd(path.join(tmp, "deleted-project")) === "cwd-missing",
+			classifyTmuxCwd(path.join(tmp, "deleted-project")) === "cwd-missing",
 		);
 		ok(
 			"a path that exists but is a FILE is refused as its own cause, not as missing",
-			classifyResumeCwd(filePath) === "cwd-not-directory",
+			classifyTmuxCwd(filePath) === "cwd-not-directory",
 		);
 		ok(
 			"[QK:MUXRESUME-CWD-FORMAT-REFUSED] a cwd containing '#' is refused unrun — measured: tmux FORMAT-EXPANDS the -c value, so `<dir>/#{pane_id}` silently became `<dir>/%0` and a `#(…)` value was observed executing its command; a path is data and tmux reads it as a format",
-			classifyResumeCwd(path.join(tmp, "#{pane_id}")) === "cwd-format-token" &&
-				classifyResumeCwd(path.join(tmp, "#(touch x)")) === "cwd-format-token",
+			classifyTmuxCwd(path.join(tmp, "#{pane_id}")) === "cwd-format-token" &&
+				classifyTmuxCwd(path.join(tmp, "#(touch x)")) === "cwd-format-token",
 		);
 		ok(
 			"the '#' refusal precedes the filesystem question, whose answer would be about a path tmux is not going to use",
-			classifyResumeCwd(path.join(realDir, "#nope")) === "cwd-format-token",
+			classifyTmuxCwd(path.join(realDir, "#nope")) === "cwd-format-token",
 		);
 		ok(
 			"a relative cwd is refused before anything touches the filesystem",
-			classifyResumeCwd("project") === "cwd-not-absolute",
+			classifyTmuxCwd("project") === "cwd-not-absolute",
 		);
 		ok(
 			"[QK:MUXRESUME-CWD-WHITESPACE-OK] a cwd containing whitespace is ACCEPTED — measured: argv is an array, tmux does not re-split it, and the directory arrived intact; inventing a quoting grammar here would refuse real project paths for a danger that was measured not to exist",
-			classifyResumeCwd(spaceDir) === null,
+			classifyTmuxCwd(spaceDir) === null,
 		);
 
 		// ── argv shape ────────────────────────────────────────────────────────────────

package/scripts/check-probe-bridge-command.ts

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// check-probe-bridge-command — deterministic contract gate for the #81 boot probe.
+//
+// The probe is what two doctors now stake their verdict on, so its reason taxonomy is a contract,
+// not an implementation detail: each value names a DIFFERENT operator situation, and collapsing two
+// of them would put the wrong repair in front of an operator. This gate pins the classification and
+// the one side effect the probe owns — reaping the child it spawned.
+//
+// Hermetic: every subject is a stub script in a mktemp dir. No network, no operator state, no MCP
+// server of ours is booted (check-entwurf-bridge-boot owns that axis).
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { EXPECTED_TOOLS, probeBridgeCommand } from "./probe-bridge-command.ts";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const PROBE_SRC = readFileSync(join(REPO_ROOT, "scripts", "probe-bridge-command.ts"), "utf8");
+
+let passed = 0;
+// The `[QK:…]` token must land on a FAILURE line (qualification does not count a token printed on
+// an `ok` line — a later red must not self-certify an earlier claim), and it must appear exactly
+// once in this file. So: strip it from the green line, print it verbatim on the red one.
+function ok(label: string, cond: boolean, detail?: string): void {
+	if (!cond) {
+		console.error(`FAIL: ${label}`);
+		if (detail) console.error(detail);
+		process.exit(1);
+	}
+	console.log(`  ok    ${label.replace(/\[QK:[^\]]+\]\s*/, "")}`);
+	passed++;
+}
+
+const dir = mkdtempSync(join(tmpdir(), "entwurf-probe-gate-"));
+const stub = (name: string, body: string): string => {
+	const p = join(dir, name);
+	writeFileSync(p, body);
+	chmodSync(p, 0o755);
+	return p;
+};
+
+/** An MCP stub that answers tools/list with exactly the given verb names. */
+const mcpStub = (name: string, names: readonly string[]): string => {
+	const tools = names.map((n) => `{"name":"${n}"}`).join(",");
+	return stub(
+		name,
+		`#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[${tools}]}}' ;;
+  esac
+done
+`,
+	);
+};
+
+try {
+	// ── the healthy shape ─────────────────────────────────────────────────────
+	const healthy = mcpStub("healthy", EXPECTED_TOOLS);
+	const rHealthy = await probeBridgeCommand({ command: healthy });
+	ok("the exact verb set is the only green", rHealthy.ok && rHealthy.reason === "ok", JSON.stringify(rHealthy));
+
+	// ── identity: booting an MCP server is not being THIS bridge ──────────────
+	// Missing one verb is the observed #81 shape (a session whose schema had no entwurf_self).
+	const partial = mcpStub(
+		"partial",
+		EXPECTED_TOOLS.filter((t) => t !== "entwurf_self"),
+	);
+	const rPartial = await probeBridgeCommand({ command: partial });
+	ok(
+		"[QK:PROBE-REASON-MISSING-VERB] a served MCP surface MISSING a verb is a mismatch, not ok",
+		!rPartial.ok && rPartial.reason === "tool-set-mismatch" && rPartial.detail.includes("missing entwurf_self"),
+		JSON.stringify(rPartial),
+	);
+	// The other direction: a stale build still serving a retired verb must not read as this bridge.
+	const extra = mcpStub("extra", [...EXPECTED_TOOLS, "entwurf_retired_verb"]);
+	const rExtra = await probeBridgeCommand({ command: extra });
+	ok(
+		"an EXTRA verb is a mismatch too (stale build / foreign binary)",
+		!rExtra.ok && rExtra.reason === "tool-set-mismatch" && rExtra.detail.includes("unexpected entwurf_retired_verb"),
+		JSON.stringify(rExtra),
+	);
+
+	// ── the defect that started #81: resolves, then dies on exec ──────────────
+	const dead = stub("dead", "#!/usr/bin/env bash\necho 'boom: no such file or directory' >&2\nexit 127\n");
+	const rDead = await probeBridgeCommand({ command: dead });
+	ok(
+		"a launcher that exits before tools/list is classified as such, with its stderr",
+		!rDead.ok && rDead.reason === "exited-before-tools-list" && rDead.detail.includes("boom"),
+		JSON.stringify(rDead),
+	);
+
+	// ── not executable at all ─────────────────────────────────────────────────
+	const rMissing = await probeBridgeCommand({ command: join(dir, "does-not-exist") });
+	ok(
+		"an unexecutable command is spawn-failed, NOT a boot failure",
+		!rMissing.ok && rMissing.reason === "spawn-failed",
+		JSON.stringify(rMissing),
+	);
+
+	// ── initialize is a handshake, not a frame we merely write ───────────────
+	const noInitialize = stub(
+		"no-initialize",
+		`#!/usr/bin/env bash
+printf '%s\\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[${EXPECTED_TOOLS.map((n) => `{"name":"${n}"}`).join(",")}]}}'
+while IFS= read -r _line; do :; done
+`,
+	);
+	const rNoInitialize = await probeBridgeCommand({ command: noInitialize, timeoutMs: 700 });
+	ok(
+		"[QK:PROBE-REQUIRES-INITIALIZE] an exact tools/list sent before initialize completes is not a healthy MCP bridge",
+		!rNoInitialize.ok && rNoInitialize.reason === "initialize-failed",
+		JSON.stringify(rNoInitialize),
+	);
+
+	// ── not an MCP server (answers id:2, no tools array) ──────────────────────
+	const notMcp = stub(
+		"not-mcp",
+		`#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"not-mcp","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\\n' '{"jsonrpc":"2.0","id":2,"result":{}}' ;;
+  esac
+done
+`,
+	);
+	const rNotMcp = await probeBridgeCommand({ command: notMcp });
+	ok(
+		"an id:2 reply without result.tools is not an MCP server",
+		!rNotMcp.ok && rNotMcp.reason === "no-tools-array",
+		JSON.stringify(rNotMcp),
+	);
+
+	// ── timeout + bounded cleanup ─────────────────────────────────────────────
+	// The probe runs whatever the operator configured, including a launcher that ignores SIGTERM.
+	// If it resolved without escalating, that process would outlive the doctor. The stub records
+	// its own pid so this gate can assert the reap actually happened — an unobserved kill is a
+	// claim, not evidence.
+	const pidFile = join(dir, "hung.pid");
+	const hung = stub(
+		"hung",
+		`#!/usr/bin/env bash
+trap '' TERM
+echo $$ > ${JSON.stringify(pidFile)}
+while true; do sleep 0.05; done
+`,
+	);
+	const rHung = await probeBridgeCommand({ command: hung, timeoutMs: 700 });
+	ok(
+		"a launcher that stays up but never answers is a timeout",
+		!rHung.ok && rHung.reason === "timeout",
+		JSON.stringify(rHung),
+	);
+	const hungPid = Number(readFileSync(pidFile, "utf8").trim());
+	ok(
+		"timeout stub recorded a usable pid (the cleanup assertion below has a subject)",
+		Number.isInteger(hungPid) && hungPid > 0,
+	);
+	// SIGTERM is trapped, so only the SIGKILL escalation can end it — and the probe must have
+	// completed that escalation BEFORE returning. Checking right here (no polling, no grace loop)
+	// is what pins that ordering: a probe that merely scheduled the kill would fail this cell,
+	// which is exactly the state a doctor's immediate process.exit() would leave behind.
+	const alive = spawnSync("kill", ["-0", String(hungPid)], { stdio: "ignore" }).status === 0;
+	// Clean up BEFORE asserting. When this claim's mutant re-plants the leak, `alive` is true and
+	// the assertion exits the process immediately — so without this line the gate that exists to
+	// prove nothing is orphaned would itself orphan the stub on the host, once per qualification
+	// run. A killed mutant must still leave zero residue.
+	if (alive) spawnSync("kill", ["-9", String(hungPid)], { stdio: "ignore" });
+	ok(
+		"[QK:PROBE-CLEANUP-ESCALATES] a SIGTERM-ignoring child is escalated to SIGKILL, never left orphaned",
+		!alive,
+		`pid ${hungPid} was still alive after the probe returned — the probe leaked the process it spawned`,
+	);
+
+	// ── source pin: the stdin EPIPE guard ─────────────────────────────────────
+	// WHY pinned instead of measured: the failure needs the child to exec, die and close its stdin
+	// read end BETWEEN uv_spawn and the parent's first write. Nothing this gate can write to a stub
+	// controls that ordering — measured on this host, five stub shapes (bad shebang, self-closed
+	// stdin, instant exit, missing file, a directory) produced EPIPE 0/20 each while idle, and only
+	// 12-way CPU contention opened the window (11/60 crashes before the fix, 0/60 after). A cell
+	// that only fires under load is a flaky gate, not a proof, so the property is pinned at the
+	// source. It is load-bearing because the crash it prevents is silent-by-substitution: the probe
+	// dies printing a Node stack trace where the doctor verdict should carry the LAUNCHER's stderr —
+	// the one line that names which hop broke. Ordering matters as much as presence: the listener
+	// must be installed before any write can dispatch.
+	const guard = '\t\tchild.stdin.on("error", () => {});';
+	const guardAt = PROBE_SRC.indexOf(guard);
+	const firstWriteAt = PROBE_SRC.indexOf("child.stdin.write(");
+	ok(
+		"[QK:PROBE-STDIN-EPIPE-GUARD] child.stdin carries an error listener installed before the first write — an async EPIPE from a launcher that died on exec must never replace the verdict with an uncaught exception",
+		guardAt >= 0 && firstWriteAt >= 0 && guardAt < firstWriteAt,
+		`guard index ${guardAt}, first child.stdin.write index ${firstWriteAt} in scripts/probe-bridge-command.ts`,
+	);
+} finally {
+	rmSync(dir, { recursive: true, force: true });
+}
+
+console.log(`check-probe-bridge-command: ${passed} checks passed`);