@junghanacs/entwurf 0.14.0 → 0.14.2

package/scripts/check-release-gate-outcomes.ts

@@ -439,6 +439,58 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 	);
 }
 
+// ===========================================================================
+// The operator's CONFIGURED bridge invocation is proven BEFORE the cost-bearing LIVE tier
+//
+// `check-bridge` boots the launcher this checkout SHIPS. It cannot speak for the string
+// pi's provider actually execs, and only that second one reaches a live ACP session.
+// 2026-08-19 measured the difference at full price: a relocated `~/.local/bin/entwurf-bridge`
+// symlink into a pnpm cmd-shim (basedir derived from $0, so not relocatable) exited 127, the
+// bundled bridge never booted, and the model had no `mcp__entwurf-bridge__*` tool — while
+// `command -v` answered yes throughout. #81 had already built the leaf that settles this in
+// under a second, and doctor-pi-provider consumes it; it was simply never a step, so the
+// verdict surfaced sixteen LIVE steps later at smoke-acp-bundled-mcp-live.
+// Pinned here because the step is CHEAP and therefore easy to drop again "to speed the gate up":
+// its whole value is the position, so both the position and the classifier arm are asserted.
+// run_step, not run_live_step — this doctor is not LIVE-gated and never emits 97, so a SKIP arm
+// would describe a prerequisite it cannot have.
+// ===========================================================================
+{
+	const runSh = readFileSync(join(REPO_DIR, "run.sh"), "utf8");
+	const gateBody = runSh.slice(runSh.indexOf("release_gate() {"), runSh.indexOf("# 5. Summary"));
+	const verify = readFileSync(join(REPO_DIR, "VERIFY.md"), "utf8");
+	const STEP =
+		'run_step "doctor-pi-provider (#81: the operator\'s CONFIGURED bridge invocation actually boots)" gate bash "$self" doctor-pi-provider';
+	const doctorSteps = gateBody.split("\n").filter((l) => l.includes('"$self" doctor-pi-provider'));
+	const gaps: string[] = [];
+	if (doctorSteps.length !== 1)
+		gaps.push(`release_gate runs doctor-pi-provider ${doctorSteps.length}x (need exactly one MUST step)`);
+	if (doctorSteps.length === 1 && doctorSteps[0]?.trim() !== STEP)
+		gaps.push(`the doctor step is not the exact pinned invocation (got: ${doctorSteps[0]?.trim()})`);
+	if (doctorSteps.length === 1 && doctorSteps[0]?.includes("run_live_step"))
+		gaps.push("the doctor step goes through run_live_step, inventing a SKIP arm for a doctor that never emits 97");
+	// Position is the point: a cheap probe scheduled after the expensive tier proves nothing new.
+	const doctorAt = gateBody.indexOf('"$self" doctor-pi-provider');
+	// Anchored on the step KEYWORD, not the bare name: prose above this step already discusses
+	// smoke-acp-bundled-mcp-live by name, and a needle that a comment can satisfy would drag the
+	// boundary backwards and fail an ordering that is actually fine.
+	const firstLiveAt = gateBody.indexOf('run_live_step "smoke-acp-');
+	if (doctorAt >= 0 && firstLiveAt >= 0 && doctorAt > firstLiveAt)
+		gaps.push("the doctor step runs AFTER the ACP LIVE tier — the fail-fast position that motivates it is gone");
+	if (!verify.includes("doctor-pi-provider"))
+		gaps.push("VERIFY.md does not name doctor-pi-provider in the MUST tier at all");
+	if (!verify.includes("the invocation the operator's pi provider actually EXECS"))
+		gaps.push("VERIFY.md no longer states WHICH invocation this step proves (ships vs execs)");
+	assert.ok(
+		gaps.length === 0,
+		"[QK:PI-DOCTOR-IS-RELEASE-MUST] the operator's configured bridge invocation must be booted as a release-gate " +
+			"MUST exactly once, through run_step (no SKIP arm — this doctor never emits 97), positioned BEFORE the ACP " +
+			"LIVE tier, with VERIFY naming it and keeping 'what this checkout ships' apart from 'what the provider execs' " +
+			"— drop any of those and the #81 127-class defect goes back to costing sixteen LIVE steps to discover. " +
+			`Broken: ${gaps.join("; ")}`,
+	);
+}
+
 console.log(
 	"[check-release-gate-outcomes] ok — STEP OUTCOME protocol: one skip exit code shared by the shell and TS halves " +
 		`(${LIVE_SKIP_EXIT}, clear of the per-tool 0..4 and shell 126+ bands), classifier maps 0→PASS / skip→SKIP / ` +
@@ -448,5 +500,6 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it",
+		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it; and " +
+		"the operator's CONFIGURED bridge invocation is booted exactly once through run_step, before the ACP LIVE tier",
 );

package/scripts/doctor-pi-provider.ts

@@ -1,10 +1,23 @@
 #!/usr/bin/env node
 // doctor-pi-provider — fail-loud doctor for the pi provider (entwurfProvider.mcpServers.
-// entwurf-bridge) ownership (#46 Task 2). Side-effect FREE (read-only). Uses the config.ts SSOT
+// entwurf-bridge) ownership (#46 Task 2). A BOUNDED BOOT PROBE, not a static inspector: it writes
+// no operator state, but it does exec the configured command on this host (#81). Uses the config.ts SSOT
 // `readProviderSettingsFile` so the effective (shadow-resolved) view matches what pi actually
 // loads — NOT a re-implemented merge (GPT D: a python re-impl drifts into "doctor green, runtime
 // red"). Reports user / project / EFFECTIVE command (project shadows user per-name, the
-// resolveProviderConfig rule), plus install-state ownership, and gates on stable-bin resolvability.
+// resolveProviderConfig rule), plus install-state ownership, and gates on the stable bin actually
+// BOOTING (#81) — not merely resolving. `command -v` answering yes is not evidence that pi gets a
+// bridge: on the reference host the bare name resolved through a relocated pnpm shim whose $0-derived
+// target did not exist, so the launcher exited 127, the ACP turn had no mcp__entwurf-bridge__* tool,
+// and THIS doctor still printed ok. Resolvability is kept as the first, cheaper cell so the two
+// failures stay distinguishable (nothing on PATH vs. on PATH but dead).
+//
+// The probe sends `initialize` + `tools/list` only — never a `tools/call` — so it takes no lock,
+// writes no record and delivers nothing. That bounds OUR bridge tightly (start.sh is an `exec node`,
+// so there is no grandchild). It does not make the doctor side-effect free in general: whatever the
+// operator configured is what gets executed, and a foreign launcher's own startup is its own
+// business. Running this doctor is therefore a decision to run that command. See
+// probe-bridge-command.ts, which owns the bounded reap of the child it spawns.
 //
 // Env overrides (for the hermetic smoke):
 //   PI_PROVIDER_GLOBAL_SETTINGS   default: $PI_CODING_AGENT_DIR/settings.json or ~/.pi/agent/settings.json
@@ -12,12 +25,13 @@
 //   PI_PROVIDER_STATE             default: $XDG_DATA_HOME/entwurf/pi-provider/install-state.json
 //
 // Exit: 0 ok (incl. honest "never installed / unowned" notes) · 1 hard fail (malformed settings /
-// state-owned-but-drifted / stable bin dangling).
-import { execSync } from "node:child_process";
-import { existsSync, constants as FS, readFileSync, statSync } from "node:fs";
+// state-owned-but-drifted / stable bin dangling / stable bin present but does NOT boot).
+import { execFileSync } from "node:child_process";
+import { accessSync, existsSync, constants as FS, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readProviderSettingsFile } from "../pi-extensions/lib/acp/config.ts";
+import { normalizeMcpServers, readProviderSettingsFile } from "../pi-extensions/lib/acp/config.ts";
+import { probeBridgeCommand } from "./probe-bridge-command.ts";
 
 const BARE = "entwurf-bridge";
 const KEY = "entwurf-bridge";
@@ -32,12 +46,55 @@ const statePath = process.env.PI_PROVIDER_STATE || join(xdg, "entwurf", "pi-prov
 let hardFail = 0;
 const log = (s: string) => process.stdout.write(s + "\n");
 
-function commandOf(settings: { mcpServers?: Record<string, unknown> }): string | undefined {
-	const entry = settings.mcpServers?.[KEY];
-	if (entry && typeof entry === "object" && typeof (entry as { command?: unknown }).command === "string") {
-		return (entry as { command: string }).command;
-	}
-	return undefined;
+/** The configured stdio invocation for our key, as PRODUCTION would build it. */
+interface BridgeEntry {
+	command: string;
+	args: string[];
+	env: Record<string, string>;
+}
+
+// Build the effective entry EXACTLY the way production does (config.ts `resolveProviderConfig`):
+// a shallow PER-NAME merge of the two `mcpServers` maps, then ONE `normalizeMcpServers` over the
+// merged map. Hand-parsing command/args (this doctor's first shape) dropped a malformed arg
+// silently and probed an invocation production never runs.
+//
+// The ORDER is load-bearing too. Normalizing each file separately validates entries production
+// never sees: a malformed server in the global map that the project map shadows is gone by the time
+// pi normalizes, yet a per-file doctor throws on it and calls a session red that in fact starts
+// fine. That is the same "the doctor's subject differs from the runtime's" defect as the silent
+// arg-drop, pointed the other way — and it is not confined to our key, since any unrelated global
+// server could trip it.
+//
+// THROWS (McpServerConfigError) when the MERGED map is malformed — the fail-loud path, caught by
+// the caller. That error names the offending SERVER and reason, not a file: after the merge an
+// entry no longer belongs to one scope, so claiming a filename here would be a guess. A non-stdio
+// (http/sse) entry is returned as `null` so the caller can say WHY it cannot be probed instead of
+// pretending it is absent.
+function mergedBridgeEntry(
+	globalSettings: { mcpServers?: Record<string, unknown> },
+	projectSettings: { mcpServers?: Record<string, unknown> },
+): BridgeEntry | null | undefined {
+	const mergedRaw = { ...(globalSettings.mcpServers ?? {}), ...(projectSettings.mcpServers ?? {}) };
+	const { servers } = normalizeMcpServers(mergedRaw);
+	const entry = servers.find((srv) => srv.name === KEY);
+	if (entry === undefined) return undefined; // not configured in either scope
+	if ("url" in entry) return null; // http/sse — a real config, but nothing to spawn
+	return {
+		command: entry.command,
+		args: entry.args,
+		// The ACP wire shape is a name/value list; collapse it to the env map a spawn wants.
+		env: Object.fromEntries(entry.env.map((kv) => [kv.name, kv.value])),
+	};
+}
+
+// Per-scope DISPLAY only — never validation. The scope lines exist so an operator can see which
+// file supplied the effective entry; judging shape here would re-introduce the per-file validation
+// the merge rule above exists to avoid.
+function describeScope(settings: { mcpServers?: Record<string, unknown> }): string {
+	const raw = settings.mcpServers?.[KEY];
+	if (raw === undefined) return "entwurf-bridge NOT configured";
+	const cmd = (raw as { command?: unknown } | null)?.command;
+	return typeof cmd === "string" ? `'${cmd}'` : "configured (shape judged in the merged view)";
 }
 
 // Does the command resolve in the environment (best local proxy for "where pi/agy runs")?
@@ -45,16 +102,16 @@ function commandOf(settings: { mcpServers?: Record<string, unknown> }): string |
 function resolvable(cmd: string): boolean {
 	if (cmd.includes("/")) {
 		try {
-			statSync(cmd);
-			// eslint-disable-next-line no-bitwise
-			return (statSync(cmd).mode & FS.S_IXUSR) !== 0;
+			accessSync(cmd, FS.X_OK);
+			return true;
 		} catch {
 			return false;
 		}
 	}
 	try {
-		// `command -v` is a POSIX sh builtin; use the default /bin/sh (NixOS has no /bin/bash).
-		execSync(`command -v ${cmd}`, { stdio: "ignore" });
+		// `command -v` is a POSIX sh builtin. Pass the configured name as argv, never shell text:
+		// an unowned override is still operator data and must not become a doctor injection surface.
+		execFileSync("sh", ["-c", 'command -v -- "$1" >/dev/null 2>&1', "sh", cmd], { stdio: "ignore" });
 		return true;
 	} catch {
 		return false;
@@ -64,24 +121,41 @@ function resolvable(cmd: string): boolean {
 log("[pi-provider doctor]");
 
 // Read via the SSOT — a malformed settings file THROWS here (fail-loud, named file).
-let userCmd: string | undefined;
-let projCmd: string | undefined;
+let effectiveEntry: BridgeEntry | null | undefined;
+let userScopeDesc = "";
+let projScopeDesc = "";
+let effectiveScope = "none";
 try {
-	userCmd = commandOf(readProviderSettingsFile(globalPath).settings);
-	projCmd = commandOf(readProviderSettingsFile(projectPath).settings);
+	const userSettings = readProviderSettingsFile(globalPath).settings;
+	const projSettings = readProviderSettingsFile(projectPath).settings;
+	userScopeDesc = describeScope(userSettings);
+	projScopeDesc = describeScope(projSettings);
+	// EFFECTIVE = project shadows user per-NAME. The whole ENTRY shadows, not a field of it, so
+	// command, args and env always come from one scope; the scope label is decided by which map
+	// owns the key, which is exactly what the merge spread resolves.
+	effectiveEntry = mergedBridgeEntry(userSettings, projSettings);
+	const ownsKey = (m: Record<string, unknown> | undefined): boolean => m !== undefined && Object.hasOwn(m, KEY);
+	effectiveScope = ownsKey(projSettings.mcpServers)
+		? "project"
+		: ownsKey(userSettings.mcpServers)
+			? "user(global)"
+			: "none";
 } catch (err) {
 	log(`  FAIL: ${err instanceof Error ? err.message : String(err)}`);
 	process.exit(1);
 }
 
-// EFFECTIVE = project shadows user per-name (the resolveProviderConfig merge rule).
-const effectiveCmd = projCmd ?? userCmd;
-const effectiveScope = projCmd !== undefined ? "project" : userCmd !== undefined ? "user(global)" : "none";
+const effectiveDesc =
+	effectiveEntry === undefined
+		? "entwurf-bridge NOT configured"
+		: effectiveEntry === null
+			? "configured as an http/sse server"
+			: `'${effectiveEntry.command}'`;
 
 log("── scopes (project shadows user per-name)");
-log(`  user(global) ${globalPath}: ${userCmd ? `'${userCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  project      ${projectPath}: ${projCmd ? `'${projCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  EFFECTIVE (${effectiveScope}): ${effectiveCmd ? `'${effectiveCmd}'` : "none"}`);
+log(`  user(global) ${globalPath}: ${userScopeDesc}`);
+log(`  project      ${projectPath}: ${projScopeDesc}`);
+log(`  EFFECTIVE (${effectiveScope}): ${effectiveDesc}`);
 
 // install-state ownership (user scope). absent state on a configured effective is either a
 // pre-Task-2 install or a user-override we deliberately did not own.
@@ -100,36 +174,66 @@ if (existsSync(statePath)) {
 }
 
 log("── verdict");
-if (effectiveCmd === undefined) {
+if (effectiveEntry === undefined) {
 	log(
 		"  note: no entwurfProvider.mcpServers.entwurf-bridge in any scope (never installed — this is the '?'; run ./run.sh setup).",
 	);
-} else if (effectiveCmd === BARE) {
-	if (resolvable(effectiveCmd)) {
-		log(`  ok: effective command is the bare stable bin '${BARE}' and it RESOLVES.`);
-	} else {
-		log(`  FAIL: effective command is '${BARE}' but it does NOT resolve (run ./run.sh expose-dev-bin / npm bin-link).`);
-		hardFail = 1;
-	}
+} else if (effectiveEntry === null) {
+	// A real, well-formed config that this bridge cannot be: entwurf-bridge is a stdio server, so
+	// an http/sse entry under our key means pi would connect to something that is not us. Nothing
+	// here is spawnable, so there is no boot to prove — say that plainly rather than reporting the
+	// absence of a failure as ok.
+	log(
+		`  FAIL: entwurf-bridge is configured as an http/sse server in ${effectiveScope} scope. This bridge is a stdio server — pi would reach something that is not entwurf, and no boot evidence is possible. Restore a stdio entry with ./run.sh setup, or remove the key if the override is deliberate.`,
+	);
+	hardFail = 1;
 } else {
-	// effective is NOT the bare bin. If state says we own it → drift (FAIL). Otherwise classify
-	// the effective command honestly: our OWN legacy repo start.sh (not yet adopted) is NOT a
-	// user override — say so distinctly so "run setup" is the clear next step. A truly foreign
-	// command is an unowned override left as the operator's choice. Neither is a hard fail.
-	const isLegacyManaged = effectiveCmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
-	if (ownership && ownership !== "user-override") {
-		log(
-			`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${effectiveCmd}'.`,
-		);
+	const cmd = effectiveEntry.command;
+	const isBare = cmd === BARE;
+	const isLegacyManaged = cmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
+
+	// Runtime truth is independent of ownership truth. An unowned override remains the operator's
+	// choice, but it still shadows the stable bridge in production; calling a dead override green
+	// repeats #81 under a different spelling. Probe the exact normalized command + args + env for
+	// EVERY effective stdio entry, then classify who owns that entry separately below.
+	if (!resolvable(cmd)) {
+		log(`  FAIL: effective command '${cmd}' does NOT resolve or is not executable.`);
 		hardFail = 1;
-	} else if (isLegacyManaged) {
-		log(
-			`  note: effective is our LEGACY managed repo path ('${effectiveCmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize (this is the pre-Task-2 '?').`,
-		);
 	} else {
-		log(
-			`  note: entwurf-bridge is an UNOWNED override ('${effectiveCmd}') — effective is not the stable bin. Left as the operator's choice (run ./run.sh setup to adopt the bare bin).`,
-		);
+		log(`  effective command '${cmd}' RESOLVES — probing the exact configured invocation…`);
+		const probe = await probeBridgeCommand({
+			command: cmd,
+			args: effectiveEntry.args,
+			env: { ...process.env, ...effectiveEntry.env },
+		});
+		if (probe.ok) {
+			log(
+				isBare
+					? `  ok: effective command is the bare stable bin '${BARE}' and it BOOTS — ${probe.detail}`
+					: `  runtime: configured override BOOTS — ${probe.detail}`,
+			);
+		} else {
+			log(`  FAIL: effective invocation does NOT serve MCP [${probe.reason}] — ${probe.detail}`);
+			log(`         Diagnose its launcher and configured args/env; entwurf will not overwrite an unowned command.`);
+			hardFail = 1;
+		}
+	}
+
+	if (!isBare) {
+		// Ownership classification never rounds a broken runtime up to green. It only says who may
+		// repair the non-canonical entry after the independent boot verdict above.
+		if (ownership && ownership !== "user-override") {
+			log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);
+			hardFail = 1;
+		} else if (isLegacyManaged) {
+			log(
+				`  note: effective is our LEGACY managed repo path ('${cmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize.`,
+			);
+		} else {
+			log(
+				`  note: entwurf-bridge is an UNOWNED override ('${cmd}'). Runtime was judged above; run ./run.sh setup only if you choose to adopt the bare stable bin.`,
+			);
+		}
 	}
 }
 

package/scripts/meta-bridge-state.py

@@ -74,7 +74,6 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("promptSuggestionEnabled", ["promptSuggestionEnabled"], False),
     ("awaySummaryEnabled", ["awaySummaryEnabled"], False),
     ("autoMemoryEnabled", ["autoMemoryEnabled"], False),
-    ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
     ("verbose", ["verbose"], False),
     ("autoCompactEnabled", ["autoCompactEnabled"], False),
     ("showTurnDuration", ["showTurnDuration"], False),
@@ -84,6 +83,19 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("workflowKeywordTriggerEnabled", ["workflowKeywordTriggerEnabled"], False),
 ]
 
+# Keys entwurf used to own but now returns to the operator. An old install-state
+# entry is the only authority to undo our prior write; a bare matching value is
+# not provenance and is never changed. apply() consumes each proven old entry
+# exactly once, then uninstall can no longer restore over the operator's choice.
+RETIRED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
+    ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
+]
+
+_managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}
+_retired_scalar_names = {name for name, _path, _last in RETIRED_SETTINGS_SCALARS}
+if overlap := _managed_scalar_names & _retired_scalar_names:
+    raise RuntimeError(f"settings scalar cannot be both managed and retired: {sorted(overlap)}")
+
 
 class StateError(RuntimeError):
     pass
@@ -391,6 +403,9 @@ def apply(repo: Path, asm: Path) -> None:
     if not isinstance(root, dict):
         die(f"{claude_root_config_path()} root must be a JSON object")
 
+    for name, path_, last_managed_value in RETIRED_SETTINGS_SCALARS:
+        relinquish_retired_scalar(state, settings, name, path_, last_managed_value)
+
     set_nested(settings, ["enabledPlugins", PLUGIN_REF], True)
     set_nested(settings, ["extraKnownMarketplaces", MARKETPLACE], desired_marketplace(asm))
     for path_, desired in [(["permissions", "allow"], PERMISSION_ALLOW), (["permissions", "deny"], PERMISSION_DENY)]:
@@ -446,6 +461,53 @@ def restore_entry(obj: dict[str, Any], entry: dict[str, Any]) -> None:
     die(f"unknown state entry kind: {kind}")
 
 
+def settings_state_keys(state: dict[str, Any]) -> dict[str, Any]:
+    """The settings key ledger, or a loud failure.
+
+    `load_state` validates only the envelope (schemaVersion/owner), so a consumer
+    that indexes straight into files.settings.keys turns a corrupt state file into
+    a bare KeyError traceback instead of an operator diagnostic. Ownership
+    decisions read this ledger, so an unreadable one must stop before any write.
+    """
+    files = state.get("files")
+    entry = files.get("settings") if isinstance(files, dict) else None
+    keys = entry.get("keys") if isinstance(entry, dict) else None
+    if not isinstance(keys, dict):
+        die(f"install state {state_path()} has no files.settings.keys ledger; re-run install-meta-bridge")
+    return keys
+
+
+def relinquish_retired_scalar(
+    state: dict[str, Any], settings: dict[str, Any], name: str, path: list[str], last_managed_value: Any
+) -> None:
+    """Return one formerly managed scalar to operator ownership.
+
+    Only a preserved install-state entry proves entwurf wrote this path. If the
+    current value still has the exact JSON scalar type+value we last managed,
+    restore the snapshot. A changed or absent current value is already the
+    operator's and stays untouched. Malformed provenance fails before any file
+    write; silently discarding it would make a still-dangerous value look clean.
+    """
+    keys = settings_state_keys(state)
+    entry = keys.get(name)
+    if entry is None:
+        return
+    if not isinstance(entry, dict) or entry.get("kind") != "scalar" or entry.get("path") != path:
+        die(f"retired scalar state entry {name} is malformed; refusing to discard ownership evidence")
+    original = entry.get("original")
+    if (
+        not isinstance(original, dict)
+        or set(original) != {"existed", "value"}
+        or type(original.get("existed")) is not bool
+    ):
+        die(f"retired scalar state entry {name} has malformed original; refusing to guess")
+
+    existed, value = get_nested(settings, path)
+    if existed and type(value) is type(last_managed_value) and value == last_managed_value:
+        restore_entry(settings, entry)
+    keys.pop(name)
+
+
 def preflight_uninstall() -> None:
     load_state(required=True)
     print(f"[meta-bridge-state] uninstall preflight ok ({state_path()})")
@@ -536,6 +598,18 @@ def check(repo: Path, asm: Path) -> None:
         if recorded_asm
         else desired_marketplace(asm)
     )
+    state_settings_keys = settings_state_keys(state)
+    for name, path_, last_managed_value in RETIRED_SETTINGS_SCALARS:
+        if name in state_settings_keys:
+            failures.append(f"install-state still owns retired scalar {name}; re-run install-meta-bridge to relinquish it")
+            continue
+        existed, value = get_nested(settings, path_)
+        if existed and type(value) is type(last_managed_value) and value == last_managed_value:
+            print(
+                f"NOTE: settings {name}={json.dumps(last_managed_value)} is operator-owned; "
+                f"entwurf no longer suppresses or restores this warning choice"
+            )
+
     checks = [
         (["enabledPlugins", PLUGIN_REF], True, "enabled plugin"),
         (["extraKnownMarketplaces", MARKETPLACE], marketplace_expected, "known marketplace"),

package/scripts/mutants/acp-prompt-lifecycle.json

@@ -54,8 +54,8 @@
 			"claim": "REUSE-CARRIES-CHILD-DIAGNOSTICS",
 			"title": "the reuse path drops the child's stderr tail again — exactly the live sonnet failure that showed only \"ACP connection closed\"",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail);"],
-			"replace": ["\t\t\tfinishError(err, aborted);"],
+			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle);"],
+			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle);"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:REUSE-CARRIES-CHILD-DIAGNOSTICS]",
@@ -89,12 +89,34 @@
 			"claim": "RETIRED-TEARDOWN-NOT-ANNOUNCED",
 			"title": "a teardown we performed ourselves is reported as a death — every ordinary turn-scoped turn cries wolf about its own cleanup",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t} else if (!session.retiring) {"],
+			"find": ["\t} else if (!session.retiring && !session.reporting) {"],
 			"replace": ["\t} else {"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:RETIRED-TEARDOWN-NOT-ANNOUNCED]",
 			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "EOF-FIRST-CARRIES-CHILD-END",
+			"title": "the failing turn seals the moment the transport closes, without waiting for the child's exit — re-plants the #72 field signature (a bare \"ACP connection closed\" naming neither exit code nor signal)",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tawait settleChildEnd(session.childEnd, CHILD_END_SETTLE_MS);"],
+			"replace": ["\tvoid CHILD_END_SETTLE_MS;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:EOF-FIRST-CARRIES-CHILD-END]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "CHILD-END-SILENCE-BOUNDED",
+			"title": "the post-mortem window grows past the bound it contracts for — a turn whose child never reports an end waits on a clock the caller did not choose",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tawait settleChildEnd(session.childEnd, CHILD_END_SETTLE_MS);"],
+			"replace": ["\tawait settleChildEnd(session.childEnd, 2_500);"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CHILD-END-SILENCE-BOUNDED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
 		}
 	]
 }

package/scripts/mutants/bridge-command-boot.json

@@ -0,0 +1,107 @@
+{
+	"schemaVersion": 1,
+	"lane": "bridge-command-boot",
+	"mutants": [
+		{
+			"claim": "PI-DOCTOR-BOOT-NEGATIVE",
+			"title": "the pi doctor goes back to blessing a command that merely RESOLVES — the exact #81 false success, where a host ran ACP turns with no mcp__entwurf-bridge__* tool while the doctor printed ok",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (probe.ok) {"],
+			"replace": ["\t\tif (probe.ok || true) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-BOOT-NEGATIVE]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-BOOT-NEGATIVE",
+			"title": "the agy doctor stops asking whether the configured command boots and reports the old '(resolvable)' green — a registered bridge agy could never actually call",
+			"subject": "scripts/agy-bridge.sh",
+			"find": ["      if command_boots \"$invocation\"; then"],
+			"replace": ["      if true; then"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-BOOT-NEGATIVE]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-PROBES-OVERRIDE",
+			"title": "the pi doctor skips runtime probing for a non-bare override, so a dead command that shadows the stable bridge returns green as an operator choice",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\tif (!resolvable(cmd)) {"],
+			"replace": [
+				"\tif (!isBare) {\n\t\tlog(`  note: skipped runtime for override '${cmd}'`);\n\t} else if (!resolvable(cmd)) {"
+			],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-PROBES-OVERRIDE]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-PROBES-ARGS",
+			"title": "the agy invocation parser drops configured args, so the doctor boots command defaults while agy executes a failing argv",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["    args = server.get(\"args\", [])"],
+			"replace": ["    args = []"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-PROBES-ARGS]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "AGY-DOCTOR-PROBES-ENV",
+			"title": "the agy invocation parser drops configured environment, so the doctor boots command defaults while agy executes a failing environment",
+			"subject": "scripts/agy-bridge-config.py",
+			"find": ["    env = server.get(\"env\", {})"],
+			"replace": ["    env = {}"],
+			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:AGY-DOCTOR-PROBES-ENV]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "PROBE-REASON-MISSING-VERB",
+			"title": "bridge identity shrinks back to a single tool, so a build missing entwurf_self — the measured #81 session shape — reads as a healthy bridge again",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\tconst missing = EXPECTED_TOOLS.filter((t) => !served.has(t));"],
+			"replace": ["\t\t\t\tconst missing = [\"entwurf_v2\"].filter((t) => !served.has(t));"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-REASON-MISSING-VERB]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-REQUIRES-INITIALIZE",
+			"title": "the probe accepts tools/list before the MCP initialize handshake completes — a launcher the harness cannot initialize reads healthy",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\tif (!initialized) {"],
+			"replace": ["\t\t\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-REQUIRES-INITIALIZE]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-CLEANUP-ESCALATES",
+			"title": "the probe stops escalating past SIGTERM, so a launcher that traps TERM outlives the doctor that spawned it — the probe leaks the broken process it exists to detect",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\t\t\t\t\tchild.kill(\"SIGKILL\");"],
+			"replace": ["\t\t\t\t\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-CLEANUP-ESCALATES]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		},
+		{
+			"claim": "PROBE-STDIN-EPIPE-GUARD",
+			"title": "the async EPIPE from a launcher that died on exec goes unlistened again, so the probe dies on an uncaught stream error and the doctor prints a Node stack trace where the LAUNCHER's own stderr belongs — the #81 diagnosis erased in the one cell that needs it",
+			"subject": "scripts/probe-bridge-command.ts",
+			"find": ["\t\tchild.stdin.on(\"error\", () => {});"],
+			"replace": ["\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-probe-bridge-command"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PROBE-STDIN-EPIPE-GUARD]",
+			"signatureSource": "scripts/check-probe-bridge-command.ts"
+		}
+	]
+}