@junghanacs/entwurf 0.14.0 → 0.14.2

package/scripts/raw-async-delivery/README.md

@@ -1,4 +1,4 @@
-# raw-async-delivery — RAW async message delivery into LIVE Claude Code / agy / Codex sessions
+# raw-async-delivery — RAW async message delivery into LIVE Claude Code / agy / Codex / Copilot sessions
 
 Goal: deliver an async message INTO an already-running **subscription** session,
 free, with no `claude -p` / backend CLI prompt spawn — and in particular wake an
@@ -12,6 +12,12 @@ Codex is split by launch surface:
   auto-attached to a default-path app-server): raw `turn/start` over
   WebSocket-over-UDS wakes the live thread — **demonstrated, no managed
   standalone, no cloud**.
+- **Copilot CLI 1.0.80 TUI+server**: official SDK `1.0.11` can resolve the
+  foreground native session and enqueue into that exact idle TUI; D7 was
+  demonstrated once (L4 direct-native, one Linux workstation). The launch flag
+  `--ui-server` is hidden from CLI help and its loopback RPC authentication is
+  not established, so this remains a probe, not a managed lane. Undocumented
+  `~/.copilot/run/ws.*` is still not a rail.
 
 ## TL;DR — three reception paths, ranked
 
@@ -82,6 +88,7 @@ do not ship that. Proven: deliver to A's sessionId → A wakes (FileChanged), B'
 - `raw-agy-send.sh <conv_id> …` — agy parity: PUSH into a live Antigravity session (LS gRPC)
 - `raw-codex-ws-turn-start.py <sock> <thread_id> …` — Codex parity (no managed standalone, no cloud): PUSH `turn/start` over WebSocket-over-UDS into a bare `app-server --listen` socket
 - `codex-local-appserver.sh [sock]` — start a bare local app-server so plain `codex` auto-attaches and becomes addressable
+- `copilot-ui-server-probe.mjs` — official-SDK D0 probe by default; `LIVE=1` performs one addressed idle enqueue and prints D0–D8
 
 ### Reproduction drivers
 - `repro-plugin-idle-wake.sh` — single-session smoke.
@@ -244,6 +251,150 @@ send-message-v2` spins a fresh thread, not the live one.
 4. **Unix-socket transport is WebSocket** (tokio-tungstenite), not newline JSON-RPC,
    and requires **no auth token** on the UDS. A plain WS client suffices.
 
+## Copilot CLI raw delivery status (1.0.80) — positive TUI+server probe, not a managed lane
+
+Copilot is a GitHub **harness** (issues, PR, CI, model `auto`, mode `autopilot`,
+remote/delegate), not a second GPT provider next to pi. This makes a native lane
+product-distinct from the declined Codex lane: Copilot can own GitHub work while
+implementation checkpoints arrive from another garden id. That split is operator
+etiquette plus dispatch, not a substrate role system.
+
+The cost premise must stay honest. Copilot reports AI Credits and a monthly
+premium-interaction entitlement; model `auto` chooses a path within that budget.
+The reason to use it is GitHub specialization and auto routing, not an unlimited
+subscription claim. Model `auto` and mode `autopilot` are separate axes.
+
+### Positive transport
+
+The first-party `@github/copilot-sdk` exposes TUI+server coordination:
+`getForegroundSessionId()`, `getSessionMetadata()`, `resumeSession(id)`, and
+session-scoped `send({mode:"enqueue"|"immediate"})`. The native TUI launch mode is:
+
+```bash
+copilot --ui-server --port 43817 --model auto
+```
+
+`--ui-server` is accepted by CLI 1.0.80 and named by the official SDK API docs,
+but hidden from `copilot --help`. Launch mode is therefore part of the capability,
+and this evidence does not apply to an already-running plain `copilot` TUI.
+
+Measured once on 2026-08-19 with SDK 1.0.11, **using the earlier chronological-slice
+probe** (it scored the events following the marker's position in the history). The probe
+in the tree today scores a named turn instead — see "Current probe contract" below — and
+that contract has NOT been run LIVE, so nothing in this list is retroactively evidence
+for it. Evidence level for the list: **L4 direct-native, ONE Linux workstation, one run**;
+the receipt is host-local probe stdout and was NOT archived as a durable artifact, so what
+follows is reproducible by instruction, not citable to a stored file:
+
+- protocol v3 ping succeeded;
+- foreground session id joined to metadata containing cwd/git root/branch;
+- `resumeSession(id)` + idle `enqueue` woke the visible TUI with zero typing;
+- the unique body appeared as `user.message` with `delivery:"idle"`;
+- model `auto` selected `gpt-5.6-luna` and returned the exact marker;
+- `assistant.message`, `assistant.turn_end`, and (in the one-session run)
+  ephemeral `session.idle` gave completion/reply evidence;
+- a two-session control then targeted A while B received no `user.message`, turn,
+  or assistant event, so D3 passed too.
+
+D0–D7 passed; D8 is unproven. One robustness defect surfaced in the two-session
+shape: the target visibly replied and persisted `assistant.message` + `turn_end`,
+but that joining SDK client did not receive ephemeral `session.idle`, so SDK
+`sendAndWait()` timed out after 60 seconds. The probe therefore uses `send()` plus
+bounded polling of the official session event-history API (`session.getEvents()` /
+`getMessages()`) and reports completion at `turn_end`. Name that surface at its real
+size: it is the SDK's own full event history — no narrower, no more privileged — and it
+is **not** TUI, file, or database transcript scraping; the probe never reads Copilot's
+storage. This is evidence, not a product retry/polling design.
+
+### Current probe contract — designed, not yet run LIVE
+
+Attribution is the load-bearing part, and it runs off the probe's own marker body:
+
+```text
+unique marker body  →  exactly one user.message
+                    →  its interactionId
+                    →  exactly one assistant.turn_start on that interaction
+                    →  that turn_start's required turnId
+                    →  only assistant.message / assistant.turn_end on that turnId
+```
+
+Every link is required and unambiguous; absent or matched twice, the probe FAILS CLOSED.
+There is no positional fallback and no "the turn after ours" rule, because scoring "the
+newest assistant.message" in a session a human is also typing into is how a probe reports
+someone else's turn as its own delivery.
+
+What is deliberately NOT the key: `session.send()` on the bundled CLI 1.0.80 resolves to a
+`Promise<string>` that is the SDK's own submission handle. The server-side `user.message`
+does not carry that string, and it is a different axis from that event's
+`id`/`interactionId` — a join on it cannot hold, so the probe logs it as a diagnostic and
+never matches on it.
+
+The D3 control cell uses the same sentence it prints: across `onEvent` and `getEvents`, the
+non-target session received no `user.message` and no `assistant.*` event of any kind.
+
+Lifecycle, stated precisely rather than flatteringly: the probe never deletes target
+session A and issues no `A.disconnect()` of its own. `client.stop()` DOES tear down every
+tracked session — A included — as a wire `session.destroy`; because A's foreground
+ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
+session, so the net effect on A is detach-equivalent, not removal. The probe deletes only
+the control session it created itself, and reads `client.stop()`'s returned error list so a
+failed teardown cannot exit 0 behind a printed verdict. Reaching past the SDK for a raw
+detach wrapper is out of bounds — it would be a second lifecycle authority.
+
+This contract has not been exercised by a LIVE turn. The next LIVE run is what would
+demonstrate it, and it also confirms the real event key names.
+
+### Reproduce with the pinned official SDK
+
+The SDK is deliberately not an entwurf production dependency while this is only
+a raw probe. Install it in scratch and point the probe at its ESM entry:
+
+```bash
+mkdir -p /tmp/copilot-sdk-probe
+printf '{"private":true,"type":"module"}\n' >/tmp/copilot-sdk-probe/package.json
+pnpm --dir /tmp/copilot-sdk-probe add --ignore-scripts @github/copilot-sdk@1.0.11
+
+# terminal A: visible native session (accept folder trust)
+copilot --ui-server --port 43817 --model auto
+
+# terminal B: D0 only, no model call
+COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
+  ./copilot-ui-server-probe.mjs
+
+# one paid/subscription turn: addressed idle enqueue through the official SDK
+LIVE=1 COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
+  ./copilot-ui-server-probe.mjs
+
+# creates a second no-turn control session and proves only the target receives the marker
+LIVE=1 COPILOT_D3_CONTROL=1 \
+  COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
+  ./copilot-ui-server-probe.mjs
+```
+
+### Admission blockers and negative evidence
+
+- **Transport authentication is not established.** The TUI server bound loopback,
+  but an SDK client without a token connected. Setting `COPILOT_CONNECTION_TOKEN`
+  on the UI server did not enable auth: the unauthenticated client still connected,
+  while a token-bearing client received `AUTHENTICATION_NOT_CONFIGURED`. Do not
+  ship this as a rail until the supported same-user/fail-closed boundary is proved.
+- Shell command-hook `sessionStart` input is `{timestamp,cwd,source,initialPrompt?}`;
+  it does **not** carry `sessionId`. SDK callbacks receive `sessionId` separately in
+  their invocation object. The discarded command-hook probe therefore could not
+  establish D0, and UUID-only process-log scraping did not satisfy D0's cwd/liveness
+  join. Do not revive that path.
+- Hooks have no `FileChanged` / `watchPaths` / `asyncRewake`; the Claude mailbox
+  mechanism cannot be copied.
+- `--acp` is a pi-host child path, not this native TUI citizen path. `--remote` is
+  GitHub web/mobile steering, not a local `entwurf_v2` API. Undocumented
+  `~/.copilot/run/ws.*` remains out of bounds.
+
+Do not add `backend:"copilot"`, `FRESH_CALL_BACKENDS`, a schema change, or an OPEN
+issue from these positive probes. Next evidence is active-turn enqueue/immediate
+behavior, TUI-vs-SDK permission ownership, the missing multi-session `session.idle`,
+endpoint staleness/crash behavior, and a supported authenticated or equivalent local
+boundary.
+
 ## Live SSOT for "is the target session alive?"
 
 - Claude Code: `~/.claude/sessions/<pid>.json` (pid, sessionId, cwd, status). NOT
@@ -256,3 +407,9 @@ send-message-v2` spins a fresh thread, not the live one.
   `$HOME/.codex/app-server-control/app-server-control.sock` (or any owned 0700
   socket via `codex app-server --listen unix://PATH`) is the delivery surface.
   threadId comes from the newest rollout's `session_meta.id`.
+- Copilot TUI+server probe: SDK `ping` + `getForegroundSessionId()` +
+  `getSessionMetadata()` identify the currently displayed native session, and
+  the official session event-history API (`getEvents()` / `getMessages()`) reads
+  a turn back — no transcript file or database is touched. The TCP port is a
+  runtime endpoint, never an identity axis; no managed liveness join exists
+  until its authentication and stale-endpoint behavior are proved.

package/scripts/raw-async-delivery/copilot-ui-server-probe.mjs

@@ -0,0 +1,337 @@
+#!/usr/bin/env node
+/**
+ * Raw Copilot CLI TUI+server delivery probe.
+ *
+ * This is probe evidence, not a shipped adapter. Start a visible native TUI:
+ *   copilot --ui-server --port 43817 --model auto
+ *
+ * The official SDK is intentionally not a production dependency of entwurf.
+ * Point COPILOT_SDK_MODULE at its ESM entry (README has the pinned setup).
+ * Without LIVE=1 this proves only D0 and spends no model credit.
+ *
+ * ATTRIBUTION IS THE WHOLE CLAIM. A delivery probe that reads "the newest
+ * assistant.message" is reading the TUI, not its own turn: a human typing in the
+ * visible session, a queued earlier prompt, or a retried send all produce events
+ * that would be scored as OUR delivery.
+ *
+ * The join runs off the PROBE-OWNED MARKER BODY, not off what `send()` returned.
+ * On the bundled CLI 1.0.80 `session.send()` resolves to a `Promise<string>` whose
+ * id is the SDK's own submission handle: the server-side `user.message` does NOT
+ * carry it, and it is a different axis from that event's `id`/`interactionId`. A
+ * join on the returned string is therefore not merely fragile, it cannot hold — so
+ * the returned value is kept for the diagnostic log only. The chain that carries
+ * the claim is:
+ *
+ *   unique marker body  →  exactly one `user.message`
+ *                       →  its `interactionId`
+ *                       →  exactly one `assistant.turn_start` on that interaction
+ *                       →  that turn_start's required `turnId`
+ *                       →  only `assistant.message` / `assistant.turn_end` on that turnId
+ *
+ * Every link is required and unambiguous. Absent, or matched more than once, the
+ * probe FAILS CLOSED (throws). There is no positional fallback and no "the next
+ * turn after ours" rule, because a wrong pass here would be published as capability
+ * evidence.
+ */
+import { pathToFileURL } from "node:url";
+
+const modulePath = process.env.COPILOT_SDK_MODULE;
+if (!modulePath?.startsWith("/")) {
+	throw new Error("COPILOT_SDK_MODULE must be an absolute path to @github/copilot-sdk/dist/index.js");
+}
+
+const { CopilotClient, RuntimeConnection } = await import(pathToFileURL(modulePath).href);
+const server = process.env.COPILOT_UI_SERVER ?? "localhost:43817";
+const live = process.env.LIVE === "1";
+const twoSessionControl = process.env.COPILOT_D3_CONTROL === "1";
+if (twoSessionControl && !live) throw new Error("COPILOT_D3_CONTROL=1 requires LIVE=1");
+const marker = `NATIVE-ENTWURF-${Date.now()}`;
+const TURN_BUDGET_MS = 30_000;
+/** Cleanup gets its own small bound: a probe must not hang on the way out. */
+const CLEANUP_BOUND_MS = 5_000;
+const seen = new Set();
+const controlSeen = new Set();
+let controlSession;
+
+const client = new CopilotClient({
+	connection: RuntimeConnection.forUri(server),
+	mode: "copilot-cli",
+	logLevel: "error",
+});
+
+/**
+ * Bound ONE awaited SDK call. Promise.race does not cancel the underlying request —
+ * nothing in the SDK offers that — so this is a liveness bound on the probe, not a
+ * cancellation. That is the honest guarantee: the probe always reaches a verdict or
+ * an error within its budget, and never sits forever on a call that will not return.
+ */
+async function bounded(label, promise, ms) {
+	if (ms <= 0) throw new Error(`${label}: no time left in the ${TURN_BUDGET_MS}ms turn budget`);
+	let timer;
+	try {
+		return await Promise.race([
+			promise,
+			new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new Error(`${label} exceeded its ${ms}ms bound`)), ms);
+			}),
+		]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+// Identifier readers for the two links that DO exist server-side. The SDK nests payloads
+// under `data`, but a top-level carrier is accepted too so a protocol revision that flattens
+// one field does not silently turn a cell into a positional guess — an ABSENT id still fails
+// closed below. There is deliberately no reader for send()'s returned handle: it is not a key
+// any event carries, so joining on it would be inventing a relation.
+const interactionOf = (event) => event?.data?.interactionId ?? event?.interactionId;
+const turnOf = (event) => event?.data?.turnId ?? event?.turnId;
+
+function observe(event) {
+	seen.add(event.type);
+}
+
+function report(cells) {
+	console.log("DELIVERY_LEVELS:");
+	console.log("harness=copilot-cli");
+	console.log(`transport=official-sdk-over-hidden-ui-server server=${server}`);
+	for (const [level, value] of Object.entries(cells)) console.log(`${level} ${value}`);
+	console.log(
+		"notes=probe-only; --ui-server is hidden from CLI help; loopback RPC authentication is not established; " +
+			"no managed citizen lane; completion is read through the official session event-history API " +
+			"(getEvents/getMessages) — no TUI, file, or database transcript scraping; " +
+			"evidence=L4 direct-native on ONE Linux workstation; this stdout is host-local and was not archived as a durable artifact",
+	);
+}
+
+/** Everything the probe must do on the way out, each bounded. Returns failure lines. */
+async function cleanup(foregroundSessionId) {
+	const problems = [];
+	const attempt = async (label, thunk) => {
+		try {
+			return await bounded(label, thunk(), CLEANUP_BOUND_MS);
+		} catch (err) {
+			problems.push(`${label}: ${String(err)}`);
+			return undefined;
+		}
+	};
+
+	// RE-CONFIRM A as the foreground session BEFORE anything is torn down: creating the control
+	// session moved the TUI's foreground, and leaving the operator's visible window pointing at a
+	// probe-owned session would be the probe editing the operator's state. Read first and write
+	// only on drift — a probe that unconditionally re-sets the foreground is making a write it
+	// cannot tell apart from a no-op, and it would report a drift it caused as clean.
+	if (foregroundSessionId) {
+		const current = await attempt("getForegroundSessionId()", () => client.getForegroundSessionId());
+		if (current !== foregroundSessionId) {
+			console.error(`CLEANUP_NOTE foreground was ${current ?? "none"}, not target A — restoring A`);
+			await attempt("setForegroundSessionId(A)", () => client.setForegroundSessionId(foregroundSessionId));
+		}
+	}
+
+	// Only the session the PROBE created is deleted. A is the operator's live session and is
+	// never deleted here.
+	if (controlSession?.sessionId) {
+		await attempt("deleteSession(B)", () => client.deleteSession(controlSession.sessionId));
+	}
+
+	// Say what stop() actually does, not the flattering version. The probe issues no
+	// A.disconnect() of its own, but client.stop() tears down EVERY tracked session — including
+	// the resumed A — and that teardown goes out on the wire as session.destroy. What keeps this
+	// honest rather than destructive is the order above: A's foreground ownership is re-confirmed
+	// first, so the TUI keeps A as its foreground session and the net effect on A is
+	// detach-equivalent, not removal. A is not deleted. Do NOT "fix" this by reaching past the
+	// SDK for a raw detach — a bespoke wrapper would be a second lifecycle authority, and this
+	// probe's whole claim is that it used the official surface.
+	//
+	// stop() also reports its teardown failures by RETURNING them, so an unread array is a
+	// cleanup failure laundered into success.
+	const stopErrors = await attempt("client.stop()", () => client.stop());
+	if (Array.isArray(stopErrors) && stopErrors.length > 0) {
+		problems.push(
+			`client.stop() reported ${stopErrors.length} teardown error(s): ${stopErrors.map(String).join("; ")}`,
+		);
+	}
+	return problems;
+}
+
+let foregroundSessionId;
+try {
+	await client.start();
+	const ping = await client.ping("entwurf-native-probe");
+	const sessionId = await client.getForegroundSessionId();
+	if (!sessionId) throw new Error("ui-server has no foreground session");
+	foregroundSessionId = sessionId;
+	const metadata = await client.getSessionMetadata(sessionId);
+	if (!metadata?.context?.workingDirectory) throw new Error("foreground session metadata has no workingDirectory");
+
+	console.error(
+		`protocol=${ping.protocolVersion ?? "unknown"} sessionId=${sessionId} cwd=${metadata.context.workingDirectory}`,
+	);
+	if (!live) {
+		report({
+			"D0 live_identity:": 'pass reason="ping + foreground session id + metadata cwd"',
+			"D1 native_continuation:": 'unproven reason="set LIVE=1 for one model turn"',
+			"D2 receiver_armed:": 'pass reason="SDK connected to the TUI ui-server"',
+			"D3 addressed_enqueue:": "unproven",
+			"D4 idle_wake:": "unproven",
+			"D5 context_injection:": "unproven",
+			"D6 continuity:": "unproven",
+			"D7 completion_reply:": "unproven",
+			"D8 robustness:": "unproven",
+		});
+		process.exitCode = 0;
+	} else {
+		if (twoSessionControl) {
+			controlSession = await client.createSession({
+				model: "auto",
+				workingDirectory: metadata.context.workingDirectory,
+				skipCustomInstructions: true,
+				onEvent: (event) => controlSeen.add(event.type),
+			});
+			await client.setForegroundSessionId(sessionId);
+			console.error(`controlSessionId=${controlSession.sessionId}`);
+		}
+
+		const session = await client.resumeSession(sessionId, {
+			suppressResumeEvent: true,
+			onEvent: observe,
+		});
+		// send() resolves to the SDK's own submission handle. On the bundled CLI 1.0.80 that string
+		// appears on NO server event — not as user.message.id, not as its interactionId — so it is
+		// logged as a diagnostic and never joined on. The marker body below is the real key.
+		const sentHandle = await session.send({
+			prompt: `This is a native delivery probe. Reply with exactly ${marker} and nothing else.`,
+			mode: "enqueue",
+		});
+		console.error(`sendHandle=${String(sentHandle)} (diagnostic only — not an event key)`);
+
+		/** Resolve the marker turn from the event history, or return why it is not resolvable yet. */
+		const resolveMarkerTurn = (events) => {
+			const matches = events.filter((event) => event.type === "user.message" && event.data?.content?.includes(marker));
+			if (matches.length === 0) return { pending: `no user.message carries the unique marker ${marker}` };
+			// AMBIGUITY IS A FAILURE, NOT A TIE-BREAK. Two user.messages with this body means the send
+			// was duplicated (retry, replay, a human pasting it); picking one would be a guess.
+			if (matches.length > 1) {
+				return {
+					fatal: `${matches.length} user.message events carry the unique marker ${marker} — the delivery is ambiguous`,
+				};
+			}
+			const markerEvent = matches[0];
+			const interactionId = interactionOf(markerEvent);
+			if (interactionId === undefined) {
+				return {
+					fatal: "the marker user.message exposes no interactionId — assistant events cannot be attributed to it",
+				};
+			}
+			const starts = events.filter(
+				(event) => event.type === "assistant.turn_start" && interactionOf(event) === interactionId,
+			);
+			if (starts.length === 0) return { pending: `no assistant.turn_start yet on interactionId=${interactionId}` };
+			if (starts.length > 1) {
+				return {
+					fatal: `${starts.length} assistant.turn_start events share interactionId=${interactionId} — the turn is ambiguous`,
+				};
+			}
+			const turnId = turnOf(starts[0]);
+			if (turnId === undefined) {
+				return {
+					fatal: `the assistant.turn_start on interactionId=${interactionId} exposes no turnId — its assistant events cannot be attributed`,
+				};
+			}
+			return { markerEvent, interactionId, turnId };
+		};
+
+		const deadline = Date.now() + TURN_BUDGET_MS;
+		const remaining = () => deadline - Date.now();
+		let events = [];
+		let resolved = { pending: "no getEvents() read completed" };
+		while (remaining() > 0) {
+			events = await bounded("session.getEvents()", session.getEvents(), remaining());
+			for (const event of events) observe(event);
+			resolved = resolveMarkerTurn(events);
+			// A fatal shape will not become valid by waiting — stop polling and fail closed below.
+			if (resolved.fatal) break;
+			if (resolved.turnId !== undefined) {
+				const inTurn = events.filter((event) => turnOf(event) === resolved.turnId);
+				const replied = inTurn.some((event) => event.type === "assistant.message");
+				const ended = inTurn.some((event) => event.type === "assistant.turn_end");
+				if (replied && ended) break;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 100));
+		}
+
+		// FAIL CLOSED — an ambiguous or unnameable turn is a broken measurement, and a turn that
+		// never resolved inside the budget is an unfinished one. Neither is a partial pass, and
+		// neither falls back to "the assistant events that came after ours".
+		if (resolved.fatal) throw new Error(resolved.fatal);
+		if (resolved.turnId === undefined) {
+			throw new Error(
+				`the marker turn did not resolve within ${TURN_BUDGET_MS}ms (${resolved.pending}) — the delivery is unattributable`,
+			);
+		}
+		const { markerEvent, turnId } = resolved;
+
+		// From here on ONLY this turn's events are evidence.
+		const turnEvents = events.filter((event) => turnOf(event) === turnId);
+		const turnReplies = turnEvents.filter((event) => event.type === "assistant.message");
+		const replied = turnReplies.length > 0;
+		const completed = replied && turnEvents.some((event) => event.type === "assistant.turn_end");
+		const responseContent = turnReplies.at(-1)?.data?.content;
+		const responseModel = turnReplies.at(-1)?.data?.model;
+		const exact = responseContent === marker;
+		// D4 is read off the marker event itself — an older idle wake in the transcript is
+		// somebody else's evidence.
+		const idleDelivery = markerEvent.data?.delivery === "idle";
+		if (!completed) throw new Error("timeout waiting for the marker turn to complete");
+
+		if (controlSession) {
+			// Bounded like every other read. The turn finished inside the budget, so what is left of
+			// it is the natural bound; if it landed on the very edge, D3 still gets the cleanup bound
+			// rather than an unbounded call.
+			const controlBound = Math.max(remaining(), CLEANUP_BOUND_MS);
+			const controlEvents = await bounded("controlSession.getEvents()", controlSession.getEvents(), controlBound);
+			for (const event of controlEvents) controlSeen.add(event.type);
+		}
+		// D3's predicate is the SAME sentence the verdict prints: across onEvent AND getEvents,
+		// the non-target session received no user.message and no assistant.* event of any kind.
+		// The old check enumerated two assistant types, so an isolation break that arrived as
+		// assistant.turn_end (or any future assistant.*) would have been reported as a pass.
+		const controlTouched = [...controlSeen].some((type) => type === "user.message" || type.startsWith("assistant."));
+
+		report({
+			"D0 live_identity:": 'pass reason="ping + foreground session id + metadata cwd"',
+			"D1 native_continuation:": replied
+				? 'pass reason="the turn opened on the marker user.message\'s interactionId replied in the same session"'
+				: 'fail reason="marker turn did not continue"',
+			"D2 receiver_armed:": 'pass reason="SDK connected to the TUI ui-server"',
+			"D3 addressed_enqueue:": twoSessionControl
+				? controlTouched
+					? `fail reason="non-target control session received a user.message or assistant.* event (${[...controlSeen].sort().join(",")})"`
+					: 'pass reason="exact target woke; second session received no user.message and no assistant.* event"'
+				: 'partial reason="exact session id selected; rerun with COPILOT_D3_CONTROL=1"',
+			"D4 idle_wake:": idleDelivery
+				? 'pass reason="the marker user.message itself carries delivery=idle"'
+				: 'fail reason="the marker user.message does not carry delivery=idle"',
+			"D5 context_injection:": exact
+				? 'pass reason="unique marker entered the attributed user.message and was returned exactly"'
+				: 'pass reason="unique marker entered the attributed user.message; reply was non-exact"',
+			"D6 continuity:": responseModel
+				? `pass reason="the same session answered this turn on ${responseModel}"`
+				: 'fail reason="the attributed turn exposed no reply model"',
+			"D7 completion_reply:": seen.has("session.idle")
+				? 'pass reason="attributed assistant.message + assistant.turn_end; session.idle also seen"'
+				: 'pass reason="attributed assistant.message + assistant.turn_end; session.idle not observed"',
+			"D8 robustness:": 'unproven reason="permission ownership, crash, ordering, auth, and stale endpoint remain"',
+		});
+	}
+} finally {
+	const problems = await cleanup(foregroundSessionId);
+	if (problems.length > 0) {
+		// A probe that cannot close what it opened has not finished cleanly, and a delivery
+		// verdict printed above must not carry a zero exit past that.
+		for (const problem of problems) console.error(`CLEANUP_FAILED ${problem}`);
+		process.exitCode = 1;
+	}
+}

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.66.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.70.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-agy-install-state.sh

@@ -54,9 +54,48 @@ PSTATE="$XDG_DATA_HOME/entwurf/agy-bridge/permission-state.json"
 mkdir -p "$(dirname "$GLOBAL")" "$(dirname "$LEGACY")" "$SB/bin"
 
 # fake stable bin (on PATH) + fake ss (unused by the deterministic path) — fake agy toggled per case.
-printf '#!/usr/bin/env bash\necho fake-entwurf-bridge\n' > "$SB/bin/entwurf-bridge"
+#
+# #81: the doctor now BOOTS the configured command and requires the entwurf MCP tool surface back,
+# because `command -v` succeeding is not evidence agy gets a bridge — a relocated launcher resolves
+# and still exits 127. So the healthy fake speaks the two frames the probe sends; the dead fake
+# below reproduces the observed relocated-shim failure for the negative cell.
+write_mcp_fake() {   # $1 = path
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+write_dead_fake() {  # $1 = path — resolves, then dies on exec (the relocated-shim shape)
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+echo "bash: /nonexistent/../global/v11/deadbeef/node_modules/@junghanacs/entwurf/mcp/entwurf-bridge/start.sh: No such file or directory" >&2
+exit 127
+FAKE
+  chmod +x "$1"
+}
+write_invocation_sensitive_fake() {  # command alone is healthy; configured argv or env makes it fail
+  cat > "$1" <<'FAKE'
+#!/usr/bin/env bash
+if [ "${1:-}" = "--fail" ]; then echo configured-arg-failure >&2; exit 23; fi
+if [ "${REVIEW_ENV:-}" = "fail" ]; then echo configured-env-failure >&2; exit 24; fi
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+  esac
+done
+FAKE
+  chmod +x "$1"
+}
+write_mcp_fake "$SB/bin/entwurf-bridge"
 printf '#!/usr/bin/env bash\nexit 0\n' > "$SB/bin/ss"
-chmod +x "$SB/bin/entwurf-bridge" "$SB/bin/ss"
+chmod +x "$SB/bin/ss"
 export PATH="$SB/bin:$PATH"
 export AGY_MCP_CONFIG="$GLOBAL"
 export AGY_MCP_CONFIG_ALT="$LEGACY"
@@ -96,6 +135,41 @@ want "doctor(no-agy): SKIP is not disguised as a pass" "! printf '%s' \"\$DOC_OU
 want "doctor(installed): state-evidence confirms the managed config still configured" \
   "printf '%s' \"\$DOC_OUT\" | grep -q 'still configures entwurf-bridge'"
 
+# ── B-boot: #81 A/B — a configured command that RESOLVES but does not serve MCP ──
+# The static tier used to print "(resolvable)" and stay green here, which is exactly the state in
+# which agy would have had no entwurf tool at all. Sandbox PATH only — the operator's launcher is
+# never touched. `set -e` is fenced around the drive alone so the assertions still run.
+write_dead_fake "$SB/bin/entwurf-bridge"
+set +e; DOC_OUT="$(bash "$BRIDGE" doctor 2>&1)"; DOC_RC=$?; set -e
+want "[QK:AGY-DOCTOR-BOOT-NEGATIVE] doctor(cmd resolves, does not boot): FAILS instead of blessing a resolvable name" "[ '$DOC_RC' -ne 0 ]"
+want "doctor(cmd resolves, does not boot): says it does NOT serve MCP" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'does NOT serve MCP with its configured args/env'"
+want "doctor(cmd resolves, does not boot): carries the launcher's own stderr" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'No such file or directory'"
+want "doctor(cmd resolves, does not boot): does not offer to clobber a foreign launcher" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'repair/remove it yourself'"
+write_mcp_fake "$SB/bin/entwurf-bridge"
+DOC_OUT="$(bash "$BRIDGE" doctor)"; DOC_RC=$?
+want "doctor(after repair): the SAME unchanged doctor goes green once the command boots" "[ '$DOC_RC' -eq 0 ]"
+want "doctor(after repair): green names the exact invocation BOOT evidence" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'exact configured invocation boots the entwurf MCP surface'"
+
+# The configured invocation is command + args + env, not command alone. Replant each review
+# shape independently: this fake boots with defaults, but agy's configured argv/env make it fail.
+write_invocation_sensitive_fake "$SB/bin/invocation-sensitive"
+python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); d["mcpServers"]["entwurf-bridge"]={"command":"invocation-sensitive","args":["--fail"],"env":{"REVIEW_ENV":"ok"}}; json.dump(d,open(sys.argv[1],"w"))' "$GLOBAL"
+set +e; DOC_OUT="$(bash "$BRIDGE" doctor 2>&1)"; DOC_RC=$?; set -e
+want "[QK:AGY-DOCTOR-PROBES-ARGS] doctor(command healthy, configured argv red): FAILS exact invocation" "[ '$DOC_RC' -ne 0 ]"
+want "doctor(configured argv red): carries the argv-sensitive stderr" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'configured-arg-failure'"
+python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); d["mcpServers"]["entwurf-bridge"]={"command":"invocation-sensitive","args":[],"env":{"REVIEW_ENV":"fail"}}; json.dump(d,open(sys.argv[1],"w"))' "$GLOBAL"
+set +e; DOC_OUT="$(bash "$BRIDGE" doctor 2>&1)"; DOC_RC=$?; set -e
+want "[QK:AGY-DOCTOR-PROBES-ENV] doctor(command healthy, configured env red): FAILS exact invocation" "[ '$DOC_RC' -ne 0 ]"
+want "doctor(configured env red): carries the env-sensitive stderr" \
+  "printf '%s' \"\$DOC_OUT\" | grep -q 'configured-env-failure'"
+# Restore the managed shape for the remaining lifecycle cells.
+python3 "$REPO_DIR/scripts/agy-bridge-config.py" install "$GLOBAL" entwurf-bridge "$STATE" >/dev/null
+
 # ── C: doctor with a fake agy present → live is CONSISTENT (honest, not overclaimed) ──
 fake_agy on
 DOC_OUT="$(bash "$BRIDGE" doctor)"; DOC_RC=$?