@junghanacs/entwurf 0.14.1 → 0.14.2

package/scripts/agy-bridge-config.py

@@ -28,8 +28,12 @@ Subcommands (argv[1]):
       This is NOT tracked for an honest inverse: the legacy entry was wrong and stays gone.
 
   doctor-static <config_path>
-      Print one line describing the candidate for the shell doctor: `absent` / `symlink ->
-      <target>` prefix / `invalid-json` / `not-configured` / `command <cmd>`. Never mutates.
+      Print one line describing the candidate for the shell doctor: `absent` / `invalid-json` /
+      `invalid-entry` / `not-configured` / `configured <cmd>`. Never mutates.
+
+  doctor-invocation <config_path>
+      Print the configured server's exact `{command,args,env}` as compact JSON for the boot probe.
+      Invalid or absent entries fail rather than silently dropping argv/environment.
 
   permission-install <settings_path> <state_path>
       The OTHER half of "agy can call our bridge": registering the server (above) makes the tools
@@ -349,25 +353,51 @@ def cmd_clean_legacy(config_path: str) -> None:
         sys.stdout.write(f"cleaned-kept {config_path}\n")
 
 
-def cmd_doctor_static(config_path: str) -> None:
-    # Report the RESOLVED path's config status in one shell-parseable token line. Symlink
-    # detection/reporting is the shell's job (realpath here just follows any link).
+def _doctor_invocation(config_path: str):
+    """Return the exact stdio invocation agy reads, or a status token.
+
+    Command-only inspection is a false-success surface: configured argv/env can make a launcher
+    fail even while the same command boots with defaults. Display and execution share this parser
+    so they cannot disagree about whether an entry is valid.
+    """
     real = os.path.realpath(config_path)
     if not os.path.exists(real):
-        sys.stdout.write("absent\n")
-        return
+        return "absent", None
     try:
         with open(real, "r", encoding="utf-8") as fh:
             data = json.loads(fh.read() or "{}")
     except (json.JSONDecodeError, OSError):
-        sys.stdout.write("invalid-json\n")
-        return
+        return "invalid-json", None
     server = (data.get("mcpServers") or {}).get(SERVER_KEY) if isinstance(data, dict) else None
-    if not isinstance(server, dict) or not server.get("command"):
-        sys.stdout.write("not-configured\n")
+    if server is None:
+        return "not-configured", None
+    if not isinstance(server, dict):
+        return "invalid-entry", None
+    command = server.get("command")
+    args = server.get("args", [])
+    env = server.get("env", {})
+    if not isinstance(command, str) or not command:
+        return "invalid-entry", None
+    if not isinstance(args, list) or not all(isinstance(arg, str) for arg in args):
+        return "invalid-entry", None
+    if not isinstance(env, dict) or not all(isinstance(k, str) and isinstance(v, str) for k, v in env.items()):
+        return "invalid-entry", None
+    return "configured", {"command": command, "args": args, "env": env}
+
+
+def cmd_doctor_static(config_path: str) -> None:
+    status, invocation = _doctor_invocation(config_path)
+    if status != "configured":
+        sys.stdout.write(f"{status}\n")
         return
-    # "configured <command>" — command is the trailing token(s); shell takes field 2..N.
-    sys.stdout.write(f"configured {server['command']}\n")
+    sys.stdout.write(f"configured {invocation['command']}\n")
+
+
+def cmd_doctor_invocation(config_path: str) -> None:
+    status, invocation = _doctor_invocation(config_path)
+    if status != "configured":
+        _die(4, f"agy-bridge: cannot read configured invocation from {config_path}: {status}")
+    sys.stdout.write(json.dumps(invocation, separators=(",", ":")) + "\n")
 
 
 def cmd_permission_install(settings_path: str, state_path: str) -> None:
@@ -619,6 +649,10 @@ def main(argv: list) -> None:
         if len(argv) != 3:
             _die(5, "usage: agy-bridge-config.py doctor-static <config_path>")
         cmd_doctor_static(argv[2])
+    elif sub == "doctor-invocation":
+        if len(argv) != 3:
+            _die(5, "usage: agy-bridge-config.py doctor-invocation <config_path>")
+        cmd_doctor_invocation(argv[2])
     elif sub == "permission-state-doctor":
         if len(argv) != 3:
             _die(5, "usage: agy-bridge-config.py permission-state-doctor <state_path>")

package/scripts/agy-bridge.sh

@@ -7,9 +7,11 @@
 #              install-state for an honest inverse. The command written is a STABLE bin
 #              (`entwurf-bridge`), NEVER a repo/git-hash path (the oracle dangling lesson).
 #   uninstall  honest inverse from the install-state (restore preimage / remove our key).
-#   doctor     2-tier: STATIC proves both candidate configs (documented + observed) resolve,
-#              parse, and carry a resolvable command; LIVE proves runtime-effectiveness only
-#              when an agy process exists, else an honest SKIP (never a PASS in disguise).
+#   doctor     2-tier: STATIC proves both candidate configs (documented + observed) resolve, parse,
+#              and carry a command that actually BOOTS the entwurf MCP surface (#81 — resolvable
+#              is necessary, not sufficient; it execs the configured command); LIVE proves
+#              runtime-effectiveness only when an agy process exists, else an honest SKIP (never a
+#              PASS in disguise).
 #
 # GLOBAL ROOT (the one file that matters): live agy reads its global MCP config from
 # ~/.gemini/config/mcp_config.json (agy's own builtin doc: mcp_servers.md — "Global Configuration:
@@ -25,6 +27,7 @@
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="$(cd "$HERE/.." && pwd)"
 CONFIG_PY="$HERE/agy-bridge-config.py"
 
 GLOBAL_CONFIG="${AGY_MCP_CONFIG:-$HOME/.gemini/config/mcp_config.json}"
@@ -62,6 +65,33 @@ command_resolvable() {
   esac
 }
 
+# Does COMMAND actually BOOT and serve the entwurf MCP surface? (#81) Resolvability is necessary
+# and NOT sufficient: on the reference host the bare name resolved through a relocated pnpm shim
+# whose $0-derived target was gone, so it exited 127 and agy would have had no entwurf tool — while
+# this doctor printed "(resolvable)" and stayed green. The verdict leaf is shared with the pi
+# doctor via run.sh (the ONE strip-types fence crossing), so both lanes judge boot the same way.
+#
+# Cached per exact invocation: the probe spawns a real child, and the doctor asks about the same
+# configured {command,args,env} for two candidate configs plus the live tier. BOOT_DETAIL carries
+# the last probe's one-line verdict for the caller to print.
+BOOT_PROBED_INVOCATION=""
+BOOT_PROBED_RC=1
+BOOT_PROBED_OUT=""
+BOOT_DETAIL=""
+command_boots() {
+  local invocation="$1" out rc
+  if [ "$invocation" = "$BOOT_PROBED_INVOCATION" ]; then
+    BOOT_DETAIL="$BOOT_PROBED_OUT"
+    return "$BOOT_PROBED_RC"
+  fi
+  set +e
+  out="$("$REPO_DIR/run.sh" probe-bridge-command --invocation-json "$invocation" 2>&1)"
+  rc=$?
+  set -e
+  BOOT_PROBED_INVOCATION="$invocation"; BOOT_PROBED_RC="$rc"; BOOT_PROBED_OUT="$out"; BOOT_DETAIL="$out"
+  return "$rc"
+}
+
 # Prune the agy MCP tool-schema cache for the KNOWN-legacy server keys (LEGACY_CACHE_KEYS). Removes
 # ONLY the exact-named dirs — a symlink is left intact (not ours), and any OTHER server's cache is
 # never touched. Idempotent (absent = no-op). One-shot cutover hygiene, not honest-inverse tracked.
@@ -171,8 +201,8 @@ do_uninstall() {
 }
 
 # Static-check ONE candidate config. Prints a status line; returns 1 on a hard failure
-# (invalid JSON / configured-but-dangling command), 0 otherwise (absent / not-configured /
-# configured+resolvable are not doctor failures — a candidate may legitimately be unused).
+# (invalid JSON / configured invocation that cannot boot), 0 otherwise (absent / not-configured
+# are not doctor failures — a candidate may legitimately be unused).
 doctor_static_one() {
   local label="$1" candidate="$2"
   local link_note=""
@@ -185,13 +215,25 @@ doctor_static_one() {
     absent)         log "  $label: absent$link_note"; return 0 ;;
     not-configured) log "  $label: present but entwurf-bridge NOT configured$link_note"; return 0 ;;
     invalid-json)   log "  $label: INVALID JSON$link_note"; return 1 ;;
+    invalid-entry)  log "  $label: INVALID entwurf-bridge entry (command/args/env)$link_note"; return 1 ;;
     configured\ *)
-      local cmd="${status#configured }"
-      if command_resolvable "$cmd"; then
-        log "  $label: configured → '$cmd' (resolvable)$link_note"
+      local cmd="${status#configured }" invocation
+      if ! invocation="$(python3 "$CONFIG_PY" doctor-invocation "$candidate")"; then
+        log "  $label: configured → '$cmd' but its exact invocation is unreadable$link_note"
+        return 1
+      fi
+      if command_boots "$invocation"; then
+        log "  $label: configured → '$cmd' (the exact configured invocation boots the entwurf MCP surface)$link_note"
         return 0
       fi
-      log "  $label: configured → '$cmd' DANGLING (not on PATH / not executable)$link_note"
+      # A configured environment may itself carry PATH, so a shell-side `command -v` is not the
+      # runtime's subject. The shared probe executes the exact command + args + env instead.
+      # entwurf does NOT repair a failed launcher here: it may be owned by a foreign file.
+      log "  $label: configured → '$cmd' does NOT serve MCP with its configured args/env$link_note"
+      log "        $BOOT_DETAIL"
+      log "        Identify the launcher: command -v '$cmd'; readlink -f \"\$(command -v '$cmd')\""
+      log "        If it is entwurf's managed dev link, restore it with ./run.sh expose-dev-bin (it REFUSES a foreign link)."
+      log "        If a foreign launcher owns the name, repair/remove it yourself or put a working one earlier on PATH."
       return 1 ;;
     *) log "  $label: unexpected status '$status'$link_note"; return 1 ;;
   esac
@@ -283,23 +325,29 @@ sys.exit(0 if same and owned else 1)' "$PERMISSION_STATE_FILE" "$SETTINGS_FILE";
 
 do_doctor() {
   log "[agy-bridge doctor]"
-  local hard_fail=0 configured_any=0 resolvable_any=0
+  local hard_fail=0 configured_any=0 bootable_any=0
 
   log "── static (configured candidates)"
   doctor_static_one "global ($GLOBAL_CONFIG)" "$GLOBAL_CONFIG" || hard_fail=1
   doctor_static_one "legacy ($LEGACY_CONFIG)" "$LEGACY_CONFIG" || hard_fail=1
   doctor_permission || hard_fail=1
-  # Did EITHER candidate carry a configured + resolvable entwurf-bridge? Keep this runtime fact
-  # separate from ownership-state failures below: a FOREIGN TARGET makes the doctor red, but it
-  # does not make a visibly configured command disappear.
-  local c candidate_status candidate_cmd
+  # Did EITHER candidate carry a configured entwurf-bridge that actually BOOTS? Keep this runtime
+  # fact separate from ownership-state failures below: a FOREIGN TARGET makes the doctor red, but it
+  # does not make a visibly configured command disappear. Boot (not mere resolvability) is the fact
+  # the live tier reports on — the probe is cached, so this loop re-costs nothing.
+  local c candidate_status candidate_cmd candidate_invocation
   for c in "$GLOBAL_CONFIG" "$LEGACY_CONFIG"; do
     candidate_status="$(python3 "$CONFIG_PY" doctor-static "$c")"
     case "$candidate_status" in
       configured\ *)
         configured_any=1
         candidate_cmd="${candidate_status#configured }"
-        command_resolvable "$candidate_cmd" && resolvable_any=1
+        if candidate_invocation="$(python3 "$CONFIG_PY" doctor-invocation "$c")"; then
+          command_boots "$candidate_invocation" && bootable_any=1
+        else
+          log "  runtime: configured '$candidate_cmd' has an unreadable exact invocation."
+          hard_fail=1
+        fi
         ;;
     esac
   done
@@ -373,17 +421,19 @@ do_doctor() {
 
   log "── live (runtime wiring)"
   if command -v pgrep >/dev/null 2>&1 && pgrep -x agy >/dev/null 2>&1; then
-    if [ "$resolvable_any" -eq 1 ]; then
-      # HONEST label (N2): a running agy + a resolvable configured candidate is CONSISTENT with
-      # runtime wiring, but it does NOT prove agy actually read that config — that needs MCP
-      # tool-listing-grade evidence (deferred). Ownership/state failures remain red independently.
+    if [ "$bootable_any" -eq 1 ]; then
+      # HONEST label (N2): a running agy + a configured candidate whose command BOOTS and serves the
+      # entwurf MCP surface is CONSISTENT with runtime wiring. It still does NOT prove agy actually
+      # READ that config — that remains the deferred half. What is no longer deferred (#81) is the
+      # tool-listing evidence itself: the static tier above got it from the command, not from the
+      # mere fact that a name resolved. Ownership/state failures remain red independently.
       if [ "$hard_fail" -eq 0 ]; then
-        log "  live: agy is running AND a configured candidate has a resolvable command — consistent with runtime wiring (config-read NOT proven; MCP-tool-listing evidence deferred)."
+        log "  live: agy is running AND a configured candidate's command boots the entwurf MCP surface — consistent with runtime wiring (agy's own config-read NOT proven)."
       else
-        log "  live: agy is running and a configured candidate resolves, but ownership/state errors above keep this doctor red (config-read NOT proven)."
+        log "  live: agy is running and a configured candidate boots, but ownership/state errors above keep this doctor red (agy's own config-read NOT proven)."
       fi
     else
-      log "  live: agy is running but no resolvable configured candidate — runtime wiring is broken."
+      log "  live: agy is running but no configured candidate whose command boots the entwurf MCP surface — runtime wiring is broken."
       hard_fail=1
     fi
   else
@@ -391,7 +441,7 @@ do_doctor() {
   fi
 
   if [ "$hard_fail" -ne 0 ]; then
-    fail "doctor found a broken candidate (invalid JSON / dangling command / broken live wiring)."
+    fail "doctor found a broken candidate (invalid JSON / dangling command / command that does not serve MCP / broken live wiring)."
   fi
   log "doctor: ok (static candidates clean)."
 }

package/scripts/check-acp-prompt-lifecycle.ts

@@ -172,6 +172,19 @@ function makeHarness(recordDir: string) {
 		settle(stopReason: string) {
 			pending?.resolve({ stopReason });
 		},
+		/**
+		 * The TRANSPORT ends under the pending request — the real SDK's own
+		 * rejection, and the one production actually sees FIRST.
+		 *
+		 * Distinct from `close()` on purpose: the SDK does not route this through
+		 * an explicit close call. Its read loop hits stdout EOF and rejects every
+		 * pending response with `closeSignal.reason ?? new Error("ACP connection
+		 * closed")` — a GENERIC message, because a clean EOF carries no reason.
+		 * That verbatim text is the subject of the cells below.
+		 */
+		transportClosed(reason?: string) {
+			pending?.reject(new Error(reason ?? "ACP connection closed"));
+		},
 		/** the agent streams something mid-turn (proof the turn is progressing) */
 		async progress(text: string) {
 			await notifier?.({ sessionUpdate: "agent_message_chunk", content: { type: "text", text } });
@@ -524,6 +537,187 @@ try {
 		await t2.done;
 	}
 
+	// ----------------------------------------------------------------------
+	// CELL 9 — THE OTHER TEMPORAL ORDER: EOF first, exit one tick later.
+	//
+	// CELLS 4/5 drive the lifecycle-FIRST order: the child's `exit` event fires
+	// while the prompt is still pending, so `notifyChildGone` wins the race and
+	// reports the exit status. Those cells stay — that order remains possible and
+	// must keep working. This cell covers the order the FIELD showed.
+	//
+	// Measured with the production shape (piped stdio, detached, `Readable.toWeb`)
+	// on Linux, the child's stdout EOF landed ~1ms BEFORE node emitted `exit` —
+	// for a clean exit(0) and for SIGKILL alike (numbers preserved in issue #72).
+	//
+	// In that order the SDK's generic rejection settles the turn first,
+	// `awaitAcpPromptTurn`'s `finally` clears `notifyChildGone`, and the exit
+	// status arriving one tick later has nowhere to go. Issue #72's field sample
+	// is exactly that: `ACP connection closed` plus a stderr tail, naming neither
+	// exit code nor signal — while the backend HAD an exit status the whole time.
+	//
+	// The order here is scheduled EXPLICITLY (reject, then `die` on a later tick)
+	// rather than borrowed from a production helper: the claim IS the ordering,
+	// so the oracle must state it, not inherit it from the subject.
+	// ----------------------------------------------------------------------
+	let eofFirstMessage = "";
+	{
+		const h = makeHarness(recordDir);
+		const t1 = startTurn(backend, userCtx("first NONCE-E1"), { sessionId: "life-eof-first" }, h.deps);
+		await delay(20);
+		h.settle("end_turn");
+		await t1.done;
+		assert.equal(sealed(t1.events)[0].type, "done", "turn 1 completes so the session is retained for reuse");
+
+		// Turn 2 is the field shape: a retained child, a completed tool phase, and
+		// then the transport ends before the final answer.
+		const t2 = startTurn(
+			backend,
+			reuseCtx("first NONCE-E1", "second NONCE-E2"),
+			{ sessionId: "life-eof-first" },
+			h.deps,
+		);
+		await delay(30);
+		assert.equal(h.children.length, 1, "turn 2 reused the live child (no respawn)");
+		h.children[0].writeStderr(
+			"(node:501006) [CLAUDE_SDK_CAN_USE_TOOL_SHADOWED] Warning: canUseTool will not be invoked\n",
+		);
+		// EOF first …
+		h.transportClosed();
+		// … and the exit status one tick later, exactly as measured.
+		await delay(1);
+		h.children[0].die(0, null);
+		await t2.done;
+
+		eofFirstMessage = String(sealed(t2.events)[0].error.errorMessage);
+		assert.ok(
+			eofFirstMessage.includes("ACP connection closed"),
+			"the backend's own first words are preserved verbatim, not swapped out for ours — " +
+				`a reader must still be able to match the transport's text. Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		assert.ok(
+			eofFirstMessage.includes("exit code 0"),
+			"[QK:EOF-FIRST-CARRIES-CHILD-END] when the transport closes BEFORE node reports the child's exit — the order " +
+				"the field sample exhibited — the sealed error must still name how the child ended. Losing it to that " +
+				"~1ms race is what left issue #72's field sample with no exit code and no signal. " +
+				`Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		assert.ok(
+			eofFirstMessage.includes("while the prompt was still in flight"),
+			"the sealed error names the PHASE that died — a closure during bootstrap and one under a live prompt are " +
+				`different failures. Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		// NARROW on purpose: this proves the tail collected BEFORE the seal is not
+		// cut short by our own cleanup. It does NOT claim the child's last words —
+		// nothing here waits for the stderr pipe to drain, and node's `exit` can
+		// precede that drain. Draining is a separate lever; see backend.ts.
+		assert.ok(
+			eofFirstMessage.includes("CLAUDE_SDK_CAN_USE_TOOL_SHADOWED"),
+			`the stderr tail collected before the seal rides the sealed error. Got: ${JSON.stringify(eofFirstMessage)}`,
+		);
+		// Cleanup still runs after the seal — settling first DELAYS teardown, it
+		// does not skip it. The signal itself is not the evidence here: the child
+		// is already dead by now, and `teardownChild` correctly declines to signal
+		// a corpse. The connection close is the part that always runs.
+		assert.ok(
+			h.closes.length > 0,
+			"the uncertain connection is still closed after the seal — an error path must never leave it reusable",
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 10 — a SIGKILL under the same order is told apart from a clean exit.
+	//
+	// exit(0) and SIGKILL are the two candidate deaths behind #72 — a backend
+	// that chose to shut down (claude-agent-acp's index.js exits 0 when its ACP
+	// connection closes, silently) versus one killed from outside. They are
+	// distinguishable ONLY by this field, which is why CELL 9's claim is not
+	// enough on its own: a report that always said "exit code 0" would satisfy it
+	// while telling the operator nothing.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("killed from outside"), { sessionId: "life-eof-kill" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("KILLED-STDERR-MARK\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(null, "SIGKILL");
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("signal SIGKILL") && !message.includes("exit code"),
+			"a child killed from outside must read as a SIGNAL, never as a clean exit — a report that always said " +
+				`"exit code 0" would satisfy the previous cell while telling the operator nothing. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("KILLED-STDERR-MARK"),
+			`the stderr tail rides the signal case too. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 11 — a child that never reports an end says SO, bounded.
+	//
+	// A closed transport does not prove a dead child: the connection can end
+	// while the process lives. The honest report then is that we waited and it
+	// never said — NOT a guessed exit code, and NOT an unbounded wait. Silence
+	// must be reported as silence.
+	// ----------------------------------------------------------------------
+	let noEndMessage = "";
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("transport closes, child lives"), { sessionId: "life-eof-noend" }, h.deps);
+		await delay(30);
+		const closedAt = Date.now();
+		h.transportClosed();
+		await turn.done;
+		const waited = Date.now() - closedAt;
+
+		noEndMessage = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			noEndMessage.includes("reported no exit status within") &&
+				!noEndMessage.includes("exit code") &&
+				!noEndMessage.includes("signal "),
+			"when the transport closed but the child never reported an end, the turn must SAY so and invent nothing — " +
+				`a guessed exit status would be worse than the bare closure. Got: ${JSON.stringify(noEndMessage)}`,
+		);
+		// The window is BOTH real and bounded. The lower bound is what stops a
+		// mutant from passing by never waiting at all (it would then report silence
+		// for a child that was about to answer); the upper bound is what stops the
+		// wait from growing into the wall clock this gate exists to keep out. The
+		// shipped bound is CHILD_END_SETTLE_MS (500ms) — not imported, since the
+		// gate must not widen the backend's module surface — so the range allows a
+		// loaded host some slack while refusing multi-second drift.
+		assert.ok(
+			waited >= 400 && waited < 1_500,
+			"[QK:CHILD-END-SILENCE-BOUNDED] the post-mortem wait must actually happen AND be bounded — a failing turn may " +
+				`neither skip the window nor hang in it. Waited ${waited}ms`,
+		);
+	}
+
+	// A closure that CARRIES A REASON already explains itself, so it must not be
+	// given the post-mortem window: only the SDK's bare, reason-less text earns
+	// it. Without this, a broadened match would tax unrelated prompt errors with a
+	// delay — and the near-miss below is exactly what a substring test would catch
+	// by mistake.
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("closure with a reason"), { sessionId: "life-near-match" }, h.deps);
+		await delay(30);
+		const closedAt = Date.now();
+		h.transportClosed("ACP connection closed by the operator's proxy");
+		await turn.done;
+		const waited = Date.now() - closedAt;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			!message.includes("[acp] lifecycle:"),
+			`a closure that named its own reason must not be re-diagnosed. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(waited < 300, `…and must not pay the post-mortem wait either. Waited ${waited}ms`);
+	}
+
 	// ----------------------------------------------------------------------
 	// CELL 8 — our prompt-phase failure text is not transient, judged by pi.
 	// ----------------------------------------------------------------------
@@ -533,12 +727,28 @@ try {
 		"positive control: pi still classifies the RETIRED 600s cutoff text as transient — that classification is " +
 			"exactly why one wall-clock kill cost four full cold turns",
 	);
-	assert.equal(
-		isRetryableAssistantError({ stopReason: "error", errorMessage: childDeathMessage } as any),
-		false,
-		"[QK:PROMPT-ERROR-NOT-TRANSIENT] pi must NOT classify a prompt-phase lifecycle failure we authored as a " +
-			"transient provider error — a retry here is a cold replay of the whole prompt, not a cheap retry. " +
-			`Judged text: ${JSON.stringify(childDeathMessage)}`,
+	// EVERY prompt-phase failure text this backend authors, judged together by pi's
+	// own classifier. One aggregate assertion rather than three: the claim is the
+	// same for all of them, and the token that names it must appear exactly once.
+	//
+	// The two closure diagnoses are the ones that carry real risk — they are
+	// APPENDED to the SDK's own message, and the first draft said "within 500ms",
+	// which pi read as an HTTP 500 and classified as transient.
+	const authoredFailureTexts = [
+		["mid-prompt child death", childDeathMessage],
+		["EOF-first child end", eofFirstMessage],
+		["no child end within the bound", noEndMessage],
+	] as const;
+	const transientlyWorded = authoredFailureTexts.filter(([, text]) =>
+		isRetryableAssistantError({ stopReason: "error", errorMessage: text } as any),
+	);
+	assert.deepEqual(
+		transientlyWorded.map(([label]) => label),
+		[],
+		"[QK:PROMPT-ERROR-NOT-TRANSIENT] pi must NOT classify any prompt-phase lifecycle failure we authored as a " +
+			"transient provider error — a retry here is a cold replay of the whole prompt, and the tool side effects " +
+			"this turn already produced make that the expensive failure, not the cheap one. Offending texts: " +
+			JSON.stringify(transientlyWorded),
 	);
 } finally {
 	rmSync(TMP_EMIT, { recursive: true, force: true });
@@ -559,7 +769,9 @@ console.log(
 		"session/cancel first and seals cancelled→aborted without signalling a cooperating child; a wedged agent is torn " +
 		"down after the bounded grace and still returns promptly with no new child; a child that dies mid-prompt is " +
 		"reported with its exit status AND stderr tail on BOTH the new and the reuse path; a death BETWEEN turns is " +
-		"announced once by the next turn while a teardown WE performed stays silent; and pi's own " +
-		"isRetryableAssistantError refuses " +
-		"to classify that failure as transient while still matching the retired 600s text",
+		"announced once by the next turn while a teardown WE performed stays silent; the child's end survives the " +
+		"temporal order the field showed too (transport EOF first, exit one tick later, alongside the opposite order), " +
+		"telling a clean exit apart from a signal and reporting silence AS silence within a bounded window; and pi's " +
+		"own isRetryableAssistantError refuses to classify any of those failures as transient while still matching " +
+		"the retired 600s text",
 );

package/scripts/check-entwurf-bridge-boot.ts

@@ -25,6 +25,7 @@
 import { spawn } from "node:child_process";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { EXPECTED_TOOLS } from "./probe-bridge-command.ts";
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const START_SH = path.join(REPO_DIR, "mcp", "entwurf-bridge", "start.sh");
@@ -246,6 +247,33 @@ async function main(): Promise<void> {
 		`--- want ---\n${expectedSurface.join(",")}\n--- got ---\n${publicSurface.join(",")}`,
 	);
 
+	// G1g (#81) — bind probe-bridge-command's identity constant to the REAL runtime surface. That
+	// probe decides whether a configured launcher is this bridge by comparing tools/list against
+	// EXPECTED_TOOLS, so a verb added or retired without updating the constant would silently make
+	// every doctor red (or, worse, bless a stale build). The constant has exactly one oracle: the
+	// server booting right here. Add or retire a verb → update the constant in the same commit.
+	//
+	// Compared as SORTED ARRAYS, not as sets: set comparison would hide a duplicate on either side —
+	// including one inside the constant itself, a copy-paste that makes the probe's own length report
+	// lie. The length check here catches a runtime duplicate too; G1f ABOVE owns that as its named
+	// subject, so a duplicated verb turns BOTH red. Judging the same fact twice from two artifacts is
+	// the point, not an overlap to trim.
+	//
+	// POSITION IS LOAD-BEARING: this runs AFTER every named assertion. `ok()` exits on the first
+	// failure, so a cell placed earlier swallows the reds below it — when this block sat next to
+	// G1a, planting a defect in the resume-call or public-surface contracts turned THIS cell red
+	// first and gate qualification read WRONG-REASON for two claims that were in fact working.
+	// A gate that hides which contract broke is worse than the one it was added to strengthen.
+	// Keep unnamed/derived checks last; anything carrying a [QK:…] claim comes first.
+	const runtimeNames = tools.map((t) => t?.name).filter((n): n is string => typeof n === "string");
+	const runtimeSorted = [...runtimeNames].sort();
+	const constantSorted = [...EXPECTED_TOOLS].sort();
+	ok(
+		"G1g: probe-bridge-command EXPECTED_TOOLS equals the runtime tools/list exactly (sorted, duplicates included)",
+		runtimeSorted.length === constantSorted.length && runtimeSorted.every((n, i) => n === constantSorted[i]),
+		`--- runtime tools/list (sorted) ---\n${runtimeSorted.join(", ")}\n--- EXPECTED_TOOLS (sorted) ---\n${constantSorted.join(", ")}`,
+	);
+
 	console.log(`\ncheck-entwurf-bridge-boot: ${passed} checks passed`);
 }
 

package/scripts/check-gate-qualification.ts

@@ -800,11 +800,12 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"acp-augment": 10,
 		"acp-cortex": 12,
 		"acp-overlay": 1,
-		"acp-prompt-lifecycle": 8,
+		"acp-prompt-lifecycle": 10,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
 		"agy-permission": 6,
 		"bridge-boot-resume": 3,
+		"bridge-command-boot": 9,
 		"meta-facts": 4,
 		"meta-identity": 4,
 		"meta-retire": 3,
@@ -814,7 +815,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"mux-parent-artifact": 3,
 		"mux-resume-call": 12,
 		"probe-ordering": 1,
-		"release-gate": 11,
+		"release-gate": 12,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 3,