@junghanacs/entwurf 0.14.1 → 0.14.2

package/scripts/check-probe-bridge-command.ts

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// check-probe-bridge-command — deterministic contract gate for the #81 boot probe.
+//
+// The probe is what two doctors now stake their verdict on, so its reason taxonomy is a contract,
+// not an implementation detail: each value names a DIFFERENT operator situation, and collapsing two
+// of them would put the wrong repair in front of an operator. This gate pins the classification and
+// the one side effect the probe owns — reaping the child it spawned.
+//
+// Hermetic: every subject is a stub script in a mktemp dir. No network, no operator state, no MCP
+// server of ours is booted (check-entwurf-bridge-boot owns that axis).
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { EXPECTED_TOOLS, probeBridgeCommand } from "./probe-bridge-command.ts";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const PROBE_SRC = readFileSync(join(REPO_ROOT, "scripts", "probe-bridge-command.ts"), "utf8");
+
+let passed = 0;
+// The `[QK:…]` token must land on a FAILURE line (qualification does not count a token printed on
+// an `ok` line — a later red must not self-certify an earlier claim), and it must appear exactly
+// once in this file. So: strip it from the green line, print it verbatim on the red one.
+function ok(label: string, cond: boolean, detail?: string): void {
+	if (!cond) {
+		console.error(`FAIL: ${label}`);
+		if (detail) console.error(detail);
+		process.exit(1);
+	}
+	console.log(`  ok    ${label.replace(/\[QK:[^\]]+\]\s*/, "")}`);
+	passed++;
+}
+
+const dir = mkdtempSync(join(tmpdir(), "entwurf-probe-gate-"));
+const stub = (name: string, body: string): string => {
+	const p = join(dir, name);
+	writeFileSync(p, body);
+	chmodSync(p, 0o755);
+	return p;
+};
+
+/** An MCP stub that answers tools/list with exactly the given verb names. */
+const mcpStub = (name: string, names: readonly string[]): string => {
+	const tools = names.map((n) => `{"name":"${n}"}`).join(",");
+	return stub(
+		name,
+		`#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[${tools}]}}' ;;
+  esac
+done
+`,
+	);
+};
+
+try {
+	// ── the healthy shape ─────────────────────────────────────────────────────
+	const healthy = mcpStub("healthy", EXPECTED_TOOLS);
+	const rHealthy = await probeBridgeCommand({ command: healthy });
+	ok("the exact verb set is the only green", rHealthy.ok && rHealthy.reason === "ok", JSON.stringify(rHealthy));
+
+	// ── identity: booting an MCP server is not being THIS bridge ──────────────
+	// Missing one verb is the observed #81 shape (a session whose schema had no entwurf_self).
+	const partial = mcpStub(
+		"partial",
+		EXPECTED_TOOLS.filter((t) => t !== "entwurf_self"),
+	);
+	const rPartial = await probeBridgeCommand({ command: partial });
+	ok(
+		"[QK:PROBE-REASON-MISSING-VERB] a served MCP surface MISSING a verb is a mismatch, not ok",
+		!rPartial.ok && rPartial.reason === "tool-set-mismatch" && rPartial.detail.includes("missing entwurf_self"),
+		JSON.stringify(rPartial),
+	);
+	// The other direction: a stale build still serving a retired verb must not read as this bridge.
+	const extra = mcpStub("extra", [...EXPECTED_TOOLS, "entwurf_retired_verb"]);
+	const rExtra = await probeBridgeCommand({ command: extra });
+	ok(
+		"an EXTRA verb is a mismatch too (stale build / foreign binary)",
+		!rExtra.ok && rExtra.reason === "tool-set-mismatch" && rExtra.detail.includes("unexpected entwurf_retired_verb"),
+		JSON.stringify(rExtra),
+	);
+
+	// ── the defect that started #81: resolves, then dies on exec ──────────────
+	const dead = stub("dead", "#!/usr/bin/env bash\necho 'boom: no such file or directory' >&2\nexit 127\n");
+	const rDead = await probeBridgeCommand({ command: dead });
+	ok(
+		"a launcher that exits before tools/list is classified as such, with its stderr",
+		!rDead.ok && rDead.reason === "exited-before-tools-list" && rDead.detail.includes("boom"),
+		JSON.stringify(rDead),
+	);
+
+	// ── not executable at all ─────────────────────────────────────────────────
+	const rMissing = await probeBridgeCommand({ command: join(dir, "does-not-exist") });
+	ok(
+		"an unexecutable command is spawn-failed, NOT a boot failure",
+		!rMissing.ok && rMissing.reason === "spawn-failed",
+		JSON.stringify(rMissing),
+	);
+
+	// ── initialize is a handshake, not a frame we merely write ───────────────
+	const noInitialize = stub(
+		"no-initialize",
+		`#!/usr/bin/env bash
+printf '%s\\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[${EXPECTED_TOOLS.map((n) => `{"name":"${n}"}`).join(",")}]}}'
+while IFS= read -r _line; do :; done
+`,
+	);
+	const rNoInitialize = await probeBridgeCommand({ command: noInitialize, timeoutMs: 700 });
+	ok(
+		"[QK:PROBE-REQUIRES-INITIALIZE] an exact tools/list sent before initialize completes is not a healthy MCP bridge",
+		!rNoInitialize.ok && rNoInitialize.reason === "initialize-failed",
+		JSON.stringify(rNoInitialize),
+	);
+
+	// ── not an MCP server (answers id:2, no tools array) ──────────────────────
+	const notMcp = stub(
+		"not-mcp",
+		`#!/usr/bin/env bash
+while IFS= read -r line; do
+  case "$line" in
+    *'"id":1'*) printf '%s\\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"not-mcp","version":"0"}}}' ;;
+    *'"id":2'*) printf '%s\\n' '{"jsonrpc":"2.0","id":2,"result":{}}' ;;
+  esac
+done
+`,
+	);
+	const rNotMcp = await probeBridgeCommand({ command: notMcp });
+	ok(
+		"an id:2 reply without result.tools is not an MCP server",
+		!rNotMcp.ok && rNotMcp.reason === "no-tools-array",
+		JSON.stringify(rNotMcp),
+	);
+
+	// ── timeout + bounded cleanup ─────────────────────────────────────────────
+	// The probe runs whatever the operator configured, including a launcher that ignores SIGTERM.
+	// If it resolved without escalating, that process would outlive the doctor. The stub records
+	// its own pid so this gate can assert the reap actually happened — an unobserved kill is a
+	// claim, not evidence.
+	const pidFile = join(dir, "hung.pid");
+	const hung = stub(
+		"hung",
+		`#!/usr/bin/env bash
+trap '' TERM
+echo $$ > ${JSON.stringify(pidFile)}
+while true; do sleep 0.05; done
+`,
+	);
+	const rHung = await probeBridgeCommand({ command: hung, timeoutMs: 700 });
+	ok(
+		"a launcher that stays up but never answers is a timeout",
+		!rHung.ok && rHung.reason === "timeout",
+		JSON.stringify(rHung),
+	);
+	const hungPid = Number(readFileSync(pidFile, "utf8").trim());
+	ok(
+		"timeout stub recorded a usable pid (the cleanup assertion below has a subject)",
+		Number.isInteger(hungPid) && hungPid > 0,
+	);
+	// SIGTERM is trapped, so only the SIGKILL escalation can end it — and the probe must have
+	// completed that escalation BEFORE returning. Checking right here (no polling, no grace loop)
+	// is what pins that ordering: a probe that merely scheduled the kill would fail this cell,
+	// which is exactly the state a doctor's immediate process.exit() would leave behind.
+	const alive = spawnSync("kill", ["-0", String(hungPid)], { stdio: "ignore" }).status === 0;
+	// Clean up BEFORE asserting. When this claim's mutant re-plants the leak, `alive` is true and
+	// the assertion exits the process immediately — so without this line the gate that exists to
+	// prove nothing is orphaned would itself orphan the stub on the host, once per qualification
+	// run. A killed mutant must still leave zero residue.
+	if (alive) spawnSync("kill", ["-9", String(hungPid)], { stdio: "ignore" });
+	ok(
+		"[QK:PROBE-CLEANUP-ESCALATES] a SIGTERM-ignoring child is escalated to SIGKILL, never left orphaned",
+		!alive,
+		`pid ${hungPid} was still alive after the probe returned — the probe leaked the process it spawned`,
+	);
+
+	// ── source pin: the stdin EPIPE guard ─────────────────────────────────────
+	// WHY pinned instead of measured: the failure needs the child to exec, die and close its stdin
+	// read end BETWEEN uv_spawn and the parent's first write. Nothing this gate can write to a stub
+	// controls that ordering — measured on this host, five stub shapes (bad shebang, self-closed
+	// stdin, instant exit, missing file, a directory) produced EPIPE 0/20 each while idle, and only
+	// 12-way CPU contention opened the window (11/60 crashes before the fix, 0/60 after). A cell
+	// that only fires under load is a flaky gate, not a proof, so the property is pinned at the
+	// source. It is load-bearing because the crash it prevents is silent-by-substitution: the probe
+	// dies printing a Node stack trace where the doctor verdict should carry the LAUNCHER's stderr —
+	// the one line that names which hop broke. Ordering matters as much as presence: the listener
+	// must be installed before any write can dispatch.
+	const guard = '\t\tchild.stdin.on("error", () => {});';
+	const guardAt = PROBE_SRC.indexOf(guard);
+	const firstWriteAt = PROBE_SRC.indexOf("child.stdin.write(");
+	ok(
+		"[QK:PROBE-STDIN-EPIPE-GUARD] child.stdin carries an error listener installed before the first write — an async EPIPE from a launcher that died on exec must never replace the verdict with an uncaught exception",
+		guardAt >= 0 && firstWriteAt >= 0 && guardAt < firstWriteAt,
+		`guard index ${guardAt}, first child.stdin.write index ${firstWriteAt} in scripts/probe-bridge-command.ts`,
+	);
+} finally {
+	rmSync(dir, { recursive: true, force: true });
+}
+
+console.log(`check-probe-bridge-command: ${passed} checks passed`);

package/scripts/check-release-gate-outcomes.ts

@@ -439,6 +439,58 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 	);
 }
 
+// ===========================================================================
+// The operator's CONFIGURED bridge invocation is proven BEFORE the cost-bearing LIVE tier
+//
+// `check-bridge` boots the launcher this checkout SHIPS. It cannot speak for the string
+// pi's provider actually execs, and only that second one reaches a live ACP session.
+// 2026-08-19 measured the difference at full price: a relocated `~/.local/bin/entwurf-bridge`
+// symlink into a pnpm cmd-shim (basedir derived from $0, so not relocatable) exited 127, the
+// bundled bridge never booted, and the model had no `mcp__entwurf-bridge__*` tool — while
+// `command -v` answered yes throughout. #81 had already built the leaf that settles this in
+// under a second, and doctor-pi-provider consumes it; it was simply never a step, so the
+// verdict surfaced sixteen LIVE steps later at smoke-acp-bundled-mcp-live.
+// Pinned here because the step is CHEAP and therefore easy to drop again "to speed the gate up":
+// its whole value is the position, so both the position and the classifier arm are asserted.
+// run_step, not run_live_step — this doctor is not LIVE-gated and never emits 97, so a SKIP arm
+// would describe a prerequisite it cannot have.
+// ===========================================================================
+{
+	const runSh = readFileSync(join(REPO_DIR, "run.sh"), "utf8");
+	const gateBody = runSh.slice(runSh.indexOf("release_gate() {"), runSh.indexOf("# 5. Summary"));
+	const verify = readFileSync(join(REPO_DIR, "VERIFY.md"), "utf8");
+	const STEP =
+		'run_step "doctor-pi-provider (#81: the operator\'s CONFIGURED bridge invocation actually boots)" gate bash "$self" doctor-pi-provider';
+	const doctorSteps = gateBody.split("\n").filter((l) => l.includes('"$self" doctor-pi-provider'));
+	const gaps: string[] = [];
+	if (doctorSteps.length !== 1)
+		gaps.push(`release_gate runs doctor-pi-provider ${doctorSteps.length}x (need exactly one MUST step)`);
+	if (doctorSteps.length === 1 && doctorSteps[0]?.trim() !== STEP)
+		gaps.push(`the doctor step is not the exact pinned invocation (got: ${doctorSteps[0]?.trim()})`);
+	if (doctorSteps.length === 1 && doctorSteps[0]?.includes("run_live_step"))
+		gaps.push("the doctor step goes through run_live_step, inventing a SKIP arm for a doctor that never emits 97");
+	// Position is the point: a cheap probe scheduled after the expensive tier proves nothing new.
+	const doctorAt = gateBody.indexOf('"$self" doctor-pi-provider');
+	// Anchored on the step KEYWORD, not the bare name: prose above this step already discusses
+	// smoke-acp-bundled-mcp-live by name, and a needle that a comment can satisfy would drag the
+	// boundary backwards and fail an ordering that is actually fine.
+	const firstLiveAt = gateBody.indexOf('run_live_step "smoke-acp-');
+	if (doctorAt >= 0 && firstLiveAt >= 0 && doctorAt > firstLiveAt)
+		gaps.push("the doctor step runs AFTER the ACP LIVE tier — the fail-fast position that motivates it is gone");
+	if (!verify.includes("doctor-pi-provider"))
+		gaps.push("VERIFY.md does not name doctor-pi-provider in the MUST tier at all");
+	if (!verify.includes("the invocation the operator's pi provider actually EXECS"))
+		gaps.push("VERIFY.md no longer states WHICH invocation this step proves (ships vs execs)");
+	assert.ok(
+		gaps.length === 0,
+		"[QK:PI-DOCTOR-IS-RELEASE-MUST] the operator's configured bridge invocation must be booted as a release-gate " +
+			"MUST exactly once, through run_step (no SKIP arm — this doctor never emits 97), positioned BEFORE the ACP " +
+			"LIVE tier, with VERIFY naming it and keeping 'what this checkout ships' apart from 'what the provider execs' " +
+			"— drop any of those and the #81 127-class defect goes back to costing sixteen LIVE steps to discover. " +
+			`Broken: ${gaps.join("; ")}`,
+	);
+}
+
 console.log(
 	"[check-release-gate-outcomes] ok — STEP OUTCOME protocol: one skip exit code shared by the shell and TS halves " +
 		`(${LIVE_SKIP_EXIT}, clear of the per-tool 0..4 and shell 126+ bands), classifier maps 0→PASS / skip→SKIP / ` +
@@ -448,5 +500,6 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it",
+		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it; and " +
+		"the operator's CONFIGURED bridge invocation is booted exactly once through run_step, before the ACP LIVE tier",
 );

package/scripts/doctor-pi-provider.ts

@@ -1,10 +1,23 @@
 #!/usr/bin/env node
 // doctor-pi-provider — fail-loud doctor for the pi provider (entwurfProvider.mcpServers.
-// entwurf-bridge) ownership (#46 Task 2). Side-effect FREE (read-only). Uses the config.ts SSOT
+// entwurf-bridge) ownership (#46 Task 2). A BOUNDED BOOT PROBE, not a static inspector: it writes
+// no operator state, but it does exec the configured command on this host (#81). Uses the config.ts SSOT
 // `readProviderSettingsFile` so the effective (shadow-resolved) view matches what pi actually
 // loads — NOT a re-implemented merge (GPT D: a python re-impl drifts into "doctor green, runtime
 // red"). Reports user / project / EFFECTIVE command (project shadows user per-name, the
-// resolveProviderConfig rule), plus install-state ownership, and gates on stable-bin resolvability.
+// resolveProviderConfig rule), plus install-state ownership, and gates on the stable bin actually
+// BOOTING (#81) — not merely resolving. `command -v` answering yes is not evidence that pi gets a
+// bridge: on the reference host the bare name resolved through a relocated pnpm shim whose $0-derived
+// target did not exist, so the launcher exited 127, the ACP turn had no mcp__entwurf-bridge__* tool,
+// and THIS doctor still printed ok. Resolvability is kept as the first, cheaper cell so the two
+// failures stay distinguishable (nothing on PATH vs. on PATH but dead).
+//
+// The probe sends `initialize` + `tools/list` only — never a `tools/call` — so it takes no lock,
+// writes no record and delivers nothing. That bounds OUR bridge tightly (start.sh is an `exec node`,
+// so there is no grandchild). It does not make the doctor side-effect free in general: whatever the
+// operator configured is what gets executed, and a foreign launcher's own startup is its own
+// business. Running this doctor is therefore a decision to run that command. See
+// probe-bridge-command.ts, which owns the bounded reap of the child it spawns.
 //
 // Env overrides (for the hermetic smoke):
 //   PI_PROVIDER_GLOBAL_SETTINGS   default: $PI_CODING_AGENT_DIR/settings.json or ~/.pi/agent/settings.json
@@ -12,12 +25,13 @@
 //   PI_PROVIDER_STATE             default: $XDG_DATA_HOME/entwurf/pi-provider/install-state.json
 //
 // Exit: 0 ok (incl. honest "never installed / unowned" notes) · 1 hard fail (malformed settings /
-// state-owned-but-drifted / stable bin dangling).
-import { execSync } from "node:child_process";
-import { existsSync, constants as FS, readFileSync, statSync } from "node:fs";
+// state-owned-but-drifted / stable bin dangling / stable bin present but does NOT boot).
+import { execFileSync } from "node:child_process";
+import { accessSync, existsSync, constants as FS, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readProviderSettingsFile } from "../pi-extensions/lib/acp/config.ts";
+import { normalizeMcpServers, readProviderSettingsFile } from "../pi-extensions/lib/acp/config.ts";
+import { probeBridgeCommand } from "./probe-bridge-command.ts";
 
 const BARE = "entwurf-bridge";
 const KEY = "entwurf-bridge";
@@ -32,12 +46,55 @@ const statePath = process.env.PI_PROVIDER_STATE || join(xdg, "entwurf", "pi-prov
 let hardFail = 0;
 const log = (s: string) => process.stdout.write(s + "\n");
 
-function commandOf(settings: { mcpServers?: Record<string, unknown> }): string | undefined {
-	const entry = settings.mcpServers?.[KEY];
-	if (entry && typeof entry === "object" && typeof (entry as { command?: unknown }).command === "string") {
-		return (entry as { command: string }).command;
-	}
-	return undefined;
+/** The configured stdio invocation for our key, as PRODUCTION would build it. */
+interface BridgeEntry {
+	command: string;
+	args: string[];
+	env: Record<string, string>;
+}
+
+// Build the effective entry EXACTLY the way production does (config.ts `resolveProviderConfig`):
+// a shallow PER-NAME merge of the two `mcpServers` maps, then ONE `normalizeMcpServers` over the
+// merged map. Hand-parsing command/args (this doctor's first shape) dropped a malformed arg
+// silently and probed an invocation production never runs.
+//
+// The ORDER is load-bearing too. Normalizing each file separately validates entries production
+// never sees: a malformed server in the global map that the project map shadows is gone by the time
+// pi normalizes, yet a per-file doctor throws on it and calls a session red that in fact starts
+// fine. That is the same "the doctor's subject differs from the runtime's" defect as the silent
+// arg-drop, pointed the other way — and it is not confined to our key, since any unrelated global
+// server could trip it.
+//
+// THROWS (McpServerConfigError) when the MERGED map is malformed — the fail-loud path, caught by
+// the caller. That error names the offending SERVER and reason, not a file: after the merge an
+// entry no longer belongs to one scope, so claiming a filename here would be a guess. A non-stdio
+// (http/sse) entry is returned as `null` so the caller can say WHY it cannot be probed instead of
+// pretending it is absent.
+function mergedBridgeEntry(
+	globalSettings: { mcpServers?: Record<string, unknown> },
+	projectSettings: { mcpServers?: Record<string, unknown> },
+): BridgeEntry | null | undefined {
+	const mergedRaw = { ...(globalSettings.mcpServers ?? {}), ...(projectSettings.mcpServers ?? {}) };
+	const { servers } = normalizeMcpServers(mergedRaw);
+	const entry = servers.find((srv) => srv.name === KEY);
+	if (entry === undefined) return undefined; // not configured in either scope
+	if ("url" in entry) return null; // http/sse — a real config, but nothing to spawn
+	return {
+		command: entry.command,
+		args: entry.args,
+		// The ACP wire shape is a name/value list; collapse it to the env map a spawn wants.
+		env: Object.fromEntries(entry.env.map((kv) => [kv.name, kv.value])),
+	};
+}
+
+// Per-scope DISPLAY only — never validation. The scope lines exist so an operator can see which
+// file supplied the effective entry; judging shape here would re-introduce the per-file validation
+// the merge rule above exists to avoid.
+function describeScope(settings: { mcpServers?: Record<string, unknown> }): string {
+	const raw = settings.mcpServers?.[KEY];
+	if (raw === undefined) return "entwurf-bridge NOT configured";
+	const cmd = (raw as { command?: unknown } | null)?.command;
+	return typeof cmd === "string" ? `'${cmd}'` : "configured (shape judged in the merged view)";
 }
 
 // Does the command resolve in the environment (best local proxy for "where pi/agy runs")?
@@ -45,16 +102,16 @@ function commandOf(settings: { mcpServers?: Record<string, unknown> }): string |
 function resolvable(cmd: string): boolean {
 	if (cmd.includes("/")) {
 		try {
-			statSync(cmd);
-			// eslint-disable-next-line no-bitwise
-			return (statSync(cmd).mode & FS.S_IXUSR) !== 0;
+			accessSync(cmd, FS.X_OK);
+			return true;
 		} catch {
 			return false;
 		}
 	}
 	try {
-		// `command -v` is a POSIX sh builtin; use the default /bin/sh (NixOS has no /bin/bash).
-		execSync(`command -v ${cmd}`, { stdio: "ignore" });
+		// `command -v` is a POSIX sh builtin. Pass the configured name as argv, never shell text:
+		// an unowned override is still operator data and must not become a doctor injection surface.
+		execFileSync("sh", ["-c", 'command -v -- "$1" >/dev/null 2>&1', "sh", cmd], { stdio: "ignore" });
 		return true;
 	} catch {
 		return false;
@@ -64,24 +121,41 @@ function resolvable(cmd: string): boolean {
 log("[pi-provider doctor]");
 
 // Read via the SSOT — a malformed settings file THROWS here (fail-loud, named file).
-let userCmd: string | undefined;
-let projCmd: string | undefined;
+let effectiveEntry: BridgeEntry | null | undefined;
+let userScopeDesc = "";
+let projScopeDesc = "";
+let effectiveScope = "none";
 try {
-	userCmd = commandOf(readProviderSettingsFile(globalPath).settings);
-	projCmd = commandOf(readProviderSettingsFile(projectPath).settings);
+	const userSettings = readProviderSettingsFile(globalPath).settings;
+	const projSettings = readProviderSettingsFile(projectPath).settings;
+	userScopeDesc = describeScope(userSettings);
+	projScopeDesc = describeScope(projSettings);
+	// EFFECTIVE = project shadows user per-NAME. The whole ENTRY shadows, not a field of it, so
+	// command, args and env always come from one scope; the scope label is decided by which map
+	// owns the key, which is exactly what the merge spread resolves.
+	effectiveEntry = mergedBridgeEntry(userSettings, projSettings);
+	const ownsKey = (m: Record<string, unknown> | undefined): boolean => m !== undefined && Object.hasOwn(m, KEY);
+	effectiveScope = ownsKey(projSettings.mcpServers)
+		? "project"
+		: ownsKey(userSettings.mcpServers)
+			? "user(global)"
+			: "none";
 } catch (err) {
 	log(`  FAIL: ${err instanceof Error ? err.message : String(err)}`);
 	process.exit(1);
 }
 
-// EFFECTIVE = project shadows user per-name (the resolveProviderConfig merge rule).
-const effectiveCmd = projCmd ?? userCmd;
-const effectiveScope = projCmd !== undefined ? "project" : userCmd !== undefined ? "user(global)" : "none";
+const effectiveDesc =
+	effectiveEntry === undefined
+		? "entwurf-bridge NOT configured"
+		: effectiveEntry === null
+			? "configured as an http/sse server"
+			: `'${effectiveEntry.command}'`;
 
 log("── scopes (project shadows user per-name)");
-log(`  user(global) ${globalPath}: ${userCmd ? `'${userCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  project      ${projectPath}: ${projCmd ? `'${projCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  EFFECTIVE (${effectiveScope}): ${effectiveCmd ? `'${effectiveCmd}'` : "none"}`);
+log(`  user(global) ${globalPath}: ${userScopeDesc}`);
+log(`  project      ${projectPath}: ${projScopeDesc}`);
+log(`  EFFECTIVE (${effectiveScope}): ${effectiveDesc}`);
 
 // install-state ownership (user scope). absent state on a configured effective is either a
 // pre-Task-2 install or a user-override we deliberately did not own.
@@ -100,36 +174,66 @@ if (existsSync(statePath)) {
 }
 
 log("── verdict");
-if (effectiveCmd === undefined) {
+if (effectiveEntry === undefined) {
 	log(
 		"  note: no entwurfProvider.mcpServers.entwurf-bridge in any scope (never installed — this is the '?'; run ./run.sh setup).",
 	);
-} else if (effectiveCmd === BARE) {
-	if (resolvable(effectiveCmd)) {
-		log(`  ok: effective command is the bare stable bin '${BARE}' and it RESOLVES.`);
-	} else {
-		log(`  FAIL: effective command is '${BARE}' but it does NOT resolve (run ./run.sh expose-dev-bin / npm bin-link).`);
-		hardFail = 1;
-	}
+} else if (effectiveEntry === null) {
+	// A real, well-formed config that this bridge cannot be: entwurf-bridge is a stdio server, so
+	// an http/sse entry under our key means pi would connect to something that is not us. Nothing
+	// here is spawnable, so there is no boot to prove — say that plainly rather than reporting the
+	// absence of a failure as ok.
+	log(
+		`  FAIL: entwurf-bridge is configured as an http/sse server in ${effectiveScope} scope. This bridge is a stdio server — pi would reach something that is not entwurf, and no boot evidence is possible. Restore a stdio entry with ./run.sh setup, or remove the key if the override is deliberate.`,
+	);
+	hardFail = 1;
 } else {
-	// effective is NOT the bare bin. If state says we own it → drift (FAIL). Otherwise classify
-	// the effective command honestly: our OWN legacy repo start.sh (not yet adopted) is NOT a
-	// user override — say so distinctly so "run setup" is the clear next step. A truly foreign
-	// command is an unowned override left as the operator's choice. Neither is a hard fail.
-	const isLegacyManaged = effectiveCmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
-	if (ownership && ownership !== "user-override") {
-		log(
-			`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${effectiveCmd}'.`,
-		);
+	const cmd = effectiveEntry.command;
+	const isBare = cmd === BARE;
+	const isLegacyManaged = cmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
+
+	// Runtime truth is independent of ownership truth. An unowned override remains the operator's
+	// choice, but it still shadows the stable bridge in production; calling a dead override green
+	// repeats #81 under a different spelling. Probe the exact normalized command + args + env for
+	// EVERY effective stdio entry, then classify who owns that entry separately below.
+	if (!resolvable(cmd)) {
+		log(`  FAIL: effective command '${cmd}' does NOT resolve or is not executable.`);
 		hardFail = 1;
-	} else if (isLegacyManaged) {
-		log(
-			`  note: effective is our LEGACY managed repo path ('${effectiveCmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize (this is the pre-Task-2 '?').`,
-		);
 	} else {
-		log(
-			`  note: entwurf-bridge is an UNOWNED override ('${effectiveCmd}') — effective is not the stable bin. Left as the operator's choice (run ./run.sh setup to adopt the bare bin).`,
-		);
+		log(`  effective command '${cmd}' RESOLVES — probing the exact configured invocation…`);
+		const probe = await probeBridgeCommand({
+			command: cmd,
+			args: effectiveEntry.args,
+			env: { ...process.env, ...effectiveEntry.env },
+		});
+		if (probe.ok) {
+			log(
+				isBare
+					? `  ok: effective command is the bare stable bin '${BARE}' and it BOOTS — ${probe.detail}`
+					: `  runtime: configured override BOOTS — ${probe.detail}`,
+			);
+		} else {
+			log(`  FAIL: effective invocation does NOT serve MCP [${probe.reason}] — ${probe.detail}`);
+			log(`         Diagnose its launcher and configured args/env; entwurf will not overwrite an unowned command.`);
+			hardFail = 1;
+		}
+	}
+
+	if (!isBare) {
+		// Ownership classification never rounds a broken runtime up to green. It only says who may
+		// repair the non-canonical entry after the independent boot verdict above.
+		if (ownership && ownership !== "user-override") {
+			log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);
+			hardFail = 1;
+		} else if (isLegacyManaged) {
+			log(
+				`  note: effective is our LEGACY managed repo path ('${cmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize.`,
+			);
+		} else {
+			log(
+				`  note: entwurf-bridge is an UNOWNED override ('${cmd}'). Runtime was judged above; run ./run.sh setup only if you choose to adopt the bare stable bin.`,
+			);
+		}
 	}
 }
 

package/scripts/mutants/acp-prompt-lifecycle.json

@@ -54,8 +54,8 @@
 			"claim": "REUSE-CARRIES-CHILD-DIAGNOSTICS",
 			"title": "the reuse path drops the child's stderr tail again — exactly the live sonnet failure that showed only \"ACP connection closed\"",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail);"],
-			"replace": ["\t\t\tfinishError(err, aborted);"],
+			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle);"],
+			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle);"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:REUSE-CARRIES-CHILD-DIAGNOSTICS]",
@@ -89,12 +89,34 @@
 			"claim": "RETIRED-TEARDOWN-NOT-ANNOUNCED",
 			"title": "a teardown we performed ourselves is reported as a death — every ordinary turn-scoped turn cries wolf about its own cleanup",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t} else if (!session.retiring) {"],
+			"find": ["\t} else if (!session.retiring && !session.reporting) {"],
 			"replace": ["\t} else {"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:RETIRED-TEARDOWN-NOT-ANNOUNCED]",
 			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "EOF-FIRST-CARRIES-CHILD-END",
+			"title": "the failing turn seals the moment the transport closes, without waiting for the child's exit — re-plants the #72 field signature (a bare \"ACP connection closed\" naming neither exit code nor signal)",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tawait settleChildEnd(session.childEnd, CHILD_END_SETTLE_MS);"],
+			"replace": ["\tvoid CHILD_END_SETTLE_MS;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:EOF-FIRST-CARRIES-CHILD-END]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "CHILD-END-SILENCE-BOUNDED",
+			"title": "the post-mortem window grows past the bound it contracts for — a turn whose child never reports an end waits on a clock the caller did not choose",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tawait settleChildEnd(session.childEnd, CHILD_END_SETTLE_MS);"],
+			"replace": ["\tawait settleChildEnd(session.childEnd, 2_500);"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CHILD-END-SILENCE-BOUNDED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
 		}
 	]
 }