@junghanacs/entwurf 0.14.1 → 0.15.0

package/scripts/copilot-statusline-config.py

@@ -0,0 +1,201 @@
+#!/usr/bin/env python3
+"""Stateful Copilot statusLine settings adapter; stdlib only.
+
+Owns the whole ``statusLine`` subtree and the one prerequisite leaf
+``footer.showCustom``.  It adopts regular settings.json files, refuses symlinks,
+and records first-install preimages for an honest inverse.
+"""
+
+import datetime
+import json
+import os
+import sys
+import tempfile
+
+STATE_SCHEMA_VERSION = 1
+STATUSLINE_KEY = "statusLine"
+FOOTER_KEY = "footer"
+SHOW_CUSTOM_KEY = "showCustom"
+
+
+def die(code: int, message: str) -> "None":
+    sys.stderr.write(message.rstrip("\n") + "\n")
+    raise SystemExit(code)
+
+
+def load_object(path: str, label: str) -> dict:
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            raw = handle.read()
+    except OSError as error:
+        die(4, f"copilot-statusline: cannot read {label} {path}: {error}")
+    if not raw.strip():
+        return {}
+    try:
+        value = json.loads(raw)
+    except json.JSONDecodeError as error:
+        die(4, f"copilot-statusline: {label} {path} is not valid JSON: {error}")
+    if not isinstance(value, dict):
+        die(4, f"copilot-statusline: {label} {path} top-level must be a JSON object")
+    return value
+
+
+def atomic_write(path: str, value: dict) -> None:
+    directory = os.path.dirname(os.path.abspath(path))
+    os.makedirs(directory, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(dir=directory, prefix=".copilot-statusline-", suffix=".json")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(value, handle, indent=2)
+            handle.write("\n")
+        os.replace(temporary, path)
+    except BaseException:
+        try:
+            os.unlink(temporary)
+        except FileNotFoundError:
+            pass
+        raise
+
+
+def now() -> str:
+    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def checked_state(state_path: str) -> dict:
+    state = load_object(state_path, "install-state")
+    required = (
+        "managedSettingsPath",
+        "settingsExistedBefore",
+        "statusLineExisted",
+        "statusLinePreimage",
+        "footerExisted",
+        "showCustomExisted",
+        "showCustomPreimage",
+    )
+    if state.get("schemaVersion") != STATE_SCHEMA_VERSION or any(key not in state for key in required):
+        die(4, f"copilot-statusline: install-state {state_path} has an unsupported shape")
+    return state
+
+
+def prior_state(state_path: str, settings_path: str) -> dict | None:
+    if not os.path.exists(state_path):
+        return None
+    state = checked_state(state_path)
+    return state if state["managedSettingsPath"] == os.path.abspath(settings_path) else None
+
+
+def install(settings_path: str, command: str, state_path: str) -> None:
+    if os.path.islink(settings_path):
+        die(3, f"copilot-statusline: refusing to adopt {settings_path} — symlink to {os.readlink(settings_path)} (someone else's SSOT)")
+
+    existed = os.path.exists(settings_path)
+    settings = load_object(settings_path, "settings") if existed else {}
+    footer_existed = FOOTER_KEY in settings
+    footer = settings.get(FOOTER_KEY) if footer_existed else {}
+    if not isinstance(footer, dict):
+        die(4, f"copilot-statusline: {settings_path} footer must be a JSON object")
+
+    prior = prior_state(state_path, settings_path)
+    if prior is None:
+        state = {
+            "schemaVersion": STATE_SCHEMA_VERSION,
+            "managedSettingsPath": os.path.abspath(settings_path),
+            "command": command,
+            "detectMode": "adopt-regular-file" if existed else "created-new",
+            "settingsExistedBefore": existed,
+            "statusLineExisted": STATUSLINE_KEY in settings,
+            "statusLinePreimage": settings.get(STATUSLINE_KEY),
+            "footerExisted": footer_existed,
+            "showCustomExisted": SHOW_CUSTOM_KEY in footer,
+            "showCustomPreimage": footer.get(SHOW_CUSTOM_KEY),
+            "installedAt": now(),
+        }
+    else:
+        state = prior
+
+    settings[STATUSLINE_KEY] = {"command": command}
+    footer[SHOW_CUSTOM_KEY] = True
+    settings[FOOTER_KEY] = footer
+    atomic_write(settings_path, settings)
+    atomic_write(state_path, state)
+    sys.stdout.write(f"{state['detectMode']} {os.path.abspath(settings_path)}\n")
+
+
+def uninstall(state_path: str) -> None:
+    if not os.path.exists(state_path):
+        die(2, f"copilot-statusline: no install-state at {state_path} — nothing to undo")
+    state = checked_state(state_path)
+    settings_path = state.get("managedSettingsPath")
+    if not isinstance(settings_path, str) or not os.path.isabs(settings_path):
+        die(4, f"copilot-statusline: install-state {state_path} has no absolute managedSettingsPath")
+    if os.path.islink(settings_path):
+        die(3, f"copilot-statusline: refusing to uninstall — {settings_path} became a symlink (someone else's SSOT)")
+
+    if os.path.exists(settings_path):
+        settings = load_object(settings_path, "settings")
+        if state.get("statusLineExisted"):
+            settings[STATUSLINE_KEY] = state.get("statusLinePreimage")
+        else:
+            settings.pop(STATUSLINE_KEY, None)
+
+        footer = settings.get(FOOTER_KEY)
+        if not isinstance(footer, dict):
+            die(4, f"copilot-statusline: {settings_path} footer changed to a non-object; refusing to guess")
+        if state.get("showCustomExisted"):
+            footer[SHOW_CUSTOM_KEY] = state.get("showCustomPreimage")
+        else:
+            footer.pop(SHOW_CUSTOM_KEY, None)
+        if footer or state.get("footerExisted"):
+            settings[FOOTER_KEY] = footer
+        else:
+            settings.pop(FOOTER_KEY, None)
+
+        created = state.get("detectMode") == "created-new" and state.get("settingsExistedBefore") is False
+        if created and not settings:
+            os.remove(settings_path)
+        else:
+            atomic_write(settings_path, settings)
+
+    os.remove(state_path)
+    sys.stdout.write(f"uninstalled {settings_path}\n")
+
+
+def doctor_static(settings_path: str, command: str) -> None:
+    if os.path.islink(settings_path):
+        sys.stdout.write("symlink\n")
+        return
+    if not os.path.exists(settings_path):
+        sys.stdout.write("file-absent\n")
+        return
+    try:
+        settings = load_object(settings_path, "settings")
+    except SystemExit:
+        sys.stdout.write("invalid-json\n")
+        return
+    status_line = settings.get(STATUSLINE_KEY)
+    if not isinstance(status_line, dict) or status_line.get("command") != command:
+        sys.stdout.write("not-ours\n")
+        return
+    footer = settings.get(FOOTER_KEY)
+    if not isinstance(footer, dict) or footer.get(SHOW_CUSTOM_KEY) is not True:
+        sys.stdout.write("custom-disabled\n")
+        return
+    sys.stdout.write(f"configured {command}\n")
+
+
+def main(argv: list[str]) -> None:
+    if len(argv) < 2:
+        die(5, "usage: copilot-statusline-config.py <install|uninstall|doctor-static> ...")
+    match argv[1]:
+        case "install" if len(argv) == 5:
+            install(argv[2], argv[3], argv[4])
+        case "uninstall" if len(argv) == 3:
+            uninstall(argv[2])
+        case "doctor-static" if len(argv) == 4:
+            doctor_static(argv[2], argv[3])
+        case _:
+            die(5, "usage: copilot-statusline-config.py <install settings command state|uninstall state|doctor-static settings command>")
+
+
+if __name__ == "__main__":
+    main(sys.argv)

package/scripts/copilot-statusline.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# copilot-statusline — Copilot custom footer: garden id only.
+#
+# Copilot already draws directory/branch/model/context/quota. This fills the
+# custom slot with the garden id. Vocabulary matches Claude and agy
+# (ready / ? / !); rail `cop`. Fail-quiet: nonzero blanks the slot (bundle Fxi).
+# Bare bin: entwurf-copilot-statusline. No cache, no git, no ANSI.
+# Reads session_id only — any other envelope key is Copilot's, not ours.
+set -euo pipefail
+
+# Copilot silently blanks a nonzero statusline, so a read failure degrades to ready.
+input=$(cat || true)
+if ! command -v python3 >/dev/null 2>&1; then
+  printf '🪛 ? cop'
+  exit 0
+fi
+output="$(STATUSLINE_INPUT="$input" python3 - <<'PY'
+import json, os, sys
+from pathlib import Path
+
+def load_input():
+    raw = os.environ.get("STATUSLINE_INPUT", "")
+    try:
+        data = json.loads(raw) if raw.strip() else {}
+    except Exception:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+def meta_sessions_dir():
+    override = os.environ.get("ENTWURF_META_SESSIONS_DIR")
+    if override:
+        return Path(override).expanduser().resolve()
+    agent = os.environ.get("PI_CODING_AGENT_DIR")
+    if agent:
+        return Path(agent).expanduser().resolve() / "meta-sessions"
+    return Path.home() / ".pi" / "agent" / "meta-sessions"
+
+def garden_lookup(native_session_id):
+    if not native_session_id:
+        return "ready"
+    root = meta_sessions_dir()
+    if not root.exists():
+        return "?"
+    matches = []
+    try:
+        entries = sorted(root.glob("*.meta.json"))
+    except Exception:
+        return "?"
+    for file in entries:
+        try:
+            record = json.loads(file.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+        if isinstance(record, dict) and record.get("nativeSessionId") == native_session_id:
+            garden = record.get("gardenId")
+            matches.append(garden if isinstance(garden, str) and garden else "!")
+    if len(matches) == 1:
+        return matches[0]
+    if len(matches) > 1:
+        return "!"
+    return "?"
+
+data = load_input()
+sid = data.get("session_id")
+sys.stdout.write(f"🪛 {garden_lookup(sid if isinstance(sid, str) else '')} cop")
+PY
+)" || output='🪛 ? cop'
+printf '%s' "$output"

package/scripts/dev-bin.sh

@@ -12,6 +12,7 @@
 #   entwurf-bridge          -> mcp/entwurf-bridge/start.sh    (agy mcp_config command)
 #   entwurf-agy-statusline  -> scripts/agy-statusline.sh      (agy settings.statusLine command)
 #   entwurf-agy-imprint     -> scripts/agy-imprint.sh         (agy PreInvocation birth hook)
+#   entwurf-copilot-statusline -> scripts/copilot-statusline.sh (copilot settings.statusLine command)
 #
 # Ownership discipline (mirrors the agy adopt/refuse rule, 봉인 7), applied PER BIN:
 #   - create/refresh ONLY a link that is OURS — absent, or a symlink into our target, or the
@@ -35,6 +36,7 @@
 #   ENTWURF_BRIDGE_TARGET         entwurf-bridge target (default: $REPO/mcp/entwurf-bridge/start.sh)
 #   ENTWURF_AGY_STATUSLINE_TARGET entwurf-agy-statusline target (default: $REPO/scripts/agy-statusline.sh)
 #   ENTWURF_AGY_IMPRINT_TARGET    entwurf-agy-imprint target (default: $REPO/scripts/agy-imprint.sh)
+#   ENTWURF_COPILOT_STATUSLINE_TARGET entwurf-copilot-statusline target (default: $REPO/scripts/copilot-statusline.sh)
 #   XDG_DATA_HOME                 state root (states under $XDG_DATA_HOME/entwurf/dev-bin/)
 set -euo pipefail
 
@@ -45,7 +47,7 @@ BIN_DIR="${ENTWURF_DEV_BIN_DIR:-$HOME/.local/bin}"
 STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/dev-bin"
 LEGACY_STATE="$STATE_DIR/install-state.json"   # pre-multi-bin single state == entwurf-bridge
 
-MANAGED_BINS="entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint"
+MANAGED_BINS="entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline"
 
 log()  { printf '%s\n' "$*"; }
 warn() { printf '%s\n' "$*" >&2; }
@@ -56,6 +58,7 @@ bin_target() {  # $1 = name → prints target path (env-overridable for smoke)
     entwurf-bridge)         echo "${ENTWURF_BRIDGE_TARGET:-$REPO_DIR/mcp/entwurf-bridge/start.sh}" ;;
     entwurf-agy-statusline) echo "${ENTWURF_AGY_STATUSLINE_TARGET:-$REPO_DIR/scripts/agy-statusline.sh}" ;;
     entwurf-agy-imprint)    echo "${ENTWURF_AGY_IMPRINT_TARGET:-$REPO_DIR/scripts/agy-imprint.sh}" ;;
+    entwurf-copilot-statusline) echo "${ENTWURF_COPILOT_STATUSLINE_TARGET:-$REPO_DIR/scripts/copilot-statusline.sh}" ;;
     *) return 1 ;;
   esac
 }

package/scripts/doctor-pi-provider.ts

@@ -1,10 +1,23 @@
 #!/usr/bin/env node
 // doctor-pi-provider — fail-loud doctor for the pi provider (entwurfProvider.mcpServers.
-// entwurf-bridge) ownership (#46 Task 2). Side-effect FREE (read-only). Uses the config.ts SSOT
+// entwurf-bridge) ownership (#46 Task 2). A BOUNDED BOOT PROBE, not a static inspector: it writes
+// no operator state, but it does exec the configured command on this host (#81). Uses the config.ts SSOT
 // `readProviderSettingsFile` so the effective (shadow-resolved) view matches what pi actually
 // loads — NOT a re-implemented merge (GPT D: a python re-impl drifts into "doctor green, runtime
 // red"). Reports user / project / EFFECTIVE command (project shadows user per-name, the
-// resolveProviderConfig rule), plus install-state ownership, and gates on stable-bin resolvability.
+// resolveProviderConfig rule), plus install-state ownership, and gates on the stable bin actually
+// BOOTING (#81) — not merely resolving. `command -v` answering yes is not evidence that pi gets a
+// bridge: on the reference host the bare name resolved through a relocated pnpm shim whose $0-derived
+// target did not exist, so the launcher exited 127, the ACP turn had no mcp__entwurf-bridge__* tool,
+// and THIS doctor still printed ok. Resolvability is kept as the first, cheaper cell so the two
+// failures stay distinguishable (nothing on PATH vs. on PATH but dead).
+//
+// The probe sends `initialize` + `tools/list` only — never a `tools/call` — so it takes no lock,
+// writes no record and delivers nothing. That bounds OUR bridge tightly (start.sh is an `exec node`,
+// so there is no grandchild). It does not make the doctor side-effect free in general: whatever the
+// operator configured is what gets executed, and a foreign launcher's own startup is its own
+// business. Running this doctor is therefore a decision to run that command. See
+// probe-bridge-command.ts, which owns the bounded reap of the child it spawns.
 //
 // Env overrides (for the hermetic smoke):
 //   PI_PROVIDER_GLOBAL_SETTINGS   default: $PI_CODING_AGENT_DIR/settings.json or ~/.pi/agent/settings.json
@@ -12,12 +25,13 @@
 //   PI_PROVIDER_STATE             default: $XDG_DATA_HOME/entwurf/pi-provider/install-state.json
 //
 // Exit: 0 ok (incl. honest "never installed / unowned" notes) · 1 hard fail (malformed settings /
-// state-owned-but-drifted / stable bin dangling).
-import { execSync } from "node:child_process";
-import { existsSync, constants as FS, readFileSync, statSync } from "node:fs";
+// state-owned-but-drifted / stable bin dangling / stable bin present but does NOT boot).
+import { execFileSync } from "node:child_process";
+import { accessSync, existsSync, constants as FS, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readProviderSettingsFile } from "../pi-extensions/lib/acp/config.ts";
+import { normalizeMcpServers, readProviderSettingsFile } from "../pi-extensions/lib/acp/config.ts";
+import { probeBridgeCommand } from "./probe-bridge-command.ts";
 
 const BARE = "entwurf-bridge";
 const KEY = "entwurf-bridge";
@@ -32,12 +46,55 @@ const statePath = process.env.PI_PROVIDER_STATE || join(xdg, "entwurf", "pi-prov
 let hardFail = 0;
 const log = (s: string) => process.stdout.write(s + "\n");
 
-function commandOf(settings: { mcpServers?: Record<string, unknown> }): string | undefined {
-	const entry = settings.mcpServers?.[KEY];
-	if (entry && typeof entry === "object" && typeof (entry as { command?: unknown }).command === "string") {
-		return (entry as { command: string }).command;
-	}
-	return undefined;
+/** The configured stdio invocation for our key, as PRODUCTION would build it. */
+interface BridgeEntry {
+	command: string;
+	args: string[];
+	env: Record<string, string>;
+}
+
+// Build the effective entry EXACTLY the way production does (config.ts `resolveProviderConfig`):
+// a shallow PER-NAME merge of the two `mcpServers` maps, then ONE `normalizeMcpServers` over the
+// merged map. Hand-parsing command/args (this doctor's first shape) dropped a malformed arg
+// silently and probed an invocation production never runs.
+//
+// The ORDER is load-bearing too. Normalizing each file separately validates entries production
+// never sees: a malformed server in the global map that the project map shadows is gone by the time
+// pi normalizes, yet a per-file doctor throws on it and calls a session red that in fact starts
+// fine. That is the same "the doctor's subject differs from the runtime's" defect as the silent
+// arg-drop, pointed the other way — and it is not confined to our key, since any unrelated global
+// server could trip it.
+//
+// THROWS (McpServerConfigError) when the MERGED map is malformed — the fail-loud path, caught by
+// the caller. That error names the offending SERVER and reason, not a file: after the merge an
+// entry no longer belongs to one scope, so claiming a filename here would be a guess. A non-stdio
+// (http/sse) entry is returned as `null` so the caller can say WHY it cannot be probed instead of
+// pretending it is absent.
+function mergedBridgeEntry(
+	globalSettings: { mcpServers?: Record<string, unknown> },
+	projectSettings: { mcpServers?: Record<string, unknown> },
+): BridgeEntry | null | undefined {
+	const mergedRaw = { ...(globalSettings.mcpServers ?? {}), ...(projectSettings.mcpServers ?? {}) };
+	const { servers } = normalizeMcpServers(mergedRaw);
+	const entry = servers.find((srv) => srv.name === KEY);
+	if (entry === undefined) return undefined; // not configured in either scope
+	if ("url" in entry) return null; // http/sse — a real config, but nothing to spawn
+	return {
+		command: entry.command,
+		args: entry.args,
+		// The ACP wire shape is a name/value list; collapse it to the env map a spawn wants.
+		env: Object.fromEntries(entry.env.map((kv) => [kv.name, kv.value])),
+	};
+}
+
+// Per-scope DISPLAY only — never validation. The scope lines exist so an operator can see which
+// file supplied the effective entry; judging shape here would re-introduce the per-file validation
+// the merge rule above exists to avoid.
+function describeScope(settings: { mcpServers?: Record<string, unknown> }): string {
+	const raw = settings.mcpServers?.[KEY];
+	if (raw === undefined) return "entwurf-bridge NOT configured";
+	const cmd = (raw as { command?: unknown } | null)?.command;
+	return typeof cmd === "string" ? `'${cmd}'` : "configured (shape judged in the merged view)";
 }
 
 // Does the command resolve in the environment (best local proxy for "where pi/agy runs")?
@@ -45,16 +102,16 @@ function commandOf(settings: { mcpServers?: Record<string, unknown> }): string |
 function resolvable(cmd: string): boolean {
 	if (cmd.includes("/")) {
 		try {
-			statSync(cmd);
-			// eslint-disable-next-line no-bitwise
-			return (statSync(cmd).mode & FS.S_IXUSR) !== 0;
+			accessSync(cmd, FS.X_OK);
+			return true;
 		} catch {
 			return false;
 		}
 	}
 	try {
-		// `command -v` is a POSIX sh builtin; use the default /bin/sh (NixOS has no /bin/bash).
-		execSync(`command -v ${cmd}`, { stdio: "ignore" });
+		// `command -v` is a POSIX sh builtin. Pass the configured name as argv, never shell text:
+		// an unowned override is still operator data and must not become a doctor injection surface.
+		execFileSync("sh", ["-c", 'command -v -- "$1" >/dev/null 2>&1', "sh", cmd], { stdio: "ignore" });
 		return true;
 	} catch {
 		return false;
@@ -64,24 +121,41 @@ function resolvable(cmd: string): boolean {
 log("[pi-provider doctor]");
 
 // Read via the SSOT — a malformed settings file THROWS here (fail-loud, named file).
-let userCmd: string | undefined;
-let projCmd: string | undefined;
+let effectiveEntry: BridgeEntry | null | undefined;
+let userScopeDesc = "";
+let projScopeDesc = "";
+let effectiveScope = "none";
 try {
-	userCmd = commandOf(readProviderSettingsFile(globalPath).settings);
-	projCmd = commandOf(readProviderSettingsFile(projectPath).settings);
+	const userSettings = readProviderSettingsFile(globalPath).settings;
+	const projSettings = readProviderSettingsFile(projectPath).settings;
+	userScopeDesc = describeScope(userSettings);
+	projScopeDesc = describeScope(projSettings);
+	// EFFECTIVE = project shadows user per-NAME. The whole ENTRY shadows, not a field of it, so
+	// command, args and env always come from one scope; the scope label is decided by which map
+	// owns the key, which is exactly what the merge spread resolves.
+	effectiveEntry = mergedBridgeEntry(userSettings, projSettings);
+	const ownsKey = (m: Record<string, unknown> | undefined): boolean => m !== undefined && Object.hasOwn(m, KEY);
+	effectiveScope = ownsKey(projSettings.mcpServers)
+		? "project"
+		: ownsKey(userSettings.mcpServers)
+			? "user(global)"
+			: "none";
 } catch (err) {
 	log(`  FAIL: ${err instanceof Error ? err.message : String(err)}`);
 	process.exit(1);
 }
 
-// EFFECTIVE = project shadows user per-name (the resolveProviderConfig merge rule).
-const effectiveCmd = projCmd ?? userCmd;
-const effectiveScope = projCmd !== undefined ? "project" : userCmd !== undefined ? "user(global)" : "none";
+const effectiveDesc =
+	effectiveEntry === undefined
+		? "entwurf-bridge NOT configured"
+		: effectiveEntry === null
+			? "configured as an http/sse server"
+			: `'${effectiveEntry.command}'`;
 
 log("── scopes (project shadows user per-name)");
-log(`  user(global) ${globalPath}: ${userCmd ? `'${userCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  project      ${projectPath}: ${projCmd ? `'${projCmd}'` : "entwurf-bridge NOT configured"}`);
-log(`  EFFECTIVE (${effectiveScope}): ${effectiveCmd ? `'${effectiveCmd}'` : "none"}`);
+log(`  user(global) ${globalPath}: ${userScopeDesc}`);
+log(`  project      ${projectPath}: ${projScopeDesc}`);
+log(`  EFFECTIVE (${effectiveScope}): ${effectiveDesc}`);
 
 // install-state ownership (user scope). absent state on a configured effective is either a
 // pre-Task-2 install or a user-override we deliberately did not own.
@@ -100,36 +174,66 @@ if (existsSync(statePath)) {
 }
 
 log("── verdict");
-if (effectiveCmd === undefined) {
+if (effectiveEntry === undefined) {
 	log(
 		"  note: no entwurfProvider.mcpServers.entwurf-bridge in any scope (never installed — this is the '?'; run ./run.sh setup).",
 	);
-} else if (effectiveCmd === BARE) {
-	if (resolvable(effectiveCmd)) {
-		log(`  ok: effective command is the bare stable bin '${BARE}' and it RESOLVES.`);
-	} else {
-		log(`  FAIL: effective command is '${BARE}' but it does NOT resolve (run ./run.sh expose-dev-bin / npm bin-link).`);
-		hardFail = 1;
-	}
+} else if (effectiveEntry === null) {
+	// A real, well-formed config that this bridge cannot be: entwurf-bridge is a stdio server, so
+	// an http/sse entry under our key means pi would connect to something that is not us. Nothing
+	// here is spawnable, so there is no boot to prove — say that plainly rather than reporting the
+	// absence of a failure as ok.
+	log(
+		`  FAIL: entwurf-bridge is configured as an http/sse server in ${effectiveScope} scope. This bridge is a stdio server — pi would reach something that is not entwurf, and no boot evidence is possible. Restore a stdio entry with ./run.sh setup, or remove the key if the override is deliberate.`,
+	);
+	hardFail = 1;
 } else {
-	// effective is NOT the bare bin. If state says we own it → drift (FAIL). Otherwise classify
-	// the effective command honestly: our OWN legacy repo start.sh (not yet adopted) is NOT a
-	// user override — say so distinctly so "run setup" is the clear next step. A truly foreign
-	// command is an unowned override left as the operator's choice. Neither is a hard fail.
-	const isLegacyManaged = effectiveCmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
-	if (ownership && ownership !== "user-override") {
-		log(
-			`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${effectiveCmd}'.`,
-		);
+	const cmd = effectiveEntry.command;
+	const isBare = cmd === BARE;
+	const isLegacyManaged = cmd.endsWith("/entwurf/mcp/entwurf-bridge/start.sh");
+
+	// Runtime truth is independent of ownership truth. An unowned override remains the operator's
+	// choice, but it still shadows the stable bridge in production; calling a dead override green
+	// repeats #81 under a different spelling. Probe the exact normalized command + args + env for
+	// EVERY effective stdio entry, then classify who owns that entry separately below.
+	if (!resolvable(cmd)) {
+		log(`  FAIL: effective command '${cmd}' does NOT resolve or is not executable.`);
 		hardFail = 1;
-	} else if (isLegacyManaged) {
-		log(
-			`  note: effective is our LEGACY managed repo path ('${effectiveCmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize (this is the pre-Task-2 '?').`,
-		);
 	} else {
-		log(
-			`  note: entwurf-bridge is an UNOWNED override ('${effectiveCmd}') — effective is not the stable bin. Left as the operator's choice (run ./run.sh setup to adopt the bare bin).`,
-		);
+		log(`  effective command '${cmd}' RESOLVES — probing the exact configured invocation…`);
+		const probe = await probeBridgeCommand({
+			command: cmd,
+			args: effectiveEntry.args,
+			env: { ...process.env, ...effectiveEntry.env },
+		});
+		if (probe.ok) {
+			log(
+				isBare
+					? `  ok: effective command is the bare stable bin '${BARE}' and it BOOTS — ${probe.detail}`
+					: `  runtime: configured override BOOTS — ${probe.detail}`,
+			);
+		} else {
+			log(`  FAIL: effective invocation does NOT serve MCP [${probe.reason}] — ${probe.detail}`);
+			log(`         Diagnose its launcher and configured args/env; entwurf will not overwrite an unowned command.`);
+			hardFail = 1;
+		}
+	}
+
+	if (!isBare) {
+		// Ownership classification never rounds a broken runtime up to green. It only says who may
+		// repair the non-canonical entry after the independent boot verdict above.
+		if (ownership && ownership !== "user-override") {
+			log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);
+			hardFail = 1;
+		} else if (isLegacyManaged) {
+			log(
+				`  note: effective is our LEGACY managed repo path ('${cmd}'), not yet adopted to the bare stable bin. Run ./run.sh setup to normalize.`,
+			);
+		} else {
+			log(
+				`  note: entwurf-bridge is an UNOWNED override ('${cmd}'). Runtime was judged above; run ./run.sh setup only if you choose to adopt the bare stable bin.`,
+			);
+		}
 	}
 }
 

package/scripts/meta-bridge-hook-log.sh

@@ -4,20 +4,32 @@
 # proves the Claude SessionStart/CwdChanged hook re-armed the mailbox watch. A
 # later `INFO attach record (event=UserPromptSubmit, ...)` is merely degraded
 # backfill and must NOT clear an arm/upsert failure.
-
+#
+# THIS JUDGEMENT IS CLAUDE'S ONLY, and since #82 it has to say so. The Copilot birth
+# unit appends to the SAME log file (one grep for the operator), tagging its lines
+# `LEVEL [copilot]`. Those lines must be invisible here, for a reason stronger than
+# tidiness: a copilot ERROR is often a CORRECT fail-closed refusal (a degraded envelope
+# the unit refused to mint from), and its recovery token can never appear — `armed
+# watch` is the Claude hook rail's token. Copilot's measured extension transport has a
+# different, not-yet-admitted lifecycle and writes no token this doctor owns. Counting them
+# would make the CLAUDE doctor permanently red for a refusal on a different rail, with
+# a prescription pointing at a Claude wake failure that never happened (cross-review,
+# glm, 2026-08-21). Copilot's own recovery rule lives in copilot-bridge-doctor.sh.
 meta_bridge_hook_log_status() {
   local log="$1"
-  if ! grep -q ' ERROR ' "$log" 2>/dev/null; then
+  local own
+  own="$(grep -v ' \[copilot\] ' "$log" 2>/dev/null || true)"
+  if ! printf '%s\n' "$own" | grep -q ' ERROR '; then
     echo "no-error"
     return 0
   fi
 
   local last_err last_recovery
-  last_err="$(grep -n ' ERROR ' "$log" | tail -1 | cut -d: -f1)"
-  last_recovery="$(grep -n ' INFO armed watch ' "$log" | tail -1 | cut -d: -f1)"
+  last_err="$(printf '%s\n' "$own" | grep -n ' ERROR ' | tail -1 | cut -d: -f1)"
+  last_recovery="$(printf '%s\n' "$own" | grep -n ' INFO armed watch ' | tail -1 | cut -d: -f1)"
 
   if [ -z "$last_recovery" ] || [ "$last_err" -gt "$last_recovery" ]; then
-    grep ' ERROR ' "$log" | tail -1
+    printf '%s\n' "$own" | grep ' ERROR ' | tail -1
     return 1
   fi
 

package/scripts/mutants/acp-prompt-lifecycle.json

@@ -54,8 +54,8 @@
 			"claim": "REUSE-CARRIES-CHILD-DIAGNOSTICS",
 			"title": "the reuse path drops the child's stderr tail again — exactly the live sonnet failure that showed only \"ACP connection closed\"",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail);"],
-			"replace": ["\t\t\tfinishError(err, aborted);"],
+			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle);"],
+			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle);"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:REUSE-CARRIES-CHILD-DIAGNOSTICS]",
@@ -89,12 +89,34 @@
 			"claim": "RETIRED-TEARDOWN-NOT-ANNOUNCED",
 			"title": "a teardown we performed ourselves is reported as a death — every ordinary turn-scoped turn cries wolf about its own cleanup",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t} else if (!session.retiring) {"],
+			"find": ["\t} else if (!session.retiring && !session.reporting) {"],
 			"replace": ["\t} else {"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:RETIRED-TEARDOWN-NOT-ANNOUNCED]",
 			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "EOF-FIRST-CARRIES-CHILD-END",
+			"title": "the failing turn seals the moment the transport closes, without waiting for the child's exit — re-plants the #72 field signature (a bare \"ACP connection closed\" naming neither exit code nor signal)",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tawait settleChildEnd(session.childEnd, CHILD_END_SETTLE_MS);"],
+			"replace": ["\tvoid CHILD_END_SETTLE_MS;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:EOF-FIRST-CARRIES-CHILD-END]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "CHILD-END-SILENCE-BOUNDED",
+			"title": "the post-mortem window grows past the bound it contracts for — a turn whose child never reports an end waits on a clock the caller did not choose",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tawait settleChildEnd(session.childEnd, CHILD_END_SETTLE_MS);"],
+			"replace": ["\tawait settleChildEnd(session.childEnd, 2_500);"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CHILD-END-SILENCE-BOUNDED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
 		}
 	]
 }