@junghanacs/entwurf 0.14.2 → 0.15.1

package/scripts/check-copilot-statusline.ts

@@ -0,0 +1,122 @@
+/**
+ * check-copilot-statusline — #82 Copilot footer renderer, without Copilot.
+ *
+ * Subject: scripts/copilot-statusline.sh. Cells: record → exact gid; duplicate
+ * nativeSessionId → `!`; no record → `?`; no session_id / empty / malformed
+ * → `ready`; every path exit 0.
+ * Copilot blanks the slot on nonzero (bundle Fxi). Isolated HOME+store.
+ */
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const SCRIPT = path.join(REPO, "scripts", "copilot-statusline.sh");
+const GID_RE = /\d{8}T\d{6}-[0-9a-f]{6}/;
+const GID = "20260821T075400-c0ffee";
+const SID = "4269fad4-d5f5-4281-969f-bbeb211f0d7c";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const root = mkdtempSync(path.join(tmpdir(), "entwurf-copilot-statusline."));
+const home = path.join(root, "home");
+const store = path.join(root, "meta-sessions");
+mkdirSync(home);
+mkdirSync(store);
+
+function run(stdin: string, extraEnv: NodeJS.ProcessEnv = {}): { status: number; stdout: string } {
+	const result = spawnSync("bash", [SCRIPT], {
+		cwd: root,
+		env: {
+			...process.env,
+			...extraEnv,
+			HOME: home,
+			ENTWURF_META_SESSIONS_DIR: store,
+			PI_CODING_AGENT_DIR: "",
+		},
+		encoding: "utf8",
+		input: stdin,
+		timeout: 10_000,
+	});
+	return { status: result.status ?? 1, stdout: result.stdout ?? "" };
+}
+
+function env(sessionId: unknown): string {
+	return JSON.stringify({ session_id: sessionId });
+}
+
+const noRecord = run(env(SID));
+ok("no-record exits 0", noRecord.status === 0);
+ok("no-record is ?", noRecord.stdout === "🪛 ? cop");
+ok("no-record plants no gid", !GID_RE.test(noRecord.stdout));
+
+writeFileSync(
+	path.join(store, `${GID}.meta.json`),
+	`${JSON.stringify({
+		schemaVersion: 3,
+		gardenId: GID,
+		backend: "copilot",
+		nativeSessionId: SID,
+	})}\n`,
+);
+const withRecord = run(env(SID));
+ok("record-present exits 0", withRecord.status === 0);
+ok("record-present is the exact gid", withRecord.stdout === `🪛 ${GID} cop`);
+
+const duplicateGid = "20260821T075401-deadbe";
+writeFileSync(
+	path.join(store, `${duplicateGid}.meta.json`),
+	`${JSON.stringify({
+		schemaVersion: 3,
+		gardenId: duplicateGid,
+		backend: "copilot",
+		nativeSessionId: SID,
+	})}\n`,
+);
+const duplicate = run(env(SID));
+ok("duplicate nativeSessionId exits 0", duplicate.status === 0);
+ok("duplicate nativeSessionId is !", duplicate.stdout === "🪛 ! cop");
+
+const empty = run("");
+ok("empty stdin exits 0", empty.status === 0);
+ok("empty stdin is ready", empty.stdout === "🪛 ready cop");
+ok("empty stdin plants no gid", !GID_RE.test(empty.stdout));
+
+const malformed = run("{this is not json");
+ok("malformed stdin exits 0", malformed.status === 0);
+ok("malformed stdin is ready", malformed.stdout === "🪛 ready cop");
+ok("malformed stdin plants no gid", !GID_RE.test(malformed.stdout));
+
+const missing = run("{}");
+ok("missing session_id exits 0", missing.status === 0);
+ok("missing session_id is ready", missing.stdout === "🪛 ready cop");
+
+const nullId = run(env(null));
+ok("null session_id exits 0", nullId.status === 0);
+ok("null session_id is ready — no leftover lookup", nullId.stdout === "🪛 ready cop");
+ok("null session_id plants no gid", !GID_RE.test(nullId.stdout));
+
+const catBin = path.join(root, "cat-bin");
+mkdirSync(catBin);
+writeFileSync(path.join(catBin, "cat"), "#!/bin/sh\nexit 73\n", { mode: 0o755 });
+const catFailure = run(env(SID), { PATH: `${catBin}${path.delimiter}${process.env.PATH ?? ""}` });
+ok("stdin read failure exits 0", catFailure.status === 0);
+ok("stdin read failure is ready, not blank", catFailure.stdout === "🪛 ready cop");
+
+const pythonBin = path.join(root, "python-bin");
+mkdirSync(pythonBin);
+writeFileSync(path.join(pythonBin, "python3"), "#!/bin/sh\nprintf partial\nexit 12\n", { mode: 0o755 });
+const pythonFailure = run(env(SID), { PATH: `${pythonBin}${path.delimiter}${process.env.PATH ?? ""}` });
+ok("partial interpreter failure exits 0", pythonFailure.status === 0);
+ok("partial interpreter failure is ?, not partial", pythonFailure.stdout === "🪛 ? cop");
+
+console.log(`\ncheck-copilot-statusline: ${passed} assertions ok`);

package/scripts/check-entwurf-capabilities.ts

@@ -21,7 +21,9 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import {
 	META_BACKEND_DESCRIPTORS,
+	META_BACKENDS,
 	META_CITIZEN_BACKENDS,
+	type MetaBackend,
 	MetaRecordError,
 	metaCapabilitiesFilePath,
 	parseMetaCapabilityRegistry,
@@ -50,12 +52,29 @@ ok(
 );
 ok("shipped registry includes the pi backend", reg.backends.pi !== undefined);
 
-// 2. drift guard — the JSON must agree field-for-field with the const for the
-//    three backends it still describes. 3D-3 already cut the live consumer over
-//    to the registry, so this is no longer a pre-cut-over guard: the const now
-//    exists ONLY as this reference, and the assertion is what keeps the live
-//    source from silently diverging from the shape it was cut over from.
-for (const backend of ["claude-code", "antigravity", "codex"] as const) {
+// 2. drift guard — the JSON must agree field-for-field with the const for every
+//    backend the const describes. 3D-3 already cut the live consumer over to the
+//    registry, so this is no longer a pre-cut-over guard: the const now exists
+//    ONLY as this reference, and the assertion is what keeps the live source from
+//    silently diverging from the shape it was cut over from.
+//
+//    IT MUST ITERATE `META_BACKENDS`, NEVER A LITERAL (#82, 2026-08-20). This loop
+//    used to spell out `["claude-code", "antigravity", "codex"]`, so a backend added
+//    to the const AND to the shipped JSON was compared against nothing: the coverage
+//    cell above passed (the keysets still matched) and the drift cell never looked at
+//    it. A green gate that does not read the row it is supposed to guard is worse than
+//    an absent one. Driving it from the const is what makes the next backend
+//    automatically in scope.
+const driftScope: readonly MetaBackend[] = META_BACKENDS;
+ok(
+	"[QK:CAPABILITY-DRIFT-SCOPE-FROM-CONST] drift scope = every shipped backend except pi (pi has no live const to compare)",
+	[...driftScope].sort().join(",") ===
+		Object.keys(reg.backends)
+			.filter((b) => b !== "pi")
+			.sort()
+			.join(","),
+);
+for (const backend of driftScope) {
 	const live = META_BACKEND_DESCRIPTORS[backend];
 	const cap = reg.backends[backend];
 	ok(

package/scripts/check-fresh-cut-gate.sh

@@ -47,6 +47,16 @@ case "$REPO" in
     ;;
 esac
 
+# This gate reaches run.sh paths that import `scripts/pi_settings_io.py`, and CPython
+# writes `scripts/__pycache__/*.pyc` next to the source it imports. In a normal clone
+# that file already exists and nothing looks different; inside the gate-qualification
+# SNAPSHOT — which copies TRACKED files only — it is a brand new file, and the harness
+# hashes the whole tree, so the run ends IMPURE with every mutant killed. Measured
+# 2026-08-20: a tracked-only copy gained exactly `scripts/__pycache__/pi_settings_io.
+# cpython-313.pyc` after this gate ran. `smoke-pi-provider-state.sh` and
+# `smoke-meta-install-state.sh` already carry this line for the same reason.
+export PYTHONDONTWRITEBYTECODE=1
+
 SANDBOX="$(mktemp -d -t entwurf-fresh-cut-gate.XXXXXX)"
 trap 'rm -rf "$SANDBOX"' EXIT
 export HOME="$SANDBOX/home"
@@ -384,11 +394,19 @@ esac
 # Static order: the gate precedes the first writer in each entrypoint, and the
 # preflight never runs the cut on the operator's behalf.
 gate_ln=$(grep -n 'preflight_v3_store setup' "$REPO/run.sh" | head -1 | cut -d: -f1) || true
-auth_ln=$(awk '/^setup_all\(\)/,/^}/{ if ($0 ~ /^  sync_auth$/) { print NR; exit } }' "$REPO/run.sh")
-if [ -n "$gate_ln" ] && [ -n "$auth_ln" ] && [ "$gate_ln" -lt "$auth_ln" ]; then
-  ok "D4 setup_all calls the gate before sync_auth (line $gate_ln < $auth_ln)"
+boot_ln=$(awk '/^setup_all\(\)/,/^}/{ if ($0 ~ /pnpm install --frozen-lockfile/) { print NR; exit } }' "$REPO/run.sh")
+if [ -n "$gate_ln" ] && [ -n "$boot_ln" ] && [ "$gate_ln" -lt "$boot_ln" ]; then
+  ok "D4 setup_all calls the gate before the source bootstrap (line $gate_ln < $boot_ln)"
+else
+  bad "D4 setup_all's gate is missing or sits after the source bootstrap (gate=$gate_ln bootstrap=$boot_ln)"
+fi
+# #86 A5 credential tripwire: the retired sync_auth mutation (OAuth alias copy +
+# auth.json.bak) must never resurrect as an invocable surface in run.sh. Comments
+# documenting the removal are allowed; a function definition or call is not.
+if awk '!/^[[:space:]]*#/' "$REPO/run.sh" | grep -q 'sync_auth'; then
+  bad "D4b the retired sync_auth credential mutation reappeared as code in run.sh"
 else
-  bad "D4 setup_all's gate is missing or sits after sync_auth (gate=$gate_ln sync_auth=$auth_ln)"
+  ok "D4b no sync_auth credential surface remains in run.sh (comments only)"
 fi
 
 ilp_gate=$(awk '/^install_local_package\(\)/,/^}/{ if ($0 ~ /preflight_v3_store install/) { print NR; exit } }' "$REPO/run.sh")
@@ -973,34 +991,93 @@ fi
 
 # ── G. an archive collision is a NO-OP, never a half-cut ─────────────────────
 echo "[check-fresh-cut-gate] G. archive-destination preflight"
-reset_world prevgen
-mkdir -p "$ENTWURF_META_MAILBOX_DIR/20260305T000000-dddd05"
-printf 'hello\n' > "$ENTWURF_META_MAILBOX_DIR/20260305T000000-dddd05/0001.msg"
-store_before="$(store_bytes)"
-# Occupy the MAILBOX destination — the second move in the plan — for this second
-# and the next two, so whichever stamp the cut computes, its first move looks free
-# and its second collides. That ordering is the whole point: checking each
-# destination just before its own rename archived the store, then refused.
-for off in 0 1 2; do
-  mkdir -p "$SANDBOX/mailbox.archive-$(date -d "+$off seconds" +%Y%m%dT%H%M%S)"
+# Occupy the MAILBOX destination — the second move in the plan — so whichever
+# stamp the cut computes, its first move looks free and its second collides.
+# That ordering is the whole point: checking each destination just before its
+# own rename archived the store, then refused.
+#
+# WHY THE BAND IS WIDE. `stamp()` takes no injection point, so the only way to
+# occupy the destination the cut will pick is to occupy every second it could
+# pick. The band used to be three seconds, which held on a dev box and lost on a
+# loaded runner: on 2026-08-20 (CI run 32370770123) node reached `stamp()` after
+# the band had passed, no collision happened, the cut correctly succeeded — and
+# G1/G2/G3 all reported a product defect that did not exist. A gate that can go
+# red with no product change is worse than the hole it guards, so the band is now
+# far longer than any plausible interpreter start, and a miss is reported AS a
+# miss rather than as a refusal that never happened.
+#
+# THE BAND MUST BE CONTIGUOUS, which is why every stamp comes off ONE base epoch.
+# Reading the clock again inside the loop looks equivalent and is not: iteration k
+# would occupy `now(k) + k`, so a second boundary crossed mid-loop skips a value and
+# punches a HOLE in the band. A cut landing in that hole finds its destination free,
+# and the hole sits INSIDE the range, so the miss test below would not catch it either.
+#
+# AND WHY A MISS RETRIES ONCE. A wider band is still a race, and "60s is enough"
+# is not a claim this file can prove. What it CAN do is make the race cost
+# nothing: stage the band, and if the cut lands past it, rebuild the band and run
+# the cut again. Two independent misses is the square of one, and the retry costs
+# a second on the happy path because it never fires there. This matters most
+# where the cell is cheapest to overlook — `check-gate-qualification` runs this
+# gate as both control and mutant pass, so a single miss there does not cost one
+# red cell, it costs the whole 22-minute inventory and re-runs it.
+G_BAND_SECONDS=60
+g_miss=0
+for g_attempt in 1 2; do
+  reset_world prevgen
+  mkdir -p "$ENTWURF_META_MAILBOX_DIR/20260305T000000-dddd05"
+  printf 'hello\n' > "$ENTWURF_META_MAILBOX_DIR/20260305T000000-dddd05/0001.msg"
+  store_before="$(store_bytes)"
+  g_band_base="$(date +%s)"
+  for off in $(seq 0 "$G_BAND_SECONDS"); do
+    mkdir -p "$SANDBOX/mailbox.archive-$(date -d "@$((g_band_base + off))" +%Y%m%dT%H%M%S)"
+  done
+  g_band_end="$(date -d "@$((g_band_base + G_BAND_SECONDS))" +%Y%m%dT%H%M%S)"
+  set +e
+  out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rcg=$?
+  set -e
+  g_cut_stamp="$(printf '%s\n' "$out" | sed -n 's|.*/mailbox\.archive-\([0-9T]*\).*|\1|p' | head -1)"
+  g_miss=0
+  [ "$rcg" != 1 ] && [ -n "$g_cut_stamp" ] && [ "$g_cut_stamp" \> "$g_band_end" ] && g_miss=1
+  [ "$g_miss" = 0 ] && break
+  echo "  ..   G fixture missed its band (cut stamped $g_cut_stamp > $g_band_end) — restaging once"
 done
-set +e
-out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rcg=$?
-set -e
-if [ "$rcg" = 1 ]; then
-  ok "G1 an occupied archive destination REFUSES the cut with the NO-MOVE status (exit 1)"
+if [ "$rcg" = 1 ] && [ -n "$(printf '%s\n' "$out" | sed -n 's|^ARCHIVE EXISTS: .*/\(mailbox\.archive-[0-9T]*\)$|\1|p')" ]; then
+  ok "G1 an occupied archive destination REFUSES the cut with the NO-MOVE status (exit 1), naming the MAILBOX destination — the second move in the plan"
+elif [ "$rcg" = 1 ]; then
+  # Refusing for some other reason is not this cell's contract. Without this arm any
+  # unrelated no-move regression that prints the generic "Nothing was moved" line would
+  # keep G1-G3 green while the second-move collision went unproven.
+  bad "G1 the cut refused with NO-MOVE but never named a mailbox.archive-* destination — this is not the second-move collision G claims to prove" "$out"
+elif [ "$g_miss" = 1 ]; then
+  bad "G1 FIXTURE MISS, not a product verdict: the cut stamped $g_cut_stamp, past the occupied band ending $g_band_end, so no collision was ever staged. Widen G_BAND_SECONDS; do not read this as the cut ignoring a collision" "$out"
 else
-  bad "G1 the cut proceeded into an occupied destination, or refused with the wrong status (rc=$rcg, want 1)" "$out"
+  bad "G1 the cut proceeded into an occupied destination, or refused with the wrong status (rc=$rcg, want 1) [QK:FRESH-CUT-COLLISION-NO-MOVE]" "$out"
 fi
-if [ -z "$(find "$SANDBOX" -maxdepth 1 -type d -name 'store.archive-*')" ] && [ "$store_before" = "$(store_bytes)" ]; then
-  ok "G2 the collision refusal moved NOTHING — the store never left its place (no half-cut generation)"
+# G2/G3 only mean something once a collision was actually staged. On a fixture
+# miss the cut was SUPPOSED to archive and SUPPOSED not to print the no-op line,
+# so scoring them would turn one missed fixture into three red cells that read
+# like a product defect — the exact cascade that sent a reader hunting a bug in
+# the cut on 2026-08-20.
+if [ "$g_miss" = 1 ]; then
+  bad "G2/G3 not scored — the G fixture missed its band (see G1); this says nothing about the cut"
 else
-  bad "G2 half-cut generation: the store was archived before the mailbox collision was seen"
+  # NOTE for whoever audits kill reasons here: the mutant carried by
+  # `scripts/mutants/fresh-cut.json` plants "preflight only the FIRST destination",
+  # which lets the cut succeed outright and dies at G1. The ORIGINAL defect this
+  # section was written for — checking each destination just before its own rename —
+  # produces exit 1, an `ARCHIVE EXISTS` line and the no-op sentence, so it passes
+  # G1 and G3 and dies HERE, at G2, which carries no [QK:] label of its own. If that
+  # path ever needs qualifying, this is the cell to label.
+  if [ -z "$(find "$SANDBOX" -maxdepth 1 -type d -name 'store.archive-*')" ] && [ "$store_before" = "$(store_bytes)" ]; then
+    ok "G2 the collision refusal moved NOTHING — the store never left its place (no half-cut generation)"
+  else
+    bad "G2 half-cut generation: the store was archived before the mailbox collision was seen"
+  fi
+  case "$out" in
+    *"Nothing was moved"*) ok "G3 the refusal states its own no-op guarantee" ;;
+    *) bad "G3 the refusal never claimed the no-op" "$out" ;;
+  esac
 fi
-case "$out" in
-  *"Nothing was moved"*) ok "G3 the refusal states its own no-op guarantee" ;;
-  *) bad "G3 the refusal never claimed the no-op" "$out" ;;
-esac
 
 # ── H. the MARKER-LESS live surface: native-push conversations ───────────────
 # A socket+marker walk is not the whole world. `entwurf_register_native` proves an

package/scripts/check-gate-qualification.ts

@@ -806,19 +806,28 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"agy-permission": 6,
 		"bridge-boot-resume": 3,
 		"bridge-command-boot": 9,
+		"capability-cache": 3,
+		"copilot-birth": 19,
+		"copilot-launch": 14,
+		"copilot-receive": 18,
+		"fresh-cut": 1,
 		"meta-facts": 4,
 		"meta-identity": 4,
 		"meta-retire": 3,
 		"mux-boundary": 14,
-		"mux-fresh-call": 19,
+		"mux-fresh-call": 37,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
+		"pack-install": 1,
+		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
 		"probe-ordering": 1,
 		"release-gate": 12,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 3,
+		"setup-verdict": 10,
+		"source-install": 2,
 		"v2-surface": 7,
 		"v2-visible-resume": 17,
 	};

package/scripts/check-install-container.sh

@@ -225,9 +225,9 @@ ok "non-root 'npm install -g' succeeded into the writable isolated prefix $npm_c
 PKG="$npm_config_prefix/lib/node_modules/@junghanacs/entwurf"
 [ -d "$PKG" ] || die "installed package not at $PKG"
 
-# ── 3. the five bins, resolved THROUGH the global PATH shim ──────────────────
+# ── 3. the six bins, resolved THROUGH the global PATH shim ───────────────────
 echo "[global bins via PATH shim]"
-for b in entwurf entwurf-bridge entwurf-statusline entwurf-agy-statusline entwurf-agy-imprint; do
+for b in entwurf entwurf-bridge entwurf-statusline entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline; do
   RESOLVED="$(command -v "$b" || true)"
   if [ -z "$RESOLVED" ]; then bad "bin '$b' is not on PATH after a global install"
   elif [ "$RESOLVED" != "$npm_config_prefix/bin/$b" ]; then bad "bin '$b' resolved to $RESOLVED, not the global shim $npm_config_prefix/bin/$b"

package/scripts/check-install-surface.ts

@@ -236,7 +236,7 @@ const operatorCmds = [...targets].filter(([cmd, ts]) => !isDevGate(cmd) && ts.le
 	// themselves: a mutation whose target is a literal $HOME/~ config path is operating on
 	// the operator's own bridge, whatever the rest of the file does. Reads ($HOME/.current-device,
 	// probing whether a real bundle exists) stay legal — they cannot uninstall anything.
-	const LIVE_ROOTS = String.raw`(?:\$HOME|\$\{HOME\}|~)/\.(?:claude|gemini|pi|config/pi|local/share/(?:claude|entwurf))`;
+	const LIVE_ROOTS = String.raw`(?:\$HOME|\$\{HOME\}|~)/\.(?:claude|copilot|gemini|pi|config/pi|local/share/(?:claude|entwurf))`;
 	const MUTATORS = String.raw`rm\s+-\w+|rm|mv|cp|install|mkdir\s+-p|mkdir|touch|tee|ln\s+-s\w*|truncate`;
 
 	// A mutating run.sh drive is shell code, not prose. `bad "… re-run ./run.sh install-meta-bridge"`

package/scripts/check-meta-capability-source.ts

@@ -12,14 +12,20 @@
  * Proves:
  *  - the lookup seam is registry-DRIVEN — fed a doctored registry,
  *    metaCapabilityFor follows it (so the value is read from the registry, not
- *    hardcoded off the const); the default still reads the shipped file and
- *    memoizes.
+ *    hardcoded off the const); the default still reads the shipped file.
+ *  - the default load is not stale-able: in a temp package closure it follows an
+ *    atomic on-disk replacement within one process, while a missing or corrupt
+ *    registry still throws.
  *  - behaviour preserved: registry ≡ META_BACKEND_DESCRIPTORS for the 3 native
  *    backends (the const survives only as the drift-guard reference; the
  *    registry ≡ const drift guard proper is check-entwurf-capabilities).
  */
 
 import assert from "node:assert/strict";
+import { copyFileSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
 import {
 	loadMetaCapabilityRegistry,
 	META_BACKEND_DESCRIPTORS,
@@ -28,6 +34,9 @@ import {
 	metaCapabilityFor,
 } from "../pi-extensions/lib/meta-session.ts";
 
+/** Repo root, from this gate's own location (`scripts/` -> `..`). */
+const REPO = path.join(import.meta.dirname, "..");
+
 let passed = 0;
 function ok(label: string, cond: boolean): void {
 	assert.ok(cond, label);
@@ -57,9 +66,84 @@ ok(
 	"seam default reads the shipped registry, not the doctored copy",
 	metaCapabilityFor("claude-code").wakeMode === shipped.backends["claude-code"].wakeMode,
 );
-const load1 = loadMetaCapabilityRegistry();
-const load2 = loadMetaCapabilityRegistry();
-ok("loadMetaCapabilityRegistry memoizes (same object on repeat load)", load1 === load2);
+
+// --- the default load is not stale-able (#82 RAIL 7) -----------------------
+// This block replaces an assertion that the loader MEMOIZES. That memo was a real
+// defect, not a design: the entwurf-bridge MCP child outlives many installs, so a
+// grade or wakeMode moved on disk stayed invisible to every already-running
+// dispatcher, with no symptom but a citizen answering out of last week's registry.
+//
+// The oracle has to be independent of the production module's own idea of freshness,
+// so it does not poke at the shipped file — mutating the real checkout registry would
+// make this gate a host-mutating test and could leave the tree dirty on a failure.
+// Instead it builds a TEMP PACKAGE CLOSURE: the module resolves its registry by
+// arithmetic on `import.meta.dirname` (see metaCapabilitiesFilePath), so a copy of
+// meta-session.ts placed at `<tmp>/pi-extensions/lib/` reads `<tmp>/pi/…json` and
+// nothing else. Two files are enough — meta-session imports only node builtins and
+// its sibling session-id.js.
+const tmpRoot = mkdtempSync(path.join(tmpdir(), "entwurf-capability-source."));
+try {
+	const libDir = path.join(tmpRoot, "pi-extensions", "lib");
+	const regDir = path.join(tmpRoot, "pi");
+	mkdirSync(libDir, { recursive: true });
+	mkdirSync(regDir, { recursive: true });
+	const srcLib = path.join(REPO, "pi-extensions", "lib");
+	copyFileSync(path.join(srcLib, "meta-session.ts"), path.join(libDir, "meta-session.ts"));
+	copyFileSync(path.join(srcLib, "session-id.js"), path.join(libDir, "session-id.js"));
+
+	const registryPath = path.join(regDir, "entwurf-capabilities.json");
+	const withGrade = (level: string): string =>
+		JSON.stringify({
+			schemaVersion: shipped.schemaVersion,
+			backends: Object.fromEntries(
+				Object.entries(shipped.backends).map(([b, cap]) => [
+					b,
+					b === "copilot" ? { ...cap, deliveryLevel: level } : cap,
+				]),
+			),
+		});
+
+	writeFileSync(registryPath, withGrade("D0"));
+	const mod = await import(pathToFileURL(path.join(libDir, "meta-session.ts")).href);
+	const before = mod.metaCapabilityFor("copilot").deliveryLevel;
+
+	// Replace the way an installer does — write a sibling and rename over the target —
+	// so the old inode is gone rather than truncated. A stat-keyed cache can survive
+	// this; only actually reading the file cannot.
+	const swap = `${registryPath}.next`;
+	writeFileSync(swap, withGrade("D6"));
+	renameSync(swap, registryPath);
+	const after = mod.metaCapabilityFor("copilot").deliveryLevel;
+
+	ok(
+		`[QK:CAPABILITY-REGISTRY-REREAD-SEES-REPLACEMENT] the default load follows an atomic on-disk replacement in the SAME process (${before} -> ${after})`,
+		before === "D0" && after === "D6",
+	);
+
+	// Losing the registry must stay loud. A loader that "kept the last good copy" to
+	// survive a replacement would pass the cell above and hide this one.
+	rmSync(registryPath);
+	let threwMissing = false;
+	try {
+		mod.loadMetaCapabilityRegistry();
+	} catch {
+		threwMissing = true;
+	}
+	ok("[QK:CAPABILITY-REGISTRY-MISSING-STILL-THROWS] a missing registry still throws on the default load", threwMissing);
+
+	writeFileSync(registryPath, "{ not json");
+	let threwCorrupt = false;
+	try {
+		mod.loadMetaCapabilityRegistry();
+	} catch {
+		threwCorrupt = true;
+	}
+	ok("[QK:CAPABILITY-REGISTRY-CORRUPT-STILL-THROWS] a corrupt registry still throws on the default load", threwCorrupt);
+} finally {
+	// Reap unconditionally: a gate that leaves fixtures behind on failure is how a
+	// checkout accumulates temp roots nobody owns.
+	rmSync(tmpRoot, { recursive: true, force: true });
+}
 
 // --- cut-over preserves behaviour: registry ≡ const for the 3 backends ------
 for (const backend of META_BACKENDS) {

package/scripts/check-meta-doctor-oracle.sh

@@ -500,6 +500,32 @@ mv "$AGENT/meta-bridge-hook.log" "$TMP/hook-log.bak"
 expect_red "hook log absent" "NOT CERTIFIED — no hook log"
 mv "$TMP/hook-log.bak" "$AGENT/meta-bridge-hook.log"
 
+# M9b — a COPILOT line in the shared hook log must not move this doctor AT ALL (#82).
+# The Copilot birth unit appends to the same file, tagged `[copilot]`, and its ERROR
+# lines are frequently CORRECT fail-closed refusals. Worse, their recovery token cannot
+# exist here: `armed watch` is written by CLAUDE's arm. Copilot does have a doorbell
+# since RAIL 5, but a different process arms it (the forked extension) into a different
+# log (`meta-bridge-receive-copilot.log`), so this file still never carries a Copilot
+# recovery line. An untagged grep would redden the Claude doctor forever, for a refusal
+# on another rail, and prescribe a Claude wake failure that never happened. This case is the kill-proof
+# for that separation — it is an expect-GREEN, since the defect it guards makes a
+# HEALTHY host go red.
+# The [QK:] token lives on the `bad` line ONLY: the qualifier requires it exactly
+# once in this file, and its classifier does not count a token printed on an `ok`
+# line — a later assertion must never be able to self-certify a red run.
+cp "$AGENT/meta-bridge-hook.log" "$TMP/hook-log-precopilot.bak"
+{
+  echo "2026-08-21T00:00:02.000Z ERROR [copilot] degraded envelope: cwd missing or not a non-empty string (keys=sessionId)"
+  echo "2026-08-21T00:00:03.000Z INFO [copilot] create record 20260821T000003-aaaaaa.meta.json (event=native(source=new), shape=copilot-native, native=cop-1)"
+} >> "$AGENT/meta-bridge-hook.log"
+run_doctor
+if [ "$DOC_RC" -eq 0 ]; then
+  ok "a copilot ERROR in the shared hook log leaves the CLAUDE doctor green (rails stay separate)"
+else
+  bad "[QK:HOOK-LOG-RAIL-SCOPED] a copilot ERROR in the shared hook log turned the CLAUDE doctor red — the hook-log judgement is not rail-scoped:"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  (FAIL|WARN)' | sed 's/^/        /')"
+fi
+cp "$TMP/hook-log-precopilot.bak" "$AGENT/meta-bridge-hook.log"
+
 # M10 — deployed writer bundle missing: staleness becomes unknowable.
 mv "$PLANTED/lib/meta-session.ts" "$TMP/meta-session.bak"
 expect_red "installed writer bundle missing" "deployed writer version is UNKNOWN"

package/scripts/check-meta-manifest-schema.py

@@ -138,6 +138,44 @@ if hooks is not None:
                 f"want command={expected_owner_command!r} args={expected_owner_args!r}"
             )
 
+# --- the Copilot unit's manifests (#82) --------------------------------------
+# The Copilot BIRTH unit is a SECOND marketplace root, not a second plugin inside the
+# Claude one: the Claude installer assembles one root and copies exactly one plugin out
+# of it, so a shared marketplace.json would publish a `source` the assembly does not
+# contain and `claude plugin validate` would run over it. Its hook FORM is pinned by
+# check-copilot-birth-hook (which drives the real assembler); what is pinned HERE is the
+# same closed-schema keyset lesson that produced this gate — a decorative key in a
+# marketplace/plugin manifest is a future rejection on some other host's CLI version.
+MBC = REPO / "pi" / "meta-bridge-copilot"
+PLUGIN_C = "entwurf-meta-receive-copilot"
+
+mkt_c = load(MBC / ".claude-plugin" / "marketplace.json")
+if mkt_c is not None:
+    subset("copilot marketplace root", mkt_c, {"name", "owner", "plugins"})
+    subset("copilot marketplace.owner", mkt_c.get("owner", {}), {"name"})
+    plugins_c = mkt_c.get("plugins")
+    if not isinstance(plugins_c, list) or len(plugins_c) != 1:
+        bad("copilot marketplace.plugins must hold exactly the one birth plugin")
+    else:
+        subset("copilot marketplace.plugins[0]", plugins_c[0], {"name", "source", "description"})
+        if plugins_c[0].get("name") != PLUGIN_C or plugins_c[0].get("source") != f"./{PLUGIN_C}":
+            bad(f"copilot marketplace.plugins[0] must name/source {PLUGIN_C}; got "
+                f"{plugins_c[0].get('name')!r}/{plugins_c[0].get('source')!r}")
+        else:
+            ok("copilot marketplace.plugins[0] names the shipped unit directory")
+
+plug_c = load(MBC / PLUGIN_C / ".claude-plugin" / "plugin.json")
+if plug_c is not None:
+    subset("copilot plugin.json", plug_c, {"name", "version", "description"})
+
+# The two roots must stay DISJOINT. One marketplace name serving both would make an
+# install of either one silently replace the other's registration.
+if mkt is not None and mkt_c is not None:
+    if mkt.get("name") == mkt_c.get("name"):
+        bad(f"both marketplaces are named {mkt.get('name')!r} — installing one would replace the other")
+    else:
+        ok("the Claude and Copilot marketplaces carry distinct names")
+
 # --- desired_mcp() installed-vs-clone dual-mode ------------------------------
 def desired_mcp(repo: str):
     out = subprocess.run(

package/scripts/check-meta-receiver-marker.ts

@@ -163,10 +163,33 @@ ok(
 
 // ── armProvenance constraint ────────────────────────────────────────────────
 ok(
-	"arm provenances are exactly the arm-capable events",
+	"arm provenances are exactly the arm-capable events, across every backend that arms one",
 	JSON.stringify([...META_RECEIVER_ARM_PROVENANCES].sort()) ===
-		JSON.stringify(["cwd-changed", "file-changed", "session-start"]),
+		JSON.stringify(["cwd-changed", "extension-join", "file-changed", "session-start"]),
 );
+// The Copilot arm is not a hook event, and the marker schema carries that difference
+// rather than flattening it: a different provenance AND a different ownerKind, because
+// the process that holds Copilot's watch is the forked extension, not the CLI. A reader
+// that sees `copilot-extension` is looking at a watcher it can verify by pid; one that
+// saw `claude-code-cli` there would be verifying the wrong process (#82 RAIL 5).
+{
+	const copilotGarden = "20260823T120000-dddddd";
+	writeMetaReceiverMarker({
+		gardenId: copilotGarden,
+		backend: "copilot",
+		nativeSessionId: "cop-native-1",
+		ownerPid: process.pid,
+		ownerKind: "copilot-extension",
+		armProvenance: "extension-join",
+		receiversDir: DIR,
+	});
+	const cop = readMetaReceiverMarker({ gardenId: copilotGarden, receiversDir: DIR });
+	ok(
+		"a Copilot extension arm round-trips with its own provenance and owner kind",
+		cop?.backend === "copilot" && cop?.armProvenance === "extension-join" && cop?.ownerKind === "copilot-extension",
+	);
+	ok("and it is subject to the SAME liveness rule as every other marker", cop?.ownerPid === process.pid);
+}
 let upsRejected = false;
 try {
 	writeMetaReceiverMarker({