@junghanacs/entwurf 0.14.2 → 0.15.1

package/scripts/mutants/setup-verdict.json

@@ -0,0 +1,148 @@
+{
+	"schemaVersion": 1,
+	"lane": "setup-verdict",
+	"mutants": [
+		{
+			"claim": "SETUP-FALSE-GREEN",
+			"title": "aggregate setup prints its computed NON-GREEN summary but exits 0 again, resurrecting the retired whole-host false success in the only surface an operator reads",
+			"subject": "run.sh",
+			"find": [
+				"    echo \"DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup.\"\n    return 1"
+			],
+			"replace": [
+				"    echo \"DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup.\"\n    return 0"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-FALSE-GREEN]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-PI-FLOOR-SKIP",
+			"title": "a resolvable pi below the supported floor is relabeled zero-state SKIP, so a stale-harness host reads green instead of being told its detected integration is incomplete",
+			"subject": "run.sh",
+			"find": [
+				"      setup_result pi FAIL \"detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup\""
+			],
+			"replace": [
+				"      setup_result pi SKIP \"detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup\""
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-PI-FLOOR-SKIP]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-INSTALLED-NO-BOOTSTRAP",
+			"title": "installed-package setup re-enters the source pnpm bootstrap inside node_modules, so the mode-first contract collapses and a neutral npm consumer's setup dies or mutates the installed tree",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$mode\" = \"source\" ]; then\n    # Source bootstrap is the ONLY install-mode difference (#86): the pinned"
+			],
+			"replace": [
+				"  if [ -n \"$mode\" ]; then\n    # Source bootstrap is the ONLY install-mode difference (#86): the pinned"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-INSTALLED-NO-BOOTSTRAP]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-CREDENTIAL-FREE",
+			"title": "a credential-store write (auth.json backup) resurrects inside aggregate setup, re-violating the corrected installation rule that setup never reads, copies, aliases or backs up harness credentials",
+			"subject": "run.sh",
+			"find": ["  SETUP_RESULTS=()\n\n  if [ \"$mode\" = \"source\" ]; then"],
+			"replace": [
+				"  SETUP_RESULTS=()\n  local _auth=\"${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}/auth.json\"\n  if [ -f \"$_auth\" ]; then cp \"$_auth\" \"$_auth.bak\"; fi\n\n  if [ \"$mode\" = \"source\" ]; then"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-CREDENTIAL-FREE]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "DEV-BIN-ATTEMPTS-ALL",
+			"title": "the no-arg dev-bin expose loop aborts at the first foreign refusal again, so units after it are never attempted while the caller's summary implies they ran",
+			"subject": "scripts/dev-bin.sh",
+			"find": [
+				"    rc=0; expose_one \"$b\" || rc=$?\n    if [ \"$rc\" -eq 0 ]; then exposed=$((exposed + 1)); else refused=\"$refused $b\"; fi"
+			],
+			"replace": [
+				"    rc=0; expose_one \"$b\" || rc=$?\n    if [ \"$rc\" -eq 0 ]; then exposed=$((exposed + 1)); else warn \"[dev-bin] REFUSE aborts the loop\"; exit 3; fi"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:DEV-BIN-ATTEMPTS-ALL]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SETUP-INSTALLED-NO-PNPM",
+			"title": "installed setup regains an unconditional pnpm requirement, so a neutral npm consumer without pnpm is refused by an accidental Missing-command instead of composing — the mode decision stops being independent of the source toolchain",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$mode\" = \"source\" ]; then\n    # Source-only dev fixtures: the pinned repo dependencies are build/test\n    # fixtures, never a product promise that consumers receive them (#86 A4).\n    require_cmd pnpm\n  fi"
+			],
+			"replace": ["  require_cmd pnpm"],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-INSTALLED-NO-PNPM]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-COPILOT-ABSENT-SKIP",
+			"title": "the copilot presence gate collapses to always-detected, so an absent-copilot host loses its zero-state SKIP and setup composes (and writes) Copilot units nobody asked for",
+			"subject": "run.sh",
+			"find": [
+				"  if ! command -v \"${COPILOT_BIN:-copilot}\" >/dev/null 2>&1; then\n    setup_result copilot SKIP \"copilot not on PATH — zero Copilot wiring written\""
+			],
+			"replace": [
+				"  if false; then\n    setup_result copilot SKIP \"copilot not on PATH — zero Copilot wiring written\""
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-COPILOT-ABSENT-SKIP]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-COPILOT-INDEPENDENT",
+			"title": "a failed Copilot birth aborts the whole composition, so the MCP/receiver/footer units are silently never attempted while the operator reads only the first failure",
+			"subject": "run.sh",
+			"find": [
+				"      setup_result copilot-birth FAIL \"detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup\"\n    fi"
+			],
+			"replace": [
+				"      setup_result copilot-birth FAIL \"detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup\"\n      return 1\n    fi"
+			],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-COPILOT-INDEPENDENT]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-COPILOT-COSMETIC-PASS",
+			"title": "the birth unit's failure capture is swallowed, so a refused vendor preflight reads as copilot-birth PASS and a broken detected integration reports a green composition",
+			"subject": "run.sh",
+			"find": ["    copilot_rc=0; (cd \"$REPO_DIR\" && bash scripts/copilot-bridge-install.sh) || copilot_rc=$?"],
+			"replace": ["    copilot_rc=0; (cd \"$REPO_DIR\" && bash scripts/copilot-bridge-install.sh) || true"],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:SETUP-COPILOT-COSMETIC-PASS]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-AGY-COSMETIC-RETURN",
+			"title": "wire_agy_bridge's failed-install path returns 0 again, restoring the WARN-then-success mechanism that let a detected-but-refused agy integration read as a green setup",
+			"subject": "run.sh",
+			"find": [
+				"      echo \"[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues.\" >&2\n      ;;\n  esac\n  return 1\n}"
+			],
+			"replace": [
+				"      echo \"[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues.\" >&2\n      ;;\n  esac\n  return 0\n}"
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SETUP-AGY-COSMETIC-RETURN]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		}
+	]
+}

package/scripts/mutants/source-install.json

@@ -0,0 +1,32 @@
+{
+	"schemaVersion": 1,
+	"lane": "source-install",
+	"mutants": [
+		{
+			"claim": "SOURCE-OPERATOR-BIN",
+			"title": "source setup again omits the entwurf operator command, so Copilot fresh rejects runtime-unresolved unless an unrelated global package happens to mask the defect",
+			"subject": "scripts/dev-bin.sh",
+			"find": [
+				"MANAGED_BINS=\"entwurf entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline\""
+			],
+			"replace": [
+				"MANAGED_BINS=\"entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline\""
+			],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-OPERATOR-BIN]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-OPERATOR-FAILS-LOUD",
+			"title": "source setup reports green after the managed operator command is foreign, shadowed, or outside PATH, recreating the runtime-unresolved incident behind a cosmetic success",
+			"subject": "run.sh",
+			"find": ["  if ! bash \"$REPO_DIR/scripts/dev-bin.sh\" verify entwurf; then\n    return 1\n  fi"],
+			"replace": ["  if ! bash \"$REPO_DIR/scripts/dev-bin.sh\" verify entwurf; then\n    return 0\n  fi"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-OPERATOR-FAILS-LOUD]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		}
+	]
+}

package/scripts/pi_settings_io.py

@@ -63,3 +63,25 @@ def unchanged(before: dict, after: dict) -> bool:
     writers mutate in place, so they parse the raw text twice rather than aliasing it.
     """
     return before == after
+
+
+def classify_installer_root(state: dict) -> "tuple[str, str | None]":
+    """ONE typed verdict for a user-scope install-state's `installerRoot` (#86 C2).
+
+    Shared by register-pi-provider install/remove and the doctor-pi-package ownership
+    coupling, because two per-site checks (`isinstance(str)` in one arm, `is None` in
+    another) let every OTHER type — a number, an empty string, a bool, an object, an
+    array — fall between them and proceed unattributed. A state MORE unattributed than
+    legacy must never be treated MORE leniently than legacy.
+
+      ("legacy", None)   key absent, or an explicit null — the pre-#86 shape; each
+                         caller names its own adoption/refusal contract for it.
+      ("owner", root)    a non-empty string — the recorded owner root.
+      ("corrupt", None)  everything else — fail-closed before any write.
+    """
+    if "installerRoot" not in state or state["installerRoot"] is None:
+        return "legacy", None
+    root = state["installerRoot"]
+    if isinstance(root, str) and root:
+        return "owner", root
+    return "corrupt", None

package/scripts/raw-async-delivery/README.md

@@ -12,12 +12,26 @@ Codex is split by launch surface:
   auto-attached to a default-path app-server): raw `turn/start` over
   WebSocket-over-UDS wakes the live thread — **demonstrated, no managed
   standalone, no cloud**.
-- **Copilot CLI 1.0.80 TUI+server**: official SDK `1.0.11` can resolve the
-  foreground native session and enqueue into that exact idle TUI; D7 was
-  demonstrated once (L4 direct-native, one Linux workstation). The launch flag
-  `--ui-server` is hidden from CLI help and its loopback RPC authentication is
-  not established, so this remains a probe, not a managed lane. Undocumented
+
+Copilot is no longer blocked on transport, and the probe below is no longer the
+product — it is the receipt the product was built on:
+
+- **Copilot CLI 1.0.80 extension**: the CLI forks a first-party extension and
+  speaks JSON-RPC over that child's **stdio**, so `fs.watch` -> `session.send()`
+  wakes the idle TUI with **no network listener or token-authentication axis**. Idle wake
+  and exact-marker attribution were demonstrated; addressed isolation was observed but its
+  decisive control log was not preserved (2026-08-23, one Linux workstation). It needs the experimental
+  `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` flag at launch. The older
+  hidden `--ui-server` loopback probe is retired — it found the capability
+  through a door that could not pass admission. Undocumented
   `~/.copilot/run/ws.*` is still not a rail.
+- **The MANAGED receiver now lives at `pi/copilot-receive/entwurf-receive/`** and is
+  installed with `run.sh install-copilot-receive` (#82 RAIL 5). Read it before reusing
+  anything here, because it deliberately differs on three points: it binds to the V3
+  record instead of publishing its own `ready.json`; its receiver marker is owned by the
+  extension pid, so a crash retires it; and it **announces** the inbox rather than
+  sending the body, leaving the drain (and the read-receipt) to `entwurf_inbox_read`.
+  The files below stay as the measurement — do not develop the product in them.
 
 ## TL;DR — three reception paths, ranked
 
@@ -88,7 +102,9 @@ do not ship that. Proven: deliver to A's sessionId → A wakes (FileChanged), B'
 - `raw-agy-send.sh <conv_id> …` — agy parity: PUSH into a live Antigravity session (LS gRPC)
 - `raw-codex-ws-turn-start.py <sock> <thread_id> …` — Codex parity (no managed standalone, no cloud): PUSH `turn/start` over WebSocket-over-UDS into a bare `app-server --listen` socket
 - `codex-local-appserver.sh [sock]` — start a bare local app-server so plain `codex` auto-attaches and becomes addressable
-- `copilot-ui-server-probe.mjs` — official-SDK D0 probe by default; `LIVE=1` performs one addressed idle enqueue and prints D0–D8
+- `copilot-enqueue-addressed.sh <session_id> …` — Copilot raw sender: write `.msg` + poke one session's signal; refuses a missing marker, but deliberately does not claim production stale-receiver safety
+- `copilot-extension-receive/extension.mjs` — Copilot reception unit: a first-party CLI extension that arms the per-session mailbox and calls `session.send()` (stdio JSON-RPC; no port, no token)
+- `copilot-ui-server-probe.mjs` — RETIRED rail, kept as history; the hidden `--ui-server` loopback path whose authentication could not be established
 
 ### Reproduction drivers
 - `repro-plugin-idle-wake.sh` — single-session smoke.
@@ -251,7 +267,7 @@ send-message-v2` spins a fresh thread, not the live one.
 4. **Unix-socket transport is WebSocket** (tokio-tungstenite), not newline JSON-RPC,
    and requires **no auth token** on the UDS. A plain WS client suffices.
 
-## Copilot CLI raw delivery status (1.0.80) — positive TUI+server probe, not a managed lane
+## Copilot CLI delivery status (1.0.80) — idle wake DEMONSTRATED on the extension rail
 
 Copilot is a GitHub **harness** (issues, PR, CI, model `auto`, mode `autopilot`,
 remote/delegate), not a second GPT provider next to pi. This makes a native lane
@@ -264,136 +280,156 @@ premium-interaction entitlement; model `auto` chooses a path within that budget.
 The reason to use it is GitHub specialization and auto routing, not an unlimited
 subscription claim. Model `auto` and mode `autopilot` are separate axes.
 
-### Positive transport
-
-The first-party `@github/copilot-sdk` exposes TUI+server coordination:
-`getForegroundSessionId()`, `getSessionMetadata()`, `resumeSession(id)`, and
-session-scoped `send({mode:"enqueue"|"immediate"})`. The native TUI launch mode is:
+### The rail: a first-party CLI extension, stdio only
 
-```bash
-copilot --ui-server --port 43817 --model auto
-```
+`copilot-extension-receive/extension.mjs` + `copilot-enqueue-addressed.sh`.
 
-`--ui-server` is accepted by CLI 1.0.80 and named by the official SDK API docs,
-but hidden from `copilot --help`. Launch mode is therefore part of the capability,
-and this evidence does not apply to an already-running plain `copilot` TUI.
-
-Measured once on 2026-08-19 with SDK 1.0.11, **using the earlier chronological-slice
-probe** (it scored the events following the marker's position in the history). The probe
-in the tree today scores a named turn instead — see "Current probe contract" below — and
-that contract has NOT been run LIVE, so nothing in this list is retroactively evidence
-for it. Evidence level for the list: **L4 direct-native, ONE Linux workstation, one run**;
-the receipt is host-local probe stdout and was NOT archived as a durable artifact, so what
-follows is reproducible by instruction, not citable to a stored file:
-
-- protocol v3 ping succeeded;
-- foreground session id joined to metadata containing cwd/git root/branch;
-- `resumeSession(id)` + idle `enqueue` woke the visible TUI with zero typing;
-- the unique body appeared as `user.message` with `delivery:"idle"`;
-- model `auto` selected `gpt-5.6-luna` and returned the exact marker;
-- `assistant.message`, `assistant.turn_end`, and (in the one-session run)
-  ephemeral `session.idle` gave completion/reply evidence;
-- a two-session control then targeted A while B received no `user.message`, turn,
-  or assistant event, so D3 passed too.
-
-D0–D7 passed; D8 is unproven. One robustness defect surfaced in the two-session
-shape: the target visibly replied and persisted `assistant.message` + `turn_end`,
-but that joining SDK client did not receive ephemeral `session.idle`, so SDK
-`sendAndWait()` timed out after 60 seconds. The probe therefore uses `send()` plus
-bounded polling of the official session event-history API (`session.getEvents()` /
-`getMessages()`) and reports completion at `turn_end`. Name that surface at its real
-size: it is the SDK's own full event history — no narrower, no more privileged — and it
-is **not** TUI, file, or database transcript scraping; the probe never reads Copilot's
-storage. This is evidence, not a product retry/polling design.
-
-### Current probe contract — designed, not yet run LIVE
-
-Attribution is the load-bearing part, and it runs off the probe's own marker body:
+The CLI forks an extension as its own child and speaks JSON-RPC over that
+child's stdio. `joinSession()` attaches it to the foreground session; from
+there `session.send({mode:"enqueue"})` injects a user message. So the whole
+delivery path is:
 
-```text
-unique marker body  →  exactly one user.message
-                    →  its interactionId
-                    →  exactly one assistant.turn_start on that interaction
-                    →  that turn_start's required turnId
-                    →  only assistant.message / assistant.turn_end on that turnId
+```
+external file write  ->  fs.watch in the extension  ->  session.send()  ->  the idle session takes a turn
 ```
 
-Every link is required and unambiguous; absent or matched twice, the probe FAILS CLOSED.
-There is no positional fallback and no "the turn after ours" rule, because scoring "the
-newest assistant.message" in a session a human is also typing into is how a probe reports
-someone else's turn as its own delivery.
+`fs.watch` -> `session.send()` is not a mechanism found by inspection: the
+bundled SDK documents it (`copilot-sdk/docs/examples.md`, "Detecting when the
+plan file is created or edited"). The SDK also ships *inside* the CLI package
+(`<platform-pkg>/copilot-sdk/`) and is injected into extension children by
+`preloads/extension_bootstrap.mjs`, so nothing has to be installed and the SDK
+version cannot drift from the CLI.
 
-What is deliberately NOT the key: `session.send()` on the bundled CLI 1.0.80 resolves to a
-`Promise<string>` that is the SDK's own submission handle. The server-side `user.message`
-does not carry that string, and it is a different axis from that event's
-`id`/`interactionId` — a join on it cannot hold, so the probe logs it as a diagnostic and
-never matches on it.
+**This is why the rail clears the network-boundary bar the old one could not.**
+The `--ui-server` probe was refused because its loopback RPC authentication was
+not established. An extension has no port, token, or listener, so that network
+authentication axis does not exist. Product admission must instead certify the
+installed extension's provenance and the CLI-owned parent/child lifecycle; the
+fork is the transport boundary, not proof that every permission, liveness, and
+integrity obligation is already closed.
 
-The D3 control cell uses the same sentence it prints: across `onEvent` and `getEvents`, the
-non-target session received no `user.message` and no `assistant.*` event of any kind.
+### Launch contract
 
-Lifecycle, stated precisely rather than flatteringly: the probe never deletes target
-session A and issues no `A.disconnect()` of its own. `client.stop()` DOES tear down every
-tracked session — A included — as a wire `session.destroy`; because A's foreground
-ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
-session, so the net effect on A is detach-equivalent, not removal. The probe deletes only
-the control session it created itself, and reads `client.stop()`'s returned error list so a
-failed teardown cannot exit 0 behind a printed verdict. Reaching past the SDK for a raw
-detach wrapper is out of bounds — it would be a second lifecycle authority.
+Extensions sit behind an experimental feature flag. Without it the CLI never
+scans for extensions and the receiver is inert **with no error at all** —
+budget for that when a receiver appears not to arm:
 
-This contract has not been exercised by a LIVE turn. The next LIVE run is what would
-demonstrate it, and it also confirms the real event key names.
+```bash
+COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS copilot --model auto
+```
 
-### Reproduce with the pinned official SDK
+`--experimental` is NOT required (measured: a session launched with the env var
+alone armed its receiver). Discovery scopes are `user`
+(`~/.copilot/extensions/`), `plugin`, `session`, and — interactive mode only —
+`project` (`.github/extensions/`). Prompt mode (`-p`) drops `project` unless
+`GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true`. The `plugin` scope matters most
+here: the existing entwurf Copilot plugin is the candidate install scope for
+this receiver, so product design need not start from a per-repository
+`.github/extensions/` directory.
 
-The SDK is deliberately not an entwurf production dependency while this is only
-a raw probe. Install it in scratch and point the probe at its ESM entry:
+### Reproduce
 
 ```bash
-mkdir -p /tmp/copilot-sdk-probe
-printf '{"private":true,"type":"module"}\n' >/tmp/copilot-sdk-probe/package.json
-pnpm --dir /tmp/copilot-sdk-probe add --ignore-scripts @github/copilot-sdk@1.0.11
-
-# terminal A: visible native session (accept folder trust)
-copilot --ui-server --port 43817 --model auto
+mkdir -p /tmp/cop-lab/.github/extensions/entwurf-mailbox
+cp copilot-extension-receive/extension.mjs /tmp/cop-lab/.github/extensions/entwurf-mailbox/
+
+# terminal A: a visible session that arms its own receiver
+cd /tmp/cop-lab
+export COPILOT_MAILBOX_ROOT=/tmp/cop-lab/mbx COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS
+copilot --model auto --allow-all-tools     # accept folder trust
+
+# terminal B: find the armed receiver, then wake it with zero typing
+ls /tmp/cop-lab/mbx/*/ready.json
+COPILOT_MAILBOX_ROOT=/tmp/cop-lab/mbx \
+  ./copilot-enqueue-addressed.sh <session_id> "Reply with exactly PING and nothing else."
+```
 
-# terminal B: D0 only, no model call
-COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
-  ./copilot-ui-server-probe.mjs
+### Measured — 2026-08-23, CLI 1.0.80, model `auto`, one Linux workstation (oracle, arm64)
 
-# one paid/subscription turn: addressed idle enqueue through the official SDK
-LIVE=1 COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
-  ./copilot-ui-server-probe.mjs
+Evidence level **L4 direct-native, one host**. The receiver log lines that still
+travel are pasted here. Scratch was cleaned before the second-session control and
+second-turn lines were copied, so those two observations are explicitly downgraded
+below rather than being laundered into durable receipts:
 
-# creates a second no-turn control session and proves only the target receives the marker
-LIVE=1 COPILOT_D3_CONTROL=1 \
-  COPILOT_SDK_MODULE=/tmp/copilot-sdk-probe/node_modules/@github/copilot-sdk/dist/index.js \
-  ./copilot-ui-server-probe.mjs
+```text
+02:19:33.996 ARMED sessionId=4fc16d8d-473d-4258-a1fd-f99d3cb375e9
+02:20:03.388 DELIVER (signal) 1787451603.msg bytes=96
+02:20:03.422 SENT 1787451603.msg
+02:20:06.141 EVENT user.message  {"content":"...Reply with exactly ENTWURF-WAKE-1787451603..."}
+02:20:06.492 EVENT assistant.turn_start {"turnId":"0"}
+02:20:09.935 EVENT assistant.message {"turnId":"0","content":"ENTWURF-WAKE-1787451603"}
+02:20:10.024 EVENT session.idle {}
 ```
 
-### Admission blockers and negative evidence
-
-- **Transport authentication is not established.** The TUI server bound loopback,
-  but an SDK client without a token connected. Setting `COPILOT_CONNECTION_TOKEN`
-  on the UI server did not enable auth: the unauthenticated client still connected,
-  while a token-bearing client received `AUTHENTICATION_NOT_CONFIGURED`. Do not
-  ship this as a rail until the supported same-user/fail-closed boundary is proved.
-- Shell command-hook `sessionStart` input is `{timestamp,cwd,source,initialPrompt?}`;
-  it does **not** carry `sessionId`. SDK callbacks receive `sessionId` separately in
-  their invocation object. The discarded command-hook probe therefore could not
-  establish D0, and UUID-only process-log scraping did not satisfy D0's cwd/liveness
-  join. Do not revive that path.
-- Hooks have no `FileChanged` / `watchPaths` / `asyncRewake`; the Claude mailbox
-  mechanism cannot be copied.
-- `--acp` is a pi-host child path, not this native TUI citizen path. `--remote` is
-  GitHub web/mobile steering, not a local `entwurf_v2` API. Undocumented
-  `~/.copilot/run/ws.*` remains out of bounds.
-
-Do not add `backend:"copilot"`, `FRESH_CALL_BACKENDS`, a schema change, or an OPEN
-issue from these positive probes. Next evidence is active-turn enqueue/immediate
-behavior, TUI-vs-SDK permission ownership, the missing multi-session `session.idle`,
-endpoint staleness/crash behavior, and a supported authenticated or equivalent local
-boundary.
+- **Idle wake: PASS.** The session had never been typed into — an empty timeline,
+  already past any turn boundary. An external file write started a turn. ~2.7 s
+  poke -> `user.message`, ~6.5 s poke -> reply. The visible TUI showed the prompt
+  and the answer.
+- **Attribution: PASS.** A unique per-run marker went in and came back exactly,
+  on one `assistant.turn_start`/`assistant.message` pair.
+- **Addressed routing: reported, receipt not preserved.** The measuring Opus
+  reported that a second armed process B stayed at one `ARMED` line across two
+  deliveries to A, with no `user.message` or `assistant.*` event. The decisive B
+  line and A's second delivery were not copied before scratch cleanup, so this is
+  a lead for the admission rerun, not durable D3 acceptance.
+- **Continuity: one turn demonstrated.** The pasted chain shows one joined
+  session taking the marker turn and replying; no `-p` process was spawned. A
+  second same-session turn was reported but its lines were not preserved, so no
+  stronger repeatability claim crosses from this checkpoint.
+
+### Not proven — do not describe these as working
+
+- **Active-turn delivery.** Every measured send landed on an idle session.
+  `mode:"enqueue"` vs `"immediate"` against a busy turn is untested.
+- **Multi-session inside ONE CLI process.** A and B were separate `copilot`
+  processes. Whether a *background* session inside one process (sidebar tabs)
+  can be woken while another holds the foreground is untested, and
+  `joinSession()` attaching to "the foreground session" is the reason to doubt it.
+- **`/clear` and foreground replacement.** The docs say extensions reload there;
+  re-arming was not measured. `[문서]`, not `[측정]`.
+- **Flag durability.** `EXTENSIONS` is an experimental flag with
+  `experimental`/`staff-or-experimental` availability. It can move or be
+  withdrawn between CLI releases; re-verify on upgrade. A flagged surface is an
+  admission question for a managed lane even when the transport is sound.
+- **Permission ownership, crash and ordering behavior, delivery under load.**
+
+That fence has since been walked, not deleted: `backend:"copilot"` receive capability
+IS now real (`wakeMode: self-fetch` plus a record-bound receiver marker, #82 RAIL 5),
+and it arrived through the managed unit with its own installer, doctor, gate and
+mutants — not by widening anything in this directory. `FRESH_CALL_BACKENDS` now
+includes `copilot` (#82 RAIL 9); that launch path lives in `mux-fresh-call`, not here.
+This probe still does not open a sibling. Waking an already-running Copilot and
+opening a new one remain different capabilities.
+The registry's receive grade moved off D0 later, and NOT because of this probe: a managed
+LIVE wake was observed on 2026-08-23 (garden `20260823T181316-d9f6ba`, CLI 1.0.80,
+doorbell→`lastReadAt` 09:23:41.235Z→09:23:56.480Z) and that is what makes the shipped lane
+D6, with D7 partial and D3 pending. This probe's receipt remains what it always was —
+evidence about the MECHANISM, not about the shipped lane. Keep the two apart when citing
+either.
+
+### Retired: the hidden `--ui-server` probe (kept for the lesson)
+
+The 2026-08-19 probe reached the TUI through `copilot --ui-server --port 43817`
+and the separately-installed SDK, and it did demonstrate an idle enqueue. It was
+refused admission because the launch flag is hidden from `copilot --help` and its
+loopback RPC authentication could not be established: an unauthenticated client
+connected, while setting `COPILOT_CONNECTION_TOKEN` on the server made a
+token-bearing client fail with `AUTHENTICATION_NOT_CONFIGURED`.
+
+The lesson is not "that probe was wrong". It found a real capability through the
+wrong door, and then the door — not the capability — was what failed admission.
+The bundled extension door was in the same package the whole time: the SDK that
+this probe installed from npm also ships inside the CLI, with an `extension.mjs` contract and
+docs beside it. `copilot-ui-server-probe.mjs` remains in this tree as that history.
+Do not revive `--ui-server` as a rail; use the extension.
+
+Also still true, and still out of bounds: hooks have no `FileChanged` /
+`watchPaths` / `asyncRewake`, so the Claude mailbox hook mechanism cannot be
+copied; the shell command-hook `sessionStart` input carries no `sessionId`
+(the receiver publishes its own `ready.json` instead of scraping for one);
+`--acp` is a pi-host child path and `--remote` is GitHub web/mobile steering,
+neither of which is a local `entwurf_v2` API; and undocumented
+`~/.copilot/run/ws.*` is not a rail.
 
 ## Live SSOT for "is the target session alive?"
 
@@ -407,9 +443,18 @@ boundary.
   `$HOME/.codex/app-server-control/app-server-control.sock` (or any owned 0700
   socket via `codex app-server --listen unix://PATH`) is the delivery surface.
   threadId comes from the newest rollout's `session_meta.id`.
-- Copilot TUI+server probe: SDK `ping` + `getForegroundSessionId()` +
-  `getSessionMetadata()` identify the currently displayed native session, and
-  the official session event-history API (`getEvents()` / `getMessages()`) reads
-  a turn back — no transcript file or database is touched. The TCP port is a
-  runtime endpoint, never an identity axis; no managed liveness join exists
-  until its authentication and stale-endpoint behavior are proved.
+- Copilot raw probe: `<COPILOT_MAILBOX_ROOT>/<session_id>/ready.json`, written by
+  the receiver extension about itself (sessionId, pid, cwd, armedAt). `[번들]`
+  `preloads/extension_bootstrap.mjs` monitors the CLI parent, but this is a
+  discovery marker for the experiment, **not a production liveness SSOT**: the
+  probe sender checks only that the file exists, so a crashed extension can
+  leave stale state and produce a false enqueue receipt.
+- Copilot PRODUCT: `<pi-agent-dir>/meta-receivers/<gardenId>.json`, written by the
+  managed extension and keyed by the garden id a sender actually targets. Liveness is
+  pid + start-key on the EXTENSION child, so a crashed receiver reads as inactive at the
+  next read — that is what `ready.json` could not do. Parent monitoring never cleaned the
+  probe's marker by itself; the product does not depend on cleanup at all. Nothing
+  scrapes `~/.copilot/session-store.db` or the session-state dirs, and the shell
+  command-hook `sessionStart` input is NOT
+  a source — it carries no `sessionId`. The retired `--ui-server` TCP port was
+  never an identity axis.

package/scripts/raw-async-delivery/copilot-enqueue-addressed.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Deliver an async message INTO one already-running, IDLE Copilot CLI session.
+#
+# Addressed by sessionId: only the named session's receiver sees the poke, so
+# siblings stay idle. Free — it is a file write plus a continuation of a session
+# that is already running; no `copilot -p` spawn is involved.
+#
+#   ./copilot-enqueue-addressed.sh <session_id> "your async message"
+#
+# The receiving session must be running the copilot-extension-receive extension
+# and must agree on COPILOT_MAILBOX_ROOT. `ready.json` is raw-probe discovery,
+# not production liveness authority: this script does not close stale pid/PID-reuse.
+# Inspect armed candidates with:
+#   ls "${COPILOT_MAILBOX_ROOT:-$HOME/.copilot/mailbox}"/*/ready.json
+set -euo pipefail
+
+root="${COPILOT_MAILBOX_ROOT:-$HOME/.copilot/mailbox}"
+session_id="${1:?usage: copilot-enqueue-addressed.sh <session_id> <message>}"
+shift
+message="${*:?usage: copilot-enqueue-addressed.sh <session_id> <message>}"
+
+box="$root/$session_id"
+# Refuse an address that never armed. A stale marker remains possible in this raw
+# probe; the managed product must add record-backed pid + start-key certification.
+if [[ ! -f "$box/ready.json" ]]; then
+	echo "no receiver marker at $box (no ready.json) — not queued" >&2
+	exit 1
+fi
+
+msg="$box/$(date +%s%N).msg"
+printf '%s\n' "$message" > "$msg"
+# The body lands before the doorbell rings, so the receiver never wakes to an
+# empty box.
+printf 'poke\n' >> "$box/inbox.signal"
+echo "queued-and-poked $msg (raw probe; extension log is the delivery receipt)"