@junghanacs/entwurf 0.15.0 → 0.16.0

package/scripts/check-omp-receive-arm.ts

@@ -0,0 +1,516 @@
+/**
+ * check-omp-receive-arm — the hermetic gate for the OMP RECEIVER unit (#87 bundle B).
+ *
+ * WHAT IT DRIVES. The REAL assembler (`omp-receive-install.sh --assemble-only`) into a
+ * temp dir, then imports the ASSEMBLED `index.ts` and binds it to a mock omp host. So the
+ * subject is the artifact an operator would get, not a second copy of the logic — the same
+ * discipline `check-omp-birth-hook` holds.
+ *
+ * WHY A MOCK HOST IS ENOUGH HERE, AND WHERE IT STOPS. Everything on entwurf's side of the
+ * vendor boundary — which sessions arm, which refuse, who owns the marker, what the
+ * doorbell says, what happens on `/new`, what happens when the watch dies — is decided by
+ * this unit and can be proved without a model turn. What a mock CANNOT prove is that
+ * `pi.sendUserMessage` really starts a turn on an idle host; that is
+ * `smoke-omp-receive-live`'s job, and the two receipts must never stand in for each other.
+ *
+ * THE SHARED FOUR-ROOT POLICY IS NOT RE-PROVED HERE. `ompMetaRoots` is one leaf with two
+ * consumers and `check-omp-birth-hook` already pins it (poisoned `PI_CODING_AGENT_DIR`,
+ * the four overrides, the absolute-or-`~` grammar, the doctor's agreement). This gate
+ * injects explicit roots instead, so a failure here is always about receive behaviour and
+ * never about root resolution — two gates, two subjects.
+ */
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+	type MetaRootBundle,
+	metaReceiverMarkerPath,
+	mintMetaIdentity,
+	readMetaReceiverMarker,
+	serializeMetaIdentity,
+	writeMetaSenderMarker,
+} from "../pi-extensions/lib/meta-session.ts";
+
+const REPO = path.resolve(import.meta.dirname, "..");
+let passed = 0;
+function ok(label: string, cond: boolean, detail = ""): void {
+	assert.ok(cond, `${label}${detail ? `\n${detail}` : ""}`);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "check-omp-receive-"));
+process.on("exit", () => {
+	try {
+		fs.rmSync(tmp, { recursive: true, force: true });
+	} catch {
+		/* scratch cleanup is best-effort */
+	}
+});
+
+// ── the REAL assembler, into a temp dir ──────────────────────────────────────
+const asm = path.join(tmp, "asm");
+execFileSync("bash", [path.join(REPO, "run.sh"), "install-omp-receive", "--assemble-only"], {
+	stdio: "pipe",
+	env: { ...process.env, ENTWURF_OMP_RECEIVE_ASM: asm },
+});
+const entry = path.join(asm, "entwurf-receive-omp", "index.ts");
+ok("the real assembler produced an importable unit entry", fs.existsSync(entry), `        ${entry}`);
+const mod = await import(pathToFileURL(entry).href);
+ok("the assembled unit exports bindOmpReceiver", typeof mod.bindOmpReceiver === "function");
+
+// ── the mock omp host ────────────────────────────────────────────────────────
+// Narrow on purpose: exactly the surface the unit touches, with the two vendor facts this
+// lane MEASURED baked in — `sendUserMessage` on the FACTORY object, timers on the event
+// ctx with `clearTimer` (never `clearInterval`) as the canceller.
+interface Timer {
+	fn: () => void;
+	cancelled: boolean;
+}
+class MockCtx {
+	timers: Timer[] = [];
+	mode: string;
+	nativeSessionId: string;
+	opts: { withTimers?: boolean; withClear?: boolean };
+	constructor(mode: string, nativeSessionId: string, opts: { withTimers?: boolean; withClear?: boolean } = {}) {
+		this.mode = mode;
+		this.nativeSessionId = nativeSessionId;
+		this.opts = opts;
+	}
+	sessionManager = {
+		getSessionId: () => this.nativeSessionId,
+	};
+	setInterval = (fn: () => void, _ms: number): unknown => {
+		if (this.opts.withTimers === false) throw new Error("no timers on this build");
+		const t: Timer = { fn, cancelled: false };
+		this.timers.push(t);
+		return t;
+	};
+	/**
+	 * PER-CONTEXT OWNERSHIP, and it is the whole point of this mock.
+	 *
+	 * A `clearTimer` that cancels any handle it is handed cannot tell a unit which cancels
+	 * through the CREATING context from one which reaches for whichever context the current
+	 * edge happens to carry. Nothing measured says a second event context can cancel a timer
+	 * the first one created, so the oracle assumes it cannot: a foreign handle is a SILENT
+	 * no-op, exactly as an unowned timer id would be. The overlapping-edge cell below is
+	 * only a real test under this rule — under the permissive version it passed while the
+	 * unit was still guessing.
+	 */
+	clearTimer = (handle: unknown): void => {
+		if (!this.timers.includes(handle as Timer)) return;
+		(handle as Timer).cancelled = true;
+	};
+	/** Fire every live timer once — the deterministic stand-in for the vendor's clock. */
+	tick(): void {
+		for (const t of [...this.timers]) if (!t.cancelled) t.fn();
+	}
+	liveTimers(): number {
+		return this.timers.filter((t) => !t.cancelled).length;
+	}
+}
+function makeCtx(mode: string, native: string, opts: { withTimers?: boolean; withClear?: boolean } = {}): any {
+	const ctx: any = new MockCtx(mode, native, opts);
+	if (opts.withClear === false) ctx.clearTimer = undefined;
+	if (opts.withTimers === false) ctx.setInterval = undefined;
+	return ctx;
+}
+class MockPi {
+	handlers = new Map<string, Array<(e: unknown, c: unknown) => void>>();
+	sent: string[] = [];
+	canSend: boolean;
+	constructor(canSend = true) {
+		this.canSend = canSend;
+		if (!canSend) (this as any).sendUserMessage = undefined;
+	}
+	on = (evt: string, h: (e: unknown, c: unknown) => void): void => {
+		const list = this.handlers.get(evt) ?? [];
+		list.push(h);
+		this.handlers.set(evt, list);
+	};
+	sendUserMessage = (text: string): void => {
+		this.sent.push(text);
+	};
+	fire(evt: string, ctx: unknown, event: unknown = {}): void {
+		for (const h of this.handlers.get(evt) ?? []) h(event, ctx);
+	}
+}
+
+let cellSeq = 0;
+interface Cell {
+	roots: MetaRootBundle;
+	pid: number;
+	logs: string[];
+	pi: MockPi;
+	receiver: any;
+}
+/** One isolated garden per cell: no cell can pass because another cell left state behind. */
+function newCell(opts: { canSend?: boolean } = {}): Cell {
+	const base = path.join(tmp, `cell-${++cellSeq}`);
+	const roots: MetaRootBundle = {
+		sessionsDir: path.join(base, "meta-sessions"),
+		mailboxDir: path.join(base, "meta-mailbox"),
+		sendersDir: path.join(base, "meta-senders"),
+		receiversDir: path.join(base, "meta-receivers"),
+	};
+	for (const d of Object.values(roots)) fs.mkdirSync(d, { recursive: true });
+	const logs: string[] = [];
+	const pi = new MockPi(opts.canSend ?? true);
+	const receiver = mod.bindOmpReceiver(pi, {
+		pid: process.pid,
+		rootsFor: () => roots,
+		log: (level: string, message: string) => logs.push(`${level} ${message}`),
+	});
+	return { roots, pid: process.pid, logs, pi, receiver };
+}
+
+/** Seed a born citizen: the V3 record plus the sender marker birth would have written. */
+function seedBirth(cell: Cell, nativeSessionId: string): string {
+	const identity = mintMetaIdentity({ backend: "omp", nativeSessionId, cwd: "/tmp", transcriptPath: null });
+	fs.writeFileSync(
+		path.join(cell.roots.sessionsDir, `${identity.gardenId}.meta.json`),
+		serializeMetaIdentity(identity),
+	);
+	writeMetaSenderMarker({
+		backend: "omp",
+		gardenId: identity.gardenId,
+		nativeSessionId,
+		cwd: "/tmp",
+		ownerPid: cell.pid,
+		sendersDir: cell.roots.sendersDir,
+	});
+	return identity.gardenId;
+}
+function markerFor(cell: Cell, gardenId: string) {
+	return readMetaReceiverMarker({ gardenId, receiversDir: cell.roots.receiversDir, verifyOwner: false });
+}
+function logHas(cell: Cell, needle: string): boolean {
+	return cell.logs.some((l) => l.includes(needle));
+}
+
+// ── 1. the §3.5 scope fence ──────────────────────────────────────────────────
+// Every task subagent re-executes this factory by default, so a unit that armed on any
+// mode would publish a doorbell for the HOST's citizen from inside a subagent — a second
+// watcher on one mailbox, and a marker whose owner is not the session it names.
+for (const mode of ["print", "rpc", "json"]) {
+	const cell = newCell();
+	const gid = seedBirth(cell, `native-${mode}`);
+	cell.pi.fire("session_start", makeCtx(mode, `native-${mode}`));
+	ok(`[QK:OMP-RECEIVE-SCOPE-FENCE] mode=${mode} arms NOTHING`, markerFor(cell, gid) === null);
+	ok(`mode=${mode} leaves a scope-refused receipt in the log`, logHas(cell, `scope-refused`));
+}
+
+// ── 2. the happy path, and what the marker says ──────────────────────────────
+{
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-happy");
+	cell.pi.fire("session_start", makeCtx("tui", "native-happy"));
+	const m = markerFor(cell, gid);
+	ok("[QK:OMP-RECEIVE-ARMS-TUI-HOST] a tui host with a born citizen arms a receiver marker", m !== null);
+	ok("the marker names the HOST process as the watch owner", m?.ownerKind === "omp-host" && m?.ownerPid === cell.pid);
+	ok(
+		"the marker carries backend omp and the vendor's native session id",
+		m?.backend === "omp" && m?.nativeSessionId === "native-happy",
+	);
+	ok("armProvenance is session-start (the edge that armed it)", m?.armProvenance === "session-start");
+	cell.receiver.unarm("gate-teardown");
+}
+
+// ── 3. ORDER: no sender marker yet is a DEFER, not an arm ────────────────────
+// The measured failure mode: a discovered extension sorting before the birth unit runs
+// first and finds nothing to join. Arming anyway would publish a doorbell for a citizen
+// that does not exist; refusing forever would leave it permanently unaddressable.
+{
+	const cell = newCell();
+	const ctx = makeCtx("tui", "native-late");
+	cell.pi.fire("session_start", ctx);
+	ok(
+		"[QK:OMP-RECEIVE-DEFERS-BEFORE-BIRTH] nothing is armed while birth has not run",
+		fs.readdirSync(cell.roots.receiversDir).length === 0,
+	);
+	ok("[QK:OMP-RECEIVE-RETRY-ARMS] a bounded retry timer is running after a deferred arm", ctx.liveTimers() === 1);
+	ok("the log says arm-deferred, not arm-refused", logHas(cell, "arm-deferred") && !logHas(cell, "arm-refused"));
+	const gid = seedBirth(cell, "native-late");
+	ctx.tick();
+	ok("the retry arms once birth's marker appears", markerFor(cell, gid) !== null);
+	ok("the retry timer is cancelled once armed (ctx.clearTimer, the vendor's only canceller)", ctx.liveTimers() === 0);
+	cell.receiver.unarm("gate-teardown");
+}
+
+// ── 3b. TWO OVERLAPPING EDGES: the first context's timer must really stop ────
+// The gap a review found, and it is the uncancellable-timer failure wearing a different
+// hat. `onEdge` used to call `cancelRetry()` with no argument, so the optional
+// `ctx?.clearTimer?.()` did nothing while `retryHandle` was set to null: the handle was
+// DROPPED rather than cancelled. A second birth edge during a deferred arm then left the
+// first context's 500ms poll running in the operator's TUI with no reference left to stop
+// it, and started a second beside it — one orphan per `/new` while birth was slow.
+//
+// The signed assertion is deliberately the FIRST one the defect breaks. A signature placed
+// after an unsigned assertion the same mutant also breaks reads back as KILLED-WRONG-REASON,
+// which is how this gate learned to place them (see the retry cell above).
+{
+	const cell = newCell();
+	const ctx1 = makeCtx("tui", "native-one");
+	cell.pi.fire("session_start", ctx1);
+	ok("a deferred arm leaves a live retry timer on the FIRST context", ctx1.liveTimers() === 1);
+
+	const gid2 = seedBirth(cell, "native-two");
+	const ctx2 = makeCtx("tui", "native-two");
+	cell.pi.fire("session_switch", ctx2, { reason: "new" });
+	ok(
+		"[QK:OMP-RECEIVE-EDGE-CANCELS-OLD-RETRY] a second birth edge CANCELS the first context's timer instead of orphaning it",
+		ctx1.liveTimers() === 0,
+		`        ctx1 live=${ctx1.liveTimers()} ctx2 live=${ctx2.liveTimers()}`,
+	);
+	ok("the second edge armed for its own citizen", markerFor(cell, gid2) !== null);
+	ok("and it started no retry of its own, having armed immediately", ctx2.liveTimers() === 0);
+	// An orphaned timer is not merely untidy: it keeps calling back into a receiver that has
+	// moved on. Ticking the abandoned context must therefore be inert.
+	const before = fs.readdirSync(cell.roots.receiversDir).length;
+	ctx1.tick();
+	ok("ticking the abandoned context changes nothing", fs.readdirSync(cell.roots.receiversDir).length === before);
+	cell.receiver.unarm("gate-teardown");
+}
+
+// ── 4. the retry is BOUNDED ──────────────────────────────────────────────────
+// An unbounded poll inside the operator's TUI is a leak, and "birth never happened" is a
+// real outcome that deserves a logged giving-up rather than a silent forever-loop.
+{
+	const cell = newCell();
+	const ctx = makeCtx("tui", "native-never");
+	cell.pi.fire("session_start", ctx);
+	for (let i = 0; i < 60 && ctx.liveTimers() > 0; i++) ctx.tick();
+	ok("[QK:OMP-RECEIVE-RETRY-BOUNDED] the retry gives up instead of polling forever", ctx.liveTimers() === 0);
+	ok("giving up is LOGGED as not-addressable", logHas(cell, "arm-gave-up"));
+}
+
+// ── 5. a timer this build cannot cancel is never started ─────────────────────
+// `ctx.clearInterval` does not exist on omp v18; calling it through `?.` was measured to
+// be a SILENT no-op that left a 500ms poll running for the life of the session. An
+// unarmed citizen is an honest refusal; an uncancellable timer is a defect we installed.
+{
+	const cell = newCell();
+	const ctx = makeCtx("tui", "native-noclear", { withClear: false });
+	cell.pi.fire("session_start", ctx);
+	ok("[QK:OMP-RECEIVE-NO-UNCANCELLABLE-TIMER] no retry is started without ctx.clearTimer", ctx.timers.length === 0);
+	ok("the refusal names both probed methods", logHas(cell, "arm-retry-unavailable"));
+}
+
+// ── 6. a doorbell that cannot ring is never advertised ───────────────────────
+{
+	const cell = newCell({ canSend: false });
+	const gid = seedBirth(cell, "native-nosend");
+	cell.pi.fire("session_start", makeCtx("tui", "native-nosend"));
+	ok(
+		"[QK:OMP-RECEIVE-REFUSES-WITHOUT-WAKE] no marker when pi.sendUserMessage is absent",
+		markerFor(cell, gid) === null,
+	);
+	ok("the refusal is an ERROR, not a silent skip", logHas(cell, "ERROR") && logHas(cell, "cannot ring"));
+}
+
+// ── 7. drift refusals, on BOTH axes, isolated from each other ────────────────
+// A marker written against a drifted id tells a sender that a reply lands in a session
+// which will never see it.
+{
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-A");
+	cell.pi.fire("session_start", makeCtx("tui", "native-B"));
+	ok("a vendor id that disagrees with BOTH the marker and the record arms nothing", markerFor(cell, gid) === null);
+	ok("no marker file exists at all for the drifted cell", fs.readdirSync(cell.roots.receiversDir).length === 0);
+}
+{
+	// THE ISOLATING CELL, and it exists because a mutant SURVIVED without it. Removing the
+	// marker-level id check left this gate green: in the cell above the RECORD check caught
+	// the drift too, so the two guards were indistinguishable and only one was really pinned.
+	// Here the record AGREES with the vendor while the sender marker is stale — the shape a
+	// `/new` produces in the window before birth rewrites the marker. Only the marker-level
+	// check can refuse it, and arming here would publish a doorbell off an id the vendor has
+	// already moved past.
+	const cell = newCell();
+	const identity = mintMetaIdentity({
+		backend: "omp",
+		nativeSessionId: "native-current",
+		cwd: "/tmp",
+		transcriptPath: null,
+	});
+	fs.writeFileSync(
+		path.join(cell.roots.sessionsDir, `${identity.gardenId}.meta.json`),
+		serializeMetaIdentity(identity),
+	);
+	writeMetaSenderMarker({
+		backend: "omp",
+		gardenId: identity.gardenId,
+		nativeSessionId: "native-stale",
+		cwd: "/tmp",
+		ownerPid: cell.pid,
+		sendersDir: cell.roots.sendersDir,
+	});
+	cell.pi.fire("session_start", makeCtx("tui", "native-current"));
+	ok(
+		"[QK:OMP-RECEIVE-ID-DRIFT-REFUSED] a STALE sender marker is refused even when the record agrees with the vendor",
+		markerFor(cell, identity.gardenId) === null && fs.readdirSync(cell.roots.receiversDir).length === 0,
+	);
+}
+
+// ── 8. `/new`: the cell the start-key guard can NEVER catch ──────────────────
+// Same pid, same start key, different citizen. Without an explicit unarm the previous
+// garden id keeps reading as an ACTIVE receiver and dispatch enqueues into a mailbox this
+// process has stopped watching — a false deliverability nothing upstream can detect,
+// because from outside the process really is alive.
+{
+	const cell = newCell();
+	const oldGid = seedBirth(cell, "native-first");
+	cell.pi.fire("session_start", makeCtx("tui", "native-first"));
+	ok("armed for the first citizen", markerFor(cell, oldGid) !== null);
+	const newGid = seedBirth(cell, "native-second");
+	cell.pi.fire("session_switch", makeCtx("tui", "native-second"), { reason: "new" });
+	ok(
+		"[QK:OMP-RECEIVE-NEW-RETIRES-OLD] the previous citizen's marker is GONE after /new",
+		markerFor(cell, oldGid) === null,
+	);
+	ok("the replacement citizen is armed", markerFor(cell, newGid) !== null);
+	ok("exactly one receiver marker remains", fs.readdirSync(cell.roots.receiversDir).length === 1);
+	cell.receiver.unarm("gate-teardown");
+}
+
+// ── 9. ORDER CONTRACT: no watch, no marker ───────────────────────────────────
+// `fs.watch` is a real failure surface. A marker written before it would advertise a
+// doorbell nobody is listening at — the fail-closed rule inverted.
+{
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-nowatch");
+	// Make the mailbox path un-mkdir-able: a FILE where the directory must go.
+	fs.writeFileSync(path.join(cell.roots.mailboxDir, gid), "not a directory");
+	cell.pi.fire("session_start", makeCtx("tui", "native-nowatch"));
+	ok("a pre-watch setup failure leaves NO marker", markerFor(cell, gid) === null);
+	ok("the failure is logged as arm-failed", logHas(cell, "arm-failed"));
+}
+
+{
+	// THE ORDERING CELL, and it exists because a mutant SURVIVED without it. The cell above
+	// fails at `mkdirSync`, BEFORE either the marker or the watch, so it cannot tell a unit
+	// that writes the marker after the watch from one that writes it before. Here the
+	// mailbox and the signal both exist and only `fs.watch` fails (EACCES on an unreadable
+	// signal — the same class as an exhausted inotify budget), so the two orderings give
+	// different answers and only the correct one leaves no marker.
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-eacces");
+	const mailbox = path.join(cell.roots.mailboxDir, gid);
+	fs.mkdirSync(mailbox, { recursive: true });
+	const signal = path.join(mailbox, "inbox.signal");
+	fs.writeFileSync(signal, "");
+	fs.chmodSync(signal, 0o000);
+	cell.pi.fire("session_start", makeCtx("tui", "native-eacces"));
+	fs.chmodSync(signal, 0o600);
+	ok(
+		"[QK:OMP-RECEIVE-NO-WATCH-NO-MARKER] a watch that FAILED while the mailbox already existed leaves NO marker",
+		markerFor(cell, gid) === null,
+	);
+	ok("the watch failure is logged as arm-failed", logHas(cell, "arm-failed"));
+}
+
+// ── 10. the doorbell: announce-only, and what it must not contain ────────────
+{
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-ring");
+	cell.pi.fire("session_start", makeCtx("tui", "native-ring"));
+	const mailbox = path.join(cell.roots.mailboxDir, gid);
+	const secret = "SECRET-BODY-THAT-MUST-NOT-BE-INJECTED";
+	fs.writeFileSync(path.join(mailbox, "2026-01-01T00-00-00-000Z-aaaaaa.msg"), secret);
+	fs.writeFileSync(path.join(mailbox, "inbox.signal"), new Date().toISOString());
+	// fs.watch is asynchronous even in a hermetic gate; wait on the effect, not a sleep.
+	const deadline = Date.now() + 5000;
+	while (cell.pi.sent.length === 0 && Date.now() < deadline) {
+		await new Promise((r) => setTimeout(r, 25));
+	}
+	ok(
+		"[QK:OMP-RECEIVE-DOORBELL-RINGS] a fresh .msg rings the doorbell",
+		cell.pi.sent.length === 1,
+		`        sent=${JSON.stringify(cell.pi.sent)}`,
+	);
+	const notice = cell.pi.sent[0] ?? "";
+	ok(
+		"the notice names the garden id and the drain tool",
+		notice.includes(gid) && notice.includes("entwurf_inbox_read"),
+	);
+	ok("[QK:OMP-RECEIVE-ANNOUNCE-NEVER-PUSHES] the notice does NOT carry the message body", !notice.includes(secret));
+	ok("the notice marks the bodies untrusted", notice.includes("untrusted"));
+	ok(
+		"the body was stamped .delivered BEFORE announcing (rename means rang, not read)",
+		fs.readdirSync(mailbox).some((f) => f.endsWith(".msg.delivered")),
+	);
+	cell.receiver.unarm("gate-teardown");
+}
+
+// ── 11. a vanished mailbox gives the marker back ─────────────────────────────
+// `meta-bridge-fresh-cut` archives the mailbox tree; inotify follows the inode, so the
+// watch survives pointing at a file nobody will ever poke again.
+{
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-vanish");
+	cell.pi.fire("session_start", makeCtx("tui", "native-vanish"));
+	ok("armed before the mailbox vanishes", markerFor(cell, gid) !== null);
+	const mailbox = path.join(cell.roots.mailboxDir, gid);
+	fs.writeFileSync(path.join(mailbox, "2026-01-01T00-00-00-000Z-bbbbbb.msg"), "body");
+	fs.rmSync(path.join(mailbox, "inbox.signal"), { force: true });
+	// Removing the watched file is itself a watch event, so the unit's own doorbell path
+	// runs and finds the signal gone — no test-only entry point is needed or offered.
+	const deadline2 = Date.now() + 5000;
+	while (markerFor(cell, gid) !== null && Date.now() < deadline2) {
+		await new Promise((r) => setTimeout(r, 25));
+	}
+	ok(
+		"[QK:OMP-RECEIVE-VANISHED-SIGNAL-UNARMS] a signal that no longer exists retires the marker rather than advertising a dead doorbell",
+		markerFor(cell, gid) === null,
+	);
+}
+
+// ── 12. teardown removes OUR marker only ─────────────────────────────────────
+// A replacement receiver for the same citizen must never have ITS marker deleted by our
+// teardown — the same identity guard the Copilot receiver holds.
+{
+	const cell = newCell();
+	const gid = seedBirth(cell, "native-foreign");
+	cell.pi.fire("session_start", makeCtx("tui", "native-foreign"));
+	const file = metaReceiverMarkerPath(gid, cell.roots.receiversDir);
+	const mine = JSON.parse(fs.readFileSync(file, "utf8"));
+	fs.writeFileSync(file, JSON.stringify({ ...mine, ownerPid: mine.ownerPid + 1 }, null, 2));
+	cell.receiver.unarm("gate-foreign-check");
+	ok(
+		"[QK:OMP-RECEIVE-UNARM-IS-IDENTITY-GUARDED] a marker owned by another pid survives our teardown",
+		fs.existsSync(file),
+	);
+}
+
+// ── 13. binding must not leak listeners into the operator's host ─────────────
+// omp re-executes the extension factory PER SESSION, subagents included, and they all
+// share one process. An unconditional `process.on("exit")` at bind time therefore grew one
+// listener per subagent — this gate hit `MaxListenersExceededWarning` at 11 bindings, which
+// in a real session would print that warning into the operator's TUI. Binding is not when a
+// teardown becomes owed; ARMING is, and a subagent never arms.
+{
+	const before = process.listenerCount("exit");
+	for (let i = 0; i < 20; i++) {
+		const cell = newCell();
+		cell.pi.fire("session_start", makeCtx("print", `native-sub-${i}`));
+	}
+	ok(
+		"[QK:OMP-RECEIVE-BIND-LEAKS-NO-LISTENERS] 20 subagent bindings add ZERO process exit listeners",
+		process.listenerCount("exit") === before,
+		`        before=${before} after=${process.listenerCount("exit")}`,
+	);
+	const cell = newCell();
+	seedBirth(cell, "native-guard");
+	cell.pi.fire("session_start", makeCtx("tui", "native-guard"));
+	ok("an ARMED receiver does register exactly one exit guard", process.listenerCount("exit") === before + 1);
+	cell.receiver.unarm("gate-teardown");
+	ok(
+		"unarming gives that listener back (a host cycling /new accumulates none)",
+		process.listenerCount("exit") === before,
+	);
+}
+
+console.log(`[check-omp-receive-arm] ${passed} assertions ok`);

package/scripts/check-setup-qualification.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# check-setup-qualification.sh — snapshot-safe mutation-attribution oracle for the
+# aggregate-setup verdict claims (#86 C1 five + C3b three). Invoked DIRECTLY by the mutant
+# manifests (`bash scripts/check-setup-qualification.sh`); deliberately NOT a
+# run.sh subcommand and NOT in any check tier. This file proves ONLY that each
+# mutant dies at its own claim token inside the tracked-files qualification
+# snapshot (no node_modules, no network, no pack). It is NOT behavior, package,
+# or preflight evidence: the rich `smoke-setup-verdict` (check:package) and the
+# actual packed consumer row in `check-pack-install` keep those authorities.
+#
+# The fake installed tree copies run.sh+package.json under a temp node_modules
+# and plants ONE explicit PRECONDITION STUB at the installed store-doctor path
+# (exit 0 + named stub verdict) because preflight_v3_store runs before
+# SETUP_RESULTS exists. The stub is not a compiled-product twin. No bridge
+# launcher is planted, so the core component FAILs BY DESIGN and every cell
+# expects setup rc=1 with a computed NON-GREEN summary.
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="$(cd "$HERE/.." && pwd)"
+export PYTHONDONTWRITEBYTECODE=1
+
+SB="$(mktemp -d -t entwurf-setup-qualification.XXXXXX)"
+trap 'rm -rf "$SB"' EXIT
+PASS=0
+ok()   { PASS=$((PASS + 1)); printf '  ok    %s\n' "$*"; }
+die()  { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
+want() { if eval "$2"; then ok "$1"; else die "$1"; fi; }
+
+PKG="$SB/node_modules/@junghanacs/entwurf"
+mkdir -p "$PKG/mcp/entwurf-bridge/dist/scripts"
+cp "$REPO_DIR/run.sh" "$PKG/run.sh"; chmod +x "$PKG/run.sh"
+cp "$REPO_DIR/package.json" "$PKG/package.json"
+printf '%s\n' 'console.log("stub-store-doctor: precondition stub for the setup-qualification oracle — empty sandbox store, verdict clean by construction");' \
+  > "$PKG/mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+
+# Copilot composition surface (#86 C3b, Cell D): the three writer units and the
+# birth installer's pre-vendor path are real tracked files; only the compiled
+# dist closure is stubbed (the receive installer copies and digests those bytes,
+# it never executes them — same not-a-product-twin discipline as the store stub).
+mkdir -p "$PKG/scripts" "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib" "$PKG/pi-extensions/lib"
+for _f in copilot-bridge-install.sh copilot-bridge-oracle.sh copilot-mcp-bridge.sh copilot-mcp-config.py \
+  copilot-receive-bridge.sh copilot-statusline-bridge.sh copilot-statusline-config.py; do
+  cp "$REPO_DIR/scripts/$_f" "$PKG/scripts/$_f"
+done
+cp -r "$REPO_DIR/pi" "$PKG/pi"
+cp "$REPO_DIR/pi-extensions/lib/session-id.js" "$PKG/pi-extensions/lib/session-id.js"
+printf '%s\n' '// dist stub: copied+digested by the receive installer, never executed here' \
+  > "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+cp "$PKG/pi-extensions/lib/session-id.js" "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib/session-id.js"
+
+# Fake pnpm: resolvable (so an unconditional require_cmd would pass), but any
+# INVOCATION writes a marker and exits uniquely — the bootstrap tripwire.
+MARKER="$SB/pnpm-invoked.marker"
+mkdir -p "$SB/bin"
+printf '#!/usr/bin/env bash\necho invoked > "%s"\nexit 97\n' "$MARKER" > "$SB/bin/pnpm"
+chmod +x "$SB/bin/pnpm"
+
+ABSENT="$SB/definitely-absent"
+run_setup() { # $1=HOME-root $2=project $3=PATH $4=PI_BIN $5=COPILOT_BIN(optional, default absent) → OUT/RC
+  mkdir -p "$1/.pi/agent" "$2"
+  set +e
+  # ONE physical line by contract: check-install-surface S5c is a line-scoped static tripwire,
+  # so the sandbox env assignments must ride the same line as the run.sh drive they guard.
+  OUT="$(HOME="$1" XDG_DATA_HOME="$1/.local/share" XDG_STATE_HOME="$1/.local/state" XDG_CACHE_HOME="$1/.cache" XDG_CONFIG_HOME="$1/.config" PI_CODING_AGENT_DIR="$1/.pi/agent" PATH="$3" PI_BIN="$4" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="${5:-$ABSENT}" bash "$PKG/run.sh" setup "$2" 2>&1)"
+  RC=$?
+  set -e
+}
+
+# ── Cell A: installed / all-absent (fake pnpm resolvable, never invoked) ──
+HOME_A="$SB/home-a"; mkdir -p "$HOME_A/.pi/agent"
+printf '{"anthropic":{"type":"oauth","access":"oracle-token"}}\n' > "$HOME_A/.pi/agent/auth.json"
+AUTH_SHA="$(sha256sum "$HOME_A/.pi/agent/auth.json" | cut -d' ' -f1)"
+run_setup "$HOME_A" "$SB/proj-a" "$SB/bin:$PATH" "$ABSENT"
+want "A: the source bootstrap never invoked pnpm in installed mode (marker absent) [QK:SETUP-INSTALLED-NO-BOOTSTRAP]" \
+  "[ ! -e '$MARKER' ]"
+want "A: the deliberate core FAIL owns setup exit 1 (computed, never cosmetic green) [QK:SETUP-FALSE-GREEN]" \
+  "[ '$RC' -eq 1 ]"
+want "A: no auth.json.bak and credential bytes identical [QK:SETUP-CREDENTIAL-FREE]" \
+  "[ ! -e '$HOME_A/.pi/agent/auth.json.bak' ] && [ \"\$(sha256sum '$HOME_A/.pi/agent/auth.json' | cut -d' ' -f1)\" = '$AUTH_SHA' ]"
+want "A: an absent copilot is one zero-state SKIP — no unit composed, no .copilot written [QK:SETUP-COPILOT-ABSENT-SKIP]" \
+  "printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && [ ! -e '$HOME_A/.copilot' ]"
+want "A control: mode named first, pi/claude/agy SKIP, bins PASS, core FAIL, NON-GREEN summary" \
+  "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: installed package' && printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'bins: PASS' && printf '%s' \"\$OUT\" | grep -q 'core: FAIL' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
+
+# ── Cell B: detected pi below floor — the verdict LABEL is the oracle ──
+printf '#!/usr/bin/env bash\necho 0.1.0\n' > "$SB/pi-stale"; chmod +x "$SB/pi-stale"
+run_setup "$SB/home-b" "$SB/proj-b" "$SB/bin:$PATH" "$SB/pi-stale"
+want "B: a below-floor pi is a detected FAIL naming the supported range, never SKIP [QK:SETUP-PI-FLOOR-SKIP]" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: FAIL' && printf '%s' \"\$OUT\" | grep -q 'outside the supported range' && ! printf '%s' \"\$OUT\" | grep -q 'pi: SKIP'"
+
+# ── Cell C: genuinely pnpm-scrubbed PATH — installed setup needs no pnpm ──
+SHIMS="$SB/scrub-shims"; mkdir -p "$SHIMS"
+for _t in bash node python3 head tr cut sed grep dirname readlink cat mkdir cp chmod rm env sha256sum; do
+  _s="$(command -v "$_t" 2>/dev/null || true)"; [ -n "$_s" ] && ln -s "$_s" "$SHIMS/$_t"
+done
+SCRUBBED="$SHIMS"
+IFS=':' read -r -a _dirs <<<"$PATH"
+for _d in "${_dirs[@]}"; do
+  [ -n "$_d" ] || continue
+  [ -x "$_d/pnpm" ] && continue
+  SCRUBBED="$SCRUBBED:$_d"
+done
+want "C scrub proof: pnpm absent, needed tools present on the scrubbed PATH" \
+  "! PATH=\"$SCRUBBED\" command -v pnpm >/dev/null 2>&1 && PATH=\"$SCRUBBED\" command -v node >/dev/null && PATH=\"$SCRUBBED\" command -v python3 >/dev/null"
+run_setup "$SB/home-c" "$SB/proj-c" "$SCRUBBED" "$ABSENT"
+want "C: installed setup needs no pnpm to decide/compose — summary reached, no Missing-command refusal [QK:SETUP-INSTALLED-NO-PNPM]" \
+  "printf '%s' \"\$OUT\" | grep -q 'setup summary (computed from component outcomes)' && ! printf '%s' \"\$OUT\" | grep -q 'Missing command: pnpm'"
+
+# ── Cell D: copilot PRESENT, vendor lists failing — independence + no cosmetic PASS ──
+# A two-line always-failing vendor is enough here: the birth installer dies at its
+# read-only `plugin list` preflight (UNKNOWN, never absence), while the three writer
+# units never touch the vendor and land in the sandbox. Behavior evidence for the
+# full success composition lives in smoke-setup-verdict S-6 / check-pack-install.
+BROKEN="$SB/broken-vendor"; mkdir -p "$BROKEN"
+printf '#!/usr/bin/env bash\necho "not authenticated" >&2\nexit 1\n' > "$BROKEN/copilot"
+chmod +x "$BROKEN/copilot"
+run_setup "$SB/home-d" "$SB/proj-d" "$BROKEN:$SB/bin:$PATH" "$ABSENT" "$BROKEN/copilot"
+want "D: a failed birth leaves the other three units attempted with their own rows [QK:SETUP-COPILOT-INDEPENDENT]" \
+  "printf '%s' \"\$OUT\" | grep -q 'copilot-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'copilot-receive: PASS' && printf '%s' \"\$OUT\" | grep -q 'copilot-statusline: PASS'"
+want "D: the failing-vendor birth is a named FAIL, never a cosmetic PASS [QK:SETUP-COPILOT-COSMETIC-PASS]" \
+  "printf '%s' \"\$OUT\" | grep -q 'copilot-birth: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'copilot-birth: PASS'"
+want "D control: detected copilot never reads SKIP, and the summary names copilot-birth NON-GREEN" \
+  "! printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN' && printf '%s' \"\$OUT\" | grep -q 'copilot-birth'"
+
+echo ""
+echo "check-setup-qualification: $PASS checks passed (mutation-attribution oracle only — behavior evidence lives in smoke-setup-verdict and check-pack-install)"