@junghanacs/entwurf 0.15.0 → 0.16.0

package/scripts/copilot-bridge-doctor.sh

@@ -40,96 +40,122 @@ PLUGIN="entwurf-meta-receive-copilot"
 QUALIFIED="$PLUGIN@$MKT_NAME"
 STALE_CLAUDE_UNIT="entwurf-meta-receive@meta-bridge-local"
 ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge-copilot/.assembled"
+STATE_FILE="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/copilot-bridge/install-state.json"
 AGENT_DIR="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
 SESSIONS_DIR="$AGENT_DIR/meta-sessions"
 HOOK_LOG="$AGENT_DIR/meta-bridge-hook.log"
 
+# RUNTIME truth and OWNERSHIP truth are separate axes (#86 C3a, same discipline as
+# doctor-pi-package): a visibly working registration does not prove entwurf owns it,
+# and a broken ownership record does not erase working runtime configuration. Either
+# required axis red makes the final verdict red.
 fail=0
-ok()   { echo "  ok    $*"; }
-bad()  { echo "  FAIL  $*"; fail=1; }
-note() { echo "  note  $*"; }
+own_fail=0
+ok()    { echo "  ok    $*"; }
+bad()   { echo "  FAIL  $*"; fail=1; }
+badown(){ echo "  FAIL  $*"; own_fail=1; }
+note()  { echo "  note  $*"; }
+
+# Shared with the installer and the inverse: one structural oracle, one state
+# validator, one exact list-row grammar — three surfaces, zero drifting copies.
+# shellcheck source=copilot-bridge-oracle.sh
+. "$HERE/copilot-bridge-oracle.sh"
 
 echo "[copilot-bridge-doctor] toolchain"
 command -v copilot >/dev/null 2>&1 && ok "copilot CLI on PATH" || bad "copilot CLI missing from PATH"
 command -v node >/dev/null 2>&1 && ok "node on PATH" || bad "node missing from PATH"
 
 echo "[copilot-bridge-doctor] assembled artifact"
-if [ -d "$ASM/$PLUGIN" ]; then
-  ok "assembly present at $ASM"
+# The SAME structural oracle the installer's adoption preflight and the inverse use
+# (C3a amendment, B defect 1): launcher presence/bake, live baked node and hook
+# entry, capability registry at the plugin root, and the native baked hooks.json form
+# are all ONE parser in copilot-bridge-oracle.sh — the doctor keeps no second copy
+# that could drift from what install/adopt actually accepts. The oracle prints its
+# first failing reason, which is surfaced verbatim.
+if ORACLE_REASON="$(copilot_assembly_valid "$ASM" "$PLUGIN" 2>&1)"; then
+  ok "assembly at $ASM passes the shared structural oracle (baked launcher, live node + hook entry, capability registry, native hooks.json)"
 else
-  bad "assembly missing at $ASM — run ./run.sh install-copilot-bridge"
+  bad "assembly fails the shared structural oracle: ${ORACLE_REASON:-no reason printed} — run ./run.sh install-copilot-bridge"
 fi
 
-LAUNCHER="$ASM/$PLUGIN/scripts/copilot-hook-launch.sh"
-HOOKS="$ASM/$PLUGIN/hooks/hooks.json"
-if [ -x "$LAUNCHER" ]; then
-  ok "launcher present and executable"
-  # The exec form names the launcher as THE executable — a lost +x bit is ENOEXEC at
-  # first prompt, not a degraded path.
-  if grep -q "__NODE_BIN__\|__HOOK_ENTRY__" "$LAUNCHER"; then
-    bad "launcher still carries an installer placeholder (bake did not run)"
+echo "[copilot-bridge-doctor] copilot wiring"
+# A failing list is UNKNOWN, never an absence (#86 C3a): reporting "not installed" off
+# a broken/unauthenticated CLI would send the operator to reinstall over a host whose
+# real contents nobody read.
+QUALIFIED_REGISTERED=0
+LISTED_VERSION=""
+if ! PLUGIN_LIST="$(copilot plugin list 2>/dev/null)"; then
+  bad "'copilot plugin list' failed — this host's installed plugins are UNKNOWN (not empty); fix the Copilot CLI error and re-run"
+  PLUGIN_LIST=""
+else
+  # EXACT row read with its version captured: a substring read would accept a longer id
+  # that merely contains ours, and a malformed/ambiguous listing is something nobody
+  # may act on. WHAT A MATCH DOES NOT PROVE: Copilot exposes no load/execution receipt,
+  # so a listing says the plugin is REGISTERED, never that Copilot loaded this unit or
+  # will invoke its hook. Only a real first prompt settles that — see birth evidence.
+  if LISTED_ROW="$(copilot_exact_row_version "$PLUGIN_LIST" "$QUALIFIED" 2>&1)"; then
+    if [ "$LISTED_ROW" = "absent" ]; then
+      bad "$QUALIFIED is NOT installed in Copilot — run ./run.sh install-copilot-bridge"
+    else
+      QUALIFIED_REGISTERED=1
+      LISTED_VERSION="${LISTED_ROW#one }"
+      ok "$QUALIFIED (v$LISTED_VERSION) is registered in Copilot (registration, not proof it is loaded)"
+    fi
   else
-    ok "launcher is baked (no placeholders)"
-    BAKED_NODE="$(sed -n 's/^NODE_BIN="\(.*\)"$/\1/p' "$LAUNCHER" | head -1)"
-    [ -x "$BAKED_NODE" ] && ok "baked node exists: $BAKED_NODE" \
-      || bad "baked node is missing or not executable: ${BAKED_NODE:-(unparsed)} — node moved (NixOS store churn?); reinstall"
-    BAKED_ENTRY="$(sed -n 's|^HOOK_ENTRY="\$PLUGIN_ROOT/\(.*\)"$|\1|p' "$LAUNCHER" | head -1)"
-    [ -n "$BAKED_ENTRY" ] && [ -f "$ASM/$PLUGIN/$BAKED_ENTRY" ] && ok "hook entry present: $BAKED_ENTRY" \
-      || bad "hook entry missing beside the launcher: ${BAKED_ENTRY:-(unparsed)}"
+    bad "the plugin listing for $QUALIFIED is malformed or ambiguous: $LISTED_ROW"
   fi
-else
-  bad "launcher missing or not executable: $LAUNCHER"
+  case "$PLUGIN_LIST" in
+    *"$STALE_CLAUDE_UNIT"*)
+      bad "the Claude unit '$STALE_CLAUDE_UNIT' is still installed in Copilot — it fires on every prompt and exits 1 before node starts (Copilot's schema has no args key). Re-run the installer without --keep-stale-claude-unit." ;;
+    *) ok "the Claude unit is not installed in Copilot" ;;
+  esac
 fi
 
-[ -f "$ASM/$PLUGIN/entwurf-capabilities.json" ] \
-  && ok "capability registry travels at the plugin root (every mint reads it)" \
-  || bad "capability registry missing at the plugin root — every mint would throw"
-
-if [ -f "$HOOKS" ]; then
-  HOOKS_PATH="$HOOKS" ASM_LAUNCHER="$LAUNCHER" python3 - <<'PY'
-import json, os, sys
-from pathlib import Path
-hooks = json.loads(Path(os.environ["HOOKS_PATH"]).read_text(encoding="utf-8"))
-launcher = os.environ["ASM_LAUNCHER"]
-problems = []
-if hooks.get("version") != 1:
-    problems.append("hooks.json root `version` must be the literal 1 (Copilot rejects the plugin otherwise)")
-events = hooks.get("hooks") or {}
-if set(events) != {"sessionStart", "userPromptSubmitted"}:
-    problems.append(f"hook events drifted: {sorted(events)} — want exactly ['sessionStart', 'userPromptSubmitted']")
-for name, entries in events.items():
-    for i, entry in enumerate(entries if isinstance(entries, list) else []):
-        exec_value = entry.get("exec")
-        if not isinstance(exec_value, str):
-            problems.append(f"hooks.{name}[{i}].exec must be a STRING (an array is rejected at plugin load)")
-        elif exec_value != launcher:
-            problems.append(f"hooks.{name}[{i}].exec does not point at the assembled launcher: {exec_value}")
-        if "args" in entry:
-            problems.append(f"hooks.{name}[{i}] carries `args`, which Copilot's schema has no key for")
-for p in problems:
-    print(f"  FAIL  {p}")
-sys.exit(1 if problems else 0)
-PY
-  [ $? -eq 0 ] && ok "hooks.json is the Copilot native form, baked at the assembled launcher" || fail=1
+echo "[copilot-bridge-doctor] ownership (package-owned state; separate axis from runtime)"
+if ! MKT_LIST="$(copilot plugin marketplace list 2>/dev/null)"; then
+  badown "'copilot plugin marketplace list' failed — this host's marketplaces are UNKNOWN (not empty); fix the Copilot CLI error and re-run"
+  MKT_LIST=""
 else
-  bad "hooks.json missing: $HOOKS"
+  # The SAME marketplace-row grammar install/inverse refuse on (C3a amendment, B
+  # defects 1+2): a malformed, non-Local, or DUPLICATE same-named listing is a red
+  # ownership fact here, never "the first row".
+  if MKT_ROW="$(copilot_marketplace_local_path "$MKT_LIST" "$MKT_NAME" 2>&1)"; then
+    if [ "$MKT_ROW" = "absent" ]; then
+      note "marketplace $MKT_NAME is not registered (consistent with an uninstalled or partially installed host)"
+    else
+      MKT_PATH="${MKT_ROW#one }"
+      if [ "$MKT_PATH" = "$ASM" ]; then
+        ok "marketplace $MKT_NAME is registered at this package's assembly path"
+      else
+        badown "marketplace '$MKT_NAME' is registered at '$MKT_PATH', not at $ASM — ownership drift; that registration is not provably ours"
+      fi
+    fi
+  else
+    badown "the marketplace listing for '$MKT_NAME' is malformed, non-Local, or duplicated: $MKT_ROW"
+  fi
+fi
+if [ -L "$STATE_FILE" ]; then
+  badown "ownership state $STATE_FILE is a symlink — not a trustworthy record"
+elif [ -f "$STATE_FILE" ]; then
+  # The SAME fail-closed validator the installer and the inverse use (exact keyset,
+  # exact types, constants + effective-ASM binding, no flag coercion).
+  if STATE_VERDICT="$(copilot_state_read "$STATE_FILE" "$QUALIFIED" "$MKT_NAME" "$ASM" 2>&1)"; then
+    ok "ownership state present and bound to this installation (ownedMarketplace/ownedAssembly/pluginVersion: $STATE_VERDICT)"
+    # version drift (final amendment): the vendor lists an exact row at a version the
+    # ownership record did not install — the inverse would refuse, so the doctor names
+    # it now instead of letting the operator discover it there.
+    STATE_PLUGIN_VERSION="$(printf '%s' "$STATE_VERDICT" | cut -d' ' -f3)"
+    if [ -n "$LISTED_VERSION" ] && [ "$LISTED_VERSION" != "$STATE_PLUGIN_VERSION" ]; then
+      badown "version drift — $QUALIFIED is listed at v$LISTED_VERSION but the ownership state recorded v$STATE_PLUGIN_VERSION; repair: './run.sh install-copilot-bridge' re-binds ownership"
+    fi
+  else
+    badown "ownership state is corrupt or names a different installation: $STATE_VERDICT — inspect $STATE_FILE"
+  fi
+elif [ "$QUALIFIED_REGISTERED" -eq 1 ]; then
+  badown "LEGACY no-state installation: $QUALIFIED is registered but no ownership state exists — repair: './run.sh install-copilot-bridge' (same-host adoption binds the state)"
+else
+  note "no ownership state (nothing this package records as installed here)"
 fi
-
-echo "[copilot-bridge-doctor] copilot wiring"
-PLUGIN_LIST="$(copilot plugin list 2>/dev/null)"
-case "$PLUGIN_LIST" in
-  *"$QUALIFIED"*)
-    # WHAT THIS DOES NOT PROVE. Copilot exposes no load/execution receipt, so a listing
-    # says the plugin is REGISTERED, never that Copilot loaded this unit or will invoke
-    # its hook. Only a real first prompt settles that — see the birth-evidence section.
-    ok "$QUALIFIED is registered in Copilot (registration, not proof it is loaded)" ;;
-  *) bad "$QUALIFIED is NOT installed in Copilot — run ./run.sh install-copilot-bridge" ;;
-esac
-case "$PLUGIN_LIST" in
-  *"$STALE_CLAUDE_UNIT"*)
-    bad "the Claude unit '$STALE_CLAUDE_UNIT' is still installed in Copilot — it fires on every prompt and exits 1 before node starts (Copilot's schema has no args key). Re-run the installer without --keep-stale-claude-unit." ;;
-  *) ok "the Claude unit is not installed in Copilot" ;;
-esac
 
 echo "[copilot-bridge-doctor] birth evidence"
 COPILOT_RECORDS=0
@@ -202,8 +228,15 @@ else
 fi
 
 echo
-if [ "$fail" -ne 0 ]; then
+# The two axes are reported separately and either red is a red verdict (#86 C3a):
+# runtime coverage does not prove ownership, and broken ownership does not erase
+# visibly working runtime configuration.
+if [ "$fail" -ne 0 ] || [ "$own_fail" -ne 0 ]; then
+  [ "$fail" -ne 0 ] && echo "[copilot-bridge-doctor] runtime axis: FAIL" || echo "[copilot-bridge-doctor] runtime axis: PASS"
+  [ "$own_fail" -ne 0 ] && echo "[copilot-bridge-doctor] ownership axis: FAIL" || echo "[copilot-bridge-doctor] ownership axis: PASS"
   echo "[copilot-bridge-doctor] FAIL"
   exit 1
 fi
+echo "[copilot-bridge-doctor] runtime axis: PASS"
+echo "[copilot-bridge-doctor] ownership axis: PASS"
 echo "[copilot-bridge-doctor] PASS"

package/scripts/copilot-bridge-install.sh

@@ -45,6 +45,12 @@ ASM="${ENTWURF_COPILOT_ASM:-${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-br
 # the unit THIS repo installed (cross-review, terra).
 STALE_CLAUDE_UNIT="entwurf-meta-receive@meta-bridge-local"
 QUALIFIED="$PLUGIN@$MKT_NAME"
+# Package-owned ownership state (#86 C3a): the birth unit gets the same discipline the
+# MCP/receiver/footer units already have. The state names exactly what this installer
+# owns — the qualified plugin id, the marketplace name, and the assembly root — so the
+# inverse can remove precisely that and nothing else. No credential, no preimage.
+STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/copilot-bridge"
+STATE_FILE="$STATE_DIR/install-state.json"
 KEEP_STALE=0
 # --assemble-only stops after the assembly, before the Copilot CLI is touched. It is
 # how the gate reaches the real bake on a host (and in CI) that has no Copilot.
@@ -77,6 +83,140 @@ NODE_MAJOR="$("$NODE_BIN" -p 'process.versions.node.split(".")[0]' 2>/dev/null |
 # inside Copilot, where nothing surfaces it. Refuse here instead.
 [ "$NODE_MAJOR" -ge 24 ] 2>/dev/null || die "node >= 24 is required (package engines); resolved $NODE_BIN reports major '$NODE_MAJOR'."
 
+# shellcheck source=copilot-bridge-oracle.sh
+. "$HERE/copilot-bridge-oracle.sh"
+
+if [ "$ASSEMBLE_ONLY" -eq 1 ]; then
+  # --assemble-only is a GATE-ONLY path that deliberately writes no ownership state, so
+  # it must never touch the LIVE assembly: without a state, a rebuilt live assembly
+  # would drift from what the state/marketplace record. Require the explicit temp
+  # override its callers already pass, BEFORE any assembly mutation (amendment,
+  # 2026-08-27).
+  DEFAULT_ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge-copilot/.assembled"
+  if [ -z "${ENTWURF_COPILOT_ASM:-}" ]; then
+    die "--assemble-only requires an explicit ENTWURF_COPILOT_ASM (a temp dir): this gate-only path writes no ownership state and must not rebuild the live assembly."
+  fi
+  if [ "$(python3 -c 'import os,sys;print(os.path.abspath(sys.argv[1]))' "$ENTWURF_COPILOT_ASM")" = \
+       "$(python3 -c 'import os,sys;print(os.path.abspath(sys.argv[1]))' "$DEFAULT_ASM")" ]; then
+    die "--assemble-only refuses the DEFAULT live assembly path ($DEFAULT_ASM): pass a temp ENTWURF_COPILOT_ASM instead."
+  fi
+fi
+
+# The shipped plugin version travels into the ownership state so the post-install list
+# evidence and the doctor can join on it.
+PLUGIN_VERSION="$(python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['version'])" "$SRC/$PLUGIN/.claude-plugin/plugin.json")" \
+  || die "could not read the shipped plugin version from $SRC/$PLUGIN/.claude-plugin/plugin.json"
+# C3a amendment (B defect 4): the version rides space-separated state facts and exact
+# list rows, so a shipped version carrying whitespace/control (or nothing at all)
+# would truncate into a fabricated value downstream. Refuse it at the source.
+case "$PLUGIN_VERSION" in
+  ""|*[![:graph:]]*) die "shipped plugin version ${PLUGIN_VERSION:-<empty>} is empty or carries whitespace/control characters — it must be one printable token (it travels through space-separated fact transports and exact list rows)." ;;
+esac
+
+# Atomic state writer: regular file, temp+rename, exact schema. `ownedMarketplace`
+# flips false→true around the marketplace add so a partial failure leaves an honest
+# record of what is actually owned.
+write_state() { # $1 = ownedMarketplace (true|false)
+  mkdir -p "$STATE_DIR"
+  STATE_FILE_ENV="$STATE_FILE" QUALIFIED_ENV="$QUALIFIED" MKT_ENV="$MKT_NAME" ASM_ENV="$ASM" \
+  PLUGIN_VERSION_ENV="$PLUGIN_VERSION" OWNED_MKT_ENV="$1" python3 - <<'PY' || die "could not write the ownership state at $STATE_FILE"
+import json, os, tempfile
+state_file = os.environ["STATE_FILE_ENV"]
+state = {
+    "schemaVersion": 1,
+    "qualifiedId": os.environ["QUALIFIED_ENV"],
+    "marketplaceName": os.environ["MKT_ENV"],
+    "assemblyPath": os.path.abspath(os.environ["ASM_ENV"]),
+    "pluginVersion": os.environ["PLUGIN_VERSION_ENV"],
+    "ownedMarketplace": os.environ["OWNED_MKT_ENV"] == "true",
+    "ownedAssembly": True,
+    "installedAt": __import__("datetime").datetime.now(__import__("datetime").timezone.utc).isoformat(),
+}
+fd, tmp = tempfile.mkstemp(dir=os.path.dirname(state_file), prefix=".install-state.")
+with os.fdopen(fd, "w") as fh:
+    json.dump(state, fh, indent=2)
+    fh.write("\n")
+os.replace(tmp, state_file)
+PY
+}
+
+# ── 0. vendor ownership preflight (READ-ONLY; #86 C3a) ────────────────────────
+# Every destructive vendor step below is licensed HERE, from `plugin list` +
+# `plugin marketplace list` plus the ownership state — a failing list is UNKNOWN and
+# refuses (an unknown host is not an empty one), a same-named marketplace at another
+# path is someone else's and refuses, and a no-state host adopts an existing exact
+# QUALIFIED only when the listed marketplace path is OUR effective assembly AND that
+# assembly passes the doctor's structural oracle. Refusals here are zero-write: no
+# assembly rebuild, no state, no vendor mutation.
+MKT_PREREGISTERED=0
+QUALIFIED_LISTED=0
+INSTALLED_LIST=""
+if [ "$ASSEMBLE_ONLY" -eq 0 ]; then
+  if ! INSTALLED_LIST="$(copilot plugin list 2>/dev/null)"; then
+    die "'copilot plugin list' failed, so this host's installed plugins are UNKNOWN — refusing before any write. Fix the Copilot CLI error and re-run."
+  fi
+  if ! MKT_LIST="$(copilot plugin marketplace list 2>/dev/null)"; then
+    die "'copilot plugin marketplace list' failed, so this host's marketplaces are UNKNOWN — refusing before any write. Fix the Copilot CLI error and re-run."
+  fi
+  # EXACT row membership (amendment): a substring match would let `$QUALIFIED-extra`
+  # or `prefix-$QUALIFIED` from someone else authorize the adoption/uninstall branches.
+  # ANY exact version is accepted here — a reinstall over an older shipped version is
+  # exactly the bounded upgrade path (the version is recorded below and the sequence
+  # still runs the loud exact uninstall first) — but a malformed or ambiguous listing
+  # is something nobody may act on and refuses.
+  LISTED_ROW="$(copilot_exact_row_version "$INSTALLED_LIST" "$QUALIFIED")" \
+    || die "the 'copilot plugin list' rows for $QUALIFIED are malformed or ambiguous (see above) — refusing before any write."
+  if [ "$LISTED_ROW" != "absent" ]; then
+    QUALIFIED_LISTED=1
+    echo "[copilot-bridge-install] $QUALIFIED currently listed at ${LISTED_ROW#one } (shipped: v$PLUGIN_VERSION) — bounded upgrade via loud exact uninstall"
+  fi
+  # ONE marketplace-row grammar (C3a amendment, B defects 1+2): the shared oracle
+  # parses the measured `<name> (Local: <abs path>)` form, refuses a non-Local or
+  # garbled row, and refuses DUPLICATE same-named rows instead of silently taking the
+  # first — a second marketplace with our name could otherwise steer every path check
+  # at the wrong target. The exact registered path is what ownership joins on.
+  MKT_ROW="$(copilot_marketplace_local_path "$MKT_LIST" "$MKT_NAME")" \
+    || die "the 'copilot plugin marketplace list' rows for '$MKT_NAME' are malformed, non-Local, or duplicated (see above) — refusing before any write."
+  if [ "$MKT_ROW" != "absent" ]; then
+    MKT_PREREGISTERED=1
+    MKT_PATH="${MKT_ROW#one }"
+    if [ "$MKT_PATH" != "$ASM" ]; then
+      die "a marketplace named '$MKT_NAME' is registered at '$MKT_PATH', not at this install's assembly ($ASM). That registration is not provably ours — zero writes. Inspect with 'copilot plugin marketplace list' and remove it manually if it is stale."
+    fi
+  fi
+
+  if [ -L "$STATE_FILE" ]; then
+    die "ownership state $STATE_FILE is a symlink — refusing to trust or overwrite it."
+  fi
+  if [ -f "$STATE_FILE" ]; then
+    # The ONE fail-closed schema/constants/binding validator, shared with the inverse
+    # and the doctor (copilot_state_read in the oracle) — exact keyset, exact types,
+    # no flag coercion. pluginVersion equality with the shipped version is deliberately
+    # NOT required here: a state written by an older shipped version is exactly the
+    # upgrade-reinstall case.
+    copilot_state_read "$STATE_FILE" "$QUALIFIED" "$MKT_NAME" "$ASM" >/dev/null \
+      || die "ownership state $STATE_FILE is corrupt or names a different installation (see above) — refusing with zero writes. Inspect it, or remove it manually if it is stale."
+    echo "[copilot-bridge-install] ownership state matches this installation (reinstall/repair)"
+  else
+    # No state. Adoption is EXPLICIT and narrow; anything else that already exists and
+    # cannot be proven ours refuses with zero writes.
+    if [ "$QUALIFIED_LISTED" -eq 1 ]; then
+      if [ "$MKT_PREREGISTERED" -eq 1 ] && copilot_assembly_valid "$ASM" "$PLUGIN"; then
+        echo "[copilot-bridge-install] adopting the legacy no-state installation ($QUALIFIED at $ASM; structural oracle green)"
+      else
+        die "'$QUALIFIED' is installed but carries no ownership state and its assembly/marketplace does not prove it ours (marketplace at ASM: $MKT_PREREGISTERED; structural oracle above). Refusing with zero writes — inspect 'copilot plugin list' / '$ASM' manually."
+      fi
+    elif [ "$MKT_PREREGISTERED" -eq 1 ]; then
+      if copilot_assembly_valid "$ASM" "$PLUGIN"; then
+        echo "[copilot-bridge-install] adopting the legacy marketplace registration ($MKT_NAME at $ASM, plugin not installed; structural oracle green)"
+      else
+        die "marketplace '$MKT_NAME' is registered at this install's assembly path but that assembly fails the structural oracle (see above) and no ownership state exists. Refusing with zero writes — remove the marketplace manually ('copilot plugin marketplace remove $MKT_NAME'), then re-run."
+      fi
+    fi
+    # fresh host (both absent): proceed.
+  fi
+fi
+
 # Same install-shape split as the Claude installer: an installed package lives below
 # node_modules where Node refuses strip-types on `.ts`, so it runs the tsc-emitted
 # closure; a dev clone (and the XDG artifact) runs the `.ts` source.
@@ -179,22 +319,21 @@ if [ "$ASSEMBLE_ONLY" -eq 1 ]; then
   exit 0
 fi
 
+# Ownership state BEFORE any vendor mutation (#86 C3a): once the complete assembly is
+# published, the state exists so every partial vendor failure below leaves a repair and
+# inverse authority behind. `ownedMarketplace` starts true only when the preflight
+# matched/adopted the exact registration; otherwise it flips true after the add. The
+# state is never deleted on a later failure — rerunning this installer is the repair.
+if [ "$MKT_PREREGISTERED" -eq 1 ]; then write_state true; else write_state false; fi
+echo "[copilot-bridge-install] ownership state written: $STATE_FILE"
+
 # --- 2. retire the stale Claude unit from Copilot ---------------------------
 # It is ours, it fires on every Copilot prompt, and it exits 1 before node starts.
 # Leaving it installed means the operator keeps paying for a hook that cannot work.
+# The installed-plugin list was captured (and its failure refused) by the shared
+# read-only preflight above — an unknown list never reaches this branch.
+# INSTALL-ONLY territory: the inverse never touches this unit.
 if [ "$KEEP_STALE" -eq 0 ]; then
-  # ASK FIRST, then act. Treating every nonzero uninstall as "not present" would report
-  # a CLI, config or permission failure as an absence and then install on top of a unit
-  # that is still firing (cross-review, terra). `copilot plugin list` prints the
-  # QUALIFIED id, which is also what distinguishes our unit from a same-named plugin
-  # somebody else installed from another marketplace.
-  # The LIST failing is not an empty list. `|| true` would hand the "nothing installed"
-  # arm a broken, unauthenticated or permission-denied Copilot CLI and then install on
-  # top of whatever is really there (cross-review, terra). The assignment IS the
-  # condition so `set -e` cannot kill us before we can say why.
-  if ! INSTALLED_LIST="$(copilot plugin list 2>/dev/null)"; then
-    die "'copilot plugin list' failed, so this host's installed plugins are UNKNOWN. An unknown list is not an empty one — the stale Claude unit may still be firing. Fix the Copilot CLI error, or re-run with --keep-stale-claude-unit to skip this check deliberately."
-  fi
   case "$INSTALLED_LIST" in
     *"$STALE_CLAUDE_UNIT"*)
       copilot plugin uninstall "$STALE_CLAUDE_UNIT" >/dev/null \
@@ -208,17 +347,38 @@ if [ "$KEEP_STALE" -eq 0 ]; then
 fi
 
 # --- 3. (re)register the marketplace and install ----------------------------
-copilot plugin uninstall "$QUALIFIED" >/dev/null 2>&1 || true
-copilot plugin marketplace remove "$MKT_NAME" >/dev/null 2>&1 || true
-copilot plugin marketplace add "$ASM" >/dev/null || die "'copilot plugin marketplace add $ASM' failed."
-copilot plugin install "$QUALIFIED" >/dev/null || die "'copilot plugin install $QUALIFIED' failed."
+# LOUD, in a bounded order, licensed by the preflight (#86 C3a): the old blind
+# `|| true` pair could swallow a real vendor failure and then report a working
+# install. Each step now acts only when the preflight saw its subject, and a failure
+# is an honest partial failure — state and assembly stay for the rerun-repair.
+# `--force` is forbidden: `marketplace remove --force` uninstalls that marketplace's
+# plugins as a side effect (measured 2026-08-27), and no entwurf writer takes that
+# shortcut.
+if [ "$QUALIFIED_LISTED" -eq 1 ]; then
+  copilot plugin uninstall "$QUALIFIED" >/dev/null \
+    || die "'copilot plugin uninstall $QUALIFIED' failed — honest partial failure; state and assembly are retained, re-run to repair."
+fi
+if [ "$MKT_PREREGISTERED" -eq 1 ]; then
+  copilot plugin marketplace remove "$MKT_NAME" >/dev/null \
+    || die "'copilot plugin marketplace remove $MKT_NAME' failed (never retried with --force) — honest partial failure; state and assembly are retained, re-run to repair."
+fi
+copilot plugin marketplace add "$ASM" >/dev/null || die "'copilot plugin marketplace add $ASM' failed — state and assembly are retained, re-run to repair."
+write_state true
+copilot plugin install "$QUALIFIED" >/dev/null || die "'copilot plugin install $QUALIFIED' failed — state and assembly are retained, re-run to repair."
 
 # --- 4. evidence ------------------------------------------------------------
 echo "--- copilot plugin list ---"
-# The qualified id, not the bare name: a bare grep would be satisfied by a same-named
-# plugin from another marketplace and report an install that never happened.
-copilot plugin list 2>/dev/null | grep -F "$QUALIFIED" || die "post-install: $QUALIFIED is not in 'copilot plugin list' (install did not take)."
+# The qualified id AND the shipped version as an EXACT row: a bare-name or substring
+# grep would be satisfied by a same-named plugin from another marketplace, a stale
+# version this run did not install, or a longer id that merely contains ours (list
+# shape measured on copilot 1.0.80).
+POST_LIST="$(copilot plugin list 2>/dev/null)" || die "post-install: 'copilot plugin list' failed — the install evidence is UNKNOWN."
+POST_ROW="$(copilot_exact_row_version "$POST_LIST" "$QUALIFIED")" \
+  || die "post-install: the 'copilot plugin list' rows for $QUALIFIED are malformed or ambiguous (see above)."
+[ "$POST_ROW" = "one $PLUGIN_VERSION" ] \
+  || die "post-install: want exactly one '$QUALIFIED (v$PLUGIN_VERSION)' row, got '$POST_ROW' (install did not take)."
+echo "$QUALIFIED (v$PLUGIN_VERSION) registered"
 echo
 echo "[copilot-bridge-install] DONE. A Copilot session becomes a citizen on its FIRST PROMPT,"
 echo "not when the window opens — sessionStart is deferred to the first prompt (measured)."
-echo "Verify with: ./run.sh doctor-copilot-bridge"
+echo "Verify with: ./run.sh doctor-copilot-bridge · inverse: ./run.sh uninstall-copilot-bridge"