@junghanacs/entwurf 0.15.0 → 0.16.0

package/scripts/smoke-omp-receive-live.ts

@@ -0,0 +1,340 @@
+/**
+ * smoke-omp-receive-live — the LIVE acceptance for #87 bundle B: another harness wakes an
+ * ALREADY-OPEN, IDLE omp citizen, which reads its own inbox in that same native session
+ * and answers there.
+ *
+ * IT DECIDES ITS OWN OUTCOME FROM THE CAPABILITY REGISTRY, never from a hardcoded verdict:
+ *
+ *   registry says omp has no drainable mailbox  → protocol SKIP (97). Honest: there is no
+ *       receiver rail to accept, so no addressed receive can be attempted. An unattended
+ *       `release-gate` reports it; `--cut` reads it as RED, which is what makes "no cut
+ *       while the garden is one-way for omp" executable rather than prose.
+ *   registry claims the rail and LIVE≠1        → protocol SKIP, naming LIVE=1. This step
+ *       opens a real omp TUI and spends a real model turn.
+ *   registry claims the rail and LIVE=1        → run the real acceptance below. Any
+ *       missing prerequisite here is a FAIL, not a skip: a registry that promises a wake
+ *       has already made the claim this step exists to check.
+ *
+ * WHY IT OPENS THE TUI ITSELF, AND WHY THAT IS NOT BUNDLE C. omp cannot be opened by
+ * `entwurf_fresh_call` — visible fresh is step 9 and a separate admission. But the thing
+ * under test is receive, not launch, so this step drives a plain tmux-hosted `omp` as TEST
+ * SCAFFOLDING: no nonce callback, no garden id correlation through a launch surface, no
+ * managed-runtime claim. It learns the citizen's id the way any observer would, by reading
+ * the receiver's own log. `smoke-mux-lifecycle-live` is the precedent for a release MUST
+ * that opens real windows and spends turns.
+ *
+ * WHAT IT PROVES, IN ORDER — each one a separate assertion because each fails differently:
+ *   1. an idle omp TUI ARMS a receiver marker joined to the citizen birth minted in the
+ *      same process (the marker read through the production reader, never a filename);
+ *   2. dispatch from another harness ROUTES to the mailbox instead of refusing;
+ *   3. the doorbell RINGS on a session with zero typing;
+ *   4. the model DRAINS its own inbox — `lastReadAt` moves after `lastEnqueuedAt`, which
+ *      is the honest receipt a rung doorbell alone is not;
+ *   5. the drain happened INSIDE that native session — read from the citizen's own
+ *      transcript, which is the vendor's record of what that session did.
+ *
+ * WHAT IT DELIBERATELY DOES NOT ASSERT, AND WHY THAT MATTERS. An earlier draft asked the
+ * model to echo a nonce back and failed: `[LIVE 2026-08-30]` the model drained the inbox,
+ * recorded the receipt, and then answered *"Its acceptance instruction was unverified, so
+ * no token was sent."* It was right, and it was obeying OUR OWN doorbell, which tells it
+ * to treat mailbox bodies as untrusted data and not act on unverified imperatives inside
+ * them. An acceptance that requires the model to break that rule is an acceptance aimed at
+ * our own security contract, and it would go green only on a model careless enough to
+ * fail it. So the receipt this step accepts is the one the contract actually promises:
+ * the read, recorded by the tool and visible in that session's transcript.
+ */
+import { type ChildProcess, execFileSync, spawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { loadMetaCapabilityRegistry, ompMetaRoots } from "../pi-extensions/lib/meta-session.ts";
+import { skipLive } from "./lib/live-skip.ts";
+
+const LABEL = "smoke-omp-receive-live";
+const REPO = path.resolve(import.meta.dirname, "..");
+const DIST_ENTRY = path.join(REPO, "mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js");
+const TMUX_SESSION = `entwurf-omp-recv-${process.pid}`;
+
+let passed = 0;
+function ok(label: string, cond: boolean, detail = ""): void {
+	if (!cond) {
+		console.error(`  FAIL  ${label}${detail ? `\n${detail}` : ""}`);
+		teardown();
+		process.exit(1);
+	}
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function fail(message: string): never {
+	console.error(`[${LABEL}] ${message}`);
+	teardown();
+	process.exit(1);
+}
+
+function sh(cmd: string, args: string[]): string {
+	return execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+function tmux(...args: string[]): string {
+	return sh("tmux", args);
+}
+function teardown(): void {
+	try {
+		tmux("kill-session", "-t", TMUX_SESSION);
+	} catch {
+		/* the session may never have started; teardown is best-effort */
+	}
+}
+
+/** Poll a predicate on a real clock. LIVE steps wait on other processes, so this is a
+ * genuine wait rather than the busy-loop a hermetic gate would refuse. */
+async function until<T>(what: string, timeoutMs: number, probe: () => T | null): Promise<T> {
+	const deadline = Date.now() + timeoutMs;
+	for (;;) {
+		const got = probe();
+		if (got !== null && got !== undefined) return got;
+		if (Date.now() > deadline) fail(`timed out after ${timeoutMs}ms waiting for ${what}`);
+		await new Promise((r) => setTimeout(r, 250));
+	}
+}
+
+// ── 1. the registry decides whether this step has anything to accept ─────────
+const wakeMode = (() => {
+	try {
+		return loadMetaCapabilityRegistry().backends.omp?.wakeMode ?? "ABSENT";
+	} catch (err) {
+		fail(`capability registry unreadable: ${String(err)}`);
+	}
+})();
+
+if (wakeMode !== "self-fetch") {
+	skipLive(
+		LABEL,
+		`omp declares wakeMode=${wakeMode}, so it has no drainable mailbox and no receiver rail exists to accept (#87 bundle B). ` +
+			"OMP is outbound-only under that label: it sends under its own garden id and NOTHING can reply, which dispatch reports as " +
+			"mailbox-undeliverable. That is a designed boundary, not a defect — and it is why a cut taken now would ship a one-way harness. " +
+			"Close it by landing the receiver unit and moving wakeMode, which makes this step demand the real roundtrip receipt below.",
+	);
+}
+if (process.env.LIVE !== "1") {
+	skipLive(
+		LABEL,
+		"set LIVE=1 to run — this step opens a real omp TUI in tmux and spends one model turn on the operator's configured omp model.",
+	);
+}
+
+console.log(`[${LABEL}] registry declares omp wakeMode=self-fetch — the receive rail must now prove itself`);
+
+// ── 2. preflight: every prerequisite the registry's claim depends on ─────────
+// FAIL, not skip. Once the registry says a wake happens, a missing unit is a broken
+// promise rather than an absent prerequisite.
+try {
+	sh("bash", ["-c", "command -v omp"]);
+} catch {
+	fail(
+		"the 'omp' CLI is not on PATH, but the registry claims omp has a receive rail. entwurf never installs a harness — install omp, or move wakeMode back.",
+	);
+}
+try {
+	execFileSync("bash", [path.join(REPO, "scripts/omp-receive-doctor.sh")], { stdio: "pipe" });
+	console.log(`  ok    doctor-omp-receive is green (unit installed, ownership bound, writer current)`);
+} catch (err) {
+	fail(
+		`doctor-omp-receive is RED, so the receive rail the registry promises is not actually deployed here:\n${String((err as { stdout?: Buffer }).stdout ?? err)}`,
+	);
+}
+// `tools.xdev` defaults ON and wraps MCP tools as `xd://` devices whose schemas never
+// reach the prompt — a model so configured cannot call `entwurf_inbox_read`, so the
+// doorbell would announce a tool that does not exist for it and this step would fail for
+// a reason that is not the receive rail's fault. Name it up front (measured, #87 2026-08-28).
+const ompConfig = path.join(os.homedir(), ".omp", "agent", "config.yml");
+const xdevOff =
+	fs.existsSync(ompConfig) && /(^|\n)tools:\s*\n(\s+.*\n)*?\s+xdev:\s*false/.test(fs.readFileSync(ompConfig, "utf8"));
+ok(
+	"operator config sets tools.xdev: false (MCP tools stay top-level, so the model can actually call entwurf_inbox_read)",
+	xdevOff,
+	`        ${ompConfig} — see docs/setup-clean-host.md §4b`,
+);
+if (!fs.existsSync(DIST_ENTRY)) fail(`the built bridge is missing at ${DIST_ENTRY} — run 'pnpm run build-bridge'.`);
+
+// ── 3. open a real, idle omp TUI ─────────────────────────────────────────────
+const roots = ompMetaRoots();
+const receiveLog = path.join(path.dirname(roots.sessionsDir), "meta-bridge-receive-omp.log");
+const logBefore = fs.existsSync(receiveLog) ? fs.readFileSync(receiveLog, "utf8").length : 0;
+const workdir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-omp-recv-"));
+const nonce = `OMP-RECV-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`.toUpperCase();
+
+process.on("exit", teardown);
+tmux("new-session", "-d", "-s", TMUX_SESSION, "-x", "200", "-y", "50", "-c", workdir, `omp --cwd ${workdir}`);
+console.log(`[${LABEL}] opened an omp TUI in tmux session ${TMUX_SESSION} (cwd ${workdir})`);
+
+// ── 4. it arms, and the marker is real ───────────────────────────────────────
+const gardenId = await until("the receiver to arm (log line 'armed garden=…')", 60_000, () => {
+	if (!fs.existsSync(receiveLog)) return null;
+	const fresh = fs.readFileSync(receiveLog, "utf8").slice(logBefore);
+	const m = fresh.match(/armed garden=([0-9A-Za-z-]+) owner=(\d+)/);
+	return m ? m[1] : null;
+});
+ok(`an idle omp TUI armed a receiver for garden ${gardenId}`, true);
+
+const facts = JSON.parse(sh("bash", [path.join(REPO, "run.sh"), "omp-receive-facts"]));
+const armed = (facts.receivers as Array<Record<string, unknown>>).find((r) => r.gardenId === gardenId);
+ok(
+	"the production marker reader sees that receiver as LIVE (not a filename read)",
+	armed?.ownerLive === true,
+	`        ${JSON.stringify(armed)}`,
+);
+ok("the marker names the omp HOST process as the watch owner", armed?.ownerKind === "omp-host");
+
+// ── 5. another harness dispatches to it ──────────────────────────────────────
+// Through the REAL bridge over MCP stdio — `tools/call entwurf_v2`, the same surface every
+// other citizen reaches. A direct `enqueueMetaMessage` would bypass the deliverability
+// guard, which is half of what this step is here to prove.
+// The nonce is a CORRELATION token, not an instruction: it is asserted against the
+// delivered mailbox body, never against what the model chose to say. See the header.
+const body = `BUNDLE-B LIVE ACCEPTANCE probe ${nonce}. No action is requested; this message exists so an automated acceptance can confirm it reached the right mailbox.`;
+const dispatch = await new Promise<{ text: string; isError: boolean }>((resolve, reject) => {
+	// THE SENDER IS DELIBERATELY ANONYMOUS, AND THAT IS THE HONEST WIRING FOR A GATE.
+	// The bridge refuses anonymous sends by default and names this exact hatch for "a
+	// deliberately-anonymous external MCP host"; the message then travels marked
+	// external/non-replyable. Seeding a fake sender marker instead would fabricate a
+	// citizen that does not exist, and the sender's identity is not what this step
+	// accepts — the RECEIVE half is. The cross-harness case with a real authoritative
+	// sender was measured separately (#87, a claude-code citizen → an omp citizen).
+	const child: ChildProcess = spawn(process.execPath, [DIST_ENTRY], {
+		stdio: ["pipe", "pipe", "pipe"],
+		env: { ...process.env, ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER: "1" },
+	});
+	let buf = "";
+	let err = "";
+	const timer = setTimeout(() => {
+		child.kill("SIGKILL");
+		reject(new Error(`bridge did not answer tools/call entwurf_v2 in 30s\n${err}`));
+	}, 30_000);
+	child.stderr?.on("data", (d) => {
+		err += d.toString();
+	});
+	child.stdout?.on("data", (d) => {
+		buf += d.toString();
+		for (const line of buf.split("\n")) {
+			if (!line.trim().startsWith("{")) continue;
+			try {
+				const msg = JSON.parse(line);
+				if (msg.id !== 2) continue;
+				clearTimeout(timer);
+				child.kill("SIGTERM");
+				const text = (msg.result?.content ?? []).map((c: { text?: string }) => c.text ?? "").join("\n");
+				resolve({ text, isError: msg.result?.isError === true });
+			} catch {
+				/* partial frame; wait for more */
+			}
+		}
+	});
+	child.stdin?.write(
+		`${JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: LABEL, version: "0" } } })}\n`,
+	);
+	child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })}\n`);
+	child.stdin?.write(
+		`${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/call", params: { name: "entwurf_v2", arguments: { target: gardenId, intent: "fire-and-forget", message: body } } })}\n`,
+	);
+});
+ok("tools/call entwurf_v2 to the omp citizen was NOT refused", !dispatch.isError, `        ${dispatch.text}`);
+ok(
+	"dispatch chose the MAILBOX rail (self-fetch), not a refusal",
+	/mailbox|enqueued/i.test(dispatch.text),
+	`        ${dispatch.text}`,
+);
+
+// ── 6. the doorbell rings on a session nobody typed into ─────────────────────
+await until("the doorbell to ring", 30_000, () => {
+	const fresh = fs.readFileSync(receiveLog, "utf8").slice(logBefore);
+	return fresh.includes(`rang garden=${gardenId}`) ? true : null;
+});
+ok(`the doorbell rang for ${gardenId} with zero typing (idle wake)`, true);
+
+// ── 7. the MODEL drains its own inbox — the honest receipt ───────────────────
+const statePath = path.join(roots.mailboxDir, gardenId, "state.json");
+const state = await until("the model to record a read receipt (lastReadAt)", 120_000, () => {
+	if (!fs.existsSync(statePath)) return null;
+	try {
+		const s = JSON.parse(fs.readFileSync(statePath, "utf8"));
+		return s.lastReadAt ? s : null;
+	} catch {
+		return null;
+	}
+});
+ok(
+	"lastReadAt moved AFTER lastEnqueuedAt — a rung doorbell is only a wake attempt; THIS is the receipt",
+	Date.parse(state.lastReadAt) >= Date.parse(state.lastEnqueuedAt),
+	`        ${JSON.stringify(state)}`,
+);
+
+// ── 8. the drain happened INSIDE that session, and it carried OUR body ───────
+// One oracle, two facts, and it has to be the transcript rather than the mailbox:
+// `entwurf_inbox_read` ARCHIVES each body as it returns it, so a `.msg.delivered` check
+// after the drain finds an empty directory — measured here as a failing assertion on a
+// run whose read receipt had already landed. The vendor's own session log keeps both
+// halves permanently: the toolCall (this session asked, for its own garden id) and the
+// toolResult (what came back, including our nonce).
+//
+// This closes a real gap rather than a cosmetic one. `entwurf_inbox_read` takes a
+// CALLER-SUPPLIED garden id and does not verify it against the caller's identity, so
+// `lastReadAt` alone proves a read happened — not that THIS session performed it.
+const record = JSON.parse(sh("bash", [path.join(REPO, "run.sh"), "meta-facts"]));
+const citizen = (record.citizens as Array<Record<string, unknown>>).find((c) => c.gardenId === gardenId);
+ok("the citizen's V3 record names a transcript for this session", typeof citizen?.transcriptPath === "string");
+const transcriptPath = citizen?.transcriptPath as string;
+
+interface TranscriptPart {
+	type?: string;
+	name?: string;
+	toolName?: string;
+	text?: string;
+	arguments?: { gardenId?: string };
+}
+function scanTranscript(): { called: string | null; resultCarriedNonce: boolean } {
+	let called: string | null = null;
+	let resultCarriedNonce = false;
+	if (!fs.existsSync(transcriptPath)) return { called, resultCarriedNonce };
+	for (const line of fs.readFileSync(transcriptPath, "utf8").split("\n")) {
+		if (!line.includes("entwurf_inbox_read")) continue;
+		let entry: { message?: { role?: string; toolName?: string; content?: TranscriptPart[] } };
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		for (const part of entry.message?.content ?? []) {
+			if (
+				part.type === "toolCall" &&
+				part.name?.includes("entwurf_inbox_read") &&
+				part.arguments?.gardenId === gardenId
+			) {
+				called = part.name;
+			}
+			if (entry.message?.role === "toolResult" && entry.message.toolName?.includes("entwurf_inbox_read")) {
+				if ((part.text ?? "").includes(nonce)) resultCarriedNonce = true;
+			}
+		}
+	}
+	return { called, resultCarriedNonce };
+}
+
+const scan = await until("this session's own inbox_read call and its result in the transcript", 60_000, () => {
+	const got = scanTranscript();
+	return got.called && got.resultCarriedNonce ? got : null;
+});
+ok(
+	`the SAME native session called ${scan.called} for its OWN garden id — the drain is joined to the citizen, not merely to the clock`,
+	true,
+);
+ok("the drained result carried this run's nonce — the right body reached the right citizen", scan.resultCarriedNonce);
+
+teardown();
+try {
+	fs.rmSync(workdir, { recursive: true, force: true });
+} catch {
+	/* scratch cleanup is best-effort */
+}
+console.log(
+	`[${LABEL}] ${passed} assertions ok — garden ${gardenId}, lastEnqueuedAt ${state.lastEnqueuedAt}, lastReadAt ${state.lastReadAt}`,
+);

package/scripts/smoke-omp-receive-state.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# smoke-omp-receive-state — hermetic install/doctor/inverse contract for the OMP RECEIVER
+# extension (#87 bundle B). No omp process, no model turn, no writes outside the sandbox.
+#
+# Same four properties the birth unit's smoke holds, plus the two this surface adds:
+#   - it installs where the vendor actually looks, and the doctor agrees;
+#   - the inverse is honest — it removes exactly what the state records, and a host whose
+#     ownership cannot be established REFUSES rather than tidying up;
+#   - a foreign or symlinked artifact at our path is refused, never written through;
+#   - a stale deployed copy of the shared writer is named;
+#   - installing a DOORBELL arms nothing by itself: a fresh install must leave zero
+#     receiver markers, because a marker is a claim that a LIVE process holds a watch and
+#     an installer holds none;
+#   - the doctor stays green while the BIRTH unit is absent, reporting the dependency as a
+#     note rather than a fault — receive without birth is a real, legible operator state,
+#     not a broken install.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RUN="$REPO_DIR/run.sh"
+pass=0
+ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
+die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+want() { eval "$2" && ok "$1" || die "$1"; }
+
+REPO_BEFORE="$(cd "$REPO_DIR" && git status --porcelain)"
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+# HARD RULE 12, in full. Not HOME + XDG_DATA_HOME alone: an inherited XDG_CONFIG_HOME or a
+# PI_CODING_AGENT_DIR from the operator's shell would leave a writable real root reachable
+# from inside this smoke. PI is set to a POISON path on purpose — after #87 B1 no OMP garden
+# artifact may resolve through it, and the last check in this file asserts that tree stayed
+# empty. (`ENTWURF_OMP_AGENT_DIR` still wins for the VENDOR agent dir, which is what keeps
+# the installer from refusing on the ambiguity below.)
+export HOME="$SB/home"
+export XDG_DATA_HOME="$SB/xdg"
+export XDG_CONFIG_HOME="$SB/xdg-config"
+export XDG_STATE_HOME="$SB/xdg-state"
+export XDG_CACHE_HOME="$SB/xdg-cache"
+export XDG_RUNTIME_DIR="$SB/xdg-runtime"
+PI_POISON="$SB/pi-poison-agent"
+export PI_CODING_AGENT_DIR="$PI_POISON"
+export ENTWURF_OMP_AGENT_DIR="$SB/home/.omp/agent"
+mkdir -p "$ENTWURF_OMP_AGENT_DIR" "$SB/bin" "$XDG_CONFIG_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME" "$XDG_RUNTIME_DIR"
+# The installer requires the vendor on PATH — entwurf never installs a harness, so an
+# absent omp is a refusal rather than a silent no-op. A fake binary is enough: nothing in
+# this lane executes it (the unit is a module omp imports, not a process we launch).
+printf '#!/usr/bin/env bash\nexit 0\n' > "$SB/bin/omp"
+chmod +x "$SB/bin/omp"
+export PATH="$SB/bin:$PATH"
+
+UNIT_DIR="$ENTWURF_OMP_AGENT_DIR/extensions/entwurf-receive-omp"
+STATE="$XDG_DATA_HOME/entwurf/omp-receive/install-state.json"
+ASM="$XDG_DATA_HOME/entwurf/omp-receive/.assembled"
+
+# ── 1. install ───────────────────────────────────────────────────────────────
+"$RUN" install-omp-receive >/dev/null || die "install-omp-receive failed"
+want "the unit lands where omp's native discovery looks" "[ -f '$UNIT_DIR/index.ts' ]"
+want "it carries the shared V3 writer" "[ -f '$UNIT_DIR/lib/meta-session.ts' ]"
+want "it carries the capability registry the writer resolves via ../" "[ -f '$UNIT_DIR/entwurf-capabilities.json' ]"
+want "ownership state was written" "[ -f '$STATE' ]"
+want "the state records the unit dir it placed" "grep -q '\"unitDir\"' '$STATE' && grep -q 'entwurf-receive-omp' '$STATE'"
+want "config.yml was NOT created or touched — this unit owns no operator SSOT" "[ ! -e '$ENTWURF_OMP_AGENT_DIR/config.yml' ]"
+"$RUN" doctor-omp-receive >/dev/null || die "doctor red right after a clean install"
+ok "doctor is green right after install"
+
+# ── 2. reinstall is idempotent ───────────────────────────────────────────────
+"$RUN" install-omp-receive >/dev/null || die "reinstall over our own state failed"
+"$RUN" doctor-omp-receive >/dev/null || die "doctor red after a reinstall"
+ok "reinstall over our own state is idempotent and stays green"
+
+# ── 3. a STALE deployed writer is named ──────────────────────────────────────
+printf '\n// drifted\n' >> "$UNIT_DIR/lib/meta-session.ts"
+if OUT="$("$RUN" doctor-omp-receive 2>&1)"; then
+  die "doctor stayed green with a stale deployed writer"
+fi
+printf '%s\n' "$OUT" | grep -q "STALE" || die "doctor went red without naming the staleness"
+ok "a drifted copy of the writer is reported as STALE, with the redeploy prescription"
+"$RUN" install-omp-receive >/dev/null
+"$RUN" doctor-omp-receive >/dev/null || die "reinstall did not repair the stale writer"
+ok "reinstall repairs it"
+
+# A byte-valid copy of our OWN unit, kept for the no-state cell below: it passes every
+# structural check there is, which is exactly why a shape must not license adoption.
+cp -r "$UNIT_DIR" "$SB/valid-unit"
+
+# ── 4. the inverse is honest ─────────────────────────────────────────────────
+"$RUN" uninstall-omp-receive >/dev/null || die "uninstall failed"
+want "the unit is gone" "[ ! -e '$UNIT_DIR' ]"
+want "the assembly is gone" "[ ! -e '$ASM' ]"
+want "the ownership state is gone" "[ ! -e '$STATE' ]"
+want "the agent dir itself survives — we only ever owned our own subdirectory" "[ -d '$ENTWURF_OMP_AGENT_DIR' ]"
+"$RUN" doctor-omp-receive >/dev/null || die "doctor red on a clean uninstalled host (zero state is a SKIP, not a fault)"
+ok "doctor reads a clean uninstalled host as zero-state, not as a fault"
+
+if "$RUN" uninstall-omp-receive >/dev/null 2>&1; then
+  die "uninstall on a no-state host reported success"
+fi
+ok "a second uninstall REFUSES — a no-state host is unproven ownership, not an empty one"
+
+# ── 5. NOTHING at our path is adopted without ownership STATE (#87 B2) ───────
+# The structurally VALID case first, because it is the one that used to pass: the old
+# installer ran a shape oracle, called green "ours", moved the directory aside, published
+# over it and DELETED the preimage — and the inverse then rm -rf'd the path on the same
+# unproven claim. A hand-copied unit, or ours plus operator files beside it, was destroyed
+# with no way back. A shape is not a proof of ownership.
+cp -r "$SB/valid-unit" "$UNIT_DIR"
+printf 'operator note\n' > "$UNIT_DIR/NOTES.md"
+if "$RUN" install-omp-receive >/dev/null 2>&1; then
+  die "install ADOPTED a structurally valid no-state unit — a shape is not ownership"
+fi
+want "the stranger's file beside it survives the refusal" "[ -f '$UNIT_DIR/NOTES.md' ]"
+want "the unit's own entry is untouched" "[ -f '$UNIT_DIR/index.ts' ]"
+want "no ownership state was invented by the refusal" "[ ! -e '$STATE' ]"
+ok "a structurally VALID no-state unit is refused with zero writes — ownership state is the only licence"
+rm -rf "$UNIT_DIR"
+
+# ── 5b. a foreign unit at our path is refused, never written through ─────────
+mkdir -p "$UNIT_DIR"
+printf 'someone else\n' > "$UNIT_DIR/index.ts"
+if "$RUN" install-omp-receive >/dev/null 2>&1; then
+  die "install adopted a foreign directory that fails the structural oracle"
+fi
+want "the foreign file is byte-identical after the refusal" "grep -q 'someone else' '$UNIT_DIR/index.ts'"
+want "no ownership state was written by the refusal" "[ ! -e '$STATE' ]"
+ok "a foreign no-state unit is refused with zero writes"
+rm -rf "$UNIT_DIR"
+
+mkdir -p "$SB/elsewhere"
+ln -s "$SB/elsewhere" "$UNIT_DIR"
+if "$RUN" install-omp-receive >/dev/null 2>&1; then
+  die "install wrote through a symlinked unit path"
+fi
+want "the symlink target is still empty — nothing was written through the link" "[ -z \"\$(ls -A '$SB/elsewhere')\" ]"
+ok "a SYMLINK at the unit path is refused"
+rm -f "$UNIT_DIR"
+
+# ── 6. an ambiguous agent dir refuses instead of guessing (ledger M6) ────────
+# omp is a pi fork and reads pi's env vocabulary, so an inherited PI_* knob does not say
+# WHICH harness it is addressing. Installing into a directory chosen by that guess is how
+# an operator ends up with a unit no live omp reads.
+# Each variable is tested ALONE — the sandbox exports a poisoned PI_CODING_AGENT_DIR
+# globally, and leaving it set would make every row below refuse on that one branch and
+# prove nothing about the others.
+for var in PI_CODING_AGENT_DIR PI_CONFIG_DIR; do
+  if env -u ENTWURF_OMP_AGENT_DIR -u PI_CODING_AGENT_DIR -u PI_CONFIG_DIR "$var=$SB/ambiguous" \
+     "$RUN" install-omp-receive >/dev/null 2>&1; then
+    die "install guessed an agent dir while $var was set"
+  fi
+  ok "$var set (with no explicit override) REFUSES rather than guessing which harness it addresses"
+done
+if env -u ENTWURF_OMP_AGENT_DIR -u PI_CODING_AGENT_DIR PI_PROFILE=work "$RUN" install-omp-receive >/dev/null 2>&1; then
+  die "install guessed an agent dir from PI_PROFILE alone"
+fi
+ok "PI_PROFILE without OMP_PROFILE REFUSES — pi and omp both read it"
+
+# ── 7. --assemble-only never touches the live assembly ──────────────────────
+if ENTWURF_OMP_RECEIVE_ASM="$ASM" "$RUN" install-omp-receive --assemble-only >/dev/null 2>&1; then
+  die "--assemble-only rebuilt the DEFAULT live assembly"
+fi
+ok "--assemble-only refuses the live assembly path (it writes no ownership state)"
+
+# ── 8. nothing resolved through the double-duty PI knob ─────────────────────
+# The whole run had PI_CODING_AGENT_DIR pointing at a poison path. After #87 B1 that
+# variable is the VENDOR's agent dir for backend omp and is never a garden root, so a
+# single artifact under it would mean some surface still derives its roots from it.
+want "the poisoned PI_CODING_AGENT_DIR tree was never created" "[ ! -e '$PI_POISON' ]"
+
+# ── 8b. installing a doorbell ARMS NOTHING ──────────────────────────────────
+# A receiver marker claims a LIVE process is holding a watch. An installer is not that
+# process, so a fresh install that produced one would be advertising a doorbell nobody is
+# listening at — the exact false-deliverability this unit exists to avoid.
+"$RUN" install-omp-receive >/dev/null || die "reinstall for the arm check failed"
+want "installing the receiver creates NO receiver marker" "[ ! -d '$HOME/.pi/agent/meta-receivers' ] || [ -z \"\$(ls -A '$HOME/.pi/agent/meta-receivers' 2>/dev/null)\" ]"
+want "installing the receiver creates no mailbox either" "[ ! -d '$HOME/.pi/agent/meta-mailbox' ] || [ -z \"\$(ls -A '$HOME/.pi/agent/meta-mailbox' 2>/dev/null)\" ]"
+ok "an installed doorbell is not an armed one — only a live tui host arms"
+
+# ── 8c. receive without birth is a NOTE, not a fault ────────────────────────
+# An operator may install the receiver first, or uninstall birth and leave this behind.
+# That host is legibly incomplete, not broken: the doctor must say so on its own axis
+# without going red, because a red here would send the operator hunting a defect that is
+# really a missing sibling unit.
+if ! OUT="$("$RUN" doctor-omp-receive 2>&1)"; then
+  die "doctor-omp-receive went RED merely because the birth unit is not installed"
+fi
+printf '%s\n' "$OUT" | grep -q "BIRTH unit is not installed" \
+  || die "doctor stayed green but never NAMED the missing birth unit"
+ok "with no birth unit the doctor is green and names the dependency as a note"
+"$RUN" uninstall-omp-receive >/dev/null || die "final uninstall failed"
+
+# ── 9. the repo itself was never written ────────────────────────────────────
+REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
+[ "$REPO_BEFORE" = "$REPO_AFTER" ] || die "the smoke mutated the repo working tree"
+ok "the checkout is byte-identical to before the smoke"
+
+printf '[smoke-omp-receive-state] %d assertions ok\n' "$pass"