@junghanacs/entwurf 0.15.1 → 0.16.1

package/scripts/check-acp-launch-namespace.ts

@@ -0,0 +1,127 @@
+// Deterministic gate — the Claude ACP child launches under a name entwurf OWNS.
+//
+// WHY THIS IS A GATE AND NOT A COMMENT (#72). The vendor bin is called
+// `claude-agent-acp`, and that name belongs to the package, not to us: any
+// harness on the host spawning the same package produces a process with the
+// same name. On GLG's oracle host a janitor installed for a DIFFERENT harness
+// selects `claude-agent-acp` by argv SUBSTRING and SIGTERMs anything older than
+// 900s. Because entwurf RETAINS its child across turns, its age is the age of
+// the session — 12 of 12 anomalous terminations across two boots were that
+// janitor (receipts: scripts/raw-acp-child-exit-measure/README.md §ANSWERED).
+//
+// The defense is a launcher whose own name carries no vendor substring. That is
+// a property of a STRING, which is exactly the kind of thing that rots silently
+// under a rename or a "harmless" revert — hence a gate that fails loudly.
+//
+// The second half matters as much: the launcher must remain TRANSPARENT. The
+// vendor reads `--cli` / `--version` from `process.argv` and builds its own
+// re-invocation command from `process.argv.slice(1)`. A launcher that consumed
+// a flag of its own, or failed to start the vendor at all, would trade one
+// silent breakage for another — so we RUN it and require the vendor to answer.
+
+import { strict as assert } from "node:assert";
+import { execFileSync } from "node:child_process";
+import { rmdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/** The substring the janitor matches on — the thing our launch argv must not contain. */
+const VENDOR_PROCESS_MATCHER = "claude-agent-acp";
+
+const TMP_EMIT = ".tmp-verify/acp-launch-namespace";
+rmSync(TMP_EMIT, { recursive: true, force: true });
+try {
+	execFileSync("node_modules/.bin/tsc", ["--outDir", TMP_EMIT, "--rootDir", ".", "--noEmit", "false"], {
+		stdio: "pipe",
+	});
+	const adapterUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend-adapter.js")).href;
+	const mod = (await import(adapterUrl)) as {
+		claudeAdapter: {
+			resolveLaunch: (p: { cwd: string; modelId: string; nativeModelId: string; config: unknown }) => {
+				command: string;
+				args: string[];
+			};
+		};
+	};
+
+	const launch = mod.claudeAdapter.resolveLaunch({
+		cwd: process.cwd(),
+		modelId: "claude-sonnet-5",
+		nativeModelId: "claude-sonnet-5",
+		config: {},
+	});
+
+	// ----------------------------------------------------------------------
+	// The claim: nothing a name-matching janitor scans contains the vendor name.
+	// We check the WHOLE argv the way `ps` presents it, because that is what the
+	// janitor's awk actually reads — not just the basename.
+	// ----------------------------------------------------------------------
+	const psLine = [launch.command, ...launch.args].join(" ");
+	assert.ok(
+		!psLine.includes(VENDOR_PROCESS_MATCHER),
+		`[QK:CLAUDE-LAUNCH-IS-NAMESPACED] the default Claude ACP launch must not put "${VENDOR_PROCESS_MATCHER}" anywhere ` +
+			"in its argv: a janitor installed for another harness selects that substring by age and SIGTERMs it, which is " +
+			`the whole of #72. Got: ${JSON.stringify(psLine)}`,
+	);
+	assert.ok(
+		launch.args.length === 1 && launch.args[0].endsWith("claude-acp-launch.js"),
+		"the default launch is the entwurf-owned launcher and NOTHING else — an extra argv entry would be a flag of our " +
+			`own, which the vendor's argv.slice(1) self-reinvocation cannot survive. Got: ${JSON.stringify(launch.args)}`,
+	);
+
+	// ----------------------------------------------------------------------
+	// The launcher must still BE the vendor. A name split that stopped starting
+	// the agent would pass every string assertion above and ship a dead backend,
+	// so run it and make the vendor answer through it.
+	// ----------------------------------------------------------------------
+	const version = execFileSync(process.execPath, [...launch.args, "--version"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+		timeout: 60_000,
+	}).trim();
+	assert.match(
+		version,
+		/^\d+\.\d+\.\d+/,
+		"[QK:CLAUDE-LAUNCH-IS-TRANSPARENT] the launcher must pass argv through untouched and start the real vendor — " +
+			`\`--version\` has to reach it and answer. Got: ${JSON.stringify(version)}`,
+	);
+
+	// ----------------------------------------------------------------------
+	// The debug override is an EXPLICIT operator choice and must stay literal:
+	// an operator who names their own command owns the result, including losing
+	// the name split. Routing it through the launcher would silently overrule them.
+	// ----------------------------------------------------------------------
+	process.env.CLAUDE_AGENT_ACP_COMMAND = "echo overridden";
+	try {
+		const overridden = mod.claudeAdapter.resolveLaunch({
+			cwd: process.cwd(),
+			modelId: "claude-sonnet-5",
+			nativeModelId: "claude-sonnet-5",
+			config: {},
+		});
+		assert.deepEqual(
+			[overridden.command, ...overridden.args],
+			["bash", "-lc", "echo overridden"],
+			"CLAUDE_AGENT_ACP_COMMAND must stay verbatim — the launcher is the DEFAULT, never an override of the operator",
+		);
+	} finally {
+		delete process.env.CLAUDE_AGENT_ACP_COMMAND;
+	}
+} finally {
+	rmSync(TMP_EMIT, { recursive: true, force: true });
+	try {
+		// A leftover EMPTY parent dir reads as IMPURE tree drift in the
+		// qualification harness; a concurrent sibling gate's emit keeps it alive
+		// and this rmdir simply fails.
+		rmdirSync(".tmp-verify");
+	} catch {
+		// non-empty or already gone — fine either way
+	}
+}
+
+console.log(
+	"[check-acp-launch-namespace] ok — the default Claude ACP launch carries no vendor process name in its argv (so a " +
+		"name-matching janitor installed for another harness cannot select it), is exactly the entwurf-owned launcher " +
+		"with no flag of its own, still starts the real vendor through argv passed untouched, and leaves an explicit " +
+		"CLAUDE_AGENT_ACP_COMMAND override verbatim",
+);

package/scripts/check-acp-prompt-lifecycle.ts

@@ -77,6 +77,7 @@ function deferred<T>(): Deferred<T> {
 function makeFakeChild() {
 	const exitListeners: Array<(...args: unknown[]) => void> = [];
 	const stderrListeners: Array<(chunk: Buffer) => void> = [];
+	const stderrCloseListeners: Array<() => void> = [];
 	const kills: Array<NodeJS.Signals | number | undefined> = [];
 	const pipe = () => ({ destroy() {}, unref() {} });
 	const child = {
@@ -90,6 +91,9 @@ function makeFakeChild() {
 			on(_event: "data", listener: (chunk: Buffer) => void) {
 				stderrListeners.push(listener);
 			},
+			once(_event: "close", listener: () => void) {
+				stderrCloseListeners.push(listener);
+			},
 			destroy() {},
 			unref() {},
 		},
@@ -105,10 +109,11 @@ function makeFakeChild() {
 		writeStderr(text: string) {
 			for (const listener of [...stderrListeners]) listener(Buffer.from(text));
 		},
-		/** driver: the backend process ends. */
+		/** driver: the backend process ends. Its stderr pipe closes with it. */
 		die(code: number | null, signal: NodeJS.Signals | null = null) {
 			child.exitCode = code;
 			child.signalCode = signal;
+			for (const listener of stderrCloseListeners.splice(0)) listener();
 			for (const listener of exitListeners.splice(0)) listener(code, signal);
 		},
 	};
@@ -656,6 +661,141 @@ try {
 		);
 	}
 
+	// ----------------------------------------------------------------------
+	// CELL 12 — a signal the LAUNCHER caught survives the vendor erasing it.
+	//
+	// #72's whole difficulty: the vendor turns SIGTERM into `dispose(); exit(0)`,
+	// so an external kill and a clean vendor shutdown reach us as the SAME facts
+	// (code 0, signal null). CELL 10 can only separate a signal that was NOT
+	// caught. `claude-acp-launch.js` records the catch before the vendor erases
+	// it; this cell holds that the record reaches the operator, on its own line,
+	// and that the tail stays vendor-only.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("reaped from outside"), { sessionId: "life-eof-launchsig" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("VENDOR-TAIL-MARK\n");
+		h.children[0].writeStderr("ENTWURF_ACP_LAUNCH_SIGNAL=SIGTERM\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("launch observed SIGTERM before child exit"),
+			"[QK:LAUNCH-SIGNAL-EVIDENCE-STRUCTURED] a caught SIGTERM must reach the operator even though the vendor " +
+				`normalized it to exit 0 — otherwise an external kill is indistinguishable from a clean close. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("sender not attributed"),
+			"the observation must NOT claim who sent the signal — attribution needs the host journal, which this " +
+				`process cannot read. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("exit code 0") && message.includes("VENDOR-TAIL-MARK"),
+			`the exit fact and the vendor tail both survive alongside the observation. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			!message.includes("ENTWURF_ACP_LAUNCH_SIGNAL="),
+			"[QK:LAUNCH-FRAME-NOT-IN-TAIL] the raw control frame must be CONSUMED, not echoed into the vendor tail — " +
+				`the tail is vendor evidence and the observation is ours, and #72 was made of confusing the two. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 13 — NEGATIVE SIBLING: vendor prose can never manufacture the fact.
+	//
+	// The oracle for CELL 12's exactness. Vendor stderr is free text and it does
+	// mention signals; if a loose test (`includes("SIGTERM")`, or a prefix match
+	// without the enum) fed the observation, entwurf would report an entwurf-owned
+	// fact it never observed — a worse failure than reporting nothing, because it
+	// would be trusted. Both a near-miss frame and prose must produce NOTHING.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("vendor mentions a signal"), { sessionId: "life-eof-nosig" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("shutting down after SIGTERM; ENTWURF_ACP_LAUNCH_SIGNAL=SIGQUIT\n");
+		h.children[0].writeStderr("  ENTWURF_ACP_LAUNCH_SIGNAL=SIGTERM (quoted in prose, not a frame)\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			!message.includes("launch observed"),
+			"[QK:LAUNCH-SIGNAL-EXACT-FRAME-ONLY] neither vendor prose containing 'SIGTERM', an unknown signal value, nor " +
+				"an indented near-miss may produce a launch observation — the frame is an exact full line with a fixed " +
+				`enum, and anything looser lets vendor text forge our own evidence. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			message.includes("SIGQUIT") && message.includes("quoted in prose"),
+			`text that is not our frame stays in the vendor tail verbatim. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 14 — the child's LAST words survive having no trailing newline.
+	//
+	// Filtering our control frame out of the tail means reading stderr by LINE,
+	// and a process dying mid-write does not finish its line. That fragment is
+	// exactly the dying words the tail exists for, so holding it in a line buffer
+	// forever would trade #72's diagnosis for a worse blindness. The stream's
+	// close must flush it VERBATIM.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("dies mid-write"), { sessionId: "life-eof-nonl" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("FATAL dying words with no newline");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("FATAL dying words with no newline"),
+			"[QK:STDERR-TAIL-FLUSHES-PARTIAL-LINE] a child that dies mid-write leaves its last line unterminated, and " +
+				"that fragment IS the dying words the tail exists for — line-buffering to strip our own frame must not " +
+				`swallow it. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// CELL 15 — a frame split across two reads is still recognised exactly.
+	//
+	// Pipe chunk boundaries fall wherever the kernel put them, so the frame can
+	// arrive in pieces. This is the reason the filter buffers by line at all;
+	// without a cell for it, an implementation that matched per-CHUNK would pass
+	// every other test here and then miss the real signal in the field.
+	// ----------------------------------------------------------------------
+	{
+		const h = makeHarness(recordDir);
+		const turn = startTurn(backend, userCtx("frame arrives split"), { sessionId: "life-eof-split" }, h.deps);
+		await delay(30);
+		h.children[0].writeStderr("ENTWURF_ACP_LAUNCH_SI");
+		h.children[0].writeStderr("GNAL=SIGTERM\n");
+		h.transportClosed();
+		await delay(1);
+		h.children[0].die(0, null);
+		await turn.done;
+
+		const message = String(sealed(turn.events)[0].error.errorMessage);
+		assert.ok(
+			message.includes("launch observed SIGTERM before child exit"),
+			"[QK:LAUNCH-FRAME-SPANS-CHUNKS] the frame must be recognised across a chunk boundary — the kernel, not the " +
+				`writer, decides where a read ends. Got: ${JSON.stringify(message)}`,
+		);
+		assert.ok(
+			!message.includes("ENTWURF_ACP_LAUNCH_SI"),
+			`neither half of a split frame may leak into the vendor tail. Got: ${JSON.stringify(message)}`,
+		);
+	}
+
 	// ----------------------------------------------------------------------
 	// CELL 11 — a child that never reports an end says SO, bounded.
 	//
@@ -771,7 +911,10 @@ console.log(
 		"reported with its exit status AND stderr tail on BOTH the new and the reuse path; a death BETWEEN turns is " +
 		"announced once by the next turn while a teardown WE performed stays silent; the child's end survives the " +
 		"temporal order the field showed too (transport EOF first, exit one tick later, alongside the opposite order), " +
-		"telling a clean exit apart from a signal and reporting silence AS silence within a bounded window; and pi's " +
+		"telling a clean exit apart from a signal and reporting silence AS silence within a bounded window; a signal the " +
+		"LAUNCHER caught survives the vendor normalizing it to exit 0 and is reported on its own line without claiming " +
+		"who sent it, while its raw control frame is consumed out of the vendor tail and vendor prose mentioning a " +
+		"signal can never forge that observation; and pi's " +
 		"own isRetryableAssistantError refuses to classify any of those failures as transient while still matching " +
 		"the retired 600s text",
 );

package/scripts/check-copilot-birth-hook.ts

@@ -495,7 +495,7 @@ function makeFakeHost(label: string, opts: FakeOpts): FakeHost {
 				? '  "plugin list") echo "not authenticated" >&2; exit 1 ;;'
 				: opts.pluginListRaw !== undefined
 					? `  "plugin list") echo "Installed plugins:"; cat ${JSON.stringify(rawList)}; exit 0 ;;`
-					: '  "plugin list") echo "Installed plugins:"; sed "s/^/  • /;s/$/ (v$VER)/" "$STATE"; exit 0 ;;',
+					: '  "plugin list") echo "Live Plugins (loaded from a local marketplace directory, never copied):"; sed "s/^/  • /;s/$/ (v$VER) (enabled)/" "$STATE"; exit 0 ;;',
 			'  "plugin uninstall")',
 			opts.uninstallFails
 				? '    echo "boom" >&2; exit 1 ;;'
@@ -1065,6 +1065,33 @@ function writeBoundState(host: FakeHost): void {
 		inst.status !== 0 && (inst.stderr ?? "").includes("malformed") && !existsSync(instHost.stateFile),
 	);
 }
+{
+	// Copilot CLI 1.0.81 (measured 2026-08-31) appends its own state token after the
+	// version and an indented `from <path>` continuation line. The grammar admits that
+	// ONE optional `(enabled)`/`(disabled)` token — reading it as part of the version
+	// made every surface refuse a perfectly healthy host. Anything else in the tail
+	// stays malformed, so the admission cannot widen into "ignore whatever follows".
+	const liveRaw = `Live Plugins (loaded from a local marketplace directory, never copied):\n  • ${OURS} (v${SHIPPED_VERSION}) (enabled)\n      from /home/nobody/.assembled`;
+	const docHost = makeFakeHost("doctor-state-token-row", { installed: [OURS], pluginListRaw: liveRaw });
+	writeBoundState(docHost);
+	writeFileSync(docHost.mktState, `${MKT}\t${docHost.asm}\n`);
+	mkdirSync(path.join(docHost.asm, PLUGIN), { recursive: true });
+	const doc = runVerb(docHost, "doctor-copilot-bridge");
+	ok(
+		"[QK:COPILOT-ROW-STATE-TOKEN-ADMITTED] a `(vX) (enabled)` row plus its `from` continuation line parses as the installed version — no malformed refusal on a healthy 1.0.81 host",
+		doc.stdout.includes(`${OURS} (v${SHIPPED_VERSION}) is registered in Copilot`) &&
+			!doc.stdout.includes("malformed") &&
+			!(doc.stderr ?? "").includes("malformed"),
+	);
+	const foreignHost = makeFakeHost("install-foreign-tail-row", {
+		pluginListRaw: `  • ${OURS} (v${SHIPPED_VERSION}) (whatever)`,
+	});
+	const foreign = runVerb(foreignHost, "install-copilot-bridge");
+	ok(
+		"an UNKNOWN trailing token is still malformed — the admission is exactly the two measured state words",
+		foreign.status !== 0 && (foreign.stderr ?? "").includes("malformed") && !existsSync(foreignHost.stateFile),
+	);
+}
 {
 	// B defect 4: a pluginVersion carrying whitespace would be truncated by the
 	// space-separated fact transport (`cut -d' ' -f3`) into a FABRICATED version and a

package/scripts/check-entwurf-self-address.ts

@@ -155,6 +155,26 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 	);
 }
 
+// meta-session / NONE rail: no inbound transport at all. Mailbox facts and a live probe
+// cannot buy replyability — there is nothing to land on. Distinct from the unsupplied
+// (undefined) domain row below, which stays fail-closed for a caller that forgot the axis.
+{
+	const noneFacts: SelfAddressabilityFacts = {
+		origin: "meta-session",
+		metaDeliveryDomain: "none",
+		recordBacked: true,
+		ownerAlive: true,
+		watchArmed: true,
+		probeAlive: true,
+	};
+	const noneRail = computeSelfAddressability(noneFacts);
+	ok("meta/none + all facts true → NOT replyable", noneRail.replyable === false);
+	ok(
+		"meta/none names the missing inbound rail (mailbox/probe facts cannot rescue it)",
+		noneRail.reason.includes("no inbound rail"),
+	);
+}
+
 // meta-session with NO rail declared: we cannot say how a reply would travel, so we do not
 // claim it would arrive. The domain is derived from nativePushSupported(backend) — a caller
 // that forgets it gets a refusal, not an optimistic guess.
@@ -246,6 +266,17 @@ ok(
 	/existsSync\s*\(/.test(piBody) && /controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
 );
 
+const metaBuilder = functionBody("buildTrustedMetaSenderEnvelope");
+// FIRST of the two derivation claims so a binary-fallback mutant dies here, not at the seam pin.
+ok(
+	"buildTrustedMetaSenderEnvelope does not fall back every non-native-push backend to self-fetch [QK:SELFADDR-NO-FALLBACK-SELF-FETCH]",
+	!/\?\s*"native-push"\s*:\s*"self-fetch"/.test(metaBuilder),
+);
+ok(
+	"buildTrustedMetaSenderEnvelope derives self-fetch through resolveMailboxWakeModeCapability(identity), not a backend-name list [QK:SELFADDR-MAILBOX-WAKE-SEAM]",
+	/resolveMailboxWakeModeCapability\s*\(\s*identity\s*\)/.test(metaBuilder),
+);
+
 const selfRegion = toolRegion("entwurf_self");
 ok(
 	"entwurf_self existsSync-probes the pi socket (alive vs expected, no synthesized path lie)",

package/scripts/check-gate-qualification.ts

@@ -799,8 +799,9 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 	const EXPECTED_LANE_MUTANTS: Record<string, number> = {
 		"acp-augment": 10,
 		"acp-cortex": 12,
+		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
-		"acp-prompt-lifecycle": 10,
+		"acp-prompt-lifecycle": 15,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
 		"agy-permission": 6,
@@ -821,12 +822,15 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"pack-install": 1,
 		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
+		"omp-birth": 11,
+		"omp-fresh": 24,
+		"omp-receive": 11,
 		"probe-ordering": 1,
 		"release-gate": 12,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
-		"self-address": 3,
-		"setup-verdict": 10,
+		"self-address": 5,
+		"setup-verdict": 13,
 		"source-install": 2,
 		"v2-surface": 7,
 		"v2-visible-resume": 17,

package/scripts/check-harness-admission-parity.ts

@@ -0,0 +1,143 @@
+/**
+ * check-harness-admission-parity — the edge between two parity loops that were each closed and
+ * had nothing between them (#87 Bundle C).
+ *
+ * ── The defect this owns ──
+ *
+ * Two gates already held their own halves tight:
+ *
+ *   `check-entwurf-capabilities`            registry  ==  META_CITIZEN_BACKENDS
+ *   `fresh-call-surfaces.contract.test.ts`  surfaces  ==  FRESH_CALL_BACKENDS
+ *
+ * and NO file imported both constants. So a harness could be admitted as a full D6 citizen —
+ * birth, MCP hand, receive, a garden id on its own status line — while `entwurf_fresh_call`
+ * could not open it, and every gate in the repo stayed green. `docs/adding-a-harness.md` step 9
+ * says a backend is **supported** only when it can be opened as one visible fresh sibling, but
+ * that sentence had no consumer: the honest prose in `DELIVERY.md` ("Visible fresh is NOT
+ * implemented, so OMP is not a supported harness under step 9") sat there being true while a
+ * release package containing that backend passed the whole floor.
+ *
+ * `[측정]` 2026-08-30, on the Bundle A+B candidate: registry carried six backends, all D6;
+ * `FRESH_CALL_BACKENDS` carried three. The omp row read `unsupported` in the docs and shipped
+ * anyway. GLG's finding: **an `unsupported` label is not a partial-release permit.**
+ *
+ * ── The rule ──
+ *
+ * Every backend a meta-record may name is either
+ *   (a) openable by `entwurf_fresh_call` — it walked step 9; or
+ *   (b) a PRE-#82 admission, named here AND described as such in the delivery matrix.
+ *
+ * There is no third state. A post-#82 harness that is a citizen but not fresh-openable makes
+ * this gate red, which is what stops the release package rather than only the docs.
+ *
+ * ── Why the exception is a literal here plus a sentence there ──
+ *
+ * Same shape `check-release-gate-outcomes` cell 7 already uses for aggregate omissions, and for
+ * the same reason it states: *an exclusion that only this gate believes in is how the omission
+ * would come back.* The pair is deliberately redundant — the literal makes the exception a
+ * decision someone had to type, and the doc sentence makes it a thing an operator can read
+ * without opening this file. Neither half alone is the contract.
+ *
+ * This introduces NO new authority: the capability registry keeps its schema (there is no
+ * `supported` field and there must not be one — a self-declared grade is exactly what step 9
+ * refuses), and the fresh set stays the composition's own constant.
+ *
+ * Pure parse over shipped source + docs. No backend, no network, no subprocess.
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { META_CITIZEN_BACKENDS, type MetaCitizenBackend } from "../pi-extensions/lib/meta-session.ts";
+import { FRESH_CALL_BACKENDS } from "../pi-extensions/lib/mux-fresh-call.ts";
+
+const REPO_DIR = fileURLToPath(new URL("..", import.meta.url));
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+/**
+ * Backends admitted BEFORE the #82 step 9 contract, which `docs/adding-a-harness.md` step 9
+ * preserves explicitly: "a pre-contract backend that has not walked this step remains
+ * legacy/probe evidence and must not be described as supported until it is re-evaluated here."
+ * Copilot is the first admission made UNDER that contract (step 9's worked example), so nothing
+ * admitted after it qualifies for this list.
+ *
+ * `claude-code` and `pi` are also pre-contract and are deliberately absent: they are fresh-
+ * openable, so they need no exception. An exception is for a backend that CANNOT be opened —
+ * never a convenience for one that simply has not been wired yet.
+ *
+ * Each value is the file and the sentence in it that carries the exception for a reader. The
+ * sentence must be the one that says WHY the backend is not step-9 supported; a row that merely
+ * mentions the backend is not an exception.
+ */
+const PRE_82_LEGACY: Partial<Record<MetaCitizenBackend, [file: string, sentence: string]>> = {
+	antigravity: [
+		"DELIVERY.md",
+		"Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness",
+	],
+	codex: ["DELIVERY.md", "No owned native-citizen install/invocation lane."],
+};
+
+const fresh = new Set<string>(FRESH_CALL_BACKENDS);
+const legacy = Object.keys(PRE_82_LEGACY);
+
+// ---------------------------------------------------------------------------
+// 1. The join itself. This assertion is the entire point of the file: it is the
+//    first line in the repo that reads both constants at once.
+// ---------------------------------------------------------------------------
+const unaccounted = META_CITIZEN_BACKENDS.filter((b) => !fresh.has(b) && !(b in PRE_82_LEGACY));
+ok(
+	"[QK:ADMISSION-FRESH-PARITY] every citizen backend is either openable by entwurf_fresh_call or a declared pre-#82 legacy admission — a post-contract harness that mints records but cannot be opened is not admissible, and an `unsupported` note is not a partial-release permit (docs/adding-a-harness.md step 9). Unaccounted: " +
+		(unaccounted.length === 0 ? "none" : unaccounted.join(", ")),
+	unaccounted.length === 0,
+);
+
+// ---------------------------------------------------------------------------
+// 2. The exception must be readable OUTSIDE this file. A literal nobody else
+//    carries is how the omission comes back (check-release-gate-outcomes cell 7).
+// ---------------------------------------------------------------------------
+for (const backend of legacy) {
+	const [file, sentence] = PRE_82_LEGACY[backend as MetaCitizenBackend] as [string, string];
+	const body = fs.readFileSync(path.join(REPO_DIR, file), "utf8");
+	ok(
+		`[QK:ADMISSION-LEGACY-DOCUMENTED] ${backend}'s pre-#82 exception is carried by a sentence an operator can read in ${file}, not only by this gate's literal`,
+		body.includes(sentence),
+	);
+}
+
+// ---------------------------------------------------------------------------
+// 3. The two states are exclusive, and the exception list has no dead entries.
+//    A backend that got wired for fresh while keeping its legacy excuse would
+//    leave a stale "cannot be opened" sentence in the matrix pointing at a
+//    capability that now exists.
+// ---------------------------------------------------------------------------
+for (const backend of legacy) {
+	ok(
+		`[QK:ADMISSION-LEGACY-EXCLUSIVE] ${backend} is excused OR fresh-openable, never both — a backend that walked step 9 must lose its exception and its matrix sentence together`,
+		!fresh.has(backend),
+	);
+	ok(
+		`[QK:ADMISSION-LEGACY-SCOPE] ${backend} is still a citizen backend — an exception for a backend no record may name is dead weight that hides the next real one`,
+		(META_CITIZEN_BACKENDS as readonly string[]).includes(backend),
+	);
+}
+
+// ---------------------------------------------------------------------------
+// 4. The reverse direction. The fresh set naming something that can never mint a
+//    record would be a launchable window with no address to call home from —
+//    `freshCall` would open it and the callback could carry no garden id.
+// ---------------------------------------------------------------------------
+const openableNonCitizens = [...fresh].filter((b) => !(META_CITIZEN_BACKENDS as readonly string[]).includes(b));
+ok(
+	"[QK:ADMISSION-FRESH-IS-CITIZEN] every fresh-openable backend is also a citizen backend — opening a harness that cannot mint a record would produce a window with no address to call back from. Offenders: " +
+		(openableNonCitizens.length === 0 ? "none" : openableNonCitizens.join(", ")),
+	openableNonCitizens.length === 0,
+);
+
+console.log(`[check-harness-admission-parity] ${passed} assertions ok`);

package/scripts/check-meta-doctor-oracle.sh

@@ -526,6 +526,26 @@ else
 fi
 cp "$TMP/hook-log-precopilot.bak" "$AGENT/meta-bridge-hook.log"
 
+# M9c — an OMP line in the shared hook log must not move this doctor either (#87). The
+# omp birth unit is an in-process EXTENSION, and its scope fence writes a line for every
+# task subagent it refuses, so this file now carries a second rail's routine traffic. Its
+# ERROR lines are mint/marker faults on that rail and its recovery token is
+# `create`/`attach`, never `armed watch` — so counting them here would redden the CLAUDE
+# doctor for a fault it does not own and cannot prescribe a fix for. Same expect-GREEN
+# shape as M9b: the defect this guards makes a HEALTHY host go red.
+cp "$AGENT/meta-bridge-hook.log" "$TMP/hook-log-preomp.bak"
+{
+  echo "2026-08-27T00:00:02.000Z ERROR [omp] upsert failed (edge=session_start, native=01a042da-537a-7770-a275-7b8162eecca4): store refused"
+  echo "2026-08-27T00:00:03.000Z INFO [omp] scope-refused edge=session_start mode=print: not the visible tui host, no record minted"
+} >> "$AGENT/meta-bridge-hook.log"
+run_doctor
+if [ "$DOC_RC" -eq 0 ]; then
+  ok "an omp ERROR in the shared hook log leaves the CLAUDE doctor green (rails stay separate)"
+else
+  bad "[QK:HOOK-LOG-OMP-RAIL-SCOPED] an omp ERROR in the shared hook log turned the CLAUDE doctor red — the hook-log judgement does not scope out the omp rail:"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  (FAIL|WARN)' | sed 's/^/        /')"
+fi
+cp "$TMP/hook-log-preomp.bak" "$AGENT/meta-bridge-hook.log"
+
 # M10 — deployed writer bundle missing: staleness becomes unknowable.
 mv "$PLANTED/lib/meta-session.ts" "$TMP/meta-session.bak"
 expect_red "installed writer bundle missing" "deployed writer version is UNKNOWN"