@junghanacs/entwurf 0.18.2 → 0.20.0

package/scripts/smoke-mux-fresh-call-live.ts

@@ -2,7 +2,9 @@
  * smoke-mux-fresh-call-live — the ONE axis a deterministic gate cannot reach: a real window, a
  * real runtime, a real first turn, and a real callback arriving on a real inbound surface.
  *
- * OUT of `pnpm check`. Needs `LIVE=1`. Costs two model turns (one pi, one Claude Code).
+ * OUT of `pnpm check`. Needs `LIVE=1`. Costs FOUR model turns (three pi, one Claude Code): two
+ * open in the caller's own session, and #105 added two more in a second SEAT session on the same
+ * private server so the seat x cwd matrix is read on real panes rather than argued about.
  *
  * ── Isolate the WRITES, keep the runtimes real ──
  *
@@ -59,6 +61,17 @@ const REAL_CONTROL_DIR = path.join(REAL_HOME, ".pi", "entwurf-control");
 // so the real-HOME Claude cell can be given exact operator-env parity (issue #67).
 const ORIGINAL_XDG = snapshotOriginalXdg(process.env);
 
+// The #105 seat fixture. A second session on the SAME private server, its own session_path, and
+// two distinct requested cwds — three directories that must never be confusable with each other.
+const SEAT_SESSION = "seat";
+const SEAT_HOME = (root: string): string => path.join(root, "seat-home");
+const CROSS_REPO_A = (root: string): string => path.join(root, "cross-repo-a");
+const CROSS_REPO_B = (root: string): string => path.join(root, "cross-repo-b");
+/** tmux fills `#{pane_current_path}` with the SERVER's cwd at creation time and only becomes
+ * true 0.2–0.6s later (measured ×2, #105 R1) — so acceptance reads it after a delay, never from
+ * the launch receipt. */
+const PANE_CWD_SETTLE_SECONDS = "3";
+
 let passed = 0;
 function ok(label: string, cond: boolean): void {
 	if (!cond) throw new Error(`${LABEL}: FAILED — ${label}`);
@@ -89,6 +102,13 @@ function tmux(socket: string, args: string[], env: NodeJS.ProcessEnv): { status:
 	return { status: r.status, stdout: (r.stdout ?? "").trim() };
 }
 
+/** The session the caller's own anchor pane sits in — tmux's answer, never a name we assembled. */
+function inspectedSessionId(socket: string, env: NodeJS.ProcessEnv): string {
+	return tmux(socket, ["display-message", "-p", "-t", String(env.TMUX_PANE), "#{session_id}"], env).stdout.split(
+		"\n",
+	)[0];
+}
+
 function pidIsAlive(pid: number): boolean {
 	try {
 		process.kill(pid, 0);
@@ -150,6 +170,10 @@ async function main(): Promise<void> {
 	};
 	for (const dir of Object.values(fenced)) fs.mkdirSync(dir, { recursive: true });
 	fs.mkdirSync(scratch, { recursive: true });
+	// The #105 seat cells need three directories that are all DIFFERENT from each other and from
+	// the scratch cwd, so "the pane landed here" can only be true for one reason. `seatHome` is
+	// the second session's own `session_path` — the candidate the cwd must NOT come from.
+	for (const dir of [SEAT_HOME(root), CROSS_REPO_A(root), CROSS_REPO_B(root)]) fs.mkdirSync(dir, { recursive: true });
 	// A runtime dir is a private surface by convention and tmux checks it.
 	fs.chmodSync(fenced.XDG_RUNTIME_DIR, 0o700);
 	for (const [k, v] of Object.entries(fenced)) process.env[k] = v;
@@ -160,7 +184,7 @@ async function main(): Promise<void> {
 	// Import the meta layer only AFTER the redirects — a module that resolved its roots at import
 	// time would have captured the operator's.
 	const meta = await import("../pi-extensions/lib/meta-session.ts");
-	const { freshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
+	const { freshCall, renderFreshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
 
 	const siblingGids = new Set<string>();
 	const siblingPids = new Set<number>();
@@ -223,6 +247,11 @@ async function main(): Promise<void> {
 		// onboarding instead of exercising the configured runtime. Separate servers preserve
 		// those backend-native environments without adding an env carrier to the product.
 		const nonces = new Map<string, string>();
+		/** Every launched cell's pane, with the directory the pane is REQUIRED to have settled in
+		 * — read after a delay, which is the only honest way to observe it (see the constant). */
+		const cwdCells: Array<{ label: string; socket: string; env: NodeJS.ProcessEnv; paneId: string; expect: string }> =
+			[];
+		const servers = new Map<string, { socket: string; inherited: NodeJS.ProcessEnv }>();
 		// Intentional: pi + claude-code only. Copilot clause-7 LIVE is operator-metered
 		// and is not a release MUST — do not add `copilot` to this loop (VERIFY.md).
 		for (const backend of ["pi", "claude-code"] as const) {
@@ -248,12 +277,17 @@ async function main(): Promise<void> {
 			const anchorPane = tmux(socket, ["display-message", "-p", "-t", "fixture:anchor", "#{pane_id}"], env).stdout;
 			const inherited: NodeJS.ProcessEnv = { ...env, TMUX: `${socket},0,0`, TMUX_PANE: anchorPane };
 			ok(`${backend}: tmux server is a private socket, never the operator's`, String(inherited.TMUX).startsWith(root));
+			servers.set(backend, { socket, inherited });
 
+			// The caller-session half of the #105 cwd matrix: pi omits the cwd, claude-code names
+			// one. Both open in the CALLER's own session, which is the pre-#105 behaviour.
+			const requestedCwd = backend === "claude-code" ? CROSS_REPO_A(root) : undefined;
 			const result = freshCall(
 				{
 					backend,
 					model: LIVE_MODEL[backend],
 					task: "Reply with the single word ACK and then stop. Do not read files.",
+					cwd: requestedCwd,
 					callerGardenId: callerGid,
 				},
 				inherited,
@@ -262,6 +296,13 @@ async function main(): Promise<void> {
 			if (!result.ok) return;
 			nonces.set(backend, result.receipt.nonce);
 			siblingPids.add(Number(result.receipt.panePid));
+			cwdCells.push({
+				label: `${backend} @caller-session cwd=${requestedCwd === undefined ? "(omitted)" : "requested"}`,
+				socket,
+				env: inherited,
+				paneId: result.receipt.paneId,
+				expect: requestedCwd ?? scratch,
+			});
 			ok(
 				`${backend}: the receipt carries tmux coordinates, requested model and nonce, and nothing about delivery`,
 				Boolean(
@@ -271,6 +312,113 @@ async function main(): Promise<void> {
 						result.receipt.nonce,
 				) && !("gardenId" in result.receipt),
 			);
+			ok(
+				`${backend}: with no seat requested the window is in the CALLER's own session and the receipt names no seat`,
+				result.receipt.sessionId === inspectedSessionId(socket, inherited) && result.receipt.tmuxSession === undefined,
+			);
+		}
+
+		// ── #105 acceptance: the optional project seat ───────────────────────────
+		// One extra session on the SAME private pi server (R6: a second session is one line and
+		// costs no extra server). Its own `-c` gives it a session_path that is neither the
+		// caller's cwd nor either requested cwd, so the cwd matrix below can only pass for one
+		// reason.
+		const pi = servers.get("pi");
+		if (!pi) throw new Error(`${LABEL}: the pi fixture server was not captured`);
+		const callerSessionId = inspectedSessionId(pi.socket, pi.inherited);
+		if (
+			tmux(pi.socket, ["new-session", "-d", "-s", SEAT_SESSION, "-c", SEAT_HOME(root), "-n", "anchor"], pi.inherited)
+				.status !== 0
+		) {
+			throw new Error(`${LABEL}: could not create the second fixture session ${SEAT_SESSION}`);
+		}
+		const seatSessionId = tmux(
+			pi.socket,
+			["list-windows", "-t", `=${SEAT_SESSION}`, "-F", "#{session_id}"],
+			pi.inherited,
+		).stdout.split("\n")[0];
+		ok(
+			"seat: the fixture now holds two sessions on ONE server, and the seat is not the caller's",
+			/^\$[0-9]+$/.test(seatSessionId) && seatSessionId !== callerSessionId,
+		);
+
+		// Acceptance 2 FIRST, because it is the one that must leave nothing behind. Both refusals
+		// are read against a byte-identical session/window inventory.
+		const inventory = (): string =>
+			tmux(pi.socket, ["list-windows", "-a", "-F", "#{session_id}|#{window_id}"], pi.inherited).stdout;
+		const beforeRefusals = inventory();
+		for (const [label, seat, reason] of [
+			["absent", "nosuchseat", "tmux-session-missing"],
+			["unresolvable", "no.such.seat", "tmux-session-name-invalid"],
+		] as const) {
+			const refused = freshCall(
+				{
+					backend: "pi",
+					model: LIVE_MODEL.pi,
+					task: "This task must never run.",
+					placement: { tmuxSession: seat },
+					callerGardenId: callerGid,
+				},
+				pi.inherited,
+			);
+			ok(
+				`seat: an ${label} seat is refused as ${reason}, and NOTHING was created`,
+				!refused.ok && refused.reason === reason && inventory() === beforeRefusals,
+			);
+			const rendered = renderFreshCall(refused);
+			ok(
+				`seat: the ${label} refusal says so in the operator's words`,
+				rendered.isError && rendered.text.includes("No window was opened"),
+			);
+		}
+
+		// Acceptance 1 + the other half of the cwd matrix: two seated pi siblings, one with the
+		// cwd omitted and one with a requested cwd.
+		for (const [label, requestedCwd] of [
+			["seat cwd=(omitted)", undefined],
+			["seat cwd=requested", CROSS_REPO_B(root)],
+		] as const) {
+			const callerWindowsBefore = tmux(
+				pi.socket,
+				["list-windows", "-t", callerSessionId, "-F", "#{window_id}"],
+				pi.inherited,
+			).stdout;
+			const seated = freshCall(
+				{
+					backend: "pi",
+					model: LIVE_MODEL.pi,
+					task: "Reply with the single word ACK and then stop. Do not read files.",
+					cwd: requestedCwd,
+					placement: { tmuxSession: SEAT_SESSION },
+					callerGardenId: callerGid,
+				},
+				pi.inherited,
+			);
+			ok(`${label}: launch receipt is ok`, seated.ok);
+			if (!seated.ok) return;
+			nonces.set(label, seated.receipt.nonce);
+			siblingPids.add(Number(seated.receipt.panePid));
+			cwdCells.push({
+				label: `pi @${label}`,
+				socket: pi.socket,
+				env: pi.inherited,
+				paneId: seated.receipt.paneId,
+				expect: requestedCwd ?? scratch,
+			});
+			ok(
+				`${label}: the receipt echoes the REQUESTED seat name and reports the RESOLVED target session, not the caller's`,
+				seated.receipt.tmuxSession === SEAT_SESSION &&
+					seated.receipt.sessionId === seatSessionId &&
+					seated.receipt.sessionId !== callerSessionId,
+			);
+			ok(
+				`${label}: the window really landed in the seat, and the caller's session is byte-identical`,
+				tmux(pi.socket, ["list-windows", "-t", seatSessionId, "-F", "#{window_id}"], pi.inherited).stdout.includes(
+					seated.receipt.windowId,
+				) &&
+					tmux(pi.socket, ["list-windows", "-t", callerSessionId, "-F", "#{window_id}"], pi.inherited).stdout ===
+						callerWindowsBefore,
+			);
 		}
 
 		// The sender envelope rides INSIDE the mailbox body (`  session:     <gid> (…)`) — that line
@@ -295,9 +443,33 @@ async function main(): Promise<void> {
 			if (sender) siblingGids.add(sender);
 		}
 		ok(
-			"correlation: the two siblings reported DIFFERENT garden ids — the envelope identifies each one, not the launcher",
+			"correlation: every sibling reported a DIFFERENT garden id — the envelope identifies each one, not the launcher",
 			siblingGids.size === arrived.size && !siblingGids.has(callerGid),
 		);
+
+		// ── #105 acceptance 3: the seat and the cwd are ORTHOGONAL ───────────────
+		// Read AFTER a delay and from the stable %pane, never from the launch receipt: at
+		// creation time `#{pane_current_path}` reports the tmux SERVER's cwd in every cell
+		// (measured ×2), which is why the receipt reports the REQUESTED cwd and this is the
+		// acceptance that reports the observed one. The 2×2 is {cwd omitted, cwd requested} ×
+		// {caller session, seat}, and the seat's own `session_path` is a fourth directory that
+		// no cell may ever land in.
+		spawnSync("sleep", [PANE_CWD_SETTLE_SECONDS]);
+		for (const cell of cwdCells) {
+			const observed = tmux(
+				cell.socket,
+				["display-message", "-p", "-t", cell.paneId, "#{pane_current_path}"],
+				cell.env,
+			).stdout;
+			ok(
+				`cwd x seat: ${cell.label} settled in ${cell.expect} — never the target session's path, never the other cell's`,
+				observed === cell.expect && observed !== SEAT_HOME(root),
+			);
+		}
+		ok(
+			"cwd x seat: all four cells ran — {cwd omitted, cwd requested} x {caller session, seat}",
+			cwdCells.length === 4 && new Set(cwdCells.map((c) => c.expect)).size === 3,
+		);
 		ok(
 			"fence: those sibling records live in the FIXTURE store",
 			[...siblingGids].every(

package/scripts/smoke-omp-bridge-state.sh

@@ -22,7 +22,10 @@ wait_carrier() {
   local pid="$1" key="$2" i=0
   while [ "$i" -lt 50 ]; do
     if kill -0 "$pid" 2>/dev/null && [ -r "/proc/$pid/environ" ]; then
-      if tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | grep -q "^${key}"; then
+      # `-c` not `-q`, for the reason in omp-bridge-doctor.sh's carrier scan: under
+      # pipefail an early-exiting grep SIGPIPEs `tr` and the pipeline reports failure even
+      # on a match. Here that only costs a retry, but the hazard is the same one.
+      if [ "$(tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | grep -cE "^${key}" || true)" -gt 0 ]; then
         return 0
       fi
     fi
@@ -103,7 +106,7 @@ CARRIER_PID=$!
 wait_carrier "$CARRIER_PID" "PI_SESSION_ID=foreign-garden"
 if OUT="$(ENTWURF_OMP_CARRIER_PIDS="$CARRIER_PID" "$RUN" doctor-omp-bridge 2>&1)"; then
   printf '%s\n' "$OUT" >&2
-  die "doctor accepted the live omp fixture with nonblank inherited PI carriers"
+  die "[QK:OMP-DOCTOR-CARRIER-NONBLANK-IS-RED] doctor accepted the live omp fixture with nonblank inherited PI carriers"
 fi
 printf '%s\n' "$OUT" | grep -q "live omp process(es).* $CARRIER_PID" || die "doctor red without naming the nonblank-carrier fixture"
 ok "a nonblank inherited PI carrier on a live omp process remains red"
@@ -111,6 +114,44 @@ kill "$CARRIER_PID"
 wait "$CARRIER_PID" 2>/dev/null || true
 CARRIER_PID=""
 
+# THE CANDIDATE SET ITSELF CAN BE UNKNOWN, AND UNKNOWN IS NOT EMPTY (#78 B1). `pgrep`
+# answers three ways and only two of them are facts about omp: 0 = it enumerated and
+# matched, 1 = it enumerated and NOTHING matched (a real, positive absence), anything
+# else = it never enumerated. The doctor used to `|| true` that third answer into the
+# second, so a broken enumeration produced an empty candidate set, the clean carrier
+# line and a PASS — with a contaminated session possibly live on the host.
+#
+# BOTH DIRECTIONS ARE PINNED, because a repair that also reddened the honest "nothing
+# matched" would be a different defect. `ENTWURF_OMP_CARRIER_PIDS` must be UNSET for
+# these two: that seam short-circuits the very enumeration under test, which is why it
+# is a narrowing seam and never production proof.
+PGREP_SHIM="$SB/pgrep-shim"
+mkdir -p "$PGREP_SHIM"
+printf '#!/usr/bin/env bash\nexit 1\n' > "$PGREP_SHIM/pgrep"
+chmod +x "$PGREP_SHIM/pgrep"
+if OUT="$(env -u ENTWURF_OMP_CARRIER_PIDS PATH="$PGREP_SHIM:$PATH" "$RUN" doctor-omp-bridge 2>&1)"; then
+  printf '%s\n' "$OUT" | grep -q "no live omp process carries" || die "an enumerated-and-empty candidate set did not print the clean carrier verdict"
+  ok "a \`pgrep\` that enumerated and matched NOTHING is a real absence and stays green"
+else
+  printf '%s\n' "$OUT" >&2
+  die "a \`pgrep\` exit 1 (nothing matched) turned the carrier axis red"
+fi
+printf '#!/usr/bin/env bash\nexit 2\n' > "$PGREP_SHIM/pgrep"
+if OUT="$(env -u ENTWURF_OMP_CARRIER_PIDS PATH="$PGREP_SHIM:$PATH" "$RUN" doctor-omp-bridge 2>&1)"; then
+  printf '%s\n' "$OUT" >&2
+  die "[QK:OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE] a FAILED process enumeration left the doctor green — it printed a carrier verdict with no candidate set, so a live omp session carrying a foreign pi garden id would read as clean"
+fi
+if ! printf '%s\n' "$OUT" | grep -q "UNVERIFIABLE — 'pgrep -x omp' FAILED (exit 2)"; then
+  printf '%s\n' "$OUT" >&2
+  die "the doctor went red without naming the failed enumeration as UNVERIFIABLE"
+fi
+if printf '%s\n' "$OUT" | grep -q "no live omp process carries"; then
+  printf '%s\n' "$OUT" >&2
+  die "the doctor claimed a clean carrier axis while the candidate set was unknown"
+fi
+ok "a FAILED enumeration is UNVERIFIABLE and red, and it claims neither contamination nor absence"
+rm -rf "$PGREP_SHIM"
+
 # ── 2. reinstall is idempotent ───────────────────────────────────────────────
 "$RUN" install-omp-bridge >/dev/null || die "reinstall over our own state failed"
 "$RUN" doctor-omp-bridge >/dev/null || die "doctor red after a reinstall"

package/scripts/smoke-setup-verdict.sh

@@ -287,6 +287,106 @@ rm -rf "$HOME/.omp" "$XDG_DATA_HOME/entwurf/omp-bridge" "$XDG_DATA_HOME/entwurf/
   "$XDG_DATA_HOME/entwurf/omp-config" "$XDG_DATA_HOME/entwurf/omp-receive" \
   "$XDG_DATA_HOME/entwurf/meta-bridge-omp" "$XDG_DATA_HOME/entwurf/omp-receive"
 
+# ── S-9: rail certification is a SEPARATE axis from install success (#78 D1) ──
+# The 0.20.0 macOS lane opened the installers to Darwin (meta-bridge-install.sh's
+# platform gate became its own python3/node dependency instead of the platform
+# name), and that removed the only thing which used to keep a detected Mac host
+# non-green: the installer's refusal. A detected harness on Darwin now INSTALLS,
+# every harness doctor still refuses there (NOT CERTIFIED — pending physical
+# host), and `setup` runs no doctor. Hard Rule 17 names that shape non-green, so
+# setup_harness_result does — and these cells are its ONLY executing consumer,
+# because nothing else in this repo ever takes the Darwin branch.
+#
+# `uname` is faked on PATH exactly the way smoke-meta-install-state.sh already
+# fakes it for the installer's own platform gate. Both directions are pinned so
+# the fixture cannot pass for the wrong reason: the Linux twin below is the SAME
+# sandbox, the SAME stub harnesses and the SAME fixture with one byte different,
+# and S-3/S-8 above are the unfaked real-host Linux evidence.
+FAKE_UNAME="$SB/fake-uname-darwin"; mkdir -p "$FAKE_UNAME"
+# Absolute bash in the shebang, same reason as the sibling fixture: a cell may
+# hand this script a PATH that does not carry `env`/`bash` itself.
+cat > "$FAKE_UNAME/uname" <<SH
+#!$(command -v bash)
+printf '%s\n' Darwin
+SH
+chmod +x "$FAKE_UNAME/uname"
+FAKE_UNAME_LINUX="$SB/fake-uname-linux"; mkdir -p "$FAKE_UNAME_LINUX"
+cat > "$FAKE_UNAME_LINUX/uname" <<SH
+#!$(command -v bash)
+printf '%s\n' Linux
+SH
+chmod +x "$FAKE_UNAME_LINUX/uname"
+
+omp_reset() {
+  rm -rf "$HOME/.omp" "$XDG_DATA_HOME/entwurf/omp-bridge" "$XDG_DATA_HOME/entwurf/omp-mcp" \
+    "$XDG_DATA_HOME/entwurf/omp-config" "$XDG_DATA_HOME/entwurf/omp-receive" \
+    "$XDG_DATA_HOME/entwurf/meta-bridge-omp"
+}
+
+# ── S-9a: fake Darwin + DETECTED harnesses → named non-green, install intact ──
+# Two harness FAMILIES on purpose (the pi adapter rail and the four omp units):
+# a rule applied to one backend and not the next is a new defect, not half a fix.
+echo "[smoke-setup-verdict] S-9a detected harnesses on an uncertified platform"
+PROJ9="$SB/proj9"; mkdir -p "$PROJ9"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-ok" OMP_BIN="$FAKE_OMP/omp" ENTWURF_OMP_AGENT_DIR="$HOME/.omp/agent" PATH="$FAKE_UNAME:$FAKE_OMP:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9" 2>&1)"; RC=$?; set -e
+want "S-9a: a detected harness on an uncertified platform owns a nonzero setup exit" "[ '$RC' -ne 0 ]"
+want "S-9a: the pi adapter rail is named non-green, never a cosmetic PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'pi: PASS'"
+want "S-9a: all four omp units are named non-green, none cosmetically PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: FAIL' && printf '%s' \"\$OUT\" | grep -q 'omp-mcp: FAIL' && printf '%s' \"\$OUT\" | grep -q 'omp-config: FAIL' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'omp-[a-z]*: PASS'"
+want "S-9a: the reason says the wiring WAS written (this is not an install failure)" \
+  "printf '%s' \"\$OUT\" | grep -q 'the wiring WAS written and nothing failed to install'"
+want "S-9a: the reason names the RAIL evidence state and the platform" \
+  "printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED — pending physical host on Darwin'"
+want "S-9a: the reason names the doctor that owns the rail axis, per component" \
+  "printf '%s' \"\$OUT\" | grep -qF \"owned by './run.sh doctor-omp-bridge'\" && printf '%s' \"\$OUT\" | grep -qF \"owned by './run.sh doctor-pi-provider'\""
+want "S-9a: the reason points at the tracking issue" "printf '%s' \"\$OUT\" | grep -q 'Tracking: #78'"
+want "S-9a: it never reads as an install refusal (no unsupported-platform / did-not-complete vocabulary)" \
+  "! printf '%s' \"\$OUT\" | grep -qi 'unsupported platform' && ! printf '%s' \"\$OUT\" | grep -q 'did not complete'"
+want "S-9a: the summary is NON-GREEN and names the uncertified components" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL:' && ! printf '%s' \"\$OUT\" | grep -q 'result: green'"
+# The load-bearing half: the installs genuinely SUCCEEDED. Without this the cell
+# would also pass if the platform had merely broken the installers.
+want "S-9a: the wiring really landed — pi project settings plus both omp extensions and the MCP hand" \
+  "[ -f '$PROJ9/.pi/settings.json' ] && [ -d '$HOME/.omp/agent/extensions/entwurf-meta-omp' ] && [ -d '$HOME/.omp/agent/extensions/entwurf-receive-omp' ] && [ -f '$HOME/.omp/agent/mcp.json' ]"
+want_auth_untouched "S-9a"
+omp_reset
+
+# ── S-9b: the Linux twin — same fixture, one byte different → still PASS/green ──
+# This is the regression axis that matters most: the certified platform's behavior
+# must not have moved at all.
+echo "[smoke-setup-verdict] S-9b the same detected harnesses on the certified platform"
+PROJ9B="$SB/proj9b"; mkdir -p "$PROJ9B"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-ok" OMP_BIN="$FAKE_OMP/omp" ENTWURF_OMP_AGENT_DIR="$HOME/.omp/agent" PATH="$FAKE_UNAME_LINUX:$FAKE_OMP:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9B" 2>&1)"; RC=$?; set -e
+want "S-9b: the certified platform still exits 0" "[ '$RC' -eq 0 ]"
+want "S-9b: pi and all four omp units still compose as PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-config: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS'"
+want "S-9b: a PASS row is byte-identical to the pre-#78 wording (the operator surface did not move)" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS — birth extension installed — verify: ./run.sh doctor-omp-bridge'"
+want "S-9b: the computed summary is green and carries no rail-certification wording" \
+  "printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)' && ! printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED'"
+want_auth_untouched "S-9b"
+omp_reset
+
+# ── S-9c: fake Darwin + NO harness → still green (the macOS CI job's contract) ──
+# The macos-install-surface job asserts exactly this shape on a real Darwin runner:
+# five zero-state SKIPs, core PASS, computed green. The rule above must not reach
+# an absent harness — SKIP is not a completed integration.
+echo "[smoke-setup-verdict] S-9c harness-free host on an uncertified platform"
+PROJ9C="$SB/proj9c"; mkdir -p "$PROJ9C"
+seed_auth
+set +e; OUT="$(PATH="$FAKE_UNAME:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9C" 2>&1)"; RC=$?; set -e
+want "S-9c: a harness-free uncertified host still exits 0" "[ '$RC' -eq 0 ]"
+want "S-9c: all five harness probes are still zero-state SKIPs" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP'"
+want "S-9c: core still PASSes and the computed summary is still green" \
+  "printf '%s' \"\$OUT\" | grep -q 'core: PASS' && printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
+want "S-9c: an absent harness is never given a rail verdict it did not earn" \
+  "! printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED'"
+want_auth_untouched "S-9c"
+
 # ── S-5: installed mode is a NAMED first verdict, never the source bootstrap ──
 # A bare copy of run.sh under a fake node_modules root pins the mode seam
 # cheaply: the copy is NOT a runnable installed package (no dist), so this cell