@junghanacs/entwurf 0.18.2 → 0.20.0

package/scripts/check-copilot-receive-arm.ts

@@ -60,6 +60,7 @@ import {
 	upsertMetaSession,
 	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { killOnExit, reclaimNow, reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const UNIT = "entwurf-receive";
@@ -90,7 +91,7 @@ async function waitUntil(fn: () => boolean, ms = 15000): Promise<boolean> {
 	}
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-copilot-receive."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-copilot-receive.")));
 const home = path.join(root, "home");
 const store = path.join(root, "agent");
 const extRoot = path.join(root, "extensions");
@@ -260,6 +261,30 @@ writeFileSync(
 	path.join(stubDir, "register.mjs"),
 	`import { register } from "node:module";
 register("./loader.mjs", import.meta.url);
+// The vendor half this fixture MUST model. Production children are started by the CLI's
+// own bootstrap (\`preloads/extension_bootstrap.mjs\`), which exits the extension when its
+// parent disappears — checked at startup and then once a second — and the receiver's
+// owner-pid contract is built on that. A stub that omitted it made the fixture MORE
+// permissive than production: the stub's referenced timer kept every child alive after
+// the gate died, so each red run reparented its children to pid 1 forever (measured
+// 2026-09-07/08 on \`oracle\`: 360 such node processes, 720 temp roots). The check is
+// \`unref\`ed so it never becomes the reason a child stays up.
+//
+// KNOWN-OPEN, deliberately: under a subreaper (\`PR_SET_CHILD_SUBREAPER\`, systemd-run)
+// a parent that dies before this module's FIRST tick is already reparented to a LIVE
+// subreaper, so \`parentAtStart\` records that pid and never changes again. The obvious
+// patch — probing the recorded pid with signal 0 — closes nothing: Linux reparents in
+// \`forget_original_parent()\` BEFORE the old pid becomes unreachable, and a zombie
+// parent still answers signal 0, so the probe is false at startup in exactly the case
+// it was written for. The honest close is to watch the DECLARED parent
+// (\`COPILOT_EXTENSION_PARENT_PID\`), which this gate deliberately sets to a pid that is
+// not the child's real parent, so it is left documented rather than half-fixed. The
+// window is microseconds and no measured orphan on this host came through it.
+const parentAtStart = process.ppid;
+if (parentAtStart === 1) process.exit(0);
+setInterval(() => {
+	if (process.ppid !== parentAtStart) process.exit(0);
+}, 1000).unref();
 `,
 );
 
@@ -274,23 +299,25 @@ interface Harness {
 function launch(label: string, sessionId: string, extra: NodeJS.ProcessEnv = {}): Harness {
 	const box = path.join(root, `box-${label}`);
 	mkdirSync(box, { recursive: true });
-	const child = spawn(process.execPath, ["--import", path.join(stubDir, "register.mjs"), entry], {
-		env: {
-			...process.env,
-			HOME: home,
-			PI_CODING_AGENT_DIR: store,
-			STUB_BOX: box,
-			STUB_SDK: path.join(stubDir, "extension.js"),
-			STUB_SESSION_ID: sessionId,
-			SESSION_ID: sessionId,
-			// The vendor's carrier. This gate process IS the fork parent, which is also
-			// what makes the sender-marker join real rather than mocked: the marker below
-			// is written under the very pid the child will look itself up by.
-			COPILOT_EXTENSION_PARENT_PID: String(process.pid),
-			...extra,
-		},
-		stdio: ["ignore", "pipe", "pipe"],
-	});
+	const child = killOnExit(
+		spawn(process.execPath, ["--import", path.join(stubDir, "register.mjs"), entry], {
+			env: {
+				...process.env,
+				HOME: home,
+				PI_CODING_AGENT_DIR: store,
+				STUB_BOX: box,
+				STUB_SDK: path.join(stubDir, "extension.js"),
+				STUB_SESSION_ID: sessionId,
+				SESSION_ID: sessionId,
+				// The vendor's carrier. This gate process IS the fork parent, which is also
+				// what makes the sender-marker join real rather than mocked: the marker below
+				// is written under the very pid the child will look itself up by.
+				COPILOT_EXTENSION_PARENT_PID: String(process.pid),
+				...extra,
+			},
+			stdio: ["ignore", "pipe", "pipe"],
+		}),
+	);
 	child.stdout?.resume();
 	child.stderr?.resume();
 	return {
@@ -699,6 +726,68 @@ ok(
 		opaque.kill("SIGKILL");
 	}
 }
+{
+	// AN UNREADABLE argv IS "UNKNOWN", NOT "ABSENT" (#78 B2). Identity is the FIRST
+	// predicate of the scan, so a candidate whose `cmdline` will not open cannot be
+	// classified at all — and a blanket `except OSError: return None` classified it
+	// anyway, as "not a Copilot CLI". Every candidate taking that branch left all
+	// counters at zero, which is the benign "no live GitHub Copilot CLI process" note:
+	// a doctor claiming ABSENCE while its identity input was unavailable. That is the
+	// same false-success class as the platform branch above, so it gets the same verdict.
+	//
+	// THE DENIAL IS INJECTED, AND THAT IS SAID OUT LOUD BECAUSE IT MATTERS. The environ
+	// cell above makes its file really unreadable with prctl(PR_SET_DUMPABLE, 0), and
+	// measured on this kernel that trick does NOT reach argv: `/proc/<pid>/cmdline` stays
+	// mode 0444 and readable even for a non-dumpable child (a full /proc census read
+	// 340/340 cmdlines). A real EACCES there needs a `hidepid` /proc mount, which an
+	// unprivileged gate cannot create. So the refusal is raised exactly where the kernel
+	// would raise it — at the scanner's own read, with EACCES — through a `sitecustomize`
+	// on PYTHONPATH, and what this cell pins is the CLASSIFICATION of a refused read,
+	// which is the entire contract. The fixture process is real, and the control run
+	// asserts it WOULD be identified as a native CLI when its argv can be read, so
+	// neither half of the pin is vacuous.
+	const denyDir = path.join(root, "deny-cmdline");
+	mkdirSync(denyDir, { recursive: true });
+	writeFileSync(
+		path.join(denyDir, "sitecustomize.py"),
+		[
+			"import errno, os, pathlib",
+			"_pid = os.environ.get('ENTWURF_TEST_DENY_CMDLINE_PID')",
+			"if _pid:",
+			"    _target = '/proc/' + _pid + '/cmdline'",
+			"    _real = pathlib.Path.read_bytes",
+			"    def _denied(self):",
+			"        if str(self) == _target:",
+			"            raise PermissionError(errno.EACCES, 'Permission denied', str(self))",
+			"        return _real(self)",
+			"    pathlib.Path.read_bytes = _denied",
+		].join("\n") + "\n",
+	);
+	const opaqueArgv = spawn(
+		"python3",
+		["-c", "import time; time.sleep(60)", path.join(root, "node_modules", "@github", "copilot", "npm-loader.js")],
+		{ stdio: "ignore" },
+	);
+	running.push(opaqueArgv);
+	try {
+		await sleep(400);
+		const identified = doctor({ ENTWURF_COPILOT_RECEIVE_PIDS: String(opaqueArgv.pid) });
+		const blind = doctor({
+			ENTWURF_COPILOT_RECEIVE_PIDS: String(opaqueArgv.pid),
+			PYTHONPATH: denyDir,
+			ENTWURF_TEST_DENY_CMDLINE_PID: String(opaqueArgv.pid),
+		});
+		ok(
+			"[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE] a live process whose argv is REFUSED is UNKNOWN, not absent — the doctor declines to claim that no CLI is running and ends RED, where the same process with a readable argv is judged",
+			identified.includes("lack COPILOT_CLI_ENABLED_FEATURE_FLAGS") &&
+				blind.includes("UNVERIFIABLE — the argv of 1 live process(es) could not be read") &&
+				!blind.includes("no live GitHub Copilot CLI process") &&
+				blind.trimEnd().endsWith("[copilot-receive-doctor] FAIL"),
+		);
+	} finally {
+		opaqueArgv.kill("SIGKILL");
+	}
+}
 {
 	// THE SCANNER'S OWN FAILURE IS THIS DOCTOR'S VERDICT, NOT ITS DEATH. Under
 	// `set -euo pipefail`, `x="$(python3 …)"` hands the interpreter's status to the
@@ -725,10 +814,69 @@ ok(
 	);
 }
 
-// ── 10. the installer's honest inverse ───────────────────────────────────────
+// ── 10. the fixture dies with its parent, like the vendor's child does ───────
+// This gate spawns real Node children that hold a referenced timer, so "the gate
+// stopped" and "the gate's children stopped" are two different facts. Production gets
+// the second one from the CLI's bootstrap; the stub loader has to supply it here, or a
+// red run (which ends by throwing, long before any cleanup statement) leaves a process
+// per launch on the host forever. Orphan one deliberately and require it to leave on
+// its own. The intermediate `bash` holds the child for two seconds first: a child whose
+// parent is ALREADY gone when its loader runs leaves at the watchdog's startup check,
+// which proves nothing about a session that was live when the gate died.
+{
+	const orphanBox = path.join(root, "box-orphan");
+	mkdirSync(orphanBox, { recursive: true });
+	const pidFile = path.join(root, "orphan.pid");
+	const ORPHAN_SESSION = "cop-recv-orphan";
+	spawnSync(
+		"bash",
+		[
+			"-c",
+			`${JSON.stringify(process.execPath)} --import ${JSON.stringify(path.join(stubDir, "register.mjs"))} ` +
+				`${JSON.stringify(entry)} </dev/null >/dev/null 2>&1 & echo $! > ${JSON.stringify(pidFile)}; sleep 2`,
+		],
+		{
+			env: {
+				...process.env,
+				HOME: home,
+				PI_CODING_AGENT_DIR: store,
+				STUB_BOX: orphanBox,
+				STUB_SDK: path.join(stubDir, "extension.js"),
+				STUB_SESSION_ID: ORPHAN_SESSION,
+				SESSION_ID: ORPHAN_SESSION,
+				COPILOT_EXTENSION_PARENT_PID: String(process.pid),
+			},
+			stdio: "ignore",
+		},
+	);
+	const orphanPid = Number(readFileSync(pidFile, "utf8").trim());
+	// Non-vacuity: it is only evidence if the process it names actually reached the
+	// same live state every other child in this gate reaches. Its log line is written
+	// during boot and outlives it, so reading it after the exit is not a race.
+	const booted = await waitUntil(() => {
+		const f = path.join(store, "meta-bridge-receive-copilot.log");
+		return existsSync(f) && readFileSync(f, "utf8").includes(`joined session=${ORPHAN_SESSION}`);
+	});
+	ok("the orphaned child booted the real unit (so its exit below is not a startup crash)", booted);
+	const gone = await waitUntil(() => {
+		try {
+			process.kill(orphanPid, 0);
+			return false;
+		} catch {
+			return true; // ESRCH — the pid is gone
+		}
+	});
+	ok(
+		"[QK:COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT] a fixture child whose parent disappeared exits by " +
+			"itself — no pid-1 receiver survives a red or interrupted run",
+		gone,
+	);
+	if (!gone) process.kill(orphanPid, "SIGKILL");
+}
+
+// ── 11. the installer's honest inverse ───────────────────────────────────────
 execFileSync("bash", [path.join(REPO, "run.sh"), "uninstall-copilot-receive"], { env: installEnv, stdio: "pipe" });
 ok("uninstall removes the unit it installed and clears its state", !existsSync(unitDir) && !existsSync(stateFile));
 
-for (const c of running) c.kill("SIGKILL");
-rmSync(root, { recursive: true, force: true });
+reclaimNow();
 console.log(`\n[check-copilot-receive-arm] PASS (${passed} assertions)`);

package/scripts/check-copilot-statusline.ts

@@ -13,6 +13,7 @@ import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const SCRIPT = path.join(REPO, "scripts", "copilot-statusline.sh");
@@ -27,7 +28,8 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-copilot-statusline."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-copilot-statusline.")));
+
 const home = path.join(root, "home");
 const store = path.join(root, "meta-sessions");
 mkdirSync(home);

package/scripts/check-fresh-cut-gate.sh

@@ -403,12 +403,44 @@ fi
 # #86 A5 credential tripwire: the retired sync_auth mutation (OAuth alias copy +
 # auth.json.bak) must never resurrect as an invocable surface in run.sh. Comments
 # documenting the removal are allowed; a function definition or call is not.
-if awk '!/^[[:space:]]*#/' "$REPO/run.sh" | grep -q 'sync_auth'; then
+# THE PREDICATE IS A FUNCTION so the self-test below can run the SAME code against a planted
+# fixture. A self-test that re-typed this pipeline would keep passing while the real one went
+# blind, which is precisely the failure this cell exists to prevent.
+#
+# `grep -c`, never `grep -q`. This file runs under pipefail, and a `-q` grep exits at the FIRST
+# match, closing the pipe while `awk` is still writing the remaining ~200KB of a 433KB run.sh.
+# `awk` dies of SIGPIPE (141), pipefail promotes that to the pipeline's status, and the `if`
+# takes the ELSE branch — so this tripwire went blind EXACTLY when a sync_auth surface existed
+# and reported "no credential surface remains". Unlike the omp doctor's load-dependent race this
+# one was deterministic, because the producer is far larger than the pipe buffer.
+sync_auth_surface_count() {
+  awk '!/^[[:space:]]*#/' "$1" | grep -c 'sync_auth' || true
+}
+sync_auth_hits="$(sync_auth_surface_count "$REPO/run.sh")"
+if [ "${sync_auth_hits:-0}" -gt 0 ]; then
   bad "D4b the retired sync_auth credential mutation reappeared as code in run.sh"
 else
   ok "D4b no sync_auth credential surface remains in run.sh (comments only)"
 fi
 
+# D4b-self. The cell above is green on a clean run.sh — which is exactly the state in which a
+# blind tripwire and a working one are indistinguishable. This plants the surface it exists to
+# catch and requires the SAME predicate to see it. The plant goes NEAR THE TOP of the real,
+# large run.sh on purpose: the defect only appears when the consumer can exit while the producer
+# still has bulk left to write, so a small synthetic fixture would pass even with `grep -q` and
+# would prove nothing. It is a copy under mktemp; run.sh is never written.
+fc_probe="$(mktemp -t fresh-cut-syncauth-probe.XXXXXX)"
+awk 'NR==2{print "sync_auth() { cp \"$HOME/.claude/.credentials.json\" \"$HOME/.claude/auth.json.bak\"; }"}1' \
+  "$REPO/run.sh" >"$fc_probe"
+fc_planted="$(sync_auth_surface_count "$fc_probe")"
+fc_clean="$(sync_auth_surface_count "$REPO/run.sh")"
+rm -f "$fc_probe"
+if [ "${fc_planted:-0}" -gt 0 ] && [ "${fc_clean:-0}" -eq 0 ]; then
+  ok "D4b-self the tripwire actually FIRES on a planted sync_auth surface (planted=$fc_planted clean=$fc_clean)"
+else
+  bad "[QK:FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES] D4b's predicate did not see a planted sync_auth surface (planted=$fc_planted clean=$fc_clean) — the credential tripwire is blind and a green D4b means nothing"
+fi
+
 ilp_gate=$(awk '/^install_local_package\(\)/,/^}/{ if ($0 ~ /preflight_v3_store install/) { print NR; exit } }' "$REPO/run.sh")
 ilp_write=$(awk '/^install_local_package\(\)/,/^}/{ if ($0 ~ /register-pi-package.py|mkdir -p "\$project_dir/) { print NR; exit } }' "$REPO/run.sh")
 if [ -n "$ilp_gate" ] && [ -n "$ilp_write" ] && [ "$ilp_gate" -lt "$ilp_write" ]; then
@@ -425,12 +457,32 @@ else
   bad "D6 meta-bridge-install.sh's doctor call is missing or sits after the state snapshot (doctor=$mb_gate prepare=$mb_write)"
 fi
 
-if grep -n 'preflight_v3_store()' -A 40 "$REPO/run.sh" | grep -qE 'run_ts scripts/meta-bridge-fresh-cut\.ts'; then
+# Same hazard as D4b. This producer happens to emit less than one pipe buffer today, so
+# no SIGPIPE window exists — but that is a size coincidence, not a property, and it moves
+# the moment run.sh grows another match. Counted rather than short-circuited.
+preflight_cut_count() {
+  grep -n 'preflight_v3_store()' -A 40 "$1" | grep -cE 'run_ts scripts/meta-bridge-fresh-cut\.ts' || true
+}
+cut_in_preflight="$(preflight_cut_count "$REPO/run.sh")"
+if [ "${cut_in_preflight:-0}" -gt 0 ]; then
   bad "D7 the preflight invokes fresh-cut — an install must never cut a generation by itself"
 else
   ok "D7 the preflight only ever asks the doctor (never runs the cut)"
 fi
 
+# D7-self, same argument as D4b-self: a forbidding cell that is green on a clean tree proves
+# nothing until it is shown catching the thing it forbids. A synthetic fixture is enough here
+# because this producer has no SIGPIPE window to reproduce — what is being proven is detection.
+d7_probe="$(mktemp -t fresh-cut-preflight-probe.XXXXXX)"
+printf '%s\n' 'preflight_v3_store() {' '  run_ts scripts/meta-bridge-fresh-cut.ts' '}' >"$d7_probe"
+d7_planted="$(preflight_cut_count "$d7_probe")"
+rm -f "$d7_probe"
+if [ "${d7_planted:-0}" -gt 0 ] && [ "${cut_in_preflight:-0}" -eq 0 ]; then
+  ok "D7-self the cell actually FIRES on a preflight that does call fresh-cut (planted=$d7_planted real=$cut_in_preflight)"
+else
+  bad "[QK:FRESHCUT-PREFLIGHT-CUT-DETECTED] D7's predicate did not see a planted fresh-cut call in a preflight (planted=$d7_planted real=$cut_in_preflight)"
+fi
+
 if [ -e "$FRESH_CUT_GATE_CLAUDE_SENTINEL" ]; then
   bad "D8 an offline gate drive crossed the store refusal and invoked Claude" "$(cat "$FRESH_CUT_GATE_CLAUDE_SENTINEL")"
 else

package/scripts/check-gate-qualification.ts

@@ -66,6 +66,7 @@ import {
 	validateManifest,
 	validateManifestSet,
 } from "./lib/mutation-qualify.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const MUTANTS_DIR = path.join(REPO_DIR, "scripts", "mutants");
@@ -135,7 +136,7 @@ function checkVitestAttribution(): void {
 		],
 	});
 
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-attribution-selftest-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-attribution-selftest-")));
 	const reportPath = path.join(dir, "vitest-report.json");
 	try {
 		fs.writeFileSync(reportPath, report);
@@ -422,10 +423,10 @@ if (process.argv.includes("--attribution-self-test")) {
 // ═══ Phase 1c — the pipeline over a synthetic fixture repo ══════════════════
 
 function buildFixtureOrigin(): { dir: string; externalTarget: string } {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-fixture-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-fixture-")));
 	// A file OUTSIDE the fixture repo, reachable only through a tracked symlink — the
 	// P0-1 escape shape: mutating `linked.txt` would write THIS file.
-	const externalDir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-external-"));
+	const externalDir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-external-")));
 	const externalTarget = path.join(externalDir, "external-target.txt");
 	fs.writeFileSync(externalTarget, "original-line outside the sandbox\n");
 	const write = (rel: string, body: string, mode = 0o644): void => {
@@ -745,7 +746,7 @@ const quiet = (): void => {};
 
 		// pgroup kill: the grandchild really dies on this host (hardening #6, Linux axis).
 		{
-			const invocationDir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-pgk-"));
+			const invocationDir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-pgk-")));
 			const pidFile = path.join(invocationDir, "grandchild.pid");
 			const script = path.join(invocationDir, "spawner.sh");
 			fs.writeFileSync(script, `#!/usr/bin/env bash\nsleep 300 & echo $! > ${JSON.stringify(pidFile)}\nwait\n`);
@@ -773,7 +774,7 @@ const quiet = (): void => {};
 
 		// Stale-snapshot sweep: dead-pid residue is reclaimed, a live runner's dir survives.
 		{
-			const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-sweep-"));
+			const tmpRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-sweep-")));
 			const deadDir = path.join(tmpRoot, "entwurf-qualify-dead1");
 			fs.mkdirSync(deadDir);
 			fs.writeFileSync(path.join(deadDir, "runner.json"), JSON.stringify({ pid: 999_999_999, startedAt: 0 }));
@@ -820,7 +821,7 @@ let manifestCount: number;
 	// Extend this inventory and the manifests TOGETHER, never silently.
 	const EXPECTED_LANE_MUTANTS: Record<string, number> = {
 		"acp-augment": 10,
-		"acp-cortex": 12,
+		"acp-cortex": 14,
 		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
 		"acp-prompt-lifecycle": 15,
@@ -833,21 +834,21 @@ let manifestCount: number;
 		"capability-cache": 3,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
-		"copilot-receive": 18,
-		"fresh-cut": 1,
+		"copilot-receive": 20,
+		"fresh-cut": 3,
 		"gate-qualification": 2,
 		"meta-facts": 4,
 		"meta-hook-session-switch": 17,
 		"meta-identity": 4,
 		"meta-retire": 3,
-		"mux-boundary": 14,
-		"mux-fresh-call": 37,
+		"mux-boundary": 16,
+		"mux-fresh-call": 44,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
 		"pack-install": 2,
 		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
-		"omp-birth": 11,
+		"omp-birth": 13,
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
@@ -855,7 +856,7 @@ let manifestCount: number;
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
-		"setup-verdict": 13,
+		"setup-verdict": 14,
 		"source-install": 2,
 		"v2-surface": 7,
 		"v2-visible-resume": 17,

package/scripts/check-hook-launch-topology.ts

@@ -45,6 +45,7 @@ import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSyn
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -272,7 +273,7 @@ function hookEnv(agentRoot: string, pluginRoot: string): NodeJS.ProcessEnv {
 }
 
 function driveHook(label: string, pluginRoot: string, nativeSessionId: string): void {
-	const agentRoot = mkdtempSync(path.join(tmpdir(), "psa-hook-topology-"));
+	const agentRoot = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-topology-")));
 	const leaf = leafOf("SessionStart");
 	const exe = resolveEl(leaf.command ?? "", pluginRoot);
 	const argv = (leaf.args ?? []).map((a) => resolveEl(a, pluginRoot));
@@ -317,7 +318,7 @@ function driveHook(label: string, pluginRoot: string, nativeSessionId: string):
 }
 
 {
-	const plain = mkdtempSync(path.join(tmpdir(), "psa-hook-bundle-"));
+	const plain = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-bundle-")));
 	makeBundle(plain);
 	driveHook("exec direct topology", plain, "native-exec-direct");
 }
@@ -329,7 +330,7 @@ function driveHook(label: string, pluginRoot: string, nativeSessionId: string):
 // path was pasted into a command string and would have been word-split or
 // command-substituted; under exec form each element is one opaque argv slot.
 {
-	const holder = mkdtempSync(path.join(tmpdir(), "psa-hook-meta-"));
+	const holder = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-meta-")));
 	const nasty = path.join(holder, "plug in $HOME `id` ;& dir");
 	makeBundle(nasty);
 	ok("metachar fixture root really contains space/$/backtick/;&", /[ $`;&]/.test(path.basename(nasty)));
@@ -345,9 +346,9 @@ function driveHook(label: string, pluginRoot: string, nativeSessionId: string):
 // it. The launcher's provenance token is what makes this fail CLOSED — the record still
 // lands (best-effort, as always), but no presence is claimed that cannot be backed.
 {
-	const pluginRoot = mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-"));
+	const pluginRoot = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-")));
 	makeBundle(pluginRoot);
-	const agentRoot = mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-agent-"));
+	const agentRoot = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-agent-")));
 	const result = spawnSync(process.execPath, [path.join(pluginRoot, "meta-bridge-hook.ts")], {
 		encoding: "utf8",
 		input: JSON.stringify({

package/scripts/check-install-surface.ts

@@ -510,12 +510,13 @@ const operatorCmds = [...targets].filter(([cmd, ts]) => !isDevGate(cmd) && ts.le
 		`${skillRel}: missing name, four authority modes, prerelease contract, or English/ASCII-only surface`,
 	);
 	ok(
-		"S7g: the executable ASCII CI oracle binds headSha and all three required jobs",
+		"S7g: the executable ASCII CI oracle binds headSha and all four required jobs",
 		ciOracle === null ||
 			(ciOracle.includes("headSha") &&
 				ciOracle.includes('"check"') &&
 				ciOracle.includes('"install-surface"') &&
 				ciOracle.includes('"artifact-consumer"') &&
+				ciOracle.includes('"macos-install-surface"') &&
 				ciOracleMode === "100755" &&
 				oracleIsAscii),
 		`${ciOracleRel}: missing executable mode, exact-SHA classification, required jobs, or ASCII-only content`,

package/scripts/check-meta-facts.ts

@@ -33,6 +33,7 @@ import {
 	type MetaIdentity,
 	serializeMetaIdentity,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -62,7 +63,7 @@ function record(gardenId: string, over: Partial<MetaIdentity> = {}): string {
 }
 
 function store(files: Record<string, string | Buffer>): string {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")));
 	for (const [name, body] of Object.entries(files)) fs.writeFileSync(path.join(dir, name), body);
 	return dir;
 }
@@ -148,7 +149,7 @@ function parseProjection(run: CliRun, label: string): Projection {
 
 // ── drift / symlink / invalid UTF-8 are in-band defects, exit 0 ─────────────
 {
-	const outside = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-outside-"));
+	const outside = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-outside-")));
 	fs.writeFileSync(path.join(outside, "foreign.meta.json"), record(GID_C));
 	const dir = store({
 		[`${GID_A}.meta.json`]: record(GID_A),
@@ -206,7 +207,8 @@ function parseProjection(run: CliRun, label: string): Projection {
 
 // ── missing store = readable EMPTY store ────────────────────────────────────
 {
-	const gone = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")), "never-created");
+	const goneRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")));
+	const gone = path.join(goneRoot, "never-created");
 	const facts = parseProjection(cli([gone]), "missing store");
 	ok(
 		"a store that does not exist is a readable empty store (ENOENT only)",
@@ -216,7 +218,7 @@ function parseProjection(run: CliRun, label: string): Projection {
 
 // ── unreadable store = exit 3, NO JSON ──────────────────────────────────────
 {
-	const base = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-"));
+	const base = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")));
 	const file = path.join(base, "not-a-dir");
 	fs.writeFileSync(file, "plain file");
 	const run = cli([path.join(file, "store")]); // ENOTDIR: the path runs THROUGH a regular file

package/scripts/check-meta-hook-session-switch.ts

@@ -70,6 +70,7 @@ import {
 	upsertMetaSession,
 	writeMetaReceiverMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -112,9 +113,9 @@ function resolveEl(value: string, pluginRoot: string): string {
 }
 
 // ── one sandbox for the whole switch story (the pid is what ties it together) ──
-const AGENT_ROOT = mkdtempSync(path.join(tmpdir(), "psa-hook-switch-agent-"));
-const PLUGIN_ROOT = mkdtempSync(path.join(tmpdir(), "psa-hook-switch-plugin-"));
-const CWD = mkdtempSync(path.join(tmpdir(), "psa-hook-switch-cwd-"));
+const AGENT_ROOT = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-switch-agent-")));
+const PLUGIN_ROOT = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-switch-plugin-")));
+const CWD = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-switch-cwd-")));
 makeBundle(PLUGIN_ROOT);
 
 const ROOTS = {

package/scripts/check-meta-identity-consumers.ts

@@ -52,6 +52,7 @@ import {
 	serializeMetaIdentity,
 } from "../pi-extensions/lib/meta-session.ts";
 import { birthPiCitizen } from "../pi-extensions/lib/pi-citizen-birth.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -103,7 +104,7 @@ const v2Body = `${JSON.stringify(
 
 /** Run `body` against a store dir seeded by `seed`, then remove it. */
 function withStore(seed: (dir: string) => void, body: (dir: string) => void): void {
-	const dir = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-case-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-case-")));
 	try {
 		seed(dir);
 		body(dir);
@@ -129,7 +130,7 @@ const record = (dir: string, gardenId: string, nativeSessionId: string): void =>
 	write(dir, `${gardenId}.meta.json`, serializeMetaIdentity(identity(gardenId, nativeSessionId)));
 const recordCount = (dir: string): number => fs.readdirSync(dir).filter((f) => f.endsWith(".meta.json")).length;
 
-const dir = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-"));
+const dir = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-")));
 try {
 	record(dir, GID_A, "native-a");
 	record(dir, GID_B, "native-b");
@@ -355,7 +356,7 @@ withStore(
 // entries with the right kind. A pure-only proof would have passed while the fs path
 // still did a bare-name readdir and followed symlinks — which is exactly what shipped.
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-addr-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-addr-")));
 	try {
 		// A symlink whose target lives OUTSIDE the store and holds the same native id.
 		const dir = path.join(tmp, "symlink-store");
@@ -444,7 +445,7 @@ withStore(
 // into foreign bytes while every "is it a symlink" test on a settled store stayed green.
 // A plain already-a-symlink read cannot fail that way, so it cannot prove this.
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-toctou-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-toctou-")));
 	try {
 		const dir = path.join(tmp, "store");
 		const outside = path.join(tmp, "outside");
@@ -700,7 +701,7 @@ withStore(
 // where they live and a probe of this directory cannot certify them.
 withStore(
 	(dir) => {
-		const outside = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-outside-"));
+		const outside = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-outside-")));
 		fs.writeFileSync(path.join(outside, "real.json"), serializeMetaIdentity(identity(GID_C, "native-symlinked")));
 		fs.symlinkSync(path.join(outside, "real.json"), path.join(dir, `${GID_C}.meta.json`));
 	},
@@ -889,7 +890,7 @@ withStore(
 // clean "no such citizen" — the fail-open shape (2026-07-25 fresh-eyes review). ENOENT
 // alone is absence; a broken store SHAPE (ENOTDIR here) is a failure to inspect.
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-shape-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-shape-")));
 	try {
 		const brokenStore = path.join(tmp, "store-is-actually-a-file");
 		fs.writeFileSync(brokenStore, "not a store\n");
@@ -927,7 +928,7 @@ withStore(
 // — the doctor and the install preflight would call an unreadable host clean. ENOENT
 // alone is an absent store (a host that never had a generation is not broken).
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-unreadable-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-unreadable-")));
 	try {
 		ok(
 			"an absent store still certifies as empty (ENOENT alone)",

package/scripts/check-meta-receiver-marker.ts

@@ -41,6 +41,7 @@ import {
 	startKeyScheme,
 	writeMetaReceiverMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -50,7 +51,7 @@ function ok(label: string, cond: boolean): void {
 }
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const DIR = mkdtempSync(path.join(tmpdir(), "psa-meta-receivers-"));
+const DIR = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-meta-receivers-")));
 const GARDEN = "20260614T120000-aaaaaa";
 
 // ── write → read round-trip, garden-id keyed ────────────────────────────────