@junghanacs/entwurf 0.18.2 → 0.20.0

package/scripts/check-mux-launch-tmux.ts

@@ -24,6 +24,9 @@
  *     is still listed on an immediate re-read — which is why no post-launch presence check is
  *     performed and why the precondition runs before the window exists
  *   - a precondition refusal opens NO window at all
+ *   - the #105 seat, through the real `freshCall`: an absent seat refuses and creates nothing,
+ *     an existing one puts the window in THAT session with a receipt naming the resolved
+ *     target, and the resulting handle closes through `closeWindow` from outside that session
  */
 
 import assert from "node:assert/strict";
@@ -97,7 +100,7 @@ function alive(pid: string): boolean {
 	}
 }
 
-function main(): void {
+async function main(): Promise<void> {
 	if (spawnSync("tmux", ["-V"], { encoding: "utf8" }).status !== 0) {
 		skipLive(LABEL, "tmux is not installed — install tmux to run the launch acceptance");
 	}
@@ -298,6 +301,78 @@ function main(): void {
 			originalPanes.every((p) => panes().includes(p)),
 		);
 		ok("restored: focus never moved", windows().find((w) => w.endsWith("|1")) === activeBefore);
+
+		// ── the fresh-call composition, against a real server (#105) ──────────────────
+		// The seat's deterministic gate can prove the argv, the leaf and the refusals, but the
+		// two things that only exist once tmux has answered — WHICH session the window landed
+		// in, and what the receipt says about it — had no oracle independent of the production
+		// source. This cell is that oracle: the same hermetic runtime above, a SECOND session
+		// on this same private server, and the real `freshCall`, read through its return value
+		// and the server's own inventory.
+		{
+			const { freshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
+			const { closeWindow } = await import("../pi-extensions/lib/mux-placement.ts");
+			const call = (placementInput?: { tmuxSession: string }) =>
+				freshCall(
+					{
+						backend: "pi",
+						model: "fixture/model",
+						task: "fixture task",
+						placement: placementInput,
+						callerGardenId: "20260101T000000-fixture",
+					},
+					inherited,
+				);
+			const inventory = (): string => fxLines("list-windows", "-a", "-F", "#{session_id}|#{window_id}").join(" ");
+
+			// (i) an ABSENT seat: named refusal, and the server is byte-identical afterwards.
+			const beforeAbsent = inventory();
+			const absent = call({ tmuxSession: "nosuchseat" });
+			ok(
+				"seat: an absent seat refuses as tmux-session-missing and creates NOTHING — no window, no session",
+				!absent.ok && absent.reason === "tmux-session-missing" && inventory() === beforeAbsent,
+			);
+
+			// (ii) an EXISTING seat on the same server: the window lands THERE, the caller's own
+			// session is untouched, and the receipt names the resolved target rather than the caller.
+			assert.equal(fx("new-session", "-d", "-s", `${SESSION}-seat`).status, 0, "fixture seat session");
+			const seatId = fxLines("list-windows", "-t", `=${SESSION}-seat`, "-F", "#{session_id}")[0];
+			const callerWindowsBefore = fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").join(" ");
+			const seated = call({ tmuxSession: `${SESSION}-seat` });
+			assert.ok(seated.ok, `the seated fresh call must succeed: ${seated.ok ? "" : seated.reason}`);
+			const receipt = seated.receipt;
+			ok(
+				"seat: the receipt reports the RESOLVED target session and echoes the REQUESTED name — not the caller's session",
+				receipt.sessionId === seatId &&
+					receipt.sessionId !== placement.sessionId &&
+					receipt.tmuxSession === `${SESSION}-seat`,
+			);
+			ok(
+				"seat: tmux agrees — the window is in the seat, and the caller's own session is byte-identical",
+				fxLines("list-windows", "-t", seatId, "-F", "#{window_id}").includes(receipt.windowId) &&
+					fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").join(" ") === callerWindowsBefore,
+			);
+			ok(
+				"seat: an omitted seat still lands in the caller's own session and the receipt names none",
+				(() => {
+					const own = call();
+					if (!own.ok) return false;
+					const here = own.receipt.sessionId === placement.sessionId && own.receipt.tmuxSession === undefined;
+					process.kill(Number(own.receipt.panePid), "SIGKILL");
+					return here;
+				})(),
+			);
+
+			// (iii) the close side: that handle closes through the production verb, in a session
+			// that is NOT the caller's — the reason close binds to the server half.
+			ok(
+				"seat: the placed window closes through its own handle and tmux stops listing it",
+				closeWindow(receipt, inherited) === "closed" &&
+					!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(receipt.windowId),
+			);
+			fx("kill-session", "-t", seatId);
+			ok("seat: the fixture is back to one session", sessionCount() === 1);
+		}
 	} finally {
 		fx("kill-server");
 		if (fs.existsSync(SOCKET)) fs.rmSync(SOCKET, { force: true });
@@ -313,4 +388,4 @@ function main(): void {
 	console.log(`\n${LABEL}: ${passed} checks passed`);
 }
 
-main();
+await main();

package/scripts/check-mux-launch.ts

@@ -19,6 +19,7 @@
  *   MUX-LAUNCH-NO-SHELL-ARGV       the fixed runtime is passed after `--`, never as a string
  *   MUX-LAUNCH-NO-CARRIER          argv is the append shape plus the runtime, nothing else
  *   MUX-LAUNCH-CORE-IMPORT-FREE    the launch module and entwurf delivery never import each other
+ *   RESOLVE-TMUX-SESSION-IMPORT-FREE  the session-lookup leaf imports nothing at all
  */
 
 import assert from "node:assert/strict";
@@ -270,6 +271,22 @@ function main(): void {
 			"boundary: the placement leaf does not import the launch module — the leaf stays deletable on its own",
 			!importsLaunch("pi-extensions/lib/mux-placement.ts"),
 		);
+		// ── the session-lookup leaf imports NOTHING (docs §11, #105) ─────────────────
+		// It is the one leaf whose entire safety argument is that it cannot acquire an
+		// opinion: no tmux of its own (the runner is injected), no mux module, no entwurf
+		// core, and not even a node builtin. §11 states that; nothing held it, and the first
+		// `import { runTmux } from "./mux-placement.ts"` would quietly turn a decision leaf
+		// into a second place that can run tmux.
+		ok(
+			"[QK:RESOLVE-TMUX-SESSION-IMPORT-FREE] the session-lookup leaf imports nothing at all — not mux, not entwurf core, not even a node builtin — so the only power it has is the runner its caller injects",
+			importsOf(fs.readFileSync("pi-extensions/lib/resolve-tmux-session.ts", "utf8")).length === 0,
+		);
+		ok(
+			"boundary: the fresh-call composition is the ONLY shipped source that imports that leaf",
+			PRODUCTION_SOURCES.filter((m) =>
+				importsOf(fs.readFileSync(m, "utf8")).some((spec) => spec.includes("resolve-tmux-session")),
+			).join(",") === FRESH_CALL_MODULE,
+		);
 		// Prose is not behaviour: the module header names identity vocabulary precisely to say
 		// it owns none of it, so this assertion reads CODE with the comments stripped. A check
 		// that failed on its own documentation would push the boundary out of the docs.

package/scripts/check-mux-placement-tmux.ts

@@ -27,6 +27,8 @@
  *   - handles are stable @window/%pane
  *   - the rc=0 trap is real, and inspectPlacement refuses it instead of guessing
  *   - close reports `closed` for a live window and `already-gone` after a natural exit
+ *   - a window placed in ANOTHER session of the same server closes through its own handle,
+ *     while a handle from another SERVER is still refused (#105 close-side binding)
  */
 
 import assert from "node:assert/strict";
@@ -259,9 +261,10 @@ function main(): void {
 			/context changed/,
 			"appendWindow must refuse a placement from another session",
 		);
+		// Close binds to the SERVER half (#105), so its refusal names that half by its own word.
 		assert.throws(
 			() => closeWindow({ ...w4, serverPid: "999999" }, inherited),
-			/context changed/,
+			/server changed/,
 			"closeWindow must refuse a handle from another server",
 		);
 		ok("binding: append/close refuse a foreign server or session before mutating", windows().length === 4);
@@ -305,6 +308,63 @@ function main(): void {
 			originalPanes.every((p) => panes().includes(p)),
 		);
 		ok("restored: focus never moved", windows().find((w) => w.endsWith("|1")) === activeBefore);
+
+		// ── close binds to the SERVER, not the session (#105) ─────────────────────────
+		// Since #105 a launched window may live in a session that is not the caller's, so the
+		// close side had to stop requiring the session half. This is that decision judged
+		// against a real server: a SECOND session, a window opened into it from the caller's
+		// pane the way the fresh-call composition does, and a close through the same handle.
+		// Both foreign-server refusal and the two close outcomes above stay exactly as they
+		// were — the session half is what changed, and only for close.
+		assert.equal(fx("new-session", "-d", "-s", `${SESSION}-b`).status, 0, "fixture second session");
+		ok("cross-session: the fixture now holds two sessions", sessionCount() === 2);
+		const otherSessionId = fxLines("list-windows", "-t", `=${SESSION}-b`, "-F", "#{session_id}")[0];
+		ok("cross-session: the second session resolves to a native id by exact name", /^\$[0-9]+$/.test(otherSessionId));
+		const placedRow = fxLines(
+			"new-window",
+			"-d",
+			"-a",
+			"-t",
+			`${otherSessionId}:{end}`,
+			"-P",
+			"-F",
+			"#{window_id}|#{window_index}|#{pane_id}|#{pane_pid}",
+		)[0].split("|");
+		const placed = {
+			serverPid: placement.serverPid,
+			sessionId: otherSessionId,
+			windowId: placedRow[0],
+			windowIndex: placedRow[1],
+			paneId: placedRow[2],
+			panePid: placedRow[3],
+		};
+		ok(
+			"cross-session: the window really landed in the OTHER session, and the caller's session is untouched",
+			fxLines("list-windows", "-t", otherSessionId, "-F", "#{window_id}").includes(placed.windowId) &&
+				!fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").includes(placed.windowId),
+		);
+		ok(
+			"cross-session: the caller's own session still shows windows 1,2 and its focus is unmoved",
+			fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").length === 2 &&
+				windows().find((w) => w.endsWith("|1")) === activeBefore,
+		);
+		// The predicate change, stated as the two facts that had to move together.
+		assert.throws(
+			() => closeWindow({ ...placed, serverPid: "999999" }, inherited),
+			/server changed/,
+			"closeWindow must still refuse a handle from another server",
+		);
+		ok(
+			"cross-session: a window in another session of the SAME server closes through its own handle — the release lifecycle smoke's close path reaches a placed window",
+			closeWindow(placed, inherited) === "closed",
+		);
+		ok(
+			"cross-session: it is gone from the other session, and nothing else moved",
+			!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(placed.windowId) &&
+				fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").length === 2,
+		);
+		fx("kill-session", "-t", otherSessionId);
+		ok("cross-session: the fixture is back to one session", sessionCount() === 1);
 	} finally {
 		fx("kill-server");
 		if (fs.existsSync(SOCKET)) fs.rmSync(SOCKET, { force: true });

package/scripts/check-mux-placement.ts

@@ -22,6 +22,7 @@
  *   MUX-TMUX-FAILURE-LOUD    a nonzero/signalled tmux run is raised, never read as a fact
  *   MUX-APPEND-END-DETACHED  append is `-d -a -t <session_id>:{end}`, no carrier
  *   MUX-CONTEXT-BOUND-MUTATION a mutation matches the server pid AND the session id
+ *   MUX-CLOSE-SERVER-BOUND   a close binds to the server half only — same server, any session
  *   MUX-CLOSE-BY-WINDOW-ID   close targets `@window`, and absence needs positive proof
  */
 
@@ -38,6 +39,7 @@ import {
 	isDecimal,
 	isPaneId,
 	isSameContext,
+	isSameServer,
 	isSessionId,
 	isWindowId,
 	parsePlacement,
@@ -254,6 +256,37 @@ function main(): void {
 			);
 		})(),
 	);
+	// ── a close binds to the server, and the session half is covered by id uniqueness ────
+	// `appendWindow` and `closeWindow` are answering different questions, so they bind to
+	// different halves of the same fact. Append asks "is this target still the caller's own
+	// seat?" and needs both. Close asks "is this handle still the window it was born as?" —
+	// and since #105 a launched window may legitimately live in a session that is not the
+	// caller's, so requiring the session half would refuse a legitimate close. `[측정
+	// 2026-09-07]` window ids are handed out monotonically and never recycled within one
+	// server's life (after `@2` was killed the next was `@3`; after a whole session holding
+	// `@4`/`@5` was killed the next was `@6`), so on a matching server the `@id` alone
+	// identifies the window. What must still be refused is a handle from a DIFFERENT or
+	// restarted server, where the same id names something else.
+	ok(
+		"[QK:MUX-CLOSE-SERVER-BOUND] a close-side context matches on the server pid ALONE — another session on the same server is accepted, and every foreign server is refused however familiar its session id looks",
+		(() => {
+			const origin = { serverPid: "8150", sessionId: "$11" };
+			return (
+				isSameServer(origin, { serverPid: "8150", sessionId: "$11" }) &&
+				isSameServer(origin, { serverPid: "8150", sessionId: "$12" }) &&
+				!isSameServer(origin, { serverPid: "9999", sessionId: "$11" }) &&
+				!isSameServer(origin, { serverPid: "9999", sessionId: "$12" })
+			);
+		})(),
+	);
+	ok(
+		"binding: the two predicates are different contracts — append's refuses a foreign session that close's accepts, so neither may be expressed in terms of the other",
+		(() => {
+			const origin = { serverPid: "8150", sessionId: "$11" };
+			const otherSession = { serverPid: "8150", sessionId: "$12" };
+			return !isSameContext(origin, otherSession) && isSameServer(origin, otherSession);
+		})(),
+	);
 	ok(
 		"binding: a window handle carries the context it was born in",
 		(() => {

package/scripts/check-omp-birth-hook.ts

@@ -51,6 +51,7 @@ import {
 	processStartKey,
 	readMetaReceiverMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const UNIT = "entwurf-meta-omp";
@@ -62,7 +63,8 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-omp-birth."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-omp-birth.")));
+
 const asm = path.join(root, "asm");
 
 // ── 1. the real assembler ────────────────────────────────────────────────────
@@ -1045,5 +1047,4 @@ for (const cell of ROOT_CELLS) {
 	);
 }
 
-rmSync(root, { recursive: true, force: true });
 console.log(`[check-omp-birth-hook] ${passed} assertions ok`);

package/scripts/check-probe-bridge-command.ts

@@ -13,6 +13,7 @@ import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "nod
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 import { EXPECTED_TOOLS, probeBridgeCommand } from "./probe-bridge-command.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -32,7 +33,8 @@ function ok(label: string, cond: boolean, detail?: string): void {
 	passed++;
 }
 
-const dir = mkdtempSync(join(tmpdir(), "entwurf-probe-gate-"));
+const dir = reclaimOnExit(mkdtempSync(join(tmpdir(), "entwurf-probe-gate-")));
+
 const stub = (name: string, body: string): string => {
 	const p = join(dir, name);
 	writeFileSync(p, body);

package/scripts/check-setup-qualification.sh

@@ -160,5 +160,26 @@ want "F: an EXPLICIT operator tools.xdev:true is refused by name, never overwrit
 want "F control: the disagreement is a component FAIL that leaves the other omp units composed" \
   "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
 
+# ── Cell G: a COMPLETED harness install on a platform whose RAIL has no receipt ──
+# 0.20.0 opened the harness installers to Darwin, which retired the only thing that
+# used to keep a detected Mac host non-green — the installer's own refusal. Install
+# portability and rail certification are separate evidence axes (Hard Rule 17) and
+# `setup` measures only the first, so the completed install must land as the NAMED
+# non-green, never as a PASS pointing at a doctor that refuses on that platform.
+# `uname` is faked on PATH, the same seam smoke-meta-install-state.sh uses for the
+# installer's platform gate; Cell E above is the certified-platform control (same
+# stub omp, same sandbox, unfaked platform → PASS rows).
+FAKE_UNAME="$SB/fake-uname"; mkdir -p "$FAKE_UNAME"
+printf '#!%s\nprintf "%%s\\n" Darwin\n' "$(command -v bash)" > "$FAKE_UNAME/uname"
+chmod +x "$FAKE_UNAME/uname"
+run_setup "$SB/home-g" "$SB/proj-g" "$FAKE_UNAME:$STUB_OMP:$SB/bin:$PATH" "$ABSENT" "" "$STUB_OMP/omp"
+# One assertion by design: the row, its REASON, and the ARTIFACT proving the install
+# actually completed. Drop the artifact half and the cell would also pass if the fake
+# platform had merely broken the installer — the opposite of what is being claimed.
+want "G: a completed install whose rail has no receipt is the named non-green, never a cosmetic PASS [QK:SETUP-DARWIN-RAIL-COSMETIC-PASS]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED — pending physical host on Darwin' && [ -d '$SB/home-g/.omp/agent/extensions/entwurf-meta-omp' ]"
+want "G control: the reason reads as an evidence boundary, not an install refusal, and names the axis owner" \
+  "printf '%s' \"\$OUT\" | grep -q 'the wiring WAS written and nothing failed to install' && printf '%s' \"\$OUT\" | grep -qF \"owned by './run.sh doctor-omp-bridge'\" && ! printf '%s' \"\$OUT\" | grep -qi 'unsupported platform'"
+
 echo ""
 echo "check-setup-qualification: $PASS checks passed (mutation-attribution oracle only — behavior evidence lives in smoke-setup-verdict and check-pack-install)"

package/scripts/copilot-bridge-doctor.sh

@@ -183,6 +183,8 @@ if [ -f "$HOOK_LOG" ]; then
   #
   # grep -c prints 0 AND exits 1 with no match, so a `|| echo 0` fallback would append a
   # SECOND line and every numeric test below would die on "0\n0". Keep it to one line.
+  # That rule still governs the plain-literal marker counters further down; the mint
+  # selector no longer needs it, for the reason in the next paragraph.
   #
   # MINT ERRORS ONLY. Since #82 RAIL 5b this unit also writes a SENDER marker, and a
   # failed marker write is an ERROR that lands AFTER the successful mint line — so the
@@ -190,10 +192,18 @@ if [ -f "$HOOK_LOG" ]; then
   # sentence that is simply false (the record IS there). The two failures are separated
   # here rather than downgraded in the payload, because a marker write that keeps
   # breaking must stay loud somewhere; it just is not a birth failure.
-  MINT_ERRORS=' ERROR \[copilot\] (?!sender-marker-)'
-  LAST_ERROR_LINE="$(grep -nP "$MINT_ERRORS" "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
-  LAST_OK_LINE="$(grep -n ' INFO \[copilot\] \(create\|attach\) ' "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
-  TOTAL_ERRORS="$(grep -cP "$MINT_ERRORS" "$HOOK_LOG" 2>/dev/null | head -1)"
+  #
+  # PORTABLE SELECTOR, SAME CONTRACT. That separation is a negative lookahead, and BSD
+  # grep (macOS) has no `-P` at all — so the selector is awk, where two conditions ARE
+  # `(?!…)`. It also removes the `grep -c` exit-1 hazard the paragraph above works
+  # around: awk prints 0 and exits 0 on a zero-match file, so there is no second line
+  # to launder. The success selector moves from GNU BRE `\(a\|b\)` to ERE `(a|b)` for
+  # the same portability reason — BRE alternation is a GNU extension, so on BSD grep
+  # that pattern matches nothing and a RECOVERED host reads as unrecovered (false RED).
+  MINT_ERRORS='/ ERROR \[copilot\] / && !/ ERROR \[copilot\] sender-marker-/'
+  LAST_ERROR_LINE="$(awk "$MINT_ERRORS{print NR}" "$HOOK_LOG" 2>/dev/null | tail -1)"
+  LAST_OK_LINE="$(grep -nE ' INFO \[copilot\] (create|attach) ' "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
+  TOTAL_ERRORS="$(awk "$MINT_ERRORS{n++} END{print n+0}" "$HOOK_LOG" 2>/dev/null)"
   TOTAL_ERRORS="${TOTAL_ERRORS:-0}"
   if [ -z "$LAST_ERROR_LINE" ]; then
     ok "no copilot ERROR lines in $HOOK_LOG"
@@ -201,7 +211,7 @@ if [ -f "$HOOK_LOG" ]; then
     note "$TOTAL_ERRORS historical copilot ERROR line(s) in $HOOK_LOG, all followed by a successful mint (line $LAST_OK_LINE > $LAST_ERROR_LINE) — recovered, not red"
   else
     bad "the newest copilot line in $HOOK_LOG is an unrecovered ERROR — the hook RAN and did not mint:"
-    grep -P "$MINT_ERRORS" "$HOOK_LOG" | tail -3 | sed 's/^/        /'
+    awk "$MINT_ERRORS" "$HOOK_LOG" | tail -3 | sed 's/^/        /'
   fi
 
   # WHO-SENT, judged on its own axis. Both outcomes leave a citizen that EXISTS and can

package/scripts/copilot-bridge-install.sh

@@ -22,7 +22,8 @@
 # first-party extension, installed by `run.sh install-copilot-receive`, which also owns
 # the launch-flag check. Four surfaces, four installers, four failure modes.
 #
-# Platform: Linux only, same fence as the Claude installer.
+# Platform: Linux and Darwin, same fence as the Claude installer. Its own platform
+# dependency is python3 + node (checked below); no /proc, no GNU-only tool.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -66,7 +67,10 @@ for arg in "$@"; do
   esac
 done
 
-[ "$(uname -s)" = "Linux" ] || die "Linux only; $(uname -s) is not a certified axis for this install."
+case "$(uname -s)" in
+  Linux | Darwin) ;;
+  *) die "unsupported platform '$(uname -s)'. This installer requires Linux or Darwin." ;;
+esac
 if [ "$ASSEMBLE_ONLY" -eq 0 ]; then
   command -v copilot >/dev/null 2>&1 || die "the 'copilot' CLI is not on PATH."
 fi

package/scripts/copilot-launch.sh

@@ -117,9 +117,23 @@ copilot_bin="$(type -P "$VENDOR_CMD" 2>/dev/null || true)"
 
 # Self-exec fence, the second half of the recursion guard: resolve symlinks and refuse
 # anything that is one of our own entrypoints even if the sentinel was stripped.
-resolved_bin="$(readlink -f "$copilot_bin" 2>/dev/null || printf '%s' "$copilot_bin")"
+# POSIX walk, same shape as mcp/entwurf-bridge/start.sh — BSD readlink has no -f.
+resolve_path() {
+	local SOURCE="$1" DIR TARGET
+	while [ -L "$SOURCE" ]; do
+		DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+		TARGET="$(readlink "$SOURCE")"
+		case "$TARGET" in
+			/*) SOURCE="$TARGET" ;;
+			*) SOURCE="$DIR/$TARGET" ;;
+		esac
+	done
+	DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+	printf '%s/%s\n' "$DIR" "$(basename "$SOURCE")"
+}
+resolved_bin="$(resolve_path "$copilot_bin")"
 for own in "$HERE/copilot-launch.sh" "$REPO_DIR/run.sh"; do
-	own_resolved="$(readlink -f "$own" 2>/dev/null || printf '%s' "$own")"
+	own_resolved="$(resolve_path "$own")"
 	[ "$resolved_bin" = "$own_resolved" ] \
 		&& fail "'$VENDOR_CMD' on PATH resolves to entwurf's own '$own_resolved' — that is a launch loop, not the vendor CLI."
 done

package/scripts/copilot-receive-bridge.sh

@@ -233,7 +233,9 @@ do_doctor() {
 	# THE INVISIBLE FAILURE. A Copilot launched without the flag never scans for
 	# extensions and prints nothing at all, so a perfectly installed unit stays inert
 	# with no symptom anywhere. Reading the live processes' own environment is the only
-	# place that silence becomes visible. Linux /proc only; elsewhere it is a note.
+	# place that silence becomes visible. That read is `/proc`-bound today; where the
+	# interface does not exist the axis is reported UNVERIFIABLE and non-green, never
+	# as a benign note (see the branch below).
 	#
 	# WHY NOT `pgrep -x copilot` (what this used to do). It matched nothing, ever, and
 	# reported that as the benign "no live copilot" note — so the detector built to break
@@ -255,7 +257,27 @@ do_doctor() {
 	# from OUR unit and carry `COPILOT_EXTENSION_PARENT_PID`; counting one as a session
 	# would report a receiver as its own missing session.
 	if [ ! -d /proc ]; then
-		note "no /proc on this platform — cannot read the live CLI environments"
+		# D1 — NON-GREEN, NOT A NOTE. This used to `note`, and a note lets this doctor end
+		# in PASS on a platform where the flag axis is blind: the exact false-success the
+		# paragraph at the unreadable-environ branch below refuses on Linux ("A note would
+		# let the doctor end in PASS while a session that can never arm is running"). The
+		# epistemic state here is the SAME one — the flag verdict's predicate INPUT is
+		# missing — so it gets the same verdict, and the reason is stated rather than
+		# rounded off.
+		#
+		# AND ABSENCE CANNOT BE CLAIMED EITHER. Without /proc there is no candidate
+		# enumeration at all, so this branch cannot say "no live Copilot CLI" the way the
+		# zero-count note below does; it can only say the axis was not measurable. That
+		# is a strictly weaker sentence than the note it replaces, which is the point.
+		#
+		# WHY NO `ps` SUBSTITUTE IS ATTEMPTED HERE. `ps -A -o pid=,args=` would recover the
+		# argv half, but macOS truncates argv for processes the caller does not own, and the
+		# environment half (`ps -E`/`ps eww`) succeeds there only for unrestricted targets —
+		# both are unmeasured (scripts/raw-macos-measure/probe.sh cell M6 is the receipt that
+		# would decide it). A guessed reader that silently identifies nothing would restore
+		# exactly the fail-open this branch just closed, so the read is not guessed. When M6
+		# lands, the portable read belongs right here, in place of this refusal.
+		bad "UNVERIFIABLE on this platform: there is no per-process environment interface, so the $FLAG_ENV state of a live Copilot CLI cannot be read — and without one this doctor cannot enumerate processes either, so it cannot claim that no CLI is running. The receiver IS installed, so a session launched without $FLAG_ENV=$FLAG_VALUE (never scans extensions, prints nothing, can never arm) is NOT ruled out. Launch through 'entwurf copilot', which sets the flag, and treat this axis as unmeasured until a native Darwin receipt exists."
 	else
 		local pid_seam="" scan_json
 		# WHICH PROCESSES ARE CANDIDATES. Normally every pid under /proc.
@@ -274,7 +296,7 @@ do_doctor() {
 		# stepped on once. The status is captured instead, and a broken scan becomes a verdict.
 		local scan_rc=0
 		scan_json="$(ENTWURF_PID_SEAM="${pid_seam}" ENTWURF_PID_SEAM_SET="${ENTWURF_COPILOT_RECEIVE_PIDS+1}" FLAG_ENV="$FLAG_ENV" FLAG_VALUE="$FLAG_VALUE" python3 - <<'PY'
-import os, pathlib
+import errno, os, pathlib
 
 flag_env = os.environ["FLAG_ENV"]
 flag_value = os.environ["FLAG_VALUE"]
@@ -284,17 +306,43 @@ if os.environ.get("ENTWURF_PID_SEAM_SET"):
 else:
 	candidates = [p.name for p in pathlib.Path("/proc").iterdir() if p.name.isdigit()]
 
+# THREE ANSWERS, NOT TWO. "The process is gone" and "the read was refused" are different
+# facts about a live host, and collapsing them is how this scanner reported a process it
+# could not read as a process that was not there. A returned list is the bytes; `None` is
+# a PROVEN absence; `UNREADABLE` is "the input could not be obtained", which is unknown.
+UNREADABLE = object()
+
 def read_nul(pid, what):
 	try:
 		return pathlib.Path(f"/proc/{pid}/{what}").read_bytes().split(b"\0")
-	except OSError:
-		return None
+	except OSError as exc:
+		# ONLY A PROVEN ABSENCE IS BENIGN. ENOENT/ESRCH is the process itself leaving
+		# between enumeration and this read — nothing is left to judge. EVERYTHING else
+		# (EACCES/EPERM under a `hidepid` /proc or a session owned by another user, and
+		# any other I/O failure) leaves the process THERE and the input MISSING. Unknown
+		# is the DEFAULT side on purpose: a new errno class must arrive as non-green
+		# rather than inherit the benign one.
+		if exc.errno in (errno.ENOENT, errno.ESRCH):
+			return None
+		return UNREADABLE
 
-armed_ok, armed_missing, unreadable, contaminated = 0, 0, 0, 0
-missing_pids, unreadable_pids, contaminated_pids = [], [], []
+armed_ok, armed_missing, unreadable, contaminated, argv_unknown = 0, 0, 0, 0, 0
+missing_pids, unreadable_pids, contaminated_pids, argv_unknown_pids = [], [], [], []
 
 for pid in candidates:
 	argv = read_nul(pid, "cmdline")
+	if argv is UNREADABLE:
+		# WE CANNOT EVEN SAY WHAT THIS PROCESS IS. Identity is the FIRST predicate here, so
+		# a refused argv read is not "not a Copilot CLI" — it is "unknown", and a Copilot
+		# CLI is NOT ruled out. It carries its own counter because the unreadable-ENVIRON
+		# counter below means something strictly stronger: there, identity already
+		# succeeded and the process IS a Copilot CLI, so that verdict can name a session.
+		# This branch can only say the doctor was blinded — which is exactly why the `bad`
+		# path further down cannot cover it (that one is reachable only AFTER a successful
+		# argv match).
+		argv_unknown += 1
+		argv_unknown_pids.append(pid)
+		continue
 	# No cmdline at all is a kernel thread or a process that exited mid-scan; neither is
 	# a Copilot session and neither is evidence of anything.
 	if not argv:
@@ -322,9 +370,13 @@ for pid in candidates:
 		continue
 
 	env = read_nul(pid, "environ")
-	if env is None:
-		# FAIL-CLOSED: we identified a native CLI but cannot read its environment, so its
-		# flag state is unknown. That is reported, never rounded to armed.
+	if env is None or env is UNREADABLE:
+		# FAIL-CLOSED, AND DELIBERATELY NOT SPLIT. We identified a native CLI and then did
+		# not learn its environment — whether it left mid-scan or refused the read, its
+		# flag state is unknown and it WAS a live Copilot CLI when identity matched. Both
+		# halves stay in this one reported bucket. Only the argv branch above needs the
+		# distinction, because there absence and refusal answer different questions
+		# ("is anything running at all?" vs "what is this?").
 		unreadable += 1
 		unreadable_pids.append(pid)
 		continue
@@ -351,24 +403,30 @@ for pid in candidates:
 		armed_missing += 1
 		missing_pids.append(pid)
 
-print(f"{armed_ok} {armed_missing} {unreadable} {contaminated}")
+print(f"{armed_ok} {armed_missing} {unreadable} {contaminated} {argv_unknown}")
 print(" ".join(missing_pids))
 print(" ".join(unreadable_pids))
 print(" ".join(contaminated_pids))
+print(" ".join(argv_unknown_pids))
 PY
 )" || scan_rc=$?
-		local counts armed_ok armed_missing unreadable contaminated missing_pids unreadable_pids contaminated_pids
+		local counts armed_ok armed_missing unreadable contaminated argv_unknown
+		local missing_pids unreadable_pids contaminated_pids argv_unknown_pids
 		counts="$(printf '%s\n' "$scan_json" | sed -n '1p')"
 		missing_pids="$(printf '%s\n' "$scan_json" | sed -n '2p')"
 		unreadable_pids="$(printf '%s\n' "$scan_json" | sed -n '3p')"
 		contaminated_pids="$(printf '%s\n' "$scan_json" | sed -n '4p')"
+		argv_unknown_pids="$(printf '%s\n' "$scan_json" | sed -n '5p')"
 		armed_ok="$(printf '%s' "$counts" | awk '{print $1}')"
 		armed_missing="$(printf '%s' "$counts" | awk '{print $2}')"
 		unreadable="$(printf '%s' "$counts" | awk '{print $3}')"
 		contaminated="$(printf '%s' "$counts" | awk '{print $4}')"
+		argv_unknown="$(printf '%s' "$counts" | awk '{print $5}')"
 		if [ "$scan_rc" -ne 0 ] || [ -z "$armed_ok" ]; then
 			bad "the /proc scan for live Copilot CLIs FAILED (exit $scan_rc) — the flag axis is UNKNOWN, so an inert session cannot be ruled out. This is a broken doctor, not a clean host."
-		elif [ "$armed_ok" -eq 0 ] && [ "$armed_missing" -eq 0 ] && [ "$unreadable" -eq 0 ]; then
+		elif [ "$armed_ok" -eq 0 ] && [ "$armed_missing" -eq 0 ] && [ "$unreadable" -eq 0 ] && [ "${argv_unknown:-0}" -eq 0 ]; then
+			# The one branch that may claim ABSENCE, and it may only claim it because every
+			# candidate answered: each was enumerated and its argv was read (or proved gone).
 			note "no live GitHub Copilot CLI process — start one with 'entwurf copilot' (or $FLAG_ENV=$FLAG_VALUE copilot) to arm a receiver"
 		else
 			[ "$armed_ok" -gt 0 ] && ok "$armed_ok live Copilot CLI process(es) carry $FLAG_ENV=$FLAG_VALUE"
@@ -379,6 +437,15 @@ PY
 				# exact false-success the section was written to break.
 				bad "$unreadable live Copilot CLI process(es) have an unreadable environment (pids: $unreadable_pids) — their $FLAG_ENV state is UNKNOWN and is NOT assumed armed. Re-run this doctor as the user that owns those sessions."
 			fi
+			if [ "${argv_unknown:-0}" -gt 0 ]; then
+				# RED, and NOT the same finding as the line above. There, identity had already
+				# succeeded, so the doctor could name a Copilot session and say what was unknown
+				# about it. Here identity ITSELF failed to be decided: a live process would not
+				# let its argv be read, so whether it is a Copilot CLI is unknown and one is not
+				# ruled out. Rounding that to "no live CLI" is the false success this branch
+				# exists to break.
+				bad "UNVERIFIABLE — the argv of $argv_unknown live process(es) could not be read (pids: $argv_unknown_pids), so whether any of them is a GitHub Copilot CLI is UNKNOWN. This doctor therefore does NOT claim that no CLI is running, and an inert session cannot be ruled out. Re-run it as the user that owns those processes, or on a host whose /proc is not restricted."
+			fi
 			if [ "$armed_missing" -gt 0 ]; then
 				bad "$armed_missing live Copilot CLI process(es) lack $FLAG_ENV=$FLAG_VALUE while the receiver is installed (pids: $missing_pids) — relaunch them with 'entwurf copilot', or uninstall the receiver so nothing promises a doorbell"
 			fi