@junghanacs/entwurf 0.19.0 → 0.20.0

package/docs/setup-clean-host.md

@@ -1,8 +1,18 @@
 # Clean-host setup
 
-Current operator recipe for a fresh Linux desktop/workstation. The neutral npm
-package can install elsewhere, but Claude's garden-native meta-bridge is certified
-only on Linux because its strict live-owner join uses `/proc`.
+Operator recipe for a POSIX host. **Linux is the certified axis** — §2–§6 are
+written for it and their receipts are Linux receipts. What follows is the macOS
+evidence split, and its three states must not collapse into "macOS is supported":
+
+- **CERTIFIED (CI)** — the Entwurf-only install surface on macOS
+  (`macos-install-surface`). Weaker than a physical-host doctor green. §1 is
+  this surface.
+- **NOT CERTIFIED — pending physical host** — **on macOS**, every garden-native
+  harness rail in §2–§6 (pi, Claude, Copilot, OMP, agy), marker join, ACP turn,
+  mux. Wiring may be written; that is not a rail receipt. The remaining
+  unmeasured Darwin doctor reason is per-process environment DISCOVERY
+  (start-key is portable).
+- **UNSUPPORTED** — native Windows only. macOS is never this.
 
 ## Requirements
 
@@ -22,8 +32,35 @@ only on Linux because its strict live-owner join uses `/proc`.
 Claude Code >=2.1.217 is required for the managed exec-hook lifecycle. The package
 never supplies or proxies backend credentials.
 
+On a physical Darwin host, `python3` may be the CommandLineTools stub (a
+dialog instead of an interpreter) — unmeasured. That is a probe cell
+(`scripts/raw-macos-measure/probe.sh` M3), not a certification path.
+
 ## 1. Install Node and entwurf
 
+This section is the Entwurf-only install surface. On macOS it is
+**CERTIFIED (CI)** (`macos-install-surface`): npm pack → clean consumer
+install → bins → `--help` → `check-bridge` → harness-absent `setup`. That
+is not a harness-rail receipt.
+
+On Darwin, `entwurf setup` is intentionally non-green when it detects a
+harness. The wiring is written; the row is FAIL:
+
+> the wiring WAS written and nothing failed to install, but this harness
+> rail is NOT CERTIFIED — pending physical host on Darwin. setup runs no
+> doctor; the rail axis is owned by '<doctor>', which refuses on this
+> platform. Tracking: #78.
+
+That FAIL is honest: setup runs no doctor, and no physical-host rail
+receipt exists — it is not an install failure. An Entwurf-only host (no
+harness on PATH) stays green (five SKIP, `bins: PASS`, `core: PASS`,
+`result: green`), which is what CERTIFIED (CI) observed.
+
+A physical Mac can send host facts without installing entwurf or logging
+into a harness: `scripts/raw-macos-measure/probe.sh` (`/bin/sh`, ~3.5s,
+cells M1–M9, writes nothing). Measurement, not certification — it does
+not move CERTIFIED (CI) or close a rail.
+
 Use the host's normal Node 24 installation. With nvm:
 
 ```bash
@@ -107,6 +144,12 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 
 ## 2. Optional pi adapter / ACP plugin
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. Control sockets, mux, and ACP plugin hosting have no
+physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
+on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
+`setup` names the pi row FAIL with the §1 Darwin wording.
+
 Install the exact release floor, then wire the project:
 
 ```bash
@@ -134,6 +177,9 @@ The V3 record births the garden id; do not inject a pi session id manually.
 
 ## 3. Optional Claude Code native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending physical
+host (see the end of this section).
+
 First register the MCP bridge if the stable bin is not already present:
 
 ```bash
@@ -159,12 +205,21 @@ validation, or hand-inspected marker cannot replace a new real session. If the l
 form is unsupported, reinstall; if ownership is correct but the live join is absent,
 restart the affected session.
 
-New macOS wiring is refused because the live join is not instrumented there. Darwin
-uninstall remains available for cleaning an older managed install; this is an evidence
-boundary, not a permanent impossibility claim.
+The Darwin install fence is open (`Linux | Darwin`); python3 is the
+refusal, not the platform name. A completed Darwin install is still not
+a rail receipt: this rail is NOT CERTIFIED — pending physical host. The
+remaining unmeasured doctor reason is per-process environment DISCOVERY
+of live bridge children (start-key is portable). A CI runner cannot
+supply a Claude login. Uninstall is open on Darwin too. That is an
+evidence boundary, not UNSUPPORTED.
 
 ## 4. Optional GitHub Copilot CLI native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. The Darwin install fence for `install-copilot-bridge` is
+open (`Linux | Darwin`); a completed install is not a rail receipt. That
+is an evidence boundary, not UNSUPPORTED.
+
 Copilot has four independently owned surfaces. `setup` composes all four when `copilot` is on
 PATH (#86 C3b); the commands below are the per-unit repair, doctor, and inverse surfaces. All
 four must be green for supported visible fresh; a manual citizen may omit the footer, but fresh
@@ -187,7 +242,12 @@ scanning for that process, checks the receiver, removes inherited pi identity ca
 the model/permission defaults. Birth occurs on the first prompt. `entwurf_fresh_call` uses this
 same managed invocation and requires the birth, MCP, receiver, and visible-identity preflight.
 
-## 4b. Optional OMP (`omp`) native citizen — accepted on one host
+## 4b. Optional OMP (`omp`) native citizen — accepted on one Linux host (thinkpad)
+
+This rail is CERTIFIED on Linux (one host, named in the version rule
+below); on macOS it is NOT CERTIFIED — pending physical host. The Darwin
+install fences for `install-omp-bridge` and `install-omp-receive` are
+open (`Linux | Darwin`); a completed install is not a rail receipt.
 
 Three independently owned surfaces, and a boundary that is part of the instructions rather
 than a footnote. Birth, visible identity, who-sent, the MCP hand and RECEIVE are landed, and
@@ -338,6 +398,10 @@ why `disabledServers` is never the way to hide an import.
 
 ## 5. Optional Antigravity native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. The installers may write on Darwin; a green install is
+not a native-push receipt.
+
 Install the three independently owned surfaces:
 
 ```bash
@@ -363,6 +427,10 @@ LIVE=1 AGY_CONVERSATION_ID=<id> entwurf smoke-agy-native-push-live
 
 ## 6. Optional ACP backend turns
 
+ACP turns are CERTIFIED on Linux; on macOS they are NOT CERTIFIED —
+pending physical host. Mux (visible fresh / resume) is the same state.
+A CI runner has no Claude or Cortex login.
+
 Claude uses the operator's existing local Claude authentication:
 
 ```bash
@@ -386,6 +454,15 @@ After upgrading the package, rerun the managed installers for every native harne
 in use and restart their existing processes. Native plugin caches are not live-reload
 safe across launch-contract changes.
 
+On Darwin the four previously closed install fences
+(`install-meta-bridge`, `install-copilot-bridge`, `install-omp-bridge`,
+`install-omp-receive`) now accept `Linux | Darwin` and refuse on the
+real toolchain (python3 / node / harness presence), not the platform
+name. Re-running them writes wiring. `setup` still names every detected
+harness unit FAIL with the §1 Darwin wording — upgrade does not mint a
+rail receipt. Doctors refuse on Darwin until a physical-host receipt
+exists.
+
 If install or doctor reports an unreadable/old active citizen generation, do not edit
 records by hand. Close pi, Claude, Copilot, and agy sessions first, run
 `entwurf meta-bridge-fresh-cut`, and read its exit status before any install. Then choose the
@@ -414,6 +491,10 @@ PASS/SKIP/FAIL summary. The complete quiescence, archive, and exit-code contract
   core / full candidate floor); maintainer checkout only.
 - `check-install-container`: checkout-invisible Linux package-consumer shape using
   fixtures; not a native lifecycle proof.
+- `macos-install-surface`: macOS Entwurf-only package-consumer shape, CERTIFIED (CI)
+  (`macos-latest` runner, run 34303884286 @ `70eda03`); not a native lifecycle proof.
+- `scripts/raw-macos-measure/probe.sh`: physical-Darwin host facts (~3.5s,
+  no install, no login). Measurement, not a certification path.
 - `doctor-meta-bridge`: one installed real Claude host, only with a new live session.
 - `LIVE=1 entwurf release-gate /path/to/scratch --cut`: aggregate runtime acceptance (`--cut` makes any MUST SKIP red; without it the run is a diagnostic pass).
 
@@ -422,6 +503,11 @@ host verdicts are [BASELINE.md](../BASELINE.md).
 
 ## Uninstall
 
+Darwin uninstall is open for the same surfaces the installers write
+(the Claude uninstall fence was already open; the four install fences
+now match). Running an inverse on Darwin is cleanup, not a rail
+certification.
+
 Run only the surfaces this host owns:
 
 ```bash

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -49,11 +49,11 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"];
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"];
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
-// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/overlay.js

@@ -35,7 +35,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 /** Operator's real Claude config dir — the symlink-passthrough SOURCE. */
 export const CLAUDE_REAL_CONFIG_DIR = join(homedir(), ".claude");
 /** pi-owned overlay dir — the CLAUDE_CONFIG_DIR target for ACP child spawns. */
@@ -356,7 +356,11 @@ function cortexLinkIfExists(realPath, overlayPath) {
  * Returns the isolated HOME/SNOWFLAKE_HOME the spawn env must carry.
  */
 export function ensureCortexDualHomeOverlay(params) {
-    if (!params.realHome || !params.realHome.startsWith("/")) {
+    // Absoluteness is judged in BOTH path flavors so the guard states the contract
+    // ("the parent captured an absolute HOME") instead of the host it happens to run
+    // on. This asserts nothing about native-Windows support; it only stops a POSIX
+    // host from silently accepting a drive/UNC path as "relative".
+    if (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {
         throw new Error(`entwurf: cortex dual-HOME overlay requires an absolute realHome captured by the parent (got ${JSON.stringify(params.realHome)})`);
     }
     const overlaysRoot = params.overlaysRoot ?? CORTEX_OVERLAYS_ROOT;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.19.0",
-	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
+	"version": "0.20.0",
+	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, and Antigravity; Claude and Snowflake Cortex Code ACP backends. Codex has verified delivery-probe evidence, not a managed native-citizen lane.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",

package/pi-extensions/acp-provider.ts

@@ -14,7 +14,7 @@
 // registry (backend-adapter.ts), NOT a per-backend list spelled here. Adding a
 // backend therefore never edits this file. check-acp-provider-surface pins that
 // the compiled entry really registers the EXACT union
-// ([QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]).
+// ([QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE]).
 //
 // Fence: this entry rides the emit-capable root tsconfig (it is not in the root
 // `exclude` list); its lib modules are imported with `.js` suffixes (the root

package/pi-extensions/lib/acp/models.ts

@@ -53,13 +53,13 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"] as const;
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"] as const;
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
 
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
-// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/pi-extensions/lib/acp/overlay.ts

@@ -46,7 +46,7 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 
 import type { AcpMcpServer } from "./config.js";
 
@@ -416,7 +416,11 @@ function cortexLinkIfExists(realPath: string, overlayPath: string): void {
  * Returns the isolated HOME/SNOWFLAKE_HOME the spawn env must carry.
  */
 export function ensureCortexDualHomeOverlay(params: CortexOverlayParams): CortexOverlayResult {
-	if (!params.realHome || !params.realHome.startsWith("/")) {
+	// Absoluteness is judged in BOTH path flavors so the guard states the contract
+	// ("the parent captured an absolute HOME") instead of the host it happens to run
+	// on. This asserts nothing about native-Windows support; it only stops a POSIX
+	// host from silently accepting a drive/UNC path as "relative".
+	if (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {
 		throw new Error(
 			`entwurf: cortex dual-HOME overlay requires an absolute realHome captured by the parent (got ${JSON.stringify(params.realHome)})`,
 		);

package/pi-extensions/lib/meta-session.ts

@@ -1622,6 +1622,31 @@ export type MarkerOwnerVerdict = "live" | "dead" | "uncertain";
  * comparable to each other: `linux:<starttime ticks since boot>` and `ps:<lstart
  * wall-clock text>` describe the same process with different numbers, so a
  * mismatch ACROSS schemes says nothing about whether the process changed.
+ *
+ * They are also NOT equally resolved. `linux:` carries `/proc` clock ticks at
+ * 10 ms granularity; `ps:` carries `lstart` wall-clock text at ONE-SECOND
+ * granularity [measured, oracle 2026-09-09: two children spawned 50 ms apart
+ * returned identical `lstart` strings, and widening to `lstart=,command=`
+ * still collided when argv was identical]. Darwin has no `/proc`, so it ALWAYS
+ * takes the `ps:` branch — there the pid-reuse defense window is 100x wider
+ * than on Linux. 0.20.0 ships no key change anyway, and the numbers are why.
+ * A same-second pid reuse on Darwin requires pid N to die, the whole
+ * sequential pid space (PID_MAX 99999, wrapping after ~99,899 spawns and
+ * skipping live pids) to wrap back around to N, and the replacement to start
+ * in the SAME wall-clock second — a sustained ~99,900 spawns/second for a full
+ * second. Measured on the reference host: 19.9 forks/second average under real
+ * load, ~14,873 forks/second pathological synthetic peak (6.7x short even at
+ * the synthetic peak), with Darwin's default `kern.maxproc` (~2,500) capping
+ * churn in flight besides. The error direction is one-sided: a coarser clock
+ * can only make more keys compare EQUAL, and {@link classifyMarkerOwner} grants
+ * `live` on equal keys — coarsening can mint a false `live` (identity grant
+ * fails OPEN) and can never mint a false `dead` (the generation cut stays
+ * fail-CLOSED). The migration axis is empty by measurement, not argument: a
+ * read-only scan of this host's real marker store found 1,248 marker files —
+ * all `linux:`, zero `ps:` keys — because on Linux `/proc` always wins, so no
+ * Linux install ever minted a `ps:` key; only a Darwin install can. A
+ * Darwin-side hardening decision, if one is ever wanted, belongs with the
+ * physical-Mac receipts (#78), not ahead of them.
  */
 export type StartKeyScheme = "linux" | "ps";
 

package/run.sh

@@ -209,7 +209,7 @@ Usage:
 
   ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
-  ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is not yet verified/certified and stays nonzero for this cut (future validation may reopen it). Detection power is held by check-meta-doctor-oracle
+  ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is NOT CERTIFIED and stays nonzero, on ONE narrowed reason — start-key and ppid are portable there (`ps` fallback, same string the TS core mints), so what holds the lane closed is per-process environment DISCOVERY alone, pending physical-host evidence. Detection power is held by check-meta-doctor-oracle
   ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
   ./run.sh install-copilot-bridge     # #82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)
   ./run.sh uninstall-copilot-bridge   # #86 C3a: honest inverse of install-copilot-bridge from the package-owned install-state (exact qualified id + exact marketplace name/path + recorded assembly only; state deleted LAST; a failing vendor list is UNKNOWN and refuses; never --force, never the stale Claude unit)
@@ -2667,8 +2667,8 @@ check_acp_provider_surface() {
   # provider lib modules AND compiles + drives the REAL entry against a fake pi,
   # asserting: one surface name, the no-auth sentinel shape, full
   # ProviderModelConfig rows on the curated claude anchor, the EXACT curated model
-  # set both adapters contribute (claude 2 + cortex 4 —
-  # [QK:CORTEX-PROVIDER-SIX-ROW-SURFACE], the claim that catches an entry which
+  # set both adapters contribute (claude 3 + cortex 4 —
+  # [QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE], the claim that catches an entry which
   # silently drops a whole backend), and that streamSimple is the real
   # streamShellAcp backend (checked BY NAME, never invoked — invoking spawns an
   # ACP child). Pure, no pi runtime, no API.
@@ -3564,6 +3564,7 @@ _check_pack_install_impl() {
   local loader_ids loader_expected
   loader_ids=$(awk '$1 == "entwurf" { print $2 }' <<<"$loader_out" | LC_ALL=C sort)
   loader_expected=$(printf '%s\n' \
+    claude-fable-5-1 \
     claude-opus-5 \
     claude-sonnet-5 \
     cortex-auto \
@@ -3571,7 +3572,7 @@ _check_pack_install_impl() {
     cortex-claude-sonnet-5 \
     cortex-openai-gpt-5.4 | LC_ALL=C sort)
   if [ "$loader_ids" != "$loader_expected" ]; then
-    fail "[check-pack-install] installed provider model set drifted — expected exactly 6 curated ids (claude 2 + cortex 4):"
+    fail "[check-pack-install] installed provider model set drifted — expected exactly 7 curated ids (claude 3 + cortex 4):"
     echo "  expected:" >&2
     echo "$loader_expected" | sed 's/^/    /' >&2
     echo "  actual (entwurf rows):" >&2
@@ -3582,8 +3583,8 @@ _check_pack_install_impl() {
   fi
   # Name the set on SUCCESS too, not only in the failure branch — same principle as
   # the pinned-pi version assert above: a gate that cannot name what it proved has
-  # proved nothing, and "6 rows" without the ids cannot be audited from a CI log.
-  echo "[check-pack-install] pi loader smoke pass (entwurf registered; exact 6-row curated set: claude 2 + cortex 4):"
+  # proved nothing, and a row COUNT without the ids cannot be audited from a CI log.
+  echo "[check-pack-install] pi loader smoke pass (entwurf registered; exact curated set: claude 3 + cortex 4):"
   echo "$loader_ids" | sed 's/^/    /'
 
   # npm-managed neutral install regression — the README's PRIMARY install path is
@@ -4815,6 +4816,44 @@ setup_result() {  # $1=component $2=PASS|SKIP|FAIL $3=detail
   esac
 }
 
+# ── platform rail certification (#78 D1) ─────────────────────────────────────
+# ONE place answers "are entwurf's HARNESS RAILS certified on this platform?".
+# Every detected-harness branch in setup_all asks it through setup_harness_result
+# below instead of re-deciding it per backend — a verdict that is honest for one
+# harness and cosmetic for the next is its own defect, not half a fix.
+#
+# Today the answer is Linux and nothing else, and that is an EVIDENCE fact, not a
+# taste: every shipped rail proves live ownership by reading the per-process
+# ENVIRONMENT of live harness children, no portable Darwin equivalent has been
+# MEASURED, and BASELINE.md/README record each rail as `NOT CERTIFIED — pending
+# physical host`. The harness doctors own that axis and refuse on Darwin.
+#
+# What moves this line: a physical-host receipt — a real harness doctor exiting 0
+# on that platform, recorded in BASELINE.md. A green INSTALLER never moves it;
+# installation portability and rail/runtime support are separate evidence axes
+# (Hard Rule 17). Do not widen this to make a CI job green.
+harness_rail_certified_platform() {
+  [ "$(uname -s)" = "Linux" ]
+}
+
+# setup_harness_result — the verdict for a detected harness unit whose INSTALL
+# COMPLETED. It exists because "the wiring was written" and "the rail works here"
+# are two different facts and setup measures only the first: setup runs no doctor
+# (that is the doctor commands' own job). On a platform whose rails carry no
+# receipt a completed install is therefore a detected-but-INCOMPLETE integration,
+# which Hard Rule 17 names non-green rather than cosmetic success. setup_result
+# has exactly three verdicts, so FAIL IS that named non-green — and the detail
+# must say so in the operator's own words: nothing failed to install, the rail is
+# simply uncertified here. The wording stays deliberately distinct from the
+# install-failure FAIL each branch keeps for a real refusal.
+setup_harness_result() {  # $1=component $2=what got wired $3=doctor owning the rail axis
+  if harness_rail_certified_platform; then
+    setup_result "$1" PASS "$2 — verify: $3"
+    return 0
+  fi
+  setup_result "$1" FAIL "$2 — the wiring WAS written and nothing failed to install, but this harness rail is NOT CERTIFIED — pending physical host on $(uname -s). setup runs no doctor; the rail axis is owned by '$3', which refuses on this platform. Tracking: #78."
+}
+
 # Installed-vs-source is decided by PACKAGE LOCATION — the same `*/node_modules/*`
 # seam run_ts and the bridge launcher already branch on — never by which of
 # pnpm/pi happens to be missing (an accidental failure is not a mode gate).
@@ -4955,7 +4994,7 @@ setup_all() {
     if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
       setup_result pi FAIL "detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup"
     elif (install_local_package "$project_dir"); then
-      setup_result pi PASS "project + user-scope wiring complete (pi $pi_ver in $pi_range) — verify: ./run.sh doctor-pi-provider"
+      setup_harness_result pi "project + user-scope wiring complete (pi $pi_ver in $pi_range)" "./run.sh doctor-pi-provider"
     else
       setup_result pi FAIL "pi wiring did not complete (see above) — repair, then re-run setup"
     fi
@@ -4965,16 +5004,20 @@ setup_all() {
   # setup ALSO wires the native-harness meta-bridge so a relocate/clone needs ONE
   # command. Detection-gated ("있으면 설정, 없으면 담아준다");
   # meta-bridge-install.sh is idempotent and enforces the Claude floor + its own
-  # named prerequisites itself, so a below-floor or refused host lands here as a
-  # detected FAIL, never a cosmetic green. CLAUDE_BIN pins the probe for the
-  # hermetic smoke; production leaves it unset.
+  # named prerequisites itself, so a below-floor host lands here as a detected
+  # FAIL. It no longer REFUSES ON PLATFORM NAME (0.20.0 opened Darwin: the
+  # installer's own mechanism is portable), so the other half of that old
+  # guarantee — "never a cosmetic green" — is now carried by setup_harness_result:
+  # an install that completes where the RAIL has no receipt is the named
+  # non-green, never a PASS pointing at a doctor that would refuse. CLAUDE_BIN
+  # pins the probe for the hermetic smoke; production leaves it unset.
   local claude_bin="${CLAUDE_BIN:-claude}"
   if ! command -v "$claude_bin" >/dev/null 2>&1; then
     setup_result claude SKIP "claude not on PATH — zero meta-bridge wiring written"
   else
     section "meta-bridge install (native harness detected: Claude Code)"
     if (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh); then
-      setup_result claude PASS "meta-bridge wired — verify: ./run.sh doctor-meta-bridge"
+      setup_harness_result claude "meta-bridge wired" "./run.sh doctor-meta-bridge"
     else
       setup_result claude FAIL "detected Claude Code, but the meta-bridge integration did not complete (see above) — repair, then re-run setup"
     fi
@@ -5017,19 +5060,19 @@ setup_all() {
   else
     agy_rc=0; wire_agy_bridge || agy_rc=$?
     if [ "$agy_rc" -eq 0 ]; then
-      setup_result agy-bridge PASS "MCP bridge wired — verify: ./run.sh doctor-agy-bridge"
+      setup_harness_result agy-bridge "MCP bridge wired" "./run.sh doctor-agy-bridge"
     else
       setup_result agy-bridge FAIL "detected agy, but the MCP bridge integration did not complete (reason above) — repair, then re-run setup"
     fi
     agy_rc=0; wire_agy_statusline || agy_rc=$?
     if [ "$agy_rc" -eq 0 ]; then
-      setup_result agy-statusline PASS "statusLine wired — verify: ./run.sh doctor-agy-statusline"
+      setup_harness_result agy-statusline "statusLine wired" "./run.sh doctor-agy-statusline"
     else
       setup_result agy-statusline FAIL "detected agy, but the statusLine integration did not complete (reason above) — repair, then re-run setup"
     fi
     agy_rc=0; wire_agy_hooks || agy_rc=$?
     if [ "$agy_rc" -eq 0 ]; then
-      setup_result agy-hooks PASS "birth imprint wired — verify: ./run.sh doctor-agy-hooks"
+      setup_harness_result agy-hooks "birth imprint wired" "./run.sh doctor-agy-hooks"
     else
       setup_result agy-hooks FAIL "detected agy, but the birth-imprint integration did not complete (reason above) — repair, then re-run setup"
     fi
@@ -5053,13 +5096,13 @@ setup_all() {
     section "copilot units (native harness detected: GitHub Copilot CLI)"
     copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh) || copilot_rc=$?
     if [ "$copilot_rc" -eq 0 ]; then
-      setup_result copilot-birth PASS "birth plugin installed — verify: ./run.sh doctor-copilot-bridge"
+      setup_harness_result copilot-birth "birth plugin installed" "./run.sh doctor-copilot-bridge"
     else
       setup_result copilot-birth FAIL "detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup"
     fi
     copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh install) || copilot_rc=$?
     if [ "$copilot_rc" -eq 0 ]; then
-      setup_result copilot-mcp PASS "MCP server registered — verify: ./run.sh doctor-copilot-mcp"
+      setup_harness_result copilot-mcp "MCP server registered" "./run.sh doctor-copilot-mcp"
     else
       setup_result copilot-mcp FAIL "detected copilot, but the MCP registration did not complete (see above) — repair, then re-run setup"
     fi
@@ -5077,14 +5120,14 @@ setup_all() {
     else
       copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh install) || copilot_rc=$?
       if [ "$copilot_rc" -eq 0 ]; then
-        setup_result copilot-receive PASS "receiver extension installed — verify: ./run.sh doctor-copilot-receive"
+        setup_harness_result copilot-receive "receiver extension installed" "./run.sh doctor-copilot-receive"
       else
         setup_result copilot-receive FAIL "detected copilot, but the receiver extension install did not complete (see above) — repair, then re-run setup"
       fi
     fi
     copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh install) || copilot_rc=$?
     if [ "$copilot_rc" -eq 0 ]; then
-      setup_result copilot-statusline PASS "visible footer wired — verify: ./run.sh doctor-copilot-statusline"
+      setup_harness_result copilot-statusline "visible footer wired" "./run.sh doctor-copilot-statusline"
     else
       setup_result copilot-statusline FAIL "detected copilot, but the visible-footer integration did not complete (see above) — repair, then re-run setup"
     fi
@@ -5107,13 +5150,13 @@ setup_all() {
     section "omp units (native harness detected: oh-my-pi)"
     omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-bridge-install.sh) || omp_rc=$?
     if [ "$omp_rc" -eq 0 ]; then
-      setup_result omp-birth PASS "birth extension installed — verify: ./run.sh doctor-omp-bridge"
+      setup_harness_result omp-birth "birth extension installed" "./run.sh doctor-omp-bridge"
     else
       setup_result omp-birth FAIL "detected omp, but the birth extension install did not complete (see above) — repair, then re-run setup"
     fi
     omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-mcp-bridge.sh install) || omp_rc=$?
     if [ "$omp_rc" -eq 0 ]; then
-      setup_result omp-mcp PASS "MCP server registered — verify: ./run.sh doctor-omp-mcp"
+      setup_harness_result omp-mcp "MCP server registered" "./run.sh doctor-omp-mcp"
     else
       setup_result omp-mcp FAIL "detected omp, but the MCP registration did not complete (see above) — repair, then re-run setup"
     fi
@@ -5124,13 +5167,13 @@ setup_all() {
     # shipping a citizen whose tools nobody can call.
     omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-config-xdev.sh install) || omp_rc=$?
     if [ "$omp_rc" -eq 0 ]; then
-      setup_result omp-config PASS "tools.xdev: false written — verify: ./run.sh doctor-omp-mcp"
+      setup_harness_result omp-config "tools.xdev: false written" "./run.sh doctor-omp-mcp"
     else
       setup_result omp-config FAIL "detected omp, but the tools.xdev operator setting did not land (see above) — resolve it, then re-run setup"
     fi
     omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-receive-install.sh) || omp_rc=$?
     if [ "$omp_rc" -eq 0 ]; then
-      setup_result omp-receive PASS "receiver extension installed — verify: ./run.sh doctor-omp-receive"
+      setup_harness_result omp-receive "receiver extension installed" "./run.sh doctor-omp-receive"
     else
       setup_result omp-receive FAIL "detected omp, but the receiver extension install did not complete (see above) — repair, then re-run setup"
     fi
@@ -6202,10 +6245,12 @@ case "$cmd" in
     # XDG data dir ($XDG_DATA_HOME/entwurf/meta-bridge/.assembled — dev clone and
     # installed package alike, never the checkout) and runs marketplace add +
     # install --scope user, so every native Claude Code session auto-loads it.
-    # Idempotent; Linux is the only currently certified axis for the #51 repair cut.
-    # Darwin fails loud as not-yet-verified because the strict doctor cannot currently
-    # certify its live owner join; future validation may reopen it. Uninstall permits Darwin
-    # so an older macOS install is not stranded without an honest inverse.
+    # Idempotent. Install accepts Linux | Darwin — the fence that remains inside the
+    # installer is the toolchain check (python3/node/claude presence), not the platform
+    # name. Rail certification stays with doctor-meta-bridge: Darwin is NOT CERTIFIED —
+    # pending physical host, reason = per-process environment DISCOVERY. Uninstall
+    # permits Darwin so an older macOS install is not stranded without an honest
+    # inverse.
     (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh "$@")
     ;;
   uninstall-meta-bridge)

package/scripts/agy-bridge.sh

@@ -233,7 +233,7 @@ doctor_static_one() {
       # entwurf does NOT repair a failed launcher here: it may be owned by a foreign file.
       log "  $label: configured → '$cmd' does NOT serve MCP with its configured args/env$link_note"
       log "        $BOOT_DETAIL"
-      log "        Identify the launcher: command -v '$cmd'; readlink -f \"\$(command -v '$cmd')\""
+      log "        Identify the launcher: command -v '$cmd'; ls -l \"\$(command -v '$cmd')\""
       log "        If it is entwurf's managed dev link, restore it with ./run.sh expose-dev-bin (it REFUSES a foreign link)."
       log "        If a foreign launcher owns the name, repair/remove it yourself or put a working one earlier on PATH."
       return 1 ;;

package/scripts/agy-imprint.sh

@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
 # Stable bin wrapper for Antigravity PreInvocation birth imprint.
 set -euo pipefail
-SELF="${BASH_SOURCE[0]}"
-if command -v readlink >/dev/null 2>&1; then
-  RESOLVED="$(readlink -f "$SELF" 2>/dev/null || printf '%s' "$SELF")"
-else
-  RESOLVED="$SELF"
-fi
-HERE="$(cd "$(dirname "$RESOLVED")" && pwd)"
+SOURCE="${BASH_SOURCE[0]}"
+while [ -L "$SOURCE" ]; do
+  DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+  TARGET="$(readlink "$SOURCE")"
+  case "$TARGET" in
+    /*) SOURCE="$TARGET" ;;
+    *) SOURCE="$DIR/$TARGET" ;;
+  esac
+done
+HERE="$(cd -P "$(dirname "$SOURCE")" && pwd)"
 ROOT="$(cd "$HERE/.." && pwd)"
 
 # Node refuses --experimental-strip-types for raw .ts below node_modules. Dev

package/scripts/check-acp-carrier-augment.ts

@@ -31,8 +31,9 @@ import { loadEngraving } from "../pi-extensions/lib/acp/engraving.ts";
 import { bridgeConfigSignature, contextMessageSignatures } from "../pi-extensions/lib/acp/session-store.ts";
 import { buildClaudeSessionMeta } from "../pi-extensions/lib/acp/tool-surface.ts";
 import { ENTWURF_PROJECT_CONTEXT_OPEN_TAG } from "../protocol.js";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
-const tmp = mkdtempSync(join(tmpdir(), "acp-carrier-augment-"));
+const tmp = reclaimOnExit(mkdtempSync(join(tmpdir(), "acp-carrier-augment-")));
 const REPO_DIR = fileURLToPath(new URL("..", import.meta.url));
 const BRIDGE_MARK = "operating through entwurf";
 
@@ -241,8 +242,8 @@ function ctxWith(firstUser: string): Context {
 //          absent → keep it. Home AGENTS.md always survives.
 // ===========================================================================
 {
-	const home = mkdtempSync(join(tmpdir(), "acp-home-"));
-	const proj = mkdtempSync(join(tmpdir(), "acp-proj-"));
+	const home = reclaimOnExit(mkdtempSync(join(tmpdir(), "acp-home-")));
+	const proj = reclaimOnExit(mkdtempSync(join(tmpdir(), "acp-proj-")));
 	writeFileSync(join(home, "AGENTS.md"), "HOME-AGENTS-CONTENT");
 	writeFileSync(join(proj, "AGENTS.md"), "CWD-AGENTS-CONTENT");
 
@@ -295,7 +296,7 @@ function ctxWith(firstUser: string): Context {
 	assert.match(dateLine as string, /^Current date: \d{4}-\d{2}-\d{2}$/, "date is day-granularity only (no clock time)");
 
 	// > 50KB cwd AGENTS.md → augment truncated with the marker.
-	const bigHome = mkdtempSync(join(tmpdir(), "acp-big-"));
+	const bigHome = reclaimOnExit(mkdtempSync(join(tmpdir(), "acp-big-")));
 	writeFileSync(join(bigHome, "AGENTS.md"), "X".repeat(80 * 1024));
 	const big = buildPiContextAugment({ backend: "claude", cwd: tmp, mcpServerNames: [], homeDir: bigHome });
 	assert.ok(Buffer.byteLength(big, "utf8") <= 50 * 1024, "augment is truncated to the 50KB cap");
@@ -313,7 +314,7 @@ function ctxWith(firstUser: string): Context {
 //    remains an honest fallback; the maintained package prompt must not hit it.
 // ===========================================================================
 {
-	const budgetHome = mkdtempSync(join(tmpdir(), "acp-budget-home-"));
+	const budgetHome = reclaimOnExit(mkdtempSync(join(tmpdir(), "acp-budget-home-")));
 	writeFileSync(join(budgetHome, "AGENTS.md"), "H".repeat(12 * 1024));
 	const actual = buildPiContextAugment({
 		backend: "claude",