@junghanacs/entwurf 0.19.0 → 0.20.0

package/scripts/check-acp-cortex.ts

@@ -323,6 +323,47 @@ const enrichedServers: AcpMcpServer[] = [
 			/absolute realHome/,
 			"a non-absolute realHome must refuse (the child must never re-derive it)",
 		);
+		assert.throws(
+			() =>
+				ensureCortexDualHomeOverlay({
+					scopeKey: "pi:sess-empty",
+					mcpServers: [],
+					realHome: "",
+					overlaysRoot,
+					isPidAlive: () => true,
+				}),
+			/absolute realHome/,
+			"an empty realHome must refuse — the contract sentence is 'absolute', and '' is not",
+		);
+		// …and the guard states PATH-FLAVOR absoluteness, not the host it runs on:
+		// a drive/UNC realHome is absolute in the win32 flavor, so a POSIX host must
+		// NOT read it as relative. (This asserts nothing about native-Windows support
+		// — only that the refusal rule is decided by the path, not by process.platform.)
+		// realSnowflakeHome is pinned under tmp so the positive cells exercise the
+		// GUARD alone: the win32-flavored realHome never reaches a POSIX join for fs
+		// work, and every path the overlay materializes stays under overlaysRoot.
+		for (const winFlavored of ["C:\\Users\\x", "\\\\server\\share"]) {
+			let winOverlay: ReturnType<typeof ensureCortexDualHomeOverlay> | undefined;
+			assert.doesNotThrow(
+				() => {
+					winOverlay = ensureCortexDualHomeOverlay({
+						scopeKey: `pi:sess-win-${winFlavored.length}`,
+						mcpServers: [],
+						realHome: winFlavored,
+						realSnowflakeHome: realSnowflake,
+						overlaysRoot,
+						isPidAlive: () => true,
+					});
+				},
+				`a win32-flavored absolute realHome (${JSON.stringify(winFlavored)}) must PASS the guard — absoluteness is judged by PATH FLAVOR, never by the host the gate runs on [QK:CORTEX-REALHOME-PLATFORM-NEUTRAL]`,
+			);
+			assert.ok(
+				winOverlay !== undefined &&
+					winOverlay.scopeDir.startsWith(overlaysRoot) &&
+					existsSync(join(winOverlay.snowflakeHome, "cortex")),
+				"the accepted win32-flavored realHome must still materialize entirely under the overlays root (the guard is the only thing the flavor cell widens)",
+			);
+		}
 	} finally {
 		rmSync(root, { recursive: true, force: true });
 	}

package/scripts/check-acp-provider-surface.ts

@@ -138,19 +138,22 @@ try {
 	// Set comparison (sorted, exact) — not `includes`: a substring/anchor probe
 	// cannot see a row that VANISHED, and the cortex ids contain the claude ids as
 	// substrings. Expected is derived from the two source id constants so there is
-	// one SSOT; the literal 6 below is the independent floor that catches a
-	// curation list mutated to empty (which would move expected and captured
-	// together).
+	// one SSOT; the literal 7 below is the independent floor that catches a
+	// curation list that SHRANK — expected derives from the same constants, so a
+	// dropped row moves expected and captured together and the set comparison
+	// stays green. That is why the count is asserted separately and carries its
+	// own claim: the cortex list has `CORTEX-CURATED-FOUR-ROWS` for exactly this
+	// failure, and the claude list needs its own oracle rather than borrowing it.
 	const expectedIds = [...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS].slice().sort();
 	assert.equal(
 		expectedIds.length,
-		6,
-		`curated id constants must total 6 rows (claude 2 + cortex 4) — got ${expectedIds.length}: ${expectedIds.join(", ")}`,
+		7,
+		`[QK:CLAUDE-CURATED-THREE-ROWS] curated id constants must total 7 rows (claude 3 + cortex 4) — got ${expectedIds.length}: ${expectedIds.join(", ")}`,
 	);
 	assert.deepEqual(
 		capIds.slice().sort(),
 		expectedIds,
-		`[QK:CORTEX-PROVIDER-SIX-ROW-SURFACE] compiled entry must register the EXACT curated set of both adapters (claude 2 + cortex 4) — got: ${capIds.join(", ") || "none"}`,
+		`[QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE] compiled entry must register the EXACT curated set of both adapters (claude 3 + cortex 4) — got: ${capIds.join(", ") || "none"}`,
 	);
 	assert.equal(typeof cap.cfg.streamSimple, "function", "entry streamSimple must be a function");
 	// Regression guard: the entry must wire the REAL backend (streamShellAcp),

package/scripts/check-copilot-birth-hook.ts

@@ -52,6 +52,7 @@ import { resolveFactList } from "../pi-extensions/lib/entwurf-facts.ts";
 import { nativePushSupported } from "../pi-extensions/lib/entwurf-v2-contract.ts";
 import { META_SENDER_BACKENDS, resolveTrustedMetaSenderIdentity } from "../pi-extensions/lib/meta-sender-identity.ts";
 import { listAllMetaIdentitiesDir, processStartKey } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const PLUGIN = "entwurf-meta-receive-copilot";
@@ -63,7 +64,8 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-copilot-birth."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-copilot-birth.")));
+
 const asm = path.join(root, "asm");
 
 // ── 1. the real assembler ────────────────────────────────────────────────────

package/scripts/check-copilot-receive-arm.ts

@@ -60,6 +60,7 @@ import {
 	upsertMetaSession,
 	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { killOnExit, reclaimNow, reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const UNIT = "entwurf-receive";
@@ -90,7 +91,7 @@ async function waitUntil(fn: () => boolean, ms = 15000): Promise<boolean> {
 	}
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-copilot-receive."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-copilot-receive.")));
 const home = path.join(root, "home");
 const store = path.join(root, "agent");
 const extRoot = path.join(root, "extensions");
@@ -260,6 +261,30 @@ writeFileSync(
 	path.join(stubDir, "register.mjs"),
 	`import { register } from "node:module";
 register("./loader.mjs", import.meta.url);
+// The vendor half this fixture MUST model. Production children are started by the CLI's
+// own bootstrap (\`preloads/extension_bootstrap.mjs\`), which exits the extension when its
+// parent disappears — checked at startup and then once a second — and the receiver's
+// owner-pid contract is built on that. A stub that omitted it made the fixture MORE
+// permissive than production: the stub's referenced timer kept every child alive after
+// the gate died, so each red run reparented its children to pid 1 forever (measured
+// 2026-09-07/08 on \`oracle\`: 360 such node processes, 720 temp roots). The check is
+// \`unref\`ed so it never becomes the reason a child stays up.
+//
+// KNOWN-OPEN, deliberately: under a subreaper (\`PR_SET_CHILD_SUBREAPER\`, systemd-run)
+// a parent that dies before this module's FIRST tick is already reparented to a LIVE
+// subreaper, so \`parentAtStart\` records that pid and never changes again. The obvious
+// patch — probing the recorded pid with signal 0 — closes nothing: Linux reparents in
+// \`forget_original_parent()\` BEFORE the old pid becomes unreachable, and a zombie
+// parent still answers signal 0, so the probe is false at startup in exactly the case
+// it was written for. The honest close is to watch the DECLARED parent
+// (\`COPILOT_EXTENSION_PARENT_PID\`), which this gate deliberately sets to a pid that is
+// not the child's real parent, so it is left documented rather than half-fixed. The
+// window is microseconds and no measured orphan on this host came through it.
+const parentAtStart = process.ppid;
+if (parentAtStart === 1) process.exit(0);
+setInterval(() => {
+	if (process.ppid !== parentAtStart) process.exit(0);
+}, 1000).unref();
 `,
 );
 
@@ -274,23 +299,25 @@ interface Harness {
 function launch(label: string, sessionId: string, extra: NodeJS.ProcessEnv = {}): Harness {
 	const box = path.join(root, `box-${label}`);
 	mkdirSync(box, { recursive: true });
-	const child = spawn(process.execPath, ["--import", path.join(stubDir, "register.mjs"), entry], {
-		env: {
-			...process.env,
-			HOME: home,
-			PI_CODING_AGENT_DIR: store,
-			STUB_BOX: box,
-			STUB_SDK: path.join(stubDir, "extension.js"),
-			STUB_SESSION_ID: sessionId,
-			SESSION_ID: sessionId,
-			// The vendor's carrier. This gate process IS the fork parent, which is also
-			// what makes the sender-marker join real rather than mocked: the marker below
-			// is written under the very pid the child will look itself up by.
-			COPILOT_EXTENSION_PARENT_PID: String(process.pid),
-			...extra,
-		},
-		stdio: ["ignore", "pipe", "pipe"],
-	});
+	const child = killOnExit(
+		spawn(process.execPath, ["--import", path.join(stubDir, "register.mjs"), entry], {
+			env: {
+				...process.env,
+				HOME: home,
+				PI_CODING_AGENT_DIR: store,
+				STUB_BOX: box,
+				STUB_SDK: path.join(stubDir, "extension.js"),
+				STUB_SESSION_ID: sessionId,
+				SESSION_ID: sessionId,
+				// The vendor's carrier. This gate process IS the fork parent, which is also
+				// what makes the sender-marker join real rather than mocked: the marker below
+				// is written under the very pid the child will look itself up by.
+				COPILOT_EXTENSION_PARENT_PID: String(process.pid),
+				...extra,
+			},
+			stdio: ["ignore", "pipe", "pipe"],
+		}),
+	);
 	child.stdout?.resume();
 	child.stderr?.resume();
 	return {
@@ -699,6 +726,68 @@ ok(
 		opaque.kill("SIGKILL");
 	}
 }
+{
+	// AN UNREADABLE argv IS "UNKNOWN", NOT "ABSENT" (#78 B2). Identity is the FIRST
+	// predicate of the scan, so a candidate whose `cmdline` will not open cannot be
+	// classified at all — and a blanket `except OSError: return None` classified it
+	// anyway, as "not a Copilot CLI". Every candidate taking that branch left all
+	// counters at zero, which is the benign "no live GitHub Copilot CLI process" note:
+	// a doctor claiming ABSENCE while its identity input was unavailable. That is the
+	// same false-success class as the platform branch above, so it gets the same verdict.
+	//
+	// THE DENIAL IS INJECTED, AND THAT IS SAID OUT LOUD BECAUSE IT MATTERS. The environ
+	// cell above makes its file really unreadable with prctl(PR_SET_DUMPABLE, 0), and
+	// measured on this kernel that trick does NOT reach argv: `/proc/<pid>/cmdline` stays
+	// mode 0444 and readable even for a non-dumpable child (a full /proc census read
+	// 340/340 cmdlines). A real EACCES there needs a `hidepid` /proc mount, which an
+	// unprivileged gate cannot create. So the refusal is raised exactly where the kernel
+	// would raise it — at the scanner's own read, with EACCES — through a `sitecustomize`
+	// on PYTHONPATH, and what this cell pins is the CLASSIFICATION of a refused read,
+	// which is the entire contract. The fixture process is real, and the control run
+	// asserts it WOULD be identified as a native CLI when its argv can be read, so
+	// neither half of the pin is vacuous.
+	const denyDir = path.join(root, "deny-cmdline");
+	mkdirSync(denyDir, { recursive: true });
+	writeFileSync(
+		path.join(denyDir, "sitecustomize.py"),
+		[
+			"import errno, os, pathlib",
+			"_pid = os.environ.get('ENTWURF_TEST_DENY_CMDLINE_PID')",
+			"if _pid:",
+			"    _target = '/proc/' + _pid + '/cmdline'",
+			"    _real = pathlib.Path.read_bytes",
+			"    def _denied(self):",
+			"        if str(self) == _target:",
+			"            raise PermissionError(errno.EACCES, 'Permission denied', str(self))",
+			"        return _real(self)",
+			"    pathlib.Path.read_bytes = _denied",
+		].join("\n") + "\n",
+	);
+	const opaqueArgv = spawn(
+		"python3",
+		["-c", "import time; time.sleep(60)", path.join(root, "node_modules", "@github", "copilot", "npm-loader.js")],
+		{ stdio: "ignore" },
+	);
+	running.push(opaqueArgv);
+	try {
+		await sleep(400);
+		const identified = doctor({ ENTWURF_COPILOT_RECEIVE_PIDS: String(opaqueArgv.pid) });
+		const blind = doctor({
+			ENTWURF_COPILOT_RECEIVE_PIDS: String(opaqueArgv.pid),
+			PYTHONPATH: denyDir,
+			ENTWURF_TEST_DENY_CMDLINE_PID: String(opaqueArgv.pid),
+		});
+		ok(
+			"[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE] a live process whose argv is REFUSED is UNKNOWN, not absent — the doctor declines to claim that no CLI is running and ends RED, where the same process with a readable argv is judged",
+			identified.includes("lack COPILOT_CLI_ENABLED_FEATURE_FLAGS") &&
+				blind.includes("UNVERIFIABLE — the argv of 1 live process(es) could not be read") &&
+				!blind.includes("no live GitHub Copilot CLI process") &&
+				blind.trimEnd().endsWith("[copilot-receive-doctor] FAIL"),
+		);
+	} finally {
+		opaqueArgv.kill("SIGKILL");
+	}
+}
 {
 	// THE SCANNER'S OWN FAILURE IS THIS DOCTOR'S VERDICT, NOT ITS DEATH. Under
 	// `set -euo pipefail`, `x="$(python3 …)"` hands the interpreter's status to the
@@ -725,10 +814,69 @@ ok(
 	);
 }
 
-// ── 10. the installer's honest inverse ───────────────────────────────────────
+// ── 10. the fixture dies with its parent, like the vendor's child does ───────
+// This gate spawns real Node children that hold a referenced timer, so "the gate
+// stopped" and "the gate's children stopped" are two different facts. Production gets
+// the second one from the CLI's bootstrap; the stub loader has to supply it here, or a
+// red run (which ends by throwing, long before any cleanup statement) leaves a process
+// per launch on the host forever. Orphan one deliberately and require it to leave on
+// its own. The intermediate `bash` holds the child for two seconds first: a child whose
+// parent is ALREADY gone when its loader runs leaves at the watchdog's startup check,
+// which proves nothing about a session that was live when the gate died.
+{
+	const orphanBox = path.join(root, "box-orphan");
+	mkdirSync(orphanBox, { recursive: true });
+	const pidFile = path.join(root, "orphan.pid");
+	const ORPHAN_SESSION = "cop-recv-orphan";
+	spawnSync(
+		"bash",
+		[
+			"-c",
+			`${JSON.stringify(process.execPath)} --import ${JSON.stringify(path.join(stubDir, "register.mjs"))} ` +
+				`${JSON.stringify(entry)} </dev/null >/dev/null 2>&1 & echo $! > ${JSON.stringify(pidFile)}; sleep 2`,
+		],
+		{
+			env: {
+				...process.env,
+				HOME: home,
+				PI_CODING_AGENT_DIR: store,
+				STUB_BOX: orphanBox,
+				STUB_SDK: path.join(stubDir, "extension.js"),
+				STUB_SESSION_ID: ORPHAN_SESSION,
+				SESSION_ID: ORPHAN_SESSION,
+				COPILOT_EXTENSION_PARENT_PID: String(process.pid),
+			},
+			stdio: "ignore",
+		},
+	);
+	const orphanPid = Number(readFileSync(pidFile, "utf8").trim());
+	// Non-vacuity: it is only evidence if the process it names actually reached the
+	// same live state every other child in this gate reaches. Its log line is written
+	// during boot and outlives it, so reading it after the exit is not a race.
+	const booted = await waitUntil(() => {
+		const f = path.join(store, "meta-bridge-receive-copilot.log");
+		return existsSync(f) && readFileSync(f, "utf8").includes(`joined session=${ORPHAN_SESSION}`);
+	});
+	ok("the orphaned child booted the real unit (so its exit below is not a startup crash)", booted);
+	const gone = await waitUntil(() => {
+		try {
+			process.kill(orphanPid, 0);
+			return false;
+		} catch {
+			return true; // ESRCH — the pid is gone
+		}
+	});
+	ok(
+		"[QK:COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT] a fixture child whose parent disappeared exits by " +
+			"itself — no pid-1 receiver survives a red or interrupted run",
+		gone,
+	);
+	if (!gone) process.kill(orphanPid, "SIGKILL");
+}
+
+// ── 11. the installer's honest inverse ───────────────────────────────────────
 execFileSync("bash", [path.join(REPO, "run.sh"), "uninstall-copilot-receive"], { env: installEnv, stdio: "pipe" });
 ok("uninstall removes the unit it installed and clears its state", !existsSync(unitDir) && !existsSync(stateFile));
 
-for (const c of running) c.kill("SIGKILL");
-rmSync(root, { recursive: true, force: true });
+reclaimNow();
 console.log(`\n[check-copilot-receive-arm] PASS (${passed} assertions)`);

package/scripts/check-copilot-statusline.ts

@@ -13,6 +13,7 @@ import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const SCRIPT = path.join(REPO, "scripts", "copilot-statusline.sh");
@@ -27,7 +28,8 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-copilot-statusline."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-copilot-statusline.")));
+
 const home = path.join(root, "home");
 const store = path.join(root, "meta-sessions");
 mkdirSync(home);

package/scripts/check-gate-qualification.ts

@@ -66,6 +66,7 @@ import {
 	validateManifest,
 	validateManifestSet,
 } from "./lib/mutation-qualify.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const MUTANTS_DIR = path.join(REPO_DIR, "scripts", "mutants");
@@ -135,7 +136,7 @@ function checkVitestAttribution(): void {
 		],
 	});
 
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-attribution-selftest-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-attribution-selftest-")));
 	const reportPath = path.join(dir, "vitest-report.json");
 	try {
 		fs.writeFileSync(reportPath, report);
@@ -422,10 +423,10 @@ if (process.argv.includes("--attribution-self-test")) {
 // ═══ Phase 1c — the pipeline over a synthetic fixture repo ══════════════════
 
 function buildFixtureOrigin(): { dir: string; externalTarget: string } {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-fixture-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-fixture-")));
 	// A file OUTSIDE the fixture repo, reachable only through a tracked symlink — the
 	// P0-1 escape shape: mutating `linked.txt` would write THIS file.
-	const externalDir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-external-"));
+	const externalDir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-external-")));
 	const externalTarget = path.join(externalDir, "external-target.txt");
 	fs.writeFileSync(externalTarget, "original-line outside the sandbox\n");
 	const write = (rel: string, body: string, mode = 0o644): void => {
@@ -745,7 +746,7 @@ const quiet = (): void => {};
 
 		// pgroup kill: the grandchild really dies on this host (hardening #6, Linux axis).
 		{
-			const invocationDir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-pgk-"));
+			const invocationDir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-pgk-")));
 			const pidFile = path.join(invocationDir, "grandchild.pid");
 			const script = path.join(invocationDir, "spawner.sh");
 			fs.writeFileSync(script, `#!/usr/bin/env bash\nsleep 300 & echo $! > ${JSON.stringify(pidFile)}\nwait\n`);
@@ -773,7 +774,7 @@ const quiet = (): void => {};
 
 		// Stale-snapshot sweep: dead-pid residue is reclaimed, a live runner's dir survives.
 		{
-			const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-sweep-"));
+			const tmpRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-sweep-")));
 			const deadDir = path.join(tmpRoot, "entwurf-qualify-dead1");
 			fs.mkdirSync(deadDir);
 			fs.writeFileSync(path.join(deadDir, "runner.json"), JSON.stringify({ pid: 999_999_999, startedAt: 0 }));
@@ -820,7 +821,7 @@ let manifestCount: number;
 	// Extend this inventory and the manifests TOGETHER, never silently.
 	const EXPECTED_LANE_MUTANTS: Record<string, number> = {
 		"acp-augment": 10,
-		"acp-cortex": 12,
+		"acp-cortex": 14,
 		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
 		"acp-prompt-lifecycle": 15,
@@ -833,7 +834,7 @@ let manifestCount: number;
 		"capability-cache": 3,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
-		"copilot-receive": 18,
+		"copilot-receive": 20,
 		"fresh-cut": 3,
 		"gate-qualification": 2,
 		"meta-facts": 4,
@@ -847,7 +848,7 @@ let manifestCount: number;
 		"pack-install": 2,
 		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
-		"omp-birth": 12,
+		"omp-birth": 13,
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
@@ -855,7 +856,7 @@ let manifestCount: number;
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
-		"setup-verdict": 13,
+		"setup-verdict": 14,
 		"source-install": 2,
 		"v2-surface": 7,
 		"v2-visible-resume": 17,

package/scripts/check-hook-launch-topology.ts

@@ -45,6 +45,7 @@ import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSyn
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -272,7 +273,7 @@ function hookEnv(agentRoot: string, pluginRoot: string): NodeJS.ProcessEnv {
 }
 
 function driveHook(label: string, pluginRoot: string, nativeSessionId: string): void {
-	const agentRoot = mkdtempSync(path.join(tmpdir(), "psa-hook-topology-"));
+	const agentRoot = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-topology-")));
 	const leaf = leafOf("SessionStart");
 	const exe = resolveEl(leaf.command ?? "", pluginRoot);
 	const argv = (leaf.args ?? []).map((a) => resolveEl(a, pluginRoot));
@@ -317,7 +318,7 @@ function driveHook(label: string, pluginRoot: string, nativeSessionId: string):
 }
 
 {
-	const plain = mkdtempSync(path.join(tmpdir(), "psa-hook-bundle-"));
+	const plain = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-bundle-")));
 	makeBundle(plain);
 	driveHook("exec direct topology", plain, "native-exec-direct");
 }
@@ -329,7 +330,7 @@ function driveHook(label: string, pluginRoot: string, nativeSessionId: string):
 // path was pasted into a command string and would have been word-split or
 // command-substituted; under exec form each element is one opaque argv slot.
 {
-	const holder = mkdtempSync(path.join(tmpdir(), "psa-hook-meta-"));
+	const holder = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-meta-")));
 	const nasty = path.join(holder, "plug in $HOME `id` ;& dir");
 	makeBundle(nasty);
 	ok("metachar fixture root really contains space/$/backtick/;&", /[ $`;&]/.test(path.basename(nasty)));
@@ -345,9 +346,9 @@ function driveHook(label: string, pluginRoot: string, nativeSessionId: string):
 // it. The launcher's provenance token is what makes this fail CLOSED — the record still
 // lands (best-effort, as always), but no presence is claimed that cannot be backed.
 {
-	const pluginRoot = mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-"));
+	const pluginRoot = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-")));
 	makeBundle(pluginRoot);
-	const agentRoot = mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-agent-"));
+	const agentRoot = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-oldcmd-agent-")));
 	const result = spawnSync(process.execPath, [path.join(pluginRoot, "meta-bridge-hook.ts")], {
 		encoding: "utf8",
 		input: JSON.stringify({

package/scripts/check-install-surface.ts

@@ -510,12 +510,13 @@ const operatorCmds = [...targets].filter(([cmd, ts]) => !isDevGate(cmd) && ts.le
 		`${skillRel}: missing name, four authority modes, prerelease contract, or English/ASCII-only surface`,
 	);
 	ok(
-		"S7g: the executable ASCII CI oracle binds headSha and all three required jobs",
+		"S7g: the executable ASCII CI oracle binds headSha and all four required jobs",
 		ciOracle === null ||
 			(ciOracle.includes("headSha") &&
 				ciOracle.includes('"check"') &&
 				ciOracle.includes('"install-surface"') &&
 				ciOracle.includes('"artifact-consumer"') &&
+				ciOracle.includes('"macos-install-surface"') &&
 				ciOracleMode === "100755" &&
 				oracleIsAscii),
 		`${ciOracleRel}: missing executable mode, exact-SHA classification, required jobs, or ASCII-only content`,

package/scripts/check-meta-facts.ts

@@ -33,6 +33,7 @@ import {
 	type MetaIdentity,
 	serializeMetaIdentity,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -62,7 +63,7 @@ function record(gardenId: string, over: Partial<MetaIdentity> = {}): string {
 }
 
 function store(files: Record<string, string | Buffer>): string {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")));
 	for (const [name, body] of Object.entries(files)) fs.writeFileSync(path.join(dir, name), body);
 	return dir;
 }
@@ -148,7 +149,7 @@ function parseProjection(run: CliRun, label: string): Projection {
 
 // ── drift / symlink / invalid UTF-8 are in-band defects, exit 0 ─────────────
 {
-	const outside = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-outside-"));
+	const outside = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-outside-")));
 	fs.writeFileSync(path.join(outside, "foreign.meta.json"), record(GID_C));
 	const dir = store({
 		[`${GID_A}.meta.json`]: record(GID_A),
@@ -206,7 +207,8 @@ function parseProjection(run: CliRun, label: string): Projection {
 
 // ── missing store = readable EMPTY store ────────────────────────────────────
 {
-	const gone = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")), "never-created");
+	const goneRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")));
+	const gone = path.join(goneRoot, "never-created");
 	const facts = parseProjection(cli([gone]), "missing store");
 	ok(
 		"a store that does not exist is a readable empty store (ENOENT only)",
@@ -216,7 +218,7 @@ function parseProjection(run: CliRun, label: string): Projection {
 
 // ── unreadable store = exit 3, NO JSON ──────────────────────────────────────
 {
-	const base = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-"));
+	const base = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-meta-facts-")));
 	const file = path.join(base, "not-a-dir");
 	fs.writeFileSync(file, "plain file");
 	const run = cli([path.join(file, "store")]); // ENOTDIR: the path runs THROUGH a regular file

package/scripts/check-meta-hook-session-switch.ts

@@ -70,6 +70,7 @@ import {
 	upsertMetaSession,
 	writeMetaReceiverMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -112,9 +113,9 @@ function resolveEl(value: string, pluginRoot: string): string {
 }
 
 // ── one sandbox for the whole switch story (the pid is what ties it together) ──
-const AGENT_ROOT = mkdtempSync(path.join(tmpdir(), "psa-hook-switch-agent-"));
-const PLUGIN_ROOT = mkdtempSync(path.join(tmpdir(), "psa-hook-switch-plugin-"));
-const CWD = mkdtempSync(path.join(tmpdir(), "psa-hook-switch-cwd-"));
+const AGENT_ROOT = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-switch-agent-")));
+const PLUGIN_ROOT = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-switch-plugin-")));
+const CWD = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-hook-switch-cwd-")));
 makeBundle(PLUGIN_ROOT);
 
 const ROOTS = {

package/scripts/check-meta-identity-consumers.ts

@@ -52,6 +52,7 @@ import {
 	serializeMetaIdentity,
 } from "../pi-extensions/lib/meta-session.ts";
 import { birthPiCitizen } from "../pi-extensions/lib/pi-citizen-birth.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -103,7 +104,7 @@ const v2Body = `${JSON.stringify(
 
 /** Run `body` against a store dir seeded by `seed`, then remove it. */
 function withStore(seed: (dir: string) => void, body: (dir: string) => void): void {
-	const dir = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-case-"));
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-case-")));
 	try {
 		seed(dir);
 		body(dir);
@@ -129,7 +130,7 @@ const record = (dir: string, gardenId: string, nativeSessionId: string): void =>
 	write(dir, `${gardenId}.meta.json`, serializeMetaIdentity(identity(gardenId, nativeSessionId)));
 const recordCount = (dir: string): number => fs.readdirSync(dir).filter((f) => f.endsWith(".meta.json")).length;
 
-const dir = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-"));
+const dir = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-")));
 try {
 	record(dir, GID_A, "native-a");
 	record(dir, GID_B, "native-b");
@@ -355,7 +356,7 @@ withStore(
 // entries with the right kind. A pure-only proof would have passed while the fs path
 // still did a bare-name readdir and followed symlinks — which is exactly what shipped.
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-addr-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-addr-")));
 	try {
 		// A symlink whose target lives OUTSIDE the store and holds the same native id.
 		const dir = path.join(tmp, "symlink-store");
@@ -444,7 +445,7 @@ withStore(
 // into foreign bytes while every "is it a symlink" test on a settled store stayed green.
 // A plain already-a-symlink read cannot fail that way, so it cannot prove this.
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-toctou-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-toctou-")));
 	try {
 		const dir = path.join(tmp, "store");
 		const outside = path.join(tmp, "outside");
@@ -700,7 +701,7 @@ withStore(
 // where they live and a probe of this directory cannot certify them.
 withStore(
 	(dir) => {
-		const outside = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-outside-"));
+		const outside = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-outside-")));
 		fs.writeFileSync(path.join(outside, "real.json"), serializeMetaIdentity(identity(GID_C, "native-symlinked")));
 		fs.symlinkSync(path.join(outside, "real.json"), path.join(dir, `${GID_C}.meta.json`));
 	},
@@ -889,7 +890,7 @@ withStore(
 // clean "no such citizen" — the fail-open shape (2026-07-25 fresh-eyes review). ENOENT
 // alone is absence; a broken store SHAPE (ENOTDIR here) is a failure to inspect.
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-shape-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-shape-")));
 	try {
 		const brokenStore = path.join(tmp, "store-is-actually-a-file");
 		fs.writeFileSync(brokenStore, "not a store\n");
@@ -927,7 +928,7 @@ withStore(
 // — the doctor and the install preflight would call an unreadable host clean. ENOENT
 // alone is an absent store (a host that never had a generation is not broken).
 {
-	const tmp = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-unreadable-"));
+	const tmp = reclaimOnExit(fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), "psa-idcons-unreadable-")));
 	try {
 		ok(
 			"an absent store still certifies as empty (ENOENT alone)",

package/scripts/check-meta-receiver-marker.ts

@@ -41,6 +41,7 @@ import {
 	startKeyScheme,
 	writeMetaReceiverMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -50,7 +51,7 @@ function ok(label: string, cond: boolean): void {
 }
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const DIR = mkdtempSync(path.join(tmpdir(), "psa-meta-receivers-"));
+const DIR = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "psa-meta-receivers-")));
 const GARDEN = "20260614T120000-aaaaaa";
 
 // ── write → read round-trip, garden-id keyed ────────────────────────────────