@junghanacs/entwurf 0.19.0 → 0.20.0

package/scripts/check-omp-birth-hook.ts

@@ -51,6 +51,7 @@ import {
 	processStartKey,
 	readMetaReceiverMarker,
 } from "../pi-extensions/lib/meta-session.ts";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const UNIT = "entwurf-meta-omp";
@@ -62,7 +63,8 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-const root = mkdtempSync(path.join(tmpdir(), "entwurf-omp-birth."));
+const root = reclaimOnExit(mkdtempSync(path.join(tmpdir(), "entwurf-omp-birth.")));
+
 const asm = path.join(root, "asm");
 
 // ── 1. the real assembler ────────────────────────────────────────────────────
@@ -1045,5 +1047,4 @@ for (const cell of ROOT_CELLS) {
 	);
 }
 
-rmSync(root, { recursive: true, force: true });
 console.log(`[check-omp-birth-hook] ${passed} assertions ok`);

package/scripts/check-probe-bridge-command.ts

@@ -13,6 +13,7 @@ import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "nod
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
 import { EXPECTED_TOOLS, probeBridgeCommand } from "./probe-bridge-command.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -32,7 +33,8 @@ function ok(label: string, cond: boolean, detail?: string): void {
 	passed++;
 }
 
-const dir = mkdtempSync(join(tmpdir(), "entwurf-probe-gate-"));
+const dir = reclaimOnExit(mkdtempSync(join(tmpdir(), "entwurf-probe-gate-")));
+
 const stub = (name: string, body: string): string => {
 	const p = join(dir, name);
 	writeFileSync(p, body);

package/scripts/check-setup-qualification.sh

@@ -160,5 +160,26 @@ want "F: an EXPLICIT operator tools.xdev:true is refused by name, never overwrit
 want "F control: the disagreement is a component FAIL that leaves the other omp units composed" \
   "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
 
+# ── Cell G: a COMPLETED harness install on a platform whose RAIL has no receipt ──
+# 0.20.0 opened the harness installers to Darwin, which retired the only thing that
+# used to keep a detected Mac host non-green — the installer's own refusal. Install
+# portability and rail certification are separate evidence axes (Hard Rule 17) and
+# `setup` measures only the first, so the completed install must land as the NAMED
+# non-green, never as a PASS pointing at a doctor that refuses on that platform.
+# `uname` is faked on PATH, the same seam smoke-meta-install-state.sh uses for the
+# installer's platform gate; Cell E above is the certified-platform control (same
+# stub omp, same sandbox, unfaked platform → PASS rows).
+FAKE_UNAME="$SB/fake-uname"; mkdir -p "$FAKE_UNAME"
+printf '#!%s\nprintf "%%s\\n" Darwin\n' "$(command -v bash)" > "$FAKE_UNAME/uname"
+chmod +x "$FAKE_UNAME/uname"
+run_setup "$SB/home-g" "$SB/proj-g" "$FAKE_UNAME:$STUB_OMP:$SB/bin:$PATH" "$ABSENT" "" "$STUB_OMP/omp"
+# One assertion by design: the row, its REASON, and the ARTIFACT proving the install
+# actually completed. Drop the artifact half and the cell would also pass if the fake
+# platform had merely broken the installer — the opposite of what is being claimed.
+want "G: a completed install whose rail has no receipt is the named non-green, never a cosmetic PASS [QK:SETUP-DARWIN-RAIL-COSMETIC-PASS]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED — pending physical host on Darwin' && [ -d '$SB/home-g/.omp/agent/extensions/entwurf-meta-omp' ]"
+want "G control: the reason reads as an evidence boundary, not an install refusal, and names the axis owner" \
+  "printf '%s' \"\$OUT\" | grep -q 'the wiring WAS written and nothing failed to install' && printf '%s' \"\$OUT\" | grep -qF \"owned by './run.sh doctor-omp-bridge'\" && ! printf '%s' \"\$OUT\" | grep -qi 'unsupported platform'"
+
 echo ""
 echo "check-setup-qualification: $PASS checks passed (mutation-attribution oracle only — behavior evidence lives in smoke-setup-verdict and check-pack-install)"

package/scripts/copilot-bridge-doctor.sh

@@ -183,6 +183,8 @@ if [ -f "$HOOK_LOG" ]; then
   #
   # grep -c prints 0 AND exits 1 with no match, so a `|| echo 0` fallback would append a
   # SECOND line and every numeric test below would die on "0\n0". Keep it to one line.
+  # That rule still governs the plain-literal marker counters further down; the mint
+  # selector no longer needs it, for the reason in the next paragraph.
   #
   # MINT ERRORS ONLY. Since #82 RAIL 5b this unit also writes a SENDER marker, and a
   # failed marker write is an ERROR that lands AFTER the successful mint line — so the
@@ -190,10 +192,18 @@ if [ -f "$HOOK_LOG" ]; then
   # sentence that is simply false (the record IS there). The two failures are separated
   # here rather than downgraded in the payload, because a marker write that keeps
   # breaking must stay loud somewhere; it just is not a birth failure.
-  MINT_ERRORS=' ERROR \[copilot\] (?!sender-marker-)'
-  LAST_ERROR_LINE="$(grep -nP "$MINT_ERRORS" "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
-  LAST_OK_LINE="$(grep -n ' INFO \[copilot\] \(create\|attach\) ' "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
-  TOTAL_ERRORS="$(grep -cP "$MINT_ERRORS" "$HOOK_LOG" 2>/dev/null | head -1)"
+  #
+  # PORTABLE SELECTOR, SAME CONTRACT. That separation is a negative lookahead, and BSD
+  # grep (macOS) has no `-P` at all — so the selector is awk, where two conditions ARE
+  # `(?!…)`. It also removes the `grep -c` exit-1 hazard the paragraph above works
+  # around: awk prints 0 and exits 0 on a zero-match file, so there is no second line
+  # to launder. The success selector moves from GNU BRE `\(a\|b\)` to ERE `(a|b)` for
+  # the same portability reason — BRE alternation is a GNU extension, so on BSD grep
+  # that pattern matches nothing and a RECOVERED host reads as unrecovered (false RED).
+  MINT_ERRORS='/ ERROR \[copilot\] / && !/ ERROR \[copilot\] sender-marker-/'
+  LAST_ERROR_LINE="$(awk "$MINT_ERRORS{print NR}" "$HOOK_LOG" 2>/dev/null | tail -1)"
+  LAST_OK_LINE="$(grep -nE ' INFO \[copilot\] (create|attach) ' "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
+  TOTAL_ERRORS="$(awk "$MINT_ERRORS{n++} END{print n+0}" "$HOOK_LOG" 2>/dev/null)"
   TOTAL_ERRORS="${TOTAL_ERRORS:-0}"
   if [ -z "$LAST_ERROR_LINE" ]; then
     ok "no copilot ERROR lines in $HOOK_LOG"
@@ -201,7 +211,7 @@ if [ -f "$HOOK_LOG" ]; then
     note "$TOTAL_ERRORS historical copilot ERROR line(s) in $HOOK_LOG, all followed by a successful mint (line $LAST_OK_LINE > $LAST_ERROR_LINE) — recovered, not red"
   else
     bad "the newest copilot line in $HOOK_LOG is an unrecovered ERROR — the hook RAN and did not mint:"
-    grep -P "$MINT_ERRORS" "$HOOK_LOG" | tail -3 | sed 's/^/        /'
+    awk "$MINT_ERRORS" "$HOOK_LOG" | tail -3 | sed 's/^/        /'
   fi
 
   # WHO-SENT, judged on its own axis. Both outcomes leave a citizen that EXISTS and can

package/scripts/copilot-bridge-install.sh

@@ -22,7 +22,8 @@
 # first-party extension, installed by `run.sh install-copilot-receive`, which also owns
 # the launch-flag check. Four surfaces, four installers, four failure modes.
 #
-# Platform: Linux only, same fence as the Claude installer.
+# Platform: Linux and Darwin, same fence as the Claude installer. Its own platform
+# dependency is python3 + node (checked below); no /proc, no GNU-only tool.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -66,7 +67,10 @@ for arg in "$@"; do
   esac
 done
 
-[ "$(uname -s)" = "Linux" ] || die "Linux only; $(uname -s) is not a certified axis for this install."
+case "$(uname -s)" in
+  Linux | Darwin) ;;
+  *) die "unsupported platform '$(uname -s)'. This installer requires Linux or Darwin." ;;
+esac
 if [ "$ASSEMBLE_ONLY" -eq 0 ]; then
   command -v copilot >/dev/null 2>&1 || die "the 'copilot' CLI is not on PATH."
 fi

package/scripts/copilot-launch.sh

@@ -117,9 +117,23 @@ copilot_bin="$(type -P "$VENDOR_CMD" 2>/dev/null || true)"
 
 # Self-exec fence, the second half of the recursion guard: resolve symlinks and refuse
 # anything that is one of our own entrypoints even if the sentinel was stripped.
-resolved_bin="$(readlink -f "$copilot_bin" 2>/dev/null || printf '%s' "$copilot_bin")"
+# POSIX walk, same shape as mcp/entwurf-bridge/start.sh — BSD readlink has no -f.
+resolve_path() {
+	local SOURCE="$1" DIR TARGET
+	while [ -L "$SOURCE" ]; do
+		DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+		TARGET="$(readlink "$SOURCE")"
+		case "$TARGET" in
+			/*) SOURCE="$TARGET" ;;
+			*) SOURCE="$DIR/$TARGET" ;;
+		esac
+	done
+	DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+	printf '%s/%s\n' "$DIR" "$(basename "$SOURCE")"
+}
+resolved_bin="$(resolve_path "$copilot_bin")"
 for own in "$HERE/copilot-launch.sh" "$REPO_DIR/run.sh"; do
-	own_resolved="$(readlink -f "$own" 2>/dev/null || printf '%s' "$own")"
+	own_resolved="$(resolve_path "$own")"
 	[ "$resolved_bin" = "$own_resolved" ] \
 		&& fail "'$VENDOR_CMD' on PATH resolves to entwurf's own '$own_resolved' — that is a launch loop, not the vendor CLI."
 done

package/scripts/copilot-receive-bridge.sh

@@ -233,7 +233,9 @@ do_doctor() {
 	# THE INVISIBLE FAILURE. A Copilot launched without the flag never scans for
 	# extensions and prints nothing at all, so a perfectly installed unit stays inert
 	# with no symptom anywhere. Reading the live processes' own environment is the only
-	# place that silence becomes visible. Linux /proc only; elsewhere it is a note.
+	# place that silence becomes visible. That read is `/proc`-bound today; where the
+	# interface does not exist the axis is reported UNVERIFIABLE and non-green, never
+	# as a benign note (see the branch below).
 	#
 	# WHY NOT `pgrep -x copilot` (what this used to do). It matched nothing, ever, and
 	# reported that as the benign "no live copilot" note — so the detector built to break
@@ -255,7 +257,27 @@ do_doctor() {
 	# from OUR unit and carry `COPILOT_EXTENSION_PARENT_PID`; counting one as a session
 	# would report a receiver as its own missing session.
 	if [ ! -d /proc ]; then
-		note "no /proc on this platform — cannot read the live CLI environments"
+		# D1 — NON-GREEN, NOT A NOTE. This used to `note`, and a note lets this doctor end
+		# in PASS on a platform where the flag axis is blind: the exact false-success the
+		# paragraph at the unreadable-environ branch below refuses on Linux ("A note would
+		# let the doctor end in PASS while a session that can never arm is running"). The
+		# epistemic state here is the SAME one — the flag verdict's predicate INPUT is
+		# missing — so it gets the same verdict, and the reason is stated rather than
+		# rounded off.
+		#
+		# AND ABSENCE CANNOT BE CLAIMED EITHER. Without /proc there is no candidate
+		# enumeration at all, so this branch cannot say "no live Copilot CLI" the way the
+		# zero-count note below does; it can only say the axis was not measurable. That
+		# is a strictly weaker sentence than the note it replaces, which is the point.
+		#
+		# WHY NO `ps` SUBSTITUTE IS ATTEMPTED HERE. `ps -A -o pid=,args=` would recover the
+		# argv half, but macOS truncates argv for processes the caller does not own, and the
+		# environment half (`ps -E`/`ps eww`) succeeds there only for unrestricted targets —
+		# both are unmeasured (scripts/raw-macos-measure/probe.sh cell M6 is the receipt that
+		# would decide it). A guessed reader that silently identifies nothing would restore
+		# exactly the fail-open this branch just closed, so the read is not guessed. When M6
+		# lands, the portable read belongs right here, in place of this refusal.
+		bad "UNVERIFIABLE on this platform: there is no per-process environment interface, so the $FLAG_ENV state of a live Copilot CLI cannot be read — and without one this doctor cannot enumerate processes either, so it cannot claim that no CLI is running. The receiver IS installed, so a session launched without $FLAG_ENV=$FLAG_VALUE (never scans extensions, prints nothing, can never arm) is NOT ruled out. Launch through 'entwurf copilot', which sets the flag, and treat this axis as unmeasured until a native Darwin receipt exists."
 	else
 		local pid_seam="" scan_json
 		# WHICH PROCESSES ARE CANDIDATES. Normally every pid under /proc.
@@ -274,7 +296,7 @@ do_doctor() {
 		# stepped on once. The status is captured instead, and a broken scan becomes a verdict.
 		local scan_rc=0
 		scan_json="$(ENTWURF_PID_SEAM="${pid_seam}" ENTWURF_PID_SEAM_SET="${ENTWURF_COPILOT_RECEIVE_PIDS+1}" FLAG_ENV="$FLAG_ENV" FLAG_VALUE="$FLAG_VALUE" python3 - <<'PY'
-import os, pathlib
+import errno, os, pathlib
 
 flag_env = os.environ["FLAG_ENV"]
 flag_value = os.environ["FLAG_VALUE"]
@@ -284,17 +306,43 @@ if os.environ.get("ENTWURF_PID_SEAM_SET"):
 else:
 	candidates = [p.name for p in pathlib.Path("/proc").iterdir() if p.name.isdigit()]
 
+# THREE ANSWERS, NOT TWO. "The process is gone" and "the read was refused" are different
+# facts about a live host, and collapsing them is how this scanner reported a process it
+# could not read as a process that was not there. A returned list is the bytes; `None` is
+# a PROVEN absence; `UNREADABLE` is "the input could not be obtained", which is unknown.
+UNREADABLE = object()
+
 def read_nul(pid, what):
 	try:
 		return pathlib.Path(f"/proc/{pid}/{what}").read_bytes().split(b"\0")
-	except OSError:
-		return None
+	except OSError as exc:
+		# ONLY A PROVEN ABSENCE IS BENIGN. ENOENT/ESRCH is the process itself leaving
+		# between enumeration and this read — nothing is left to judge. EVERYTHING else
+		# (EACCES/EPERM under a `hidepid` /proc or a session owned by another user, and
+		# any other I/O failure) leaves the process THERE and the input MISSING. Unknown
+		# is the DEFAULT side on purpose: a new errno class must arrive as non-green
+		# rather than inherit the benign one.
+		if exc.errno in (errno.ENOENT, errno.ESRCH):
+			return None
+		return UNREADABLE
 
-armed_ok, armed_missing, unreadable, contaminated = 0, 0, 0, 0
-missing_pids, unreadable_pids, contaminated_pids = [], [], []
+armed_ok, armed_missing, unreadable, contaminated, argv_unknown = 0, 0, 0, 0, 0
+missing_pids, unreadable_pids, contaminated_pids, argv_unknown_pids = [], [], [], []
 
 for pid in candidates:
 	argv = read_nul(pid, "cmdline")
+	if argv is UNREADABLE:
+		# WE CANNOT EVEN SAY WHAT THIS PROCESS IS. Identity is the FIRST predicate here, so
+		# a refused argv read is not "not a Copilot CLI" — it is "unknown", and a Copilot
+		# CLI is NOT ruled out. It carries its own counter because the unreadable-ENVIRON
+		# counter below means something strictly stronger: there, identity already
+		# succeeded and the process IS a Copilot CLI, so that verdict can name a session.
+		# This branch can only say the doctor was blinded — which is exactly why the `bad`
+		# path further down cannot cover it (that one is reachable only AFTER a successful
+		# argv match).
+		argv_unknown += 1
+		argv_unknown_pids.append(pid)
+		continue
 	# No cmdline at all is a kernel thread or a process that exited mid-scan; neither is
 	# a Copilot session and neither is evidence of anything.
 	if not argv:
@@ -322,9 +370,13 @@ for pid in candidates:
 		continue
 
 	env = read_nul(pid, "environ")
-	if env is None:
-		# FAIL-CLOSED: we identified a native CLI but cannot read its environment, so its
-		# flag state is unknown. That is reported, never rounded to armed.
+	if env is None or env is UNREADABLE:
+		# FAIL-CLOSED, AND DELIBERATELY NOT SPLIT. We identified a native CLI and then did
+		# not learn its environment — whether it left mid-scan or refused the read, its
+		# flag state is unknown and it WAS a live Copilot CLI when identity matched. Both
+		# halves stay in this one reported bucket. Only the argv branch above needs the
+		# distinction, because there absence and refusal answer different questions
+		# ("is anything running at all?" vs "what is this?").
 		unreadable += 1
 		unreadable_pids.append(pid)
 		continue
@@ -351,24 +403,30 @@ for pid in candidates:
 		armed_missing += 1
 		missing_pids.append(pid)
 
-print(f"{armed_ok} {armed_missing} {unreadable} {contaminated}")
+print(f"{armed_ok} {armed_missing} {unreadable} {contaminated} {argv_unknown}")
 print(" ".join(missing_pids))
 print(" ".join(unreadable_pids))
 print(" ".join(contaminated_pids))
+print(" ".join(argv_unknown_pids))
 PY
 )" || scan_rc=$?
-		local counts armed_ok armed_missing unreadable contaminated missing_pids unreadable_pids contaminated_pids
+		local counts armed_ok armed_missing unreadable contaminated argv_unknown
+		local missing_pids unreadable_pids contaminated_pids argv_unknown_pids
 		counts="$(printf '%s\n' "$scan_json" | sed -n '1p')"
 		missing_pids="$(printf '%s\n' "$scan_json" | sed -n '2p')"
 		unreadable_pids="$(printf '%s\n' "$scan_json" | sed -n '3p')"
 		contaminated_pids="$(printf '%s\n' "$scan_json" | sed -n '4p')"
+		argv_unknown_pids="$(printf '%s\n' "$scan_json" | sed -n '5p')"
 		armed_ok="$(printf '%s' "$counts" | awk '{print $1}')"
 		armed_missing="$(printf '%s' "$counts" | awk '{print $2}')"
 		unreadable="$(printf '%s' "$counts" | awk '{print $3}')"
 		contaminated="$(printf '%s' "$counts" | awk '{print $4}')"
+		argv_unknown="$(printf '%s' "$counts" | awk '{print $5}')"
 		if [ "$scan_rc" -ne 0 ] || [ -z "$armed_ok" ]; then
 			bad "the /proc scan for live Copilot CLIs FAILED (exit $scan_rc) — the flag axis is UNKNOWN, so an inert session cannot be ruled out. This is a broken doctor, not a clean host."
-		elif [ "$armed_ok" -eq 0 ] && [ "$armed_missing" -eq 0 ] && [ "$unreadable" -eq 0 ]; then
+		elif [ "$armed_ok" -eq 0 ] && [ "$armed_missing" -eq 0 ] && [ "$unreadable" -eq 0 ] && [ "${argv_unknown:-0}" -eq 0 ]; then
+			# The one branch that may claim ABSENCE, and it may only claim it because every
+			# candidate answered: each was enumerated and its argv was read (or proved gone).
 			note "no live GitHub Copilot CLI process — start one with 'entwurf copilot' (or $FLAG_ENV=$FLAG_VALUE copilot) to arm a receiver"
 		else
 			[ "$armed_ok" -gt 0 ] && ok "$armed_ok live Copilot CLI process(es) carry $FLAG_ENV=$FLAG_VALUE"
@@ -379,6 +437,15 @@ PY
 				# exact false-success the section was written to break.
 				bad "$unreadable live Copilot CLI process(es) have an unreadable environment (pids: $unreadable_pids) — their $FLAG_ENV state is UNKNOWN and is NOT assumed armed. Re-run this doctor as the user that owns those sessions."
 			fi
+			if [ "${argv_unknown:-0}" -gt 0 ]; then
+				# RED, and NOT the same finding as the line above. There, identity had already
+				# succeeded, so the doctor could name a Copilot session and say what was unknown
+				# about it. Here identity ITSELF failed to be decided: a live process would not
+				# let its argv be read, so whether it is a Copilot CLI is unknown and one is not
+				# ruled out. Rounding that to "no live CLI" is the false success this branch
+				# exists to break.
+				bad "UNVERIFIABLE — the argv of $argv_unknown live process(es) could not be read (pids: $argv_unknown_pids), so whether any of them is a GitHub Copilot CLI is UNKNOWN. This doctor therefore does NOT claim that no CLI is running, and an inert session cannot be ruled out. Re-run it as the user that owns those processes, or on a host whose /proc is not restricted."
+			fi
 			if [ "$armed_missing" -gt 0 ]; then
 				bad "$armed_missing live Copilot CLI process(es) lack $FLAG_ENV=$FLAG_VALUE while the receiver is installed (pids: $missing_pids) — relaunch them with 'entwurf copilot', or uninstall the receiver so nothing promises a doorbell"
 			fi

package/scripts/lib/reclaim-on-exit.ts

@@ -0,0 +1,86 @@
+// Reclaim a gate's OWN process resources when that gate exits — however it exits.
+//
+// WHY THIS EXISTS (test-infra, not a product capability):
+// A gate ends red by THROWING (`ok()` is `assert.ok`), and ^C or a runner's SIGTERM
+// ends it with no statement running at all. Teardown written as the last line of the
+// file is therefore skipped on every path except the green one, and the mutant runner
+// makes that the COMMON path: qualification runs each committed mutant expecting the
+// gate to go red. Measured on `oracle` 2026-09-08, before this leaf existed: ~9,200
+// stale temp roots and 3.8G under `/tmp`, plus 360 reparented fixture Node processes
+// from `check-copilot-receive-arm` alone. `pnpm check` was still minting a fresh one
+// per run at that point.
+//
+// WHAT IT IS NOT. It is not error handling and it does not soften a failure: the exit
+// code is untouched (a red gate stays red, a signal still ends as 128+n), nothing is
+// logged, and no failure is converted into a warning (Hard Rule 15). It reclaims
+// process resources only — never a record, transcript or operator artifact (Hard Rule
+// 8). A SIGKILL of the gate still runs nothing here, by construction; that residue is
+// the release protocol's `P9. Reclaim the host` step, and a fixture child that must
+// outlive nothing needs its own parent-death watchdog.
+
+import type { ChildProcess } from "node:child_process";
+import { rmSync } from "node:fs";
+
+const roots: string[] = [];
+const children: ChildProcess[] = [];
+let wired = false;
+let done = false;
+
+/** Sync-only, idempotent: an `exit` handler may not await anything. */
+function reclaim(): void {
+	if (done) return;
+	done = true;
+	for (const c of children) {
+		try {
+			c.kill("SIGKILL");
+		} catch {
+			// kill() throws ESRCH on an already-reaped pid — gone either way
+		}
+	}
+	for (const dir of roots) {
+		try {
+			rmSync(dir, { recursive: true, force: true });
+		} catch {
+			// Best-effort teardown must never become the reason a GREEN gate exits
+			// non-zero: a throw inside an `exit` handler would flip the verdict of a
+			// run that had already passed every assertion it makes.
+		}
+	}
+}
+
+function wire(): void {
+	if (wired) return;
+	wired = true;
+	process.on("exit", reclaim);
+	// A signal is not an exit: without these, `exit` never fires. Re-raising as
+	// 128+n keeps the shell's own convention rather than inventing a code.
+	for (const [signal, n] of [
+		["SIGINT", 2],
+		["SIGTERM", 15],
+		["SIGHUP", 1],
+	] as const) {
+		process.on(signal, () => {
+			reclaim();
+			process.exit(128 + n);
+		});
+	}
+}
+
+/** Register a temp root to remove on exit. Returns it, so it wraps `mkdtempSync`. */
+export function reclaimOnExit(dir: string): string {
+	wire();
+	roots.push(dir);
+	return dir;
+}
+
+/** Register a spawned child to SIGKILL on exit. Returns it, so it wraps `spawn`. */
+export function killOnExit<T extends ChildProcess>(child: T): T {
+	wire();
+	children.push(child);
+	return child;
+}
+
+/** Run the registered teardown now (the green tail); later exits become no-ops. */
+export function reclaimNow(): void {
+	reclaim();
+}

package/scripts/meta-bridge-doctor.sh

@@ -66,13 +66,18 @@ echo "meta-bridge doctor"
 echo "config=$CLAUDE_CFG  agent-dir=$AGENT"
 
 echo "[platform]"
-# The #51 repair contract is Linux-only because certification requires discovery of
-# each live bridge process's environment through /proc. Darwin is not an install lane
-# for this cut and must stay nonzero here too — never downgrade unsupported to a
-# static/synthetic PASS.
+# WHAT THIS FENCE IS ABOUT, NARROWLY. It is not "GNU tools" and it is not the
+# start-key: the python join below now mints the SAME `ps:` string the TS core mints
+# (audit Q2), so start-key and ppid are portable in this doctor too and that half of
+# the old reason is retired. What is left is bridge DISCOVERY — finding the live
+# entwurf MCP children by their per-process ENVIRONMENT — which has no measured
+# portable equivalent, so the live-owner tier is unreachable rather than merely
+# unobserved (the rc=3 branch below is the same verdict, stated where it fires).
+# Darwin therefore stays nonzero here: a doctor that cannot measure its central axis
+# must never downgrade "unsupported" to a static/synthetic PASS.
 case "$(uname -s)" in
   Linux)  ok "Linux supported — the certified live axis (live owner join is instrumentable)" ;;
-  Darwin) bad "macOS is NOT YET VERIFIED/CERTIFIED for this repair cut: strict live-owner certification currently requires /proc. The installer refuses Darwin; this doctor remains nonzero for diagnosis/legacy cleanup. Future validation may reopen the lane." ;;
+  Darwin) bad "macOS is NOT CERTIFIED for this cut: the live-owner join needs per-process ENVIRONMENT discovery of the live bridge children, and no portable Darwin equivalent has been MEASURED yet (start-key/ppid are portable here now — that half of the old reason is retired). This doctor stays nonzero on Darwin for diagnosis and legacy cleanup until a physical Darwin receipt exists." ;;
   *) bad "$(uname -s) unsupported (Claude meta-bridge repair cut is Linux-only)" ;;
 esac
 
@@ -982,7 +987,7 @@ fi
 echo "[live Claude MCP owner join]"
 if command -v python3 >/dev/null; then
   if JOIN_OUT="$(python3 - "$AGENT" "$META_SESSIONS" <<'PY' 2>&1
-import json, os, sys
+import json, re, subprocess, sys
 from pathlib import Path
 
 agent = Path(sys.argv[1]).expanduser().resolve()
@@ -990,23 +995,52 @@ store = Path(sys.argv[2]).expanduser().resolve()
 proc = Path("/proc")
 if not proc.is_dir():
     # rc=3 is a PLATFORM verdict, distinct from rc=2 ("no session open right now").
-    # The runtime this doctor verifies has a `ps` fallback for start-key/ppid, but
-    # bridge DISCOVERY needs per-process environ, which has no portable equivalent
-    # here — so the live tier is unreachable, not merely unobserved.
-    print("live owner join is NOT INSTRUMENTABLE on this platform: /proc is unavailable, so entwurf MCP children cannot be discovered")
+    # NARROWLY: start-key and ppid are NOT the reason — `parent()`/`start_key()` below
+    # carry the same two-tier `/proc`-then-`ps` fallback the runtime writer has, so they
+    # answer on any platform with a `ps`. Bridge DISCOVERY is the reason: it needs each
+    # candidate's per-process ENVIRONMENT, which has no measured portable equivalent, so
+    # the live tier is unreachable here rather than merely unobserved.
+    print("live owner join is NOT INSTRUMENTABLE on this platform: what holds the lane closed is per-process environment DISCOVERY alone — start-key and ppid are portable there (`ps` fallback, same string the TS core mints), but no measured Darwin equivalent exists for reading each live bridge child's environment")
     raise SystemExit(3)
 
 def stat_fields(pid):
     text = Path(f"/proc/{pid}/stat").read_text()
     return text[text.rfind(")") + 2:].split()
 
+def ps_field(pid, fmt):
+    # The SAME argv vector the writer uses (meta-session.ts parentPid/processStartKey),
+    # so the two writers cannot disagree by construction.
+    try:
+        out = subprocess.run(["ps", "-o", fmt, "-p", str(pid)], capture_output=True, text=True).stdout
+    except Exception:
+        return ""
+    return out.strip()
+
 def parent(pid):
+    if not isinstance(pid, int) or pid <= 0: return None
     try: return int(stat_fields(pid)[1])
-    except Exception: return None
+    except Exception: pass
+    # `ps -o ppid=` — literally the fallback parentPid() already ships.
+    ppid = ps_field(pid, "ppid=")
+    return int(ppid) if ppid.isdigit() and int(ppid) > 0 else None
 
 def start_key(pid):
-    try: return "linux:" + stat_fields(pid)[19]
-    except Exception: return ""
+    # TWO WRITERS, ONE STRING. The runtime mints this key (meta-session.ts
+    # processStartKey) and this doctor RE-mints it to compare against the marker; if the
+    # two ever mint different strings for the same live pid the join fails for a reason
+    # that has nothing to do with the install. So this is not "a portable start key" —
+    # it is the same two tiers in the same order with the same prefixes: `/proc/<pid>/stat`
+    # field 22 as `linux:<ticks>`, else `ps -o lstart= -p <pid>` trimmed as `ps:<lstart>`.
+    # python `.strip()` and JS `.trim()` both strip ASCII whitespace from this single-line
+    # output, and the argv vector is identical, so the bytes are identical (audit Q2).
+    # "" stays the UNKNOWN answer and never matches a marker — fail-closed, unchanged.
+    if not isinstance(pid, int) or pid <= 0: return ""
+    try:
+        starttime = stat_fields(pid)[19]
+        if re.fullmatch(r"\d+", starttime): return "linux:" + starttime
+    except Exception: pass
+    lstart = ps_field(pid, "lstart=")
+    return "ps:" + lstart if lstart else ""
 
 def process_agent(env):
     raw = env.get("PI_CODING_AGENT_DIR")
@@ -1088,7 +1122,7 @@ PY
     # send an operator to completely different places.
     case "$JOIN_RC" in
       2) bad "NOT CERTIFIED — $JOIN_OUT. Nothing here says the install is broken: the evidence simply does not exist yet. Open a Claude Code session (or restart the affected one) and run this doctor again." ;;
-      3) bad "NOT CERTIFIED on this platform — $JOIN_OUT. This repair cut currently certifies the Claude meta-bridge on Linux only; static/synthetic evidence cannot certify $(uname -s), and future native validation may reopen that lane." ;;
+      3) bad "NOT CERTIFIED on this platform — $JOIN_OUT. This repair cut certifies the Claude meta-bridge on Linux only; static/synthetic evidence cannot certify $(uname -s), and only a physical native run can reopen that lane." ;;
       *) bad "$JOIN_OUT. Re-run install-meta-bridge, restart the affected Claude session(s), then run doctor again." ;;
     esac
   fi
@@ -1121,7 +1155,14 @@ livewrite_schema() { # $1=meta-session.<ext> → v3|v2|v1|absent
   elif grep -q "serializeMetaIdentity" "$1"; then echo "v2"
   else echo "v1"; fi
 }
-hash12() { [ -f "$1" ] && sha256sum "$1" | cut -c1-12 || echo "------------"; }
+# 12-hex digest, portable. NOT `sha256sum` (coreutils, absent on macOS) and NOT
+# `shasum -a 256` — that would be a second digest convention, while python3 is already
+# a hard prerequisite of this whole doctor (line 31 reads install-state through it). So
+# this reuses the python3 hashlib form omp-receive-doctor.sh:99 already ships. An absent
+# file still yields `------------`, and a hashing failure now falls into that same
+# placeholder instead of an empty string — either way the parity rows below read it as
+# drift and go red, which is the fail-closed side.
+hash12() { [ -f "$1" ] && python3 -c 'import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest()[:12])' "$1" 2>/dev/null || echo "------------"; }
 registry_for_ms() { # $1=bundle meta-session.ts → sibling plugin-root registry path
   [ -f "$1" ] || { echo ""; return; }
   dirname "$(dirname "$1")"

package/scripts/meta-bridge-install.sh

@@ -25,9 +25,13 @@
 # Idempotent: re-running removes the prior marketplace/plugin first, so a
 # `nix rebuild` that moved node just re-bakes and re-installs cleanly.
 #
-# Platform: Linux only for the #51 repair cut. macOS cannot reach the strict
-# live-owner certification tier, so accepting an install there would advertise a
-# surface this release can never certify. Windows and every other platform fail fast.
+# Platform: Linux and Darwin. This installer's own platform dependency is python3 +
+# node + the claude CLI (all checked below); it touches no /proc, no systemd, no
+# GNU-only tool. Windows and every other platform fail fast. Live-owner rail
+# certification is a SEPARATE evidence axis owned by doctor-meta-bridge (Hard Rule 17:
+# installation portability and rail/runtime support are separate evidence axes) — a
+# green install here does not certify the Darwin rail; run ./run.sh doctor-meta-bridge
+# for that verdict.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -64,11 +68,13 @@ esac
 
 die() { echo "meta-bridge-install: $*" >&2; exit 1; }
 
-# --- platform gate (Linux-only repair contract) -----------------------------
+# --- platform gate (installer's own dependency, not rail certification) -----
+# Darwin is open on the same precedent as meta-bridge-uninstall.sh:20-23: this
+# installer touches no /proc and no GNU-only tool, so its own mechanism is portable
+# even while the live-owner rail (doctor-meta-bridge) stays a separate, unproven axis.
 case "$(uname -s)" in
-  Linux) ;;
-  Darwin) die "macOS is not yet verified/certified for this repair cut. Strict live-owner certification currently requires /proc, so Darwin install is refused rather than left NOT CERTIFIED; future validation may reopen this lane." ;;
-  *) die "unsupported platform '$(uname -s)'. The Claude meta-bridge repair cut supports Linux only (no unverified fallback)." ;;
+  Linux | Darwin) ;;
+  *) die "unsupported platform '$(uname -s)'. This installer requires Linux or Darwin." ;;
 esac
 
 # --- toolchain gate, part 1: this machine's own runtime ---------------------

package/scripts/meta-bridge-uninstall.sh

@@ -14,12 +14,14 @@ PLUGIN="entwurf-meta-receive"
 
 die() { echo "meta-bridge-uninstall: $*" >&2; exit 1; }
 
-# Darwin stays here intentionally even though NEW installs are Linux-only in the #51
-# repair cut. Removing the inverse would strand an older macOS install precisely when
-# support narrows; uninstall is a legacy-cleanup capability, not install certification.
+# Darwin is accepted on both halves as of 0.20.0. It was accepted HERE first, while new
+# installs were still refused, because removing the inverse would strand an older macOS
+# install precisely when support narrows. That asymmetry is now gone — the installer
+# refuses on its real dependency instead of the platform name — so the two halves agree
+# and this fence only turns away platforms neither half has ever run on.
 case "$(uname -s)" in
   Linux | Darwin) ;;
-  *) die "unsupported platform '$(uname -s)'. This repair cut certifies new Claude meta-bridge installs on Linux only; uninstall additionally permits Darwin so legacy state can be removed honestly." ;;
+  *) die "unsupported platform '$(uname -s)'. Both halves of the Claude meta-bridge repair cut run on Linux and Darwin only. Rail certification is a separate axis owned by doctor-meta-bridge." ;;
 esac
 
 command -v python3 >/dev/null || die "'python3' not on PATH. It is required for stateful uninstall."