@junghanacs/entwurf 0.19.0 → 0.20.0

package/scripts/mutants/acp-cortex.json

@@ -26,6 +26,19 @@
 			"signature": "[QK:CORTEX-CURATED-FOUR-ROWS]",
 			"signatureSource": "scripts/check-acp-cortex.ts"
 		},
+		{
+			"claim": "CLAUDE-CURATED-THREE-ROWS",
+			"title": "dropping a curated CLAUDE row shrinks the operator's model list while the exact-set comparison stays green — expected derives from the same constant, so only the independent count catches it",
+			"subject": "pi-extensions/lib/acp/models.ts",
+			"find": [
+				"export const SUPPORTED_ANTHROPIC_MODEL_IDS = [\"claude-sonnet-5\", \"claude-opus-5\", \"claude-fable-5-1\"] as const;"
+			],
+			"replace": ["export const SUPPORTED_ANTHROPIC_MODEL_IDS = [\"claude-sonnet-5\", \"claude-opus-5\"] as const;"],
+			"gate": ["bash", "run.sh", "check-acp-provider-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CLAUDE-CURATED-THREE-ROWS]",
+			"signatureSource": "scripts/check-acp-provider-surface.ts"
+		},
 		{
 			"claim": "CORTEX-AUTH-NARROW-CREDENTIAL-CACHE",
 			"title": "widening the auth passthrough to the whole cortex/cache leaks operator tool_outputs/tip_history into the child",
@@ -56,6 +69,17 @@
 			"signature": "[QK:CORTEX-AUTOUPDATE-OFF]",
 			"signatureSource": "scripts/check-acp-cortex.ts"
 		},
+		{
+			"claim": "CORTEX-REALHOME-PLATFORM-NEUTRAL",
+			"title": "re-deriving realHome absoluteness from the POSIX flavor alone makes a drive/UNC HOME read as relative — the guard would state the host it runs on instead of the contract (PR #77, @yizixu)",
+			"subject": "pi-extensions/lib/acp/overlay.ts",
+			"find": ["\tif (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {"],
+			"replace": ["\tif (!params.realHome || !params.realHome.startsWith(\"/\")) {"],
+			"gate": ["bash", "run.sh", "check-acp-cortex"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CORTEX-REALHOME-PLATFORM-NEUTRAL]",
+			"signatureSource": "scripts/check-acp-cortex.ts"
+		},
 		{
 			"claim": "CORTEX-BRIDGE-DUAL-HOME",
 			"title": "dropping the bridge-only real-HOME restore leaves the garden store cut off — tools reach the model but see an empty garden (D10)",
@@ -182,14 +206,14 @@
 			"signatureSource": "scripts/check-acp-session-reuse.ts"
 		},
 		{
-			"claim": "CORTEX-PROVIDER-SIX-ROW-SURFACE",
+			"claim": "CORTEX-PROVIDER-EXACT-ROW-SURFACE",
 			"title": "filtering the cortex rows out of the REAL provider entry drops the whole backend from the operator's model list while models.ts and check-acp-cortex stay green",
 			"subject": "pi-extensions/acp-provider.ts",
 			"find": ["\t\tmodels: allCuratedModels(),"],
 			"replace": ["\t\tmodels: allCuratedModels().filter((m) => !m.id.startsWith(\"cortex-\")),"],
 			"gate": ["bash", "run.sh", "check-acp-provider-surface"],
 			"timeoutSeconds": 300,
-			"signature": "[QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]",
+			"signature": "[QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE]",
 			"signatureSource": "scripts/check-acp-provider-surface.ts"
 		}
 	]

package/scripts/mutants/copilot-receive.json

@@ -233,6 +233,17 @@
 			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ENVIRON-IS-RED]",
 			"signatureSource": "scripts/check-copilot-receive-arm.ts"
 		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE",
+			"title": "collapsing every OSError on `/proc/<pid>/cmdline` back to None makes a REFUSED identity read indistinguishable from a process that left: the candidate is skipped before identity is decided, all counters stay zero, and the doctor prints the benign `no live GitHub Copilot CLI process` note — claiming ABSENCE while a live CLI it was never allowed to identify may be sitting there inert. The environ claim above cannot cover this one: that branch is reachable only AFTER a successful argv match",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": ["\t\tif exc.errno in (errno.ENOENT, errno.ESRCH):", "\t\t\treturn None", "\t\treturn UNREADABLE"],
+			"replace": ["\t\treturn None"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
 		{
 			"claim": "COPILOT-RECEIVE-DOCTOR-OWNS-SCANNER-FAILURE",
 			"title": "letting the scanner's exit status reach the assignment under `set -e` kills the doctor mid-section: no verdict line is printed at all, so the operator cannot tell a healthy host from a broken doctor — the same silent-death shape this lane already fixed once in the log grep",
@@ -258,6 +269,21 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-PI-CARRIER-IS-RED]",
 			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT",
+			"title": "a stub child with no parent-death watchdog outlives the gate forever — measured on `oracle` as 360 reparented Node receivers, because a red gate exits by THROWING and never reaches any teardown written below it",
+			"subject": "scripts/check-copilot-receive-arm.ts",
+			"find": [
+				"if (parentAtStart === 1) process.exit(0);",
+				"setInterval(() => {",
+				"\tif (process.ppid !== parentAtStart) process.exit(0);"
+			],
+			"replace": ["void parentAtStart;", "setInterval(() => {", "\t/* the vendor bootstrap's parent check, removed */"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
 		}
 	]
 }

package/scripts/mutants/omp-birth.json

@@ -158,13 +158,13 @@
 		},
 		{
 			"claim": "OMP-DOCTOR-CARRIER-TRIMS",
-			"title": "treating an empty or whitespace-only PI carrier as an inherited identity makes Bundle C's deliberate tmux `-e NAME=` scrub fail the deterministic floor whenever a visible fresh omp citizen is alive. Re-anchored when the carrier scan moved from an early-exiting `grep -q` to `grep -c` (the SIGPIPE/pipefail repair); the replanted defect is unchanged — only the line it attaches to moved",
+			"title": "treating an empty or whitespace-only PI carrier as an inherited identity makes Bundle C's deliberate tmux `-e NAME=` scrub fail the deterministic floor whenever a visible fresh omp citizen is alive. Re-anchored twice, and the replanted defect is unchanged both times — only the line it attaches to moved: first when the carrier scan went from an early-exiting `grep -q` to `grep -c` (the SIGPIPE/pipefail repair), then when the scan lost an indentation level because the `[ -d /proc ]` wrapper whose `else` arm was a fail-open `note` was removed (#78 D1)",
 			"subject": "scripts/omp-bridge-doctor.sh",
 			"find": [
-				"    HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)\""
+				"  HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)\""
 			],
 			"replace": [
-				"    HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=' || true)\""
+				"  HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=' || true)\""
 			],
 			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
 			"timeoutSeconds": 300,
@@ -173,14 +173,31 @@
 		},
 		{
 			"claim": "OMP-DOCTOR-CARRIER-NONBLANK-IS-RED",
-			"title": "the doctor stops flagging a live omp process that carries a NONBLANK inherited PI_SESSION_ID/PI_AGENT_ID, so a session whose MCP children would speak under the parent pi garden id reads as clean and the doctor prints PASS. The real defect was subtler than this replant, which is why the replant is written this way: `grep -q` exited at the first match, SIGPIPEd `tr` mid-environ, and pipefail turned a MATCH into a failed pipeline — a race on how far `tr` got, misreading ~15% of runs, so a `-q` replant would SURVIVE most of the time and prove nothing. This one makes the same false-clean deterministic",
+			"title": "the doctor stops flagging a live omp process that carries a NONBLANK inherited PI_SESSION_ID/PI_AGENT_ID, so a session whose MCP children would speak under the parent pi garden id reads as clean and the doctor prints PASS. The real defect was subtler than this replant, which is why the replant is written this way: `grep -q` exited at the first match, SIGPIPEd `tr` mid-environ, and pipefail turned a MATCH into a failed pipeline — a race on how far `tr` got, misreading ~15% of runs, so a `-q` replant would SURVIVE most of the time and prove nothing. This one makes the same false-clean deterministic. Re-anchored at one indentation level less when the `[ -d /proc ]` wrapper was removed (#78 D1)",
 			"subject": "scripts/omp-bridge-doctor.sh",
-			"find": ["    if [ \"${HITS:-0}\" -gt 0 ]; then"],
-			"replace": ["    if [ \"${HITS:-0}\" -gt 99 ]; then"],
+			"find": ["  if [ \"${HITS:-0}\" -gt 0 ]; then"],
+			"replace": ["  if [ \"${HITS:-0}\" -gt 99 ]; then"],
 			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:OMP-DOCTOR-CARRIER-NONBLANK-IS-RED]",
 			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
+		},
+		{
+			"claim": "OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE",
+			"title": "restoring `|| true` on the candidate-discovery `pgrep` folds a FAILED enumeration (exit 2, or a `pgrep` that is not on PATH at all) into `nothing matched` (exit 1): the loop receives an empty candidate set, the doctor prints the clean carrier line and PASSes, and a live omp session carrying a foreign pi garden id reads as CLEAN because the tool that would have found it never ran. The documented `ENTWURF_OMP_CARRIER_PIDS` seam cannot substitute for this — it narrows candidates and short-circuits the very enumeration that failed",
+			"subject": "scripts/omp-bridge-doctor.sh",
+			"find": [
+				"  ENUM_RC=0",
+				"  CARRIER_CANDIDATES=\"$(pgrep -x omp 2>/dev/null)\" || ENUM_RC=$?",
+				"  if [ \"$ENUM_RC\" -gt 1 ]; then",
+				"    ENUM_FAILED=\"$ENUM_RC\"",
+				"  fi"
+			],
+			"replace": ["  CARRIER_CANDIDATES=\"$(pgrep -x omp 2>/dev/null || true)\""],
+			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE]",
+			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
 		}
 	]
 }

package/scripts/mutants/setup-verdict.json

@@ -178,6 +178,19 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:SETUP-OMP-CONFIG-NO-OVERWRITE]",
 			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-DARWIN-RAIL-COSMETIC-PASS",
+			"title": "the platform rail check is dropped, so a harness whose install completes on a platform with no rail receipt reads PASS and the whole setup reads green again — the 0.20.0 hole the installer's retired Darwin refusal used to cover",
+			"subject": "run.sh",
+			"find": [
+				"  if harness_rail_certified_platform; then\n    setup_result \"$1\" PASS \"$2 — verify: $3\"\n    return 0\n  fi"
+			],
+			"replace": ["  setup_result \"$1\" PASS \"$2 — verify: $3\"\n  return 0"],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:SETUP-DARWIN-RAIL-COSMETIC-PASS]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
 		}
 	]
 }

package/scripts/omp-bridge-doctor.sh

@@ -40,6 +40,16 @@ note() { echo "  note  $*"; }
 bad()  { echo "  FAIL  $*"; fail=1; }
 own_bad() { echo "  FAIL  $*"; own_fail=1; }
 
+# 12-hex digest, portable. NOT `sha256sum`: that is coreutils and absent on macOS.
+# NOT `shasum -a 256` either (byte-identical layout though it is) — that would be a
+# second digest convention in this tree, and python3 is already a HARD prerequisite
+# on every path that reaches a digest here: the structural oracle below runs python3
+# before this loop is entered. So the digest reuses the python3 hashlib form
+# omp-receive-doctor.sh:99 and copilot-receive-bridge.sh:174 already ship. Empty on
+# any failure, exactly like the old `2>/dev/null` form — the caller reads an empty
+# digest as STALE, which is the fail-closed side.
+sha12() { python3 -c 'import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest()[:12])' "$1" 2>/dev/null || true; }
+
 # shellcheck source=scripts/omp-bridge-oracle.sh
 . "$HERE/omp-bridge-oracle.sh"
 
@@ -87,8 +97,8 @@ if [ -n "$UNIT_DIR" ]; then
         note "$label source is absent in this checkout ($src) — parity not measurable here"
         continue
       fi
-      INST_SHA="$(sha256sum "$UNIT_DIR/$rel" 2>/dev/null | cut -c1-12)"
-      SRC_SHA="$(sha256sum "$src" 2>/dev/null | cut -c1-12)"
+      INST_SHA="$(sha12 "$UNIT_DIR/$rel")"
+      SRC_SHA="$(sha12 "$src")"
       if [ -n "$INST_SHA" ] && [ "$INST_SHA" = "$SRC_SHA" ]; then
         ok "installed $label matches source ($INST_SHA)"
       else
@@ -180,17 +190,25 @@ fi
 echo
 echo "[what the extension did — ${HOOK_LOG:-<unresolved>}]"
 if [ -n "$HOOK_LOG" ] && [ -f "$HOOK_LOG" ]; then
-  MINT_ERRORS=' ERROR \[omp\] (?!sender-marker-)'
-  LAST_ERROR_LINE="$(grep -nP "$MINT_ERRORS" "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
-  LAST_OK_LINE="$(grep -n ' INFO \[omp\] \(create\|attach\) ' "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
-  TOTAL_ERRORS="$(grep -cP "$MINT_ERRORS" "$HOOK_LOG" 2>/dev/null | head -1)"; TOTAL_ERRORS="${TOTAL_ERRORS:-0}"
+  # PORTABLE SELECTOR, SAME CONTRACT. The separation above is a negative lookahead,
+  # and BSD grep (macOS) has no `-P` at all — so the selector is awk, where two
+  # conditions ARE `(?!…)`. It is also the pipefail-safe form: `grep -c` exits 1 on a
+  # zero-match file, which under this file's `set -o pipefail` (line 26) is exactly
+  # what the old `| head -1` was laundering; awk exits 0 and prints 0.
+  # The success selector moves from GNU BRE `\(a\|b\)` to ERE `(a|b)` for the same
+  # reason: BRE alternation is a GNU extension, so on BSD grep that pattern matches
+  # nothing and a RECOVERED host would be reported as unrecovered — a false RED.
+  MINT_ERRORS='/ ERROR \[omp\] / && !/ ERROR \[omp\] sender-marker-/'
+  LAST_ERROR_LINE="$(awk "$MINT_ERRORS{print NR}" "$HOOK_LOG" 2>/dev/null | tail -1)"
+  LAST_OK_LINE="$(grep -nE ' INFO \[omp\] (create|attach) ' "$HOOK_LOG" 2>/dev/null | tail -1 | cut -d: -f1)"
+  TOTAL_ERRORS="$(awk "$MINT_ERRORS{n++} END{print n+0}" "$HOOK_LOG" 2>/dev/null)"; TOTAL_ERRORS="${TOTAL_ERRORS:-0}"
   if [ -z "$LAST_ERROR_LINE" ]; then
     ok "no omp mint ERROR lines in $HOOK_LOG"
   elif [ -n "$LAST_OK_LINE" ] && [ "$LAST_OK_LINE" -gt "$LAST_ERROR_LINE" ]; then
     note "$TOTAL_ERRORS historical omp mint ERROR line(s), all followed by a successful mint (line $LAST_OK_LINE > $LAST_ERROR_LINE) — recovered, not red"
   else
     bad "the newest omp mint line in $HOOK_LOG is an unrecovered ERROR — the extension RAN and did not mint:"
-    grep -P "$MINT_ERRORS" "$HOOK_LOG" | tail -3 | sed 's/^/        /'
+    awk "$MINT_ERRORS" "$HOOK_LOG" | tail -3 | sed 's/^/        /'
   fi
 
   MARKER_FAILED="$(grep -c ' ERROR \[omp\] sender-marker-failed ' "$HOOK_LOG" 2>/dev/null | head -1)"
@@ -251,42 +269,93 @@ fi
 # than absorbing it into any other verdict.
 echo
 echo "[inherited pi identity carriers on live omp processes]"
-if [ -d /proc ]; then
-  CONTAMINATED=""
-  # Candidate set. Production scans every `omp` pid. `ENTWURF_OMP_CARRIER_PIDS` (set, even
-  # to empty) narrows it so a hermetic smoke can hand this branch REAL processes it launched
-  # and read their real `/proc/<pid>/environ`. It narrows candidates ONLY — the nonblank
-  # predicate below is the same production code either way.
-  if [ -n "${ENTWURF_OMP_CARRIER_PIDS+x}" ]; then
-    CARRIER_CANDIDATES="$ENTWURF_OMP_CARRIER_PIDS"
-  else
-    CARRIER_CANDIDATES="$(pgrep -x omp 2>/dev/null || true)"
+# THE CANDIDATE HALF IS PORTABLE; THE PREDICATE INPUT IS NOT. `pgrep -x omp` is POSIX
+# and answers on every platform; reading another process's environment is what needs
+# `/proc`. Those two facts used to be fused into one `[ -d /proc ]` branch whose else
+# arm was a `note`, and a note lets this doctor end in PASS while the contamination
+# detector is blind — the same fail-OPEN shape copilot-receive-bridge.sh:376-380
+# refuses on Linux ("A note would let the doctor end in PASS while a session that can
+# never arm is running, which is the exact false-success the section was written to
+# break"). The epistemic state is identical, so the verdict is now identical: an axis
+# whose predicate INPUT cannot be obtained is UNVERIFIABLE and non-green, never clean.
+#
+# Candidate set. Production scans every `omp` pid. `ENTWURF_OMP_CARRIER_PIDS` (set, even
+# to empty) narrows it so a hermetic smoke can hand this branch REAL processes it launched
+# and read their real `/proc/<pid>/environ`. It narrows candidates ONLY — the nonblank
+# predicate below is the same production code either way. It is a TEST SEAM, never
+# production proof: the branch below is what a real host runs, so it owes its own honesty.
+ENUM_FAILED=""
+if [ -n "${ENTWURF_OMP_CARRIER_PIDS+x}" ]; then
+  CARRIER_CANDIDATES="$ENTWURF_OMP_CARRIER_PIDS"
+else
+  # `pgrep` HAS THREE ANSWERS AND ONLY TWO OF THEM ARE FACTS ABOUT omp. 0 = it enumerated
+  # and matched. 1 = it enumerated and NOTHING matched — a real, positive absence, which
+  # is evidence. ANYTHING ELSE (2 usage/syntax, 3 fatal, 127 not on PATH) means the
+  # enumeration itself did not happen, so the candidate set is UNKNOWN — not empty.
+  # This used to be `|| true`, which folded that third answer into the second: an empty
+  # candidate set, a loop that never runs, and the clean `ok` below. A live contaminated
+  # omp session then read as CLEAN because the tool that would have found it never ran
+  # (reproduced on an isolated install with a PATH-preceding `pgrep` shim exiting 2:
+  # rc=0, runtime PASS, ownership PASS). Same class as the missing-/proc branches below,
+  # so it gets the same verdict: an axis whose predicate INPUT cannot be obtained is
+  # UNVERIFIABLE and non-green, never clean.
+  ENUM_RC=0
+  CARRIER_CANDIDATES="$(pgrep -x omp 2>/dev/null)" || ENUM_RC=$?
+  if [ "$ENUM_RC" -gt 1 ]; then
+    ENUM_FAILED="$ENUM_RC"
   fi
-  for pid in $CARRIER_CANDIDATES; do
-    case "$pid" in *[!0-9]*) continue ;; esac
-    ENVIRON="/proc/$pid/environ"
-    [ -r "$ENVIRON" ] || continue
-    # `grep -c`, never `grep -q`. This file runs under `set -o pipefail` (line 26), and a
-    # `-q` grep EXITS AT THE FIRST MATCH, closing the pipe while `tr` is still writing the
-    # rest of an ~12KB environ. `tr` dies of SIGPIPE (141), pipefail promotes that to the
-    # pipeline's status, and the `if` takes the CLEAN branch — so a genuinely contaminated
-    # process was reported as clean, and the doctor printed PASS. It is a RACE on how far
-    # `tr` got, which is why it read as flakiness: measured on this host, 6 misses in 40
-    # reads of one live fixture carrying PI_SESSION_ID=foreign-garden. `-c` consumes all of
-    # stdin, so there is no early close and nothing to race. The same lesson is already
-    # written at smoke-omp-mcp-state.sh:91 — it had not reached this reader.
-    HITS="$(tr '\0' '\n' < "$ENVIRON" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)"
-    if [ "${HITS:-0}" -gt 0 ]; then
-      CONTAMINATED="$CONTAMINATED $pid"
-    fi
-  done
-  if [ -n "$CONTAMINATED" ]; then
-    bad "live omp process(es)$CONTAMINATED carry a non-empty PI_SESSION_ID/PI_AGENT_ID inherited from a pi citizen's shell. Their MCP children would speak under the PARENT pi garden id, not their own — close them and relaunch omp from a shell without those variables"
-  else
-    ok "no live omp process carries a non-empty PI_SESSION_ID/PI_AGENT_ID (empty carrier values are the managed tmux scrub and are nonauthoritative; omp mints neither itself — the danger is pure inheritance passthrough, ledger M6)"
+fi
+CONTAMINATED=""
+UNVERIFIABLE=""
+for pid in $CARRIER_CANDIDATES; do
+  case "$pid" in *[!0-9]*) continue ;; esac
+  ENVIRON="/proc/$pid/environ"
+  if [ ! -d "/proc/$pid" ]; then
+    # TWO DIFFERENT FACTS SHARE THIS SHAPE AND ONLY ONE IS EVIDENCE. Where /proc
+    # exists, a missing /proc/<pid> means the process vanished between `pgrep` and
+    # this read — nothing to judge, so it is skipped. Where /proc ITSELF does not
+    # exist (Darwin), the process is still there and it is the INTERFACE that is
+    # missing: the verdict input is gone while the subject is not, which is the
+    # UNVERIFIABLE state and is reported, never skipped.
+    [ -d /proc ] && continue
+    UNVERIFIABLE="$UNVERIFIABLE $pid"
+    continue
   fi
-else
-  note "/proc is unavailable, so live omp environments could not be read on this platform"
+  # STILL THERE, STILL UNREADABLE (hidepid, or an omp owned by another user that
+  # `pgrep` legitimately found) — same missing input, same state. This used to be a
+  # silent `continue`, which reported such a process as clean.
+  if [ ! -r "$ENVIRON" ]; then
+    UNVERIFIABLE="$UNVERIFIABLE $pid"
+    continue
+  fi
+  # `grep -c`, never `grep -q`. This file runs under `set -o pipefail` (line 26), and a
+  # `-q` grep EXITS AT THE FIRST MATCH, closing the pipe while `tr` is still writing the
+  # rest of an ~12KB environ. `tr` dies of SIGPIPE (141), pipefail promotes that to the
+  # pipeline's status, and the `if` takes the CLEAN branch — so a genuinely contaminated
+  # process was reported as clean, and the doctor printed PASS. It is a RACE on how far
+  # `tr` got, which is why it read as flakiness: measured on this host, 6 misses in 40
+  # reads of one live fixture carrying PI_SESSION_ID=foreign-garden. `-c` consumes all of
+  # stdin, so there is no early close and nothing to race. The same lesson is already
+  # written at smoke-omp-mcp-state.sh:91 — it had not reached this reader.
+  HITS="$(tr '\0' '\n' < "$ENVIRON" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)"
+  if [ "${HITS:-0}" -gt 0 ]; then
+    CONTAMINATED="$CONTAMINATED $pid"
+  fi
+done
+# Reported on their own lines, never folded: "contaminated", "cannot be judged" and "the
+# candidate set is unknown" send an operator to three different places, and absence is a
+# fourth answer that is none of them.
+if [ -n "$CONTAMINATED" ]; then
+  bad "live omp process(es)$CONTAMINATED carry a non-empty PI_SESSION_ID/PI_AGENT_ID inherited from a pi citizen's shell. Their MCP children would speak under the PARENT pi garden id, not their own — close them and relaunch omp from a shell without those variables"
+fi
+if [ -n "$UNVERIFIABLE" ]; then
+  bad "UNVERIFIABLE — the environment of live omp process(es)$UNVERIFIABLE could not be read, so their PI_SESSION_ID/PI_AGENT_ID state is UNKNOWN and is NOT assumed clean. On this platform there may be no per-process environment interface at all; \`ps -E\`/\`ps eww\` is deliberately NOT used as a substitute, because on Darwin it succeeds only for unrestricted targets and the measurement that would say which side omp falls on has not been run (scripts/raw-macos-measure/probe.sh cell M6). Otherwise, re-run this doctor as the user that owns those sessions."
+fi
+if [ -n "$ENUM_FAILED" ]; then
+  bad "UNVERIFIABLE — 'pgrep -x omp' FAILED (exit $ENUM_FAILED), so the SET of live omp processes is UNKNOWN and is NOT assumed empty. Nothing was enumerated, so this doctor can neither name a contaminated session nor claim there is none. Repair the process-enumeration tool on PATH (a \`pgrep\` that exits 1 is the honest 'nothing matched' and stays green) and re-run."
+fi
+if [ -z "$CONTAMINATED" ] && [ -z "$UNVERIFIABLE" ] && [ -z "$ENUM_FAILED" ]; then
+  ok "no live omp process carries a non-empty PI_SESSION_ID/PI_AGENT_ID (empty carrier values are the managed tmux scrub and are nonauthoritative; omp mints neither itself — the danger is pure inheritance passthrough, ledger M6)"
 fi
 
 # ── ownership axis ───────────────────────────────────────────────────────────

package/scripts/omp-bridge-install.sh

@@ -21,7 +21,8 @@
 # install shape. The agent dir is resolved by the shared oracle, which REFUSES rather
 # than guesses when an inherited `PI_*` knob makes it ambiguous (ledger M6).
 #
-# Platform: Linux only, same fence as the Claude and Copilot installers.
+# Platform: Linux and Darwin, same fence as the Claude and Copilot installers. Its own
+# platform dependency is python3 (checked below); no /proc, no GNU-only tool.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -45,7 +46,10 @@ for arg in "$@"; do
   esac
 done
 
-[ "$(uname -s)" = "Linux" ] || die "Linux only; $(uname -s) is not a certified axis for this install."
+case "$(uname -s)" in
+  Linux | Darwin) ;;
+  *) die "unsupported platform '$(uname -s)'. This installer requires Linux or Darwin." ;;
+esac
 command -v python3 >/dev/null 2>&1 || die "python3 is required and is not on PATH."
 
 # shellcheck source=scripts/omp-bridge-oracle.sh

package/scripts/omp-receive-install.sh

@@ -24,7 +24,9 @@
 # resolved by the shared oracle, which REFUSES rather than guesses when an inherited
 # `PI_*` knob makes it ambiguous (ledger M6).
 #
-# Platform: Linux only, same fence as the Claude, Copilot and omp-birth installers.
+# Platform: Linux and Darwin, same fence as the Claude, Copilot and omp-birth
+# installers. Its own platform dependency is python3 (checked below); no /proc,
+# no GNU-only tool.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -48,7 +50,10 @@ for arg in "$@"; do
   esac
 done
 
-[ "$(uname -s)" = "Linux" ] || die "Linux only; $(uname -s) is not a certified axis for this install."
+case "$(uname -s)" in
+  Linux | Darwin) ;;
+  *) die "unsupported platform '$(uname -s)'. This installer requires Linux or Darwin." ;;
+esac
 command -v python3 >/dev/null 2>&1 || die "python3 is required and is not on PATH."
 
 # shellcheck source=scripts/omp-bridge-oracle.sh

package/scripts/raw-async-delivery/README.md

@@ -457,7 +457,16 @@ Still true and documented rather than fixed: a hard link produces `CREATE` with
 no `CLOSE_WRITE` and is not reported (nothing writes mailbox messages that way),
 and `IN_IGNORED` for a deleted garden directory is not handled (harmless).
 
-## Codex raw delivery status (0.136.0)
+## Codex raw delivery status (0.136.0 — re-verified at 0.153.4)
+
+> **0.153.4 pointer (2026-09-08, lane #95).** Everything in this section still holds; the two
+> shipped scripts were re-run AS SHIPPED at codex-cli 0.153.4 and went green (`ok: true`,
+> `status_seen: ["active","active","idle"]`, model reply in the visible TUI with zero typing).
+> The current coordinates, the six step-1 vendor measurements, and the source receipts live in
+> [`../raw-codex-measure/README.md`](../raw-codex-measure/README.md) and its `source-audit.md`.
+> One method correction belongs here: at 0.153.4 the rollout JSONL is materialized LAZILY, so
+> the "newest rollout's session_meta id" recipe below can hand you a thread from weeks ago.
+> Ask the app-server instead — `thread/loaded/list` returns the live thread ids.
 
 Measured against `@openai/codex` 0.136.0 (source: `~/repos/3rd/codex`). **Codex IS
 breakable for local raw idle-wake — without managed standalone and without cloud.**