@junghanacs/entwurf 0.19.0 → 0.20.0

package/scripts/raw-codex-measure/source-audit.md

@@ -0,0 +1,243 @@
+Author: claude-opus-5 (entwurf fresh sibling, 2026-09-08) — source-layer receipts for #95 step 1.
+These rows were written by the same reader who took the measurements in `README.md`, so they were
+NOT self-certifying. They have since been independently audited: **terra (openai-codex), against
+commit `87ac7ad`, 2026-09-08 — 20/20 quotations CONFIRMED, 0 CORRECTED, 0 UNVERIFIABLE**, with the
+tag identity re-derived independently (`rust-v0.153.4^{}` =
+`3d2ee51ca2d5db578f328aa75e20aa22c0197c9a`). The three defects that audit raised were prose
+precision in `README.md`, not wrong vendor facts; they are folded in there and marked. Rows added
+to this file BY that amendment are marked `[post-audit]` and carry no second reader.
+
+Vendor: `~/repos/3rd/codex` at tag `rust-v0.153.4` (`3d2ee51`). Paths are relative to
+`codex-rs/`. Code is the oracle.
+
+# Item ledger
+
+## H. Hooks — vocabulary, firing, declaration, execution
+
+### H1. Event set is 12, not 0.136's 9
+`hooks/src/lib.rs:23-36` — `HOOK_EVENT_NAMES: [&str; 12]`.
+`hooks/src/lib.rs:43-52` — `HOOK_EVENT_NAMES_WITH_MATCHERS: [&str; 9]` (matcher-meaningful subset).
+`config/src/hook_config.rs:36-61` — the same 12 as TOML keys, PascalCase via `serde(rename)`.
+Added since the archived 0.136 note: `PermissionRequest`, `SessionEnd`, `Interrupt`.
+
+### H2. SessionStart source is a 4-valued matcher
+`hooks/src/events/session_start.rs:25-38` — `SessionStartSource::{Startup,Resume,Clear,Compact}`
+with `as_str()` → `startup|resume|clear|compact`.
+`hooks/src/events/session_start.rs:69-74` — `matcher_input()` returns that string for
+`SessionStart`, and `agent_type` for `SubagentStart`.
+`core/src/session/session.rs:1600-1606` — the mapping from `InitialHistory`:
+`Resumed→Resume`, `New|Forked→Startup`, `Cleared→Clear`.
+`core/src/session/mod.rs:3812` — compaction queues `Compact`.
+
+### H3. Firing is turn-time, not construction-time — the decisive chain
+1. `core/src/session/session.rs:1623` — construction only calls
+   `state.queue_pending_session_start_source(session_start_source)`.
+2. `core/src/state/session.rs:55` — the queue is a `VecDeque<SessionStartSource>`;
+   `:348-352` push, `:355-358` pop.
+3. `core/src/hook_runtime.rs:124-128` — `run_pending_session_start_hooks` DRAINS that queue
+   (`while let Some(..) = sess.take_pending_session_start_source().await`).
+4. `core/src/session/turn.rs:264` and `:504` — the only two production call sites, both inside
+   turn execution. `grep -rn 'run_pending_session_start_hooks' core/src` returns no other
+   non-test caller.
+Nothing in the construction path invokes the hook engine. `[host]` receipt in README M1.
+
+### H4. Handler kinds and TOML shape
+`config/src/hook_config.rs:12-17` — `HooksFile { description?, hooks: HookEventsToml }`
+(the `hooks.json` shape).
+`config/src/hook_config.rs:19-25` — `HooksToml { #[serde(flatten)] events, state }`
+(the `[hooks]` in-config shape, carrying `[hooks.state]`).
+`config/src/hook_config.rs:27-33` — `HookStateToml { enabled?, trusted_hash? }`.
+`config/src/hook_config.rs:153-159` — `MatcherGroup { matcher?, hooks: Vec<HookHandlerConfig> }`.
+`config/src/hook_config.rs:161-200` — `#[serde(tag="type")] HookHandlerConfig`:
+- `command { command, commandWindows?, timeout?, async, statusMessage?, additionalContextLimit? }`
+- `mcp_tool { server, tool, input, timeout?, statusMessage? }`
+- `prompt {}`, `agent {}`
+The `mcp_tool` kind is executed through `HookMcpExecutor` (`hooks/src/mcp.rs:8-24`), whose
+result text is "interpreted using ordinary command-hook output semantics".
+
+### H5. Command execution is shell-form, with an env REPLAY
+`hooks/src/engine/command_runner.rs:391-411` — `build_command`: when the configured shell
+program is empty, `default_shell_command(environment)`, then the command line as ONE arg.
+`hooks/src/engine/command_runner.rs:428-453` — non-Windows: program from `SHELL` (fallback
+`/bin/sh`), argument `-lc`. A LOGIN shell: the operator's profile runs first.
+`hooks/src/engine/command_runner.rs:419-423` — `command.env_clear()` then
+`command.envs(environment)` then the per-handler `env` then `scrub_non_inheritable_env_vars`.
+"Replay the session snapshot instead of inheriting the live process environment" is the
+in-source comment; the snapshot is the HOST process's, which is what makes M5's mode split
+visible in the hook's own env.
+There is no exec-form (`argv[]`) handler kind anywhere in `HookHandlerConfig`.
+
+### H6. Discovery sources and the trust/managed policy
+`hooks/src/engine/discovery.rs:146-166` — two sources merged per config layer:
+`load_hooks_json(layer.hooks_config_folder())` and the layer's own `hooks` TOML key
+(`:387` reads `layer.config.get("hooks")`).
+`hooks/src/engine/discovery.rs:339-343` — the JSON path is `<config folder>/hooks.json`.
+`config/src/state.rs:239-243` — `hooks_config_folder()` = override else `config_folder()`.
+`hooks/src/engine/discovery.rs:81-88` — `HookDiscoveryPolicy { allow_managed_hooks_only,
+bypass_hook_trust }`; `:105-114` reads `allow_managed_hooks_only` from layer requirements.
+`hooks/src/engine/discovery.rs:767` — the comment binding config-TOML and hooks.json hooks to
+one trust identity.
+`config/src/hook_config.rs:218-250` — `ManagedHooksRequirementsToml { managed_dir,
+windows_managed_dir, #[serde(flatten)] hooks }` + `managed_dir_for_current_platform()`.
+
+`[post-audit]` **The coordinates that actually carry the trust claim** (terra's correction; the
+four lines above are the policy struct and the JSON path, which do not):
+`hooks/src/engine/discovery.rs:794-811` — `hook_trust_status`: `is_builtin → Trusted`,
+`is_managed → Managed`, otherwise compare `trusted_hash` against the current hash
+(`Some(eq) → Trusted`, `Some(_) → Modified`, `None → Untrusted`).
+`hooks/src/engine/discovery.rs:813-815` — `hook_enabled(is_managed, is_builtin, state)` is
+`is_builtin || is_managed || state.enabled != Some(false)`.
+`hooks/src/engine/discovery.rs:817-821` — `hook_trusted_hash` reads state ONLY when `!is_managed`.
+`hooks/src/engine/discovery.rs:676-679` — the per-handler site where those three are combined.
+`hooks/src/engine/discovery.rs:208-240` — `append_managed_requirement_handlers` enters with
+`is_managed: true`.
+`core/src/config/mod.rs:3253-3260` — the CLI bypass path and its operator warning.
+
+`[post-audit]` **Which layers are managed**: `hooks/src/engine/discovery.rs:823-839` —
+`System` (= `/etc/codex/config.toml`, `config/src/loader/mod.rs:66`), `Mdm`,
+`EnterpriseManaged`, and both `LegacyManagedConfigToml*` are `is_managed: true`. `User`,
+`Project`, `PackagedDefaults` and `SessionFlags` are not. `config/src/loader/mod.rs:746-748`
+puts the requirements file at `/etc/codex/requirements.toml`;
+`config/src/loader/layer_io.rs:22` puts managed config at `/etc/codex/managed_config.toml`.
+`config/src/state.rs:43-62` — `LoaderOverrides` can redirect all of those, but it is internal
+(no CLI flag reaches it outside `cli/src/debug_sandbox.rs`).
+**Exercised on 2026-09-08 — see `README.md` §M-A.** A hook in the managed layer ran with no
+trust prompt; `--dangerously-bypass-hook-trust` also ran the hook but killed auto-attach.
+
+### H7. Stop is a turn boundary, not a wake
+`hooks/src/events/stop.rs:97-104` — `StopOutcome { should_stop, stop_reason, should_block,
+block_reason, continuation_fragments }`.
+`hooks/src/schema.rs:455-464` — `StopCommandOutputWire { universal, decision?, reason? }`
+with the in-source note that Claude requires `reason` when `decision == block`.
+Same class as Copilot's `agentStop`; `docs/adding-a-harness.md` step 7(c) forbids using it as
+an idle-wake substitute.
+
+### H8. No filesystem-wake vocabulary
+`grep -rn 'watchPaths|FileChanged|asyncRewake' --include=*.rs codex-rs/` returns exactly one
+hit: `external-agent-migration/src/hooks_cla.rs:158-161`, inside a CLAUDE-HOOKS IMPORTER, in a
+`continue` branch that SKIPS any imported hook object carrying `asyncRewake`, `shell` or
+`once`. Codex reads Claude's doorbell vocabulary only to refuse it.
+
+## E. Environment
+
+### E1. Codex's non-inheritable set is five names, none of them ours
+`protocol/src/shell_environment.rs:14-21` — `NON_INHERITABLE_ENV_VARS` =
+`CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN`, `NODE_REPL_AUTH_TOKEN`, `OPENAI_FEDERATION_RULE_ID`,
+`OPENAI_IDENTITY_TOKEN_FILE`, `OPENAI_WORKLOAD_IDENTITY_CONTEXT`.
+`:33-50` — `scrub_non_inheritable_env_vars` removes those and only those.
+
+### E2. Default shell-env policy inherits everything
+`protocol/src/config_types.rs:213-214` — `ShellEnvironmentPolicyInherit::All` is `#[default]`.
+`protocol/src/config_types.rs:264-265` — the `Default` impl sets
+`inherit: All, ignore_default_excludes: true`, so the `*KEY*`/`*SECRET*`/`*TOKEN*` filters at
+`protocol/src/shell_environment.rs:124-131` are OFF by default.
+Consequence: `PI_SESSION_ID` / `PI_AGENT_ID` pass through untouched. `[host]` confirmed in
+README M5 (embedded mode).
+
+### E3. CODEX_THREAD_ID is a shell-tool carrier, not a hook carrier
+`protocol/src/shell_environment.rs:7` — the constant.
+`protocol/src/shell_environment.rs:149-152` — inserted by `populate_env` only when a
+`thread_id` argument is supplied, i.e. on the shell-environment construction path.
+`[host]` a hook's `env | grep ^CODEX_` showed `CODEX_HOME`, `CODEX_MANAGED_BY_PNPM`,
+`CODEX_MANAGED_PACKAGE_ROOT` and nothing else.
+
+### E4. No entwurf/pi name collision
+`grep -rn '"PI_SESSION_ID"|"PI_AGENT_ID"|PI_CODING_AGENT_DIR|ENTWURF' --include=*.rs codex-rs/`
+→ 0 hits. Codex has no pi lineage, so #87's fork-collision class (step 1(6)) is inapplicable.
+
+## T. MCP tool-name dialect
+
+### T1. Prefix + delimiter constants
+`core/src/tools/handlers/mcp.rs:46` — `LEGACY_MCP_TOOL_NAME_PREFIX = "mcp__"`.
+`core/src/tools/handlers/mcp.rs:47` and `codex-mcp/src/tools.rs:225` — `MCP_TOOL_NAME_DELIMITER
+= "__"`. (`codex-mcp/src/tools.rs:22` carries the prefix constant for the same crate.)
+
+### T2. Namespace is the server name, prefixed unless a feature disables it
+`codex-mcp/src/rmcp_client.rs:821` — `callable_namespace: server_name.to_string()`.
+`codex-mcp/src/tools.rs:139-142` — `callable_namespace_with_prefix(sanitize(...), prefix &&
+!non_prefixed_servers.contains(server))`.
+`codex-mcp/src/tools.rs:228-234` — the prefixing function itself.
+`core/src/config/mod.rs:1793-1796` — `prefix_mcp_tool_names()` is
+`!features.enabled(NonPrefixedMcpToolNames) || non_prefixed_mcp_tool_servers.is_some()`.
+So prefixing is the DEFAULT and a feature flag is required to lose it.
+
+### T3. The sanitizer keeps digits and case
+`codex-mcp/src/mcp/mod.rs:544-559` — every char not in `[A-Za-z0-9_]` becomes `_`; empty →
+`"_"`. Contrast omp, whose `[a-z_]` charset deletes the `2` in `entwurf_v2`.
+Derivation for this repo's server: `entwurf-bridge` → `entwurf_bridge`, `entwurf_v2` → itself,
+giving `mcp__entwurf_bridge__entwurf_v2`. `[host]` the live tool list in README M7 matches this
+derivation on all seven bridge tools.
+
+### T4. Collision hardening exists and can mutate a name
+`codex-mcp/src/tools.rs:152-193` — a namespace or tool name shared by two distinct raw
+identities gets a 12-hex sha1 suffix (`callable_name_hash_suffix`, `:241-245`).
+`codex-mcp/src/tools.rs:226` — `MAX_TOOL_NAME_LENGTH = 128`, with truncation-plus-hash at
+`:263-285`. So the derived spelling is stable only while no second server collides on
+`entwurf_bridge`. Not exercised.
+
+### T5. Hook-facing tool names differ from model-facing ones
+`core/src/tools/handlers/mcp.rs:95-97` — `hook_tool_name()` = `ensure_mcp_prefix(join_tool_name(
+canonical))`, i.e. what `PreToolUse`/`PostToolUse` matchers compare against.
+`core/src/tools/handlers/mcp.rs:100-109` — `join_tool_name` trims a trailing `_` from the
+namespace and a leading `_` from the name before joining.
+The Copilot lesson generalises: measure the string each argv/config position actually wants.
+
+## S. §3.5 scope, statusline, app-server
+
+### S1. Subagents raise a different event
+`core/src/hook_runtime.rs:129-147` — the target selection. A `SubAgentSource::ThreadSpawn` with
+source `Startup` becomes `StartHookTarget::SubagentStart{turn_id, agent_id, agent_type}`; any
+other `SessionSource::SubAgent(_)` returns `false` WITHOUT dispatching (`:146`); everything else
+is `StartHookTarget::SessionStart`.
+`hooks/src/events/session_start.rs:52-74` — `event_name()` maps those to
+`HookEventName::SubagentStart` / `::SessionStart`.
+`hooks/src/events/session_start.rs:156-167` — the `SubagentStartCommandInput` carries
+`session_id` (parent), `turn_id`, `agent_id`, `agent_type`.
+`hooks/src/events/session_start.rs:271-274` — `continue:false` is honoured for `SessionStart`
+ONLY; `SubagentStart` is context-injection-only.
+`core/src/tools/handlers/multi_agents_spec.rs:85`, `:124` — the model-facing spawner is
+`spawn_agent` (siblings: `send_input`, `wait_agent`, `list_agents`, `close_agent`, …).
+`[host]` one `spawn_agent` call produced exactly one `SubagentStart` and zero additional
+`SessionStart` (README M8).
+
+### S2. Statusline is a closed enum with no command segment
+`tui/src/bottom_pane/status_line_setup.rs:56-155` — `StatusLineItem`, ~28 variants, all
+built-in facts. Nothing accepts operator text or a command.
+`tui/src/chatwidget.rs:502` — `DEFAULT_STATUS_LINE_ITEMS = ["model-with-reasoning","current-dir"]`.
+`tui/src/slash_command.rs:59`, `:118` — `/statusline` "configure which items appear in the
+status line".
+`tui/src/bottom_pane/status_line_setup.rs:137-139` — `SessionId` with
+`strum(to_string="thread-id", serialize="session-id")`.
+`tui/src/chatwidget/status_surfaces.rs:776-784` — `ThreadTitle` renders `thread_name`, else the
+thread id.
+`app-server-protocol/src/protocol/common.rs:566` — `ThreadSetName => "thread/name/set"`;
+params `{thread_id, name}` (`app-server-protocol/src/protocol/v2/thread.rs:753-756`, camelCase
+on the wire).
+`[post-audit]` **The auto-titler is guarded on the thread being unnamed**:
+`tui/src/app/thread_routing.rs:1841` — `let automatic_title_user_message = if
+self.chat_widget.thread_name().is_none() && …`. Only inside that branch does the TUI call
+`thread_set_name` with a provisional title (`:1877-1888`) and then generate a model title
+(`tui/src/app/event_dispatch.rs:2579-2592`, which additionally re-checks the current name).
+`app-server/src/request_processors/thread_processor.rs:639-658` — the explicit setter carries
+no such guard.
+**Exercised on 2026-09-08 — see `README.md` §M-B.** An explicitly set name survives turns in
+both orderings.
+
+### S3. App-server method surface at 0.153.4
+`app-server-protocol/src/protocol/` — the measured route survives: `turn/start`, `turn/steer`,
+`turn/interrupt`, `thread/inject_items`, `thread/status/changed`, `thread/resume`,
+`thread/loaded/list`, `thread/list`.
+New family since the archived 0.136 note: `thread/queue/{add,start,list,update,reorder,delete,
+changed}`. Not exercised; a candidate to compare against `turn/start` in a later step, not a
+claim about it now.
+
+# Open at the source layer
+
+- Rows added under `[post-audit]` have no second reader yet.
+- T4: name-collision hardening read, never triggered.
+- S3: the queue family read, never called.
+- Gotcha 2 of the archived probe (`-c` disables auto-attach) is now half-measured:
+  `tui/src/lib.rs:919-930` — `can_reuse_implicit_local_daemon` requires empty
+  `cli_kv_overrides`, default loader overrides, `!strict_config` and no non-replayable launch
+  overrides. `[host]` `--dangerously-bypass-hook-trust` was measured to defeat it (README
+  §M-A2); plain `-c` was not separately re-run at 0.153.4.

package/scripts/raw-macos-measure/README.md

@@ -0,0 +1,148 @@
+# raw-macos-measure — Darwin host measurement for the macOS parity lane (#78)
+
+Lane: `#78` macOS row, opened by the first green `macos-install-surface` CI run
+([`34303884286`](https://github.com/junghan0611/entwurf/actions/runs/34303884286) @ `70eda03`,
+2026-09-09, `macos-latest`). That run certifies the **Entwurf-only install path** and nothing
+else — it is CERTIFIED (CI), which in this repo is deliberately weaker than a physical-host
+doctor green. This ledger is where the *rest* of the axis gets measured before any code claims it.
+
+This file is a MEASUREMENT-ONLY ledger, on the `raw-codex-measure` precedent. Nothing here is
+written by an entwurf installer, no meta-record is minted, and no operator config is edited.
+
+**Evidence-state vocabulary:** **[host-linux]** = measured on the Linux oracle (control run —
+tells us what the probe reports where we already know the answer); **[host-darwin]** = measured on
+the borrowed Mac; **[source]** = read at `file:line`; **[hypothesis]** = inference not yet
+confirmed by a run.
+
+## Why a probe script and not a prose ledger
+
+The other `raw-*-measure` lanes were written on the host that owns the vendor. This one is not:
+the Darwin host is **borrowed**, so its measurement window is short and probably single-shot. The
+executable half (`probe.sh`) exists so that window costs one command instead of a live debugging
+session, and so a mistake in the probe is found on Linux rather than on the Mac.
+
+```sh
+./scripts/raw-macos-measure/probe.sh          # ~1.2s, writes nothing outside its own mktemp dir
+```
+
+It is `/bin/sh`, not bash, deliberately: macOS ships bash 3.2 and *what a shell may assume here*
+is itself one of the measurements (cell M2). Every cell prints a verdict token — `PRESENT` /
+`ABSENT` / `OK` / `FAIL` / `DIFFERS` / `UNKNOWN` — so no reader has to interpret raw tool output.
+
+## Cells
+
+| Cell | Question it answers | Consumer of the answer |
+|---|---|---|
+| **M1** | Which Darwin, which arch, which machine | BASELINE host record |
+| **M2** | bash version at `/bin/bash` and via `env bash`; are bash-4 features (`declare -A`, `mapfile`) available | the two gates that use bash 4 (`check-install-container.sh`, `check-meta-doctor-oracle.sh`) |
+| **M3** | node / npm / pnpm / python3 / git / tmux presence and versions, **and whether `python3` is the CommandLineTools stub** | `docs/setup-clean-host.md` requirements table; a stub python3 is a total failure of the install+doctor surface, not a degraded cell |
+| **M4** | GNU-vs-BSD tool matrix, measured **behaviourally** (presence is not compatibility) | the P1 substitution surface — `sha256sum` (10 files), `stat -c` (19), `xargs -0` (13), `sort -z` (12), `realpath` (11), `readlink -f` (5), `grep -P` (2), `date -d` (2), `timeout(1)` (5 files) |
+| **M5** | **The identity rail.** Which start-key source exists, at what resolution, and whether a sub-second one is reachable | `processStartKey()` `pi-extensions/lib/meta-session.ts:1554` — the defense that stops a stale marker granting the wrong garden identity |
+| **M6** | Can a reader see another process's argv/environment — measured as a **contrast**, not a single reading | the bridge/receiver discovery paths that read `/proc/<pid>/{environ,cmdline}` (`scripts/omp-bridge-doctor.sh:258-267`, `scripts/copilot-receive-bridge.sh:264-289`) |
+| **M7** | How reachable is a same-second pid reuse (`kern.maxproc`, PID_MAX) | the severity grade of the M5 finding |
+| **M8** | Case-sensitivity, HOME/XDG shape, symlink support, `~/.local/bin` on PATH | installers and the `~/.local/bin/entwurf` symlink ownership |
+| **M9** | Does a **rename-over** raise an `fs.watch` event on the watched path | the mailbox doorbell — the receiver arms a watch, the sender delivers by staging then renaming into place |
+
+### Why M6 is a contrast and not a reading
+
+A first draft of this probe asked `ps -E` about a `/bin/sleep` child. That would have produced a
+**false negative on Darwin**: Apple-signed, SIP-protected binaries refuse environment reads *by
+construction*, so `REJECTED` there says nothing about our actual case — an unrestricted
+Homebrew/nvm `node` (the entwurf MCP child) and the Copilot CLI. The probe therefore starts a
+`node` child carrying `ENTWURF_PROBE_MARKER=hello-entwurf` and asks whether that exact string is
+visible, **and** keeps the `/bin/sleep` control beside it. `VISIBLE` on the node row next to
+`REJECTED` on the sleep row is the evidence; either row alone is not.
+
+`[measured by the audit lane, 2026-09-09]` The Darwin conditions under which `ps -E` can read a
+foreign environment are: same process, SIP disabled, a development kernel, target not restricted,
+or a dedicated entitlement. Only "target not restricted" is satisfiable on a normal host, which is
+exactly why the target choice decides the answer.
+
+## M5 — the finding that already exists, measured on Linux
+
+The identity core is dual-scheme **[source, `meta-session.ts:1554-1576`]**: `/proc/<pid>/stat`
+field 22 → `linux:<ticks>`, else `ps -o lstart=` → `ps:<lstart>`, else `""` (fail-closed).
+`startKeyScheme()` **[source, `:1630-1633`]** accepts both. **Darwin has no `/proc`, so it always
+takes the `ps:` branch.**
+
+**[host-linux, oracle, 2026-09-09 12:32]** The two schemes do not have the same resolution, and
+the gap is measurable without a Mac:
+
+```
+  /proc present?    YES
+  ps -o lstart= self: Wed Sep  9 12:32:26 2026        <- 1-second granular
+  linux ticks       65958142                          <- 10ms granular (100 ticks/s)
+  child A (556824): Wed Sep  9 12:32:27 2026
+  child B (556825): Wed Sep  9 12:32:27 2026
+  RESOLUTION        1-SECOND (two back-to-back starts share one key string)
+  widened key A     Wed Sep  9 12:32:27 2026 sleep 4
+  widened key B     Wed Sep  9 12:32:27 2026 sleep 4
+  WIDENING          INSUFFICIENT ALONE (identical argv collides even widened)
+```
+
+Two consequences, stated at the size of the evidence:
+
+1. **The `ps:` scheme's pid-reuse window is 1 second, not 10ms.** The key is compared per-pid, so
+   two *different* pids sharing an `lstart` string is harmless. The reachable failure is the
+   specific sequence the source comment names **[source, `:1538-1544`]**: a process exits, its pid
+   is reused **within the same second**, and the new process's `lstart` matches the recorded key —
+   so a stale marker validates against the wrong process and grants it the wrong garden identity.
+2. **Widening the key with argv does not close it.** Both children ran identical argv on purpose,
+   because that is the worst case and the worst case is what a fail-closed rail must survive — and
+   a harness restarting under the same command line is the *normal* shape, not an exotic one.
+
+Whether that window is reachable in practice is an M7 question (pid space vs spawn rate), and the
+grade of the finding — blocker or observation — follows from it. `probe.sh` also tests whether a
+microsecond source is reachable on Darwin (`libproc` `proc_pidinfo(PROC_PIDTBSDINFO)` →
+`pbi_start_tvsec`/`pbi_start_tvusec` through python3 ctypes); on Linux that cell degrades with a
+named reason rather than a silent skip:
+
+```
+  libproc            UNAVAILABLE (/usr/lib/libproc.dylib: cannot open shared object file: ...)
+```
+
+## If the Mac is single-shot: what this one command already buys
+
+The portability audit (`.agent-reports/macos-portability-audit-20260909.md` §8) enumerates a
+nine-item acceptance checklist. **Items 1–6 need no entwurf install and no fence change**, so they
+can all be taken on first contact — and running `probe.sh` once covers every one of them:
+
+| Checklist item | Closes | Covered by |
+|---|---|---|
+| 1 · run the probe | the host facts | the whole run |
+| 2 · `ps -Eww` on a marker-carrying `node` child | **P2-2 · P2-3 · P2-4** | **M6**, with the SIP-protected `/bin/sleep` control beside it |
+| 3 · `ps -o lstart=` and the two-child cell | **P2-5 · P0-8** | **M5** |
+| 4 · `proc_pidinfo` microsecond cell | **P2-5 Plan B** | **M5** |
+| 5 · expected-failure battery (`readlink -f`, `shasum`, `grep -P`, `timeout`) | **P1-1 · P1-3 · P1-4** | **M4** |
+| 6 · `python3 -V` without the CommandLineTools dialog | **P3-3** | **M3** |
+| 7–9 · installs, `doctor-meta-bridge`, receive round trip | **P3-1 · P3-2 · P2-1 · P3-4 · P3-5** | NOT the probe — needs the 0.20.0 code landed and a real logged-in harness |
+
+So the ordering for a scarce window is: **run the probe, keep the output, leave.** Items 7–9 can
+be attempted with whatever time is left, but items 1–6 are the ones that convert open design
+questions into facts, and none of them can be answered from Linux.
+
+A cell that comes back the *opposite* of what we expect is worth as much as one that confirms —
+item 5 in particular is a battery of EXPECTED FAILURES, and a surprise success there changes a
+substitution's justification rather than validating it.
+
+## Control run — Linux oracle
+
+**[host-linux, oracle, 2026-09-09]** The probe was run on Linux before being handed to a Darwin
+host, to prove the probe itself is not the thing under test. Selected verdicts: `stat -c %s` OK ·
+`readlink -f` OK · all three sha256 producers agree on the known digest of `abc` · `sort -z` /
+`xargs -0` / `xargs -0r` / `grep -P` / `date -d` all OK · `ps -E` **REJECTED** even on Linux (so
+the environment-visibility question in M6 is not Darwin-specific) · case-sensitive volume · total
+runtime 1.2s.
+
+That control matters for one reason: every `OK` above is a **GNU** answer. The same probe on
+Darwin is expected to turn several of them into `FAIL`, and the list of which ones is exactly the
+P1 substitution work.
+
+## Darwin cells — NOT YET MEASURED
+
+Nothing below the line has been run on a Mac. GLG is borrowing a company host; when it lands, run
+`probe.sh` once and paste the whole output here under a `[host-darwin]` heading with the date,
+the Darwin version, and who ran it.
+
+Do not fill these in from documentation, from a CI runner image spec, or from another project's
+notes. This lane exists because `#78` says *claim only what physical evidence proves*.