@junghanacs/entwurf 0.19.0 → 0.20.0

package/scripts/raw-macos-measure/probe.sh

@@ -0,0 +1,389 @@
+#!/bin/sh
+# raw-macos-measure/probe.sh — Darwin host measurement for the macOS parity lane (#78).
+#
+# MEASUREMENT ONLY. This script writes nothing outside its own temp dir, installs
+# nothing, needs no entwurf installation, and touches no operator config. It is
+# meant to be run ONCE on a borrowed Mac and its whole stdout pasted into
+# scripts/raw-macos-measure/README.md.
+#
+# It is /bin/sh (not bash) on purpose: macOS ships bash 3.2 and one of the things
+# under measurement is what a shell can assume here at all.
+#
+#   ./probe.sh            # human-readable ledger on stdout
+#
+# Every cell prints its own verdict token so a reader never has to interpret raw
+# tool output: PRESENT / ABSENT / OK / DIFFERS / FAIL / UNKNOWN.
+
+set -u
+
+TMP=$(mktemp -d "${TMPDIR:-/tmp}/entwurf-macos-probe.XXXXXX") || exit 1
+trap 'rm -rf "$TMP"' EXIT INT TERM
+
+hdr() {
+	printf '\n== %s ==\n' "$1"
+}
+
+# `have <cmd>` -> PRESENT/ABSENT plus the resolved path.
+have() {
+	if p=$(command -v "$1" 2>/dev/null); then
+		printf '  %-18s PRESENT  %s\n' "$1" "$p"
+		return 0
+	fi
+	printf '  %-18s ABSENT\n' "$1"
+	return 1
+}
+
+printf 'entwurf raw-macos-measure probe\n'
+printf 'run at: %s\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ') UTC"
+
+hdr 'M1. host identity'
+if command -v sw_vers >/dev/null 2>&1; then
+	sw_vers | sed 's/^/  /'
+else
+	printf '  sw_vers ABSENT — this is not a Darwin host; the ledger cell is void.\n'
+fi
+printf '  uname -srm: %s\n' "$(uname -srm)"
+printf '  hw.model:   %s\n' "$(sysctl -n hw.model 2>/dev/null || echo UNKNOWN)"
+printf '  cpu:        %s\n' "$(sysctl -n machdep.cpu.brand_string 2>/dev/null || echo UNKNOWN)"
+
+hdr 'M2. shell — what a script may assume'
+printf '  /bin/sh   -> %s\n' "$(/bin/sh -c 'echo ${BASH_VERSION:-not-bash}' 2>/dev/null)"
+printf '  /bin/bash -> %s\n' "$(/bin/bash -c 'echo ${BASH_VERSION:-unknown}' 2>/dev/null || echo ABSENT)"
+printf '  env bash  -> %s (%s)\n' \
+	"$(env bash -c 'echo ${BASH_VERSION:-unknown}' 2>/dev/null || echo ABSENT)" \
+	"$(command -v bash 2>/dev/null || echo no-bash-on-PATH)"
+# bash 4 features the repo's gates use: `declare -A`, `mapfile`.
+if env bash -c 'declare -A _x' >/dev/null 2>&1; then
+	printf '  declare -A (bash4)  OK\n'
+else
+	printf '  declare -A (bash4)  FAIL — associative arrays unavailable to `env bash`\n'
+fi
+if env bash -c 'mapfile -t _y < /dev/null' >/dev/null 2>&1; then
+	printf '  mapfile   (bash4)   OK\n'
+else
+	printf '  mapfile   (bash4)   FAIL\n'
+fi
+
+hdr 'M3. runtime prerequisites'
+have node && printf '  %-18s %s\n' 'node --version' "$(node --version 2>/dev/null)"
+have npm && printf '  %-18s %s\n' 'npm --version' "$(npm --version 2>/dev/null)"
+have pnpm && printf '  %-18s %s\n' 'pnpm --version' "$(pnpm --version 2>/dev/null)"
+# python3 on macOS may be the CommandLineTools STUB at /usr/bin/python3, which
+# prints nothing useful and pops a GUI installer instead. The shipped operator
+# surface calls python3 in hundreds of places, so a stub is a total install
+# failure, not a degraded cell.
+if have python3; then
+	printf '  %-18s %s\n' 'python3 -V' "$(python3 -V 2>&1)"
+	if python3 -c 'print("live")' 2>/dev/null | grep -q live; then
+		printf '  %-18s REAL (executes code, no install prompt)\n' 'python3 kind'
+	else
+		printf '  %-18s STUB/BROKEN — the whole install+doctor surface dies here\n' 'python3 kind'
+	fi
+fi
+have git
+have tmux && printf '  %-18s %s\n' 'tmux -V' "$(tmux -V 2>/dev/null)"
+
+hdr 'M4. GNU-vs-BSD tool matrix (the P1 substitution surface)'
+have sha256sum || true
+have shasum || true
+have openssl || true
+have realpath || true
+have timeout || true
+have gtimeout || true
+have gsed || true
+have gstat || true
+printf '\n  -- behavioural probes (presence is not compatibility) --\n'
+printf 'abc' >"$TMP/f"
+# stat: GNU `-c %s` vs BSD `-f %z`
+if stat -c %s "$TMP/f" >/dev/null 2>&1; then
+	printf '  stat -c %%s        OK (GNU form works)\n'
+else
+	printf '  stat -c %%s        FAIL (GNU form rejected) — BSD `stat -f %%z` = %s\n' \
+		"$(stat -f %z "$TMP/f" 2>/dev/null || echo FAIL)"
+fi
+# readlink -f
+ln -s "$TMP/f" "$TMP/link"
+if readlink -f "$TMP/link" >/dev/null 2>&1; then
+	printf '  readlink -f       OK\n'
+else
+	printf '  readlink -f       FAIL (no GNU -f)\n'
+fi
+# stat: both fields the repo reads (size AND mtime), because a working `-f %z`
+# does not promise `-f %m`.
+printf '  stat -f %%z (size)  %s\n' "$(stat -f %z "$TMP/f" 2>/dev/null || echo FAIL)"
+printf '  stat -f %%m (mtime) %s\n' "$(stat -f %m "$TMP/f" 2>/dev/null || echo FAIL)"
+printf '  stat -c %%Y (mtime) %s\n' "$(stat -c %Y "$TMP/f" 2>/dev/null || echo FAIL)"
+# sha256: which producer, and does the digest text match across producers?
+S_SUM=$(sha256sum "$TMP/f" 2>/dev/null | awk '{print $1}')
+S_SHA=$(shasum -a 256 "$TMP/f" 2>/dev/null | awk '{print $1}')
+S_SSL=$(openssl dgst -sha256 "$TMP/f" 2>/dev/null | awk '{print $NF}')
+printf '  sha256sum         %s\n' "${S_SUM:-ABSENT}"
+printf '  shasum -a 256     %s\n' "${S_SHA:-ABSENT}"
+printf '  openssl dgst      %s\n' "${S_SSL:-ABSENT}"
+for v in "$S_SUM" "$S_SHA" "$S_SSL"; do
+	[ -n "$v" ] && [ "$v" != "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad" ] &&
+		printf '  DIGEST MISMATCH   a producer disagrees with the known sha256 of "abc"\n'
+done
+# NUL-delimited pipelines
+if printf 'a\0b\0' | sort -z >/dev/null 2>&1; then
+	printf '  sort -z           OK\n'
+else
+	printf '  sort -z           FAIL (no BSD equivalent flag)\n'
+fi
+if printf 'a\0' | xargs -0 true >/dev/null 2>&1; then
+	printf '  xargs -0          OK\n'
+else
+	printf '  xargs -0          FAIL\n'
+fi
+if printf 'a\0' | xargs -0r true >/dev/null 2>&1; then
+	printf '  xargs -0r         OK\n'
+else
+	printf '  xargs -0r         FAIL (GNU-only -r; BSD xargs already skips empty input)\n'
+fi
+# grep -P
+if printf 'a\n' | grep -P 'a' >/dev/null 2>&1; then
+	printf '  grep -P           OK\n'
+else
+	printf '  grep -P           FAIL (no PCRE); grep -E = %s\n' \
+		"$(printf 'a\n' | grep -E 'a' >/dev/null 2>&1 && echo OK || echo FAIL)"
+fi
+# date -d
+if date -d '@0' >/dev/null 2>&1; then
+	printf '  date -d           OK\n'
+else
+	printf '  date -d           FAIL (BSD date uses -r/-j -f)\n'
+fi
+# mktemp with a template (both accept it, but confirm)
+printf '  mktemp -d         %s\n' "$(mktemp -d "${TMPDIR:-/tmp}/probe.XXXXXX" >/dev/null 2>&1 && echo OK || echo FAIL)"
+
+hdr 'M5. start-key sources — the identity rail (meta-session.ts:1554)'
+printf '  /proc present?    %s\n' "$([ -d /proc ] && echo YES || echo NO)"
+SELF=$$
+printf '  ps -o lstart= self: %s\n' "$(ps -o lstart= -p "$SELF" 2>/dev/null | sed 's/^ *//;s/ *$//')"
+printf '  ps -o command= self: %s\n' "$(ps -o command= -p "$SELF" 2>/dev/null | sed 's/^ *//' | cut -c1-100)"
+# RESOLUTION TEST: two children started back to back. If their lstart strings are
+# equal, the `ps:` scheme's pid-reuse defense is 1-second granular.
+sleep 4 &
+C1=$!
+sleep 4 &
+C2=$!
+L1=$(ps -o lstart= -p "$C1" 2>/dev/null | sed 's/^ *//;s/ *$//')
+L2=$(ps -o lstart= -p "$C2" 2>/dev/null | sed 's/^ *//;s/ *$//')
+printf '  child A (%s): %s\n' "$C1" "$L1"
+printf '  child B (%s): %s\n' "$C2" "$L2"
+if [ "$L1" = "$L2" ]; then
+	printf '  RESOLUTION        1-SECOND (two back-to-back starts share one key string)\n'
+else
+	printf '  RESOLUTION        SUB-SECOND (back-to-back starts differ) — re-run to confirm\n'
+fi
+# WIDENING candidate: would including argv in the key have separated them? Both
+# children run the SAME argv on purpose — that is the WORST case for widening, and
+# the worst case is the one a fail-closed identity rail has to survive.
+W1=$(ps -o lstart=,command= -p "$C1" 2>/dev/null | sed 's/^ *//;s/ *$//')
+W2=$(ps -o lstart=,command= -p "$C2" 2>/dev/null | sed 's/^ *//;s/ *$//')
+printf '  widened key A     %s\n' "$W1"
+printf '  widened key B     %s\n' "$W2"
+if [ "$W1" = "$W2" ]; then
+	printf '  WIDENING          INSUFFICIENT ALONE (identical argv collides even widened)\n'
+else
+	printf '  WIDENING          SEPARATES (argv distinguished two same-second starts)\n'
+fi
+kill "$C1" "$C2" 2>/dev/null
+wait "$C1" 2>/dev/null
+wait "$C2" 2>/dev/null
+# MICROSECOND candidate: libproc proc_pidinfo(PROC_PIDTBSDINFO) via python3 ctypes.
+if command -v python3 >/dev/null 2>&1; then
+	python3 - "$SELF" <<'PY' 2>&1 | sed 's/^/  /'
+import ctypes, ctypes.util, sys
+pid = int(sys.argv[1])
+lib = ctypes.util.find_library("proc") or "/usr/lib/libproc.dylib"
+try:
+    libproc = ctypes.CDLL(lib)
+except OSError as e:
+    print(f"libproc            UNAVAILABLE ({e})")
+    raise SystemExit(0)
+
+PROC_PIDTBSDINFO = 3
+class ProcBsdInfo(ctypes.Structure):
+    _fields_ = [
+        ("pbi_flags", ctypes.c_uint32), ("pbi_status", ctypes.c_uint32),
+        ("pbi_xstatus", ctypes.c_uint32), ("pbi_pid", ctypes.c_uint32),
+        ("pbi_ppid", ctypes.c_uint32), ("pbi_uid", ctypes.c_uint32),
+        ("pbi_gid", ctypes.c_uint32), ("pbi_ruid", ctypes.c_uint32),
+        ("pbi_rgid", ctypes.c_uint32), ("pbi_svuid", ctypes.c_uint32),
+        ("pbi_svgid", ctypes.c_uint32), ("rfu_1", ctypes.c_uint32),
+        ("pbi_comm", ctypes.c_char * 16), ("pbi_name", ctypes.c_char * 32),
+        ("pbi_nfiles", ctypes.c_uint32), ("pbi_pgid", ctypes.c_uint32),
+        ("pbi_pjobc", ctypes.c_uint32), ("e_tdev", ctypes.c_uint32),
+        ("e_tpgid", ctypes.c_uint32), ("pbi_nice", ctypes.c_int32),
+        ("pbi_start_tvsec", ctypes.c_uint64), ("pbi_start_tvusec", ctypes.c_uint64),
+    ]
+
+info = ProcBsdInfo()
+n = libproc.proc_pidinfo(pid, PROC_PIDTBSDINFO, ctypes.c_uint64(0),
+                         ctypes.byref(info), ctypes.sizeof(info))
+if n != ctypes.sizeof(info):
+    print(f"proc_pidinfo       FAIL (returned {n}, expected {ctypes.sizeof(info)})")
+else:
+    print(f"proc_pidinfo       OK  pid={info.pbi_pid} "
+          f"start={info.pbi_start_tvsec}.{info.pbi_start_tvusec:06d} "
+          f"comm={info.pbi_comm.decode(errors='replace')}")
+    print("RESOLUTION         MICROSECOND (a sub-second start key IS reachable here)")
+PY
+else
+	printf '  proc_pidinfo      SKIPPED (no python3)\n'
+fi
+
+hdr 'M6. process discovery — can a reader see another process at all?'
+# The bridge/receiver doctors narrow candidates through /proc/<pid>/{environ,cmdline}
+# (scripts/omp-bridge-doctor.sh:258-267, scripts/copilot-receive-bridge.sh:264-289).
+# Darwin has neither, so `ps -E` is the only candidate — and WHICH PROCESS IS ASKED
+# decides the answer. Apple-signed, SIP-protected binaries refuse environ reads by
+# construction, so probing `/bin/sleep` would report a false REJECTED.
+#
+# SCOPE, STATED EXACTLY: the node group below is a PROXY for entwurf's own MCP child,
+# which is a node process this probe can start. It is NOT a measurement of the Copilot
+# CLI or of omp: those are different binaries with their own signing and hardened-
+# runtime state, and a proxy result does not transfer to them. The optional group 3
+# probes a REAL copilot/omp process only if the operator already has one running; when
+# it does not, that is reported as NOT MEASURED, never as coverage.
+probe_environ() {
+	# $1 = label, $2 = pid, $3 = marker expected in the environment (or "")
+	_lbl=$1
+	_pid=$2
+	_marker=$3
+	if ps -E -p "$_pid" >/dev/null 2>&1; then
+		_out=$(ps -Eww -p "$_pid" 2>/dev/null | tail -1)
+		if [ -n "$_marker" ]; then
+			if printf '%s' "$_out" | grep -q "$_marker"; then
+				printf '  %-22s VISIBLE — marker found in `ps -Eww` output\n' "$_lbl"
+			else
+				printf '  %-22s ACCEPTED-BUT-EMPTY — ps -E returned, marker ABSENT\n' "$_lbl"
+			fi
+		else
+			printf '  %-22s ACCEPTED (width %s chars)\n' "$_lbl" \
+				"$(printf '%s' "$_out" | wc -c | tr -d ' ')"
+		fi
+	else
+		printf '  %-22s REJECTED by ps -E\n' "$_lbl"
+	fi
+}
+# Group 1 — UNRESTRICTED target: a node process we start ourselves, carrying a marker.
+# This is the group that decides whether the doctors' discovery path survives.
+if command -v node >/dev/null 2>&1; then
+	ENTWURF_PROBE_MARKER=hello-entwurf \
+		node -e 'setTimeout(function(){}, 5000)' >/dev/null 2>&1 &
+	N1=$!
+	sleep 1
+	printf '  node target pid   %s\n' "$N1"
+	printf '  node argv         %s\n' \
+		"$(ps -o command= -p "$N1" 2>/dev/null | sed 's/^ *//' | cut -c1-120)"
+	probe_environ 'node environ' "$N1" 'ENTWURF_PROBE_MARKER=hello-entwurf'
+	printf '  node ppid         %s (expect this shell, %s)\n' \
+		"$(ps -o ppid= -p "$N1" 2>/dev/null | tr -d ' ')" "$SELF"
+	kill "$N1" 2>/dev/null
+	wait "$N1" 2>/dev/null
+else
+	printf '  node target       SKIPPED (no node on PATH) — THIS CELL IS THE IMPORTANT ONE\n'
+fi
+# Group 2 — RESTRICTED control: an Apple-signed system binary. A REJECTED here beside
+# a VISIBLE above is the proof that the refusal is SIP, not a missing capability.
+sleep 5 &
+D1=$!
+printf '  sleep argv        %s\n' \
+	"$(ps -o command= -p "$D1" 2>/dev/null | sed 's/^ *//' | cut -c1-100)"
+probe_environ '/bin/sleep environ' "$D1" ''
+kill "$D1" 2>/dev/null
+wait "$D1" 2>/dev/null
+# Group 3 — THE REAL TARGETS, when the operator already has one running. Group 1 is a
+# proxy; these are the binaries the doctors actually interrogate. A different signing
+# or hardened-runtime state here than on our own node child is exactly the result that
+# would invalidate the proxy, so an absent process is NOT MEASURED, never coverage.
+for real in copilot omp claude; do
+	_rp=$(pgrep -x "$real" 2>/dev/null | head -1)
+	if [ -n "${_rp:-}" ]; then
+		printf '  %-22s live pid %s\n' "$real (real target)" "$_rp"
+		probe_environ "$real environ" "$_rp" ''
+	else
+		printf '  %-22s NOT MEASURED — no live `%s` process on this host\n' \
+			"$real (real target)" "$real"
+	fi
+done
+# Full-table scan: the fallback if environ is unreadable is argv-only matching over
+# every process. Measure that it works AND what it costs.
+SCAN_START=$(date +%s)
+SCAN_N=$(ps -A -o pid=,ppid=,command= 2>/dev/null | wc -l | tr -d ' ')
+SCAN_END=$(date +%s)
+printf '  ps -A scan        %s rows in ~%ss\n' "$SCAN_N" "$((SCAN_END - SCAN_START))"
+printf '  pgrep present?    %s\n' "$(command -v pgrep >/dev/null 2>&1 && echo YES || echo NO)"
+printf '  lsof present?     %s\n' "$(command -v lsof >/dev/null 2>&1 && echo YES || echo NO)"
+
+hdr 'M7. pid space — how reachable is a same-second pid reuse?'
+printf '  kern.maxproc:     %s\n' "$(sysctl -n kern.maxproc 2>/dev/null || echo UNKNOWN)"
+printf '  kern.maxprocperuid: %s\n' "$(sysctl -n kern.maxprocperuid 2>/dev/null || echo UNKNOWN)"
+printf '  current pid:      %s\n' "$SELF"
+printf '  (PID_MAX on Darwin is a compile-time 99999; a wrap needs that many spawns)\n'
+
+hdr 'M8. filesystem semantics that installers depend on'
+printf '  case-sensitive?   '
+touch "$TMP/CaseFile"
+if [ -e "$TMP/casefile" ]; then printf 'NO (case-INSENSITIVE volume)\n'; else printf 'YES\n'; fi
+printf '  HOME:             %s\n' "${HOME:-UNSET}"
+printf '  XDG_DATA_HOME:    %s\n' "${XDG_DATA_HOME:-unset (entwurf defaults apply)}"
+printf '  symlink support:  %s\n' "$([ -L "$TMP/link" ] && echo OK || echo FAIL)"
+printf '  ~/.local/bin on PATH? %s\n' \
+	"$(printf '%s' "${PATH:-}" | tr ':' '\n' | grep -qx "$HOME/.local/bin" && echo YES || echo NO)"
+
+hdr 'M9. fs.watch rename semantics — the mailbox doorbell'
+# The receiver arms a watch and a sender delivers by writing then renaming into
+# place. Darwin's fs.watch is FSEvents-backed, not inotify: confirm a rename-over
+# actually raises an event for the WATCHED path.
+if command -v node >/dev/null 2>&1; then
+	mkdir -p "$TMP/watch"
+	printf 'v1\n' >"$TMP/watch/target"
+	node -e '
+const fs = require("fs");
+const dir = process.argv[1];
+let fired = [];
+let watchErr = null;
+let w = null;
+try {
+  w = fs.watch(dir + "/target", (ev) => fired.push(ev));
+  w.on("error", (e) => { watchErr = e; });
+} catch (e) {
+  watchErr = e;
+}
+setTimeout(() => {
+  try {
+    fs.writeFileSync(dir + "/staged", "v2\n");
+    fs.renameSync(dir + "/staged", dir + "/target");
+  } catch (e) {
+    watchErr = watchErr || e;
+  }
+}, 200);
+setTimeout(() => {
+  try { if (w) w.close(); } catch (e) { /* closing a dead watcher is not the measurement */ }
+  // EVERY path prints exactly one verdict token. An error is an honest UNKNOWN, not a
+  // missing line: a borrowed host must never hand back a cell that simply is not there.
+  if (watchErr) {
+    console.log("  fs.watch rename   UNKNOWN — watcher errored: " + (watchErr.code || watchErr.message));
+  } else if (fired.length) {
+    console.log("  fs.watch rename   FIRED [" + fired.join(",") + "]");
+  } else {
+    console.log("  fs.watch rename   SILENT — doorbell would not ring");
+  }
+  try {
+    const dw = fs.watch(dir, () => {});
+    dw.close();
+    console.log("  fs.watch on dir   SUPPORTED");
+  } catch (e) {
+    console.log("  fs.watch on dir   UNSUPPORTED — " + (e.code || e.message));
+  }
+}, 1200);
+' "$TMP/watch" 2>&1 | sed 's/^/  /;s/^  \( *fs\.watch\)/\1/'
+else
+	printf '  fs.watch          SKIPPED (no node on PATH)\n'
+fi
+
+printf '\n== probe complete ==\n'
+printf 'Paste this whole output into scripts/raw-macos-measure/README.md under the matching cell.\n'

package/scripts/smoke-meta-async-drift.sh

@@ -62,11 +62,13 @@ RAW_DIR="$HERE/raw-async-delivery"
 # 1.0 -> 1.1) is the real "re-verify the markers + Gotchas + raw/LIVE probes"
 # trigger and DOES scream.
 PIN_CLAUDE_MINOR="2.1"
-# codex 0.144 (2026-07-14): OBSERVED bump, not a re-verification. Codex is not a shipped
-# native-citizen lane in 0.12.x; the probe evidence in DELIVERY.md §Codex was measured at
-# 0.136.0 and has NOT been re-run on 0.144 — that explicit verdict lives there. Re-run the
-# raw probes before building any codex adapter on this line.
-PIN_CODEX_MINOR="0.144"
+# codex 0.153 (2026-09-08): RE-VERIFIED, not merely observed. The archived 0.136.0 raw probe
+# (codex-local-appserver.sh + raw-codex-ws-turn-start.py) was re-run AS SHIPPED on codex-cli
+# 0.153.4 and went green — idle plain `codex` auto-attached to a bare `codex app-server
+# --listen` woke with zero typing and the model replied in the same visible session. Receipts
+# and the six step-1 vendor measurements: scripts/raw-codex-measure/README.md (see raw-codex-
+# measure); coordinates restated in DELIVERY.md §Codex. Codex is still NOT a citizen backend.
+PIN_CODEX_MINOR="0.153"
 # agy 1.1 (2026-07-14): re-verified live — entwurf_self called without a permission prompt,
 # bidirectional native-push reply on the same gid, LIVE=1 smoke-agy-native-push-live 13/13
 # at agy 1.1.0 (evidence recorded in DELIVERY.md §Antigravity).

package/scripts/smoke-meta-install-state.sh

@@ -962,31 +962,82 @@ else
   bad "doctor did not surface enabled-but-cache-miss as a hard load failure:"$'\n'"$DOC_CACHE_OUT"
 fi
 
-# #51 repair support boundary. Fake only `uname -s`: no macOS implementation is
-# emulated. New Darwin install must refuse as not-yet-certified, doctor must stay
-# nonzero with the same evidence wording, while uninstall MUST get past the platform
-# gate so an older managed install is not stranded (it then honestly fails on our
-# fixture's intentionally absent state file).
-PLATFORM_BIN="$TMP/platform-bin"; mkdir -p "$PLATFORM_BIN"
-cat > "$PLATFORM_BIN/uname" <<'SH'
-#!/usr/bin/env bash
+# 0.20.0 D4: the platform fence moved from a bare `uname -s` refusal to the
+# installer's own REAL dependency (python3; see meta-bridge-install.sh's platform
+# gate comment). This gate must therefore pin the NEW contract, not the retired one:
+#   (a) Darwin install no longer refuses on platform name — it reaches PAST the
+#       platform line to its own toolchain gate, and dies there ONLY when a real
+#       dependency is actually missing;
+#   (b) with the real dependency present, Darwin clears the platform gate entirely
+#       and reaches the external claude-CLI toolchain step (never "unsupported
+#       platform", never the retired "not yet verified/certified" wording);
+#   (c) meta-bridge-doctor.sh's Darwin RAIL verdict is a SEPARATE, unmoved evidence
+#       axis (Hard Rule 17) — it still refuses (nonzero), on a narrowed reason (Q2:
+#       start-key no longer needs /proc; per-process environ discovery still does);
+#   (d) uninstall was ALREADY open to Darwin (precedent) and is untouched here.
+FAKE_UNAME_BIN="$TMP/fake-uname-bin"; mkdir -p "$FAKE_UNAME_BIN"
+# Bake the ABSOLUTE bash path into the shebang: the two cells below deliberately
+# narrow PATH (no bash on it), and `#!/usr/bin/env bash` would need `env` to find
+# `bash` on THAT narrowed PATH — this fixture's own launcher must not depend on it.
+cat > "$FAKE_UNAME_BIN/uname" <<SH
+#!$(command -v bash)
 printf '%s\n' Darwin
 SH
-chmod +x "$PLATFORM_BIN/uname"
+chmod +x "$FAKE_UNAME_BIN/uname"
+
+# (a) A minimal PATH carrying ONLY `dirname` (the sole external command
+# meta-bridge-install.sh calls before its own python3 check) plus the fake Darwin
+# `uname`. No real python3/node/claude can leak in from the host — the death point
+# is fully controlled by this fixture, not by what happens to be installed here.
+NOPY_BIN="$TMP/nopy-bin"; mkdir -p "$NOPY_BIN"
+ln -sf "$(command -v dirname)" "$NOPY_BIN/dirname"
+set +e
+DARWIN_NOPY_OUT="$(env HOME="$TMP/darwin-nopy-home" XDG_DATA_HOME="$TMP/darwin-nopy-xdg" PATH="$FAKE_UNAME_BIN:$NOPY_BIN" "$BASH" "$REPO/scripts/meta-bridge-install.sh" 2>&1)"
+DARWIN_NOPY_CODE=$?
+set -e
+if [ "$DARWIN_NOPY_CODE" -ne 0 ] \
+   && printf '%s\n' "$DARWIN_NOPY_OUT" | grep -q "python3' not on PATH" \
+   && ! printf '%s\n' "$DARWIN_NOPY_OUT" | grep -qi 'unsupported platform'; then
+  ok "Darwin install clears the platform gate and refuses on the REAL missing dependency (python3), never on platform name"
+else bad "Darwin install did not reach the python3 dependency gate as the new fence contract requires:"$'\n'"$DARWIN_NOPY_OUT"; fi
+
+# (b) The mirror proof: Darwin WITH python3+node present must clear the platform
+# gate AND the toolchain gate, refusing only because `claude` is absent from this
+# fixture's deliberately narrow PATH (never on platform name, never on the retired
+# "not yet verified/certified" wording).
+OK_BIN="$TMP/darwin-ok-bin"; mkdir -p "$OK_BIN"
+ln -sf "$(command -v dirname)" "$OK_BIN/dirname"
+ln -sf "$(command -v node)" "$OK_BIN/node"
+ln -sf "$(command -v python3)" "$OK_BIN/python3"
+set +e
+DARWIN_OK_OUT="$(env HOME="$TMP/darwin-ok-home" XDG_DATA_HOME="$TMP/darwin-ok-xdg" PI_CODING_AGENT_DIR="$TMP/darwin-ok-agent" PATH="$FAKE_UNAME_BIN:$OK_BIN" "$BASH" "$REPO/scripts/meta-bridge-install.sh" 2>&1)"
+DARWIN_OK_CODE=$?
+set -e
+if [ "$DARWIN_OK_CODE" -ne 0 ] \
+   && printf '%s\n' "$DARWIN_OK_OUT" | grep -q "'claude' CLI not on PATH" \
+   && ! printf '%s\n' "$DARWIN_OK_OUT" | grep -qi 'unsupported platform' \
+   && ! printf '%s\n' "$DARWIN_OK_OUT" | grep -qi 'not yet verified'; then
+  ok "Darwin install with real python3+node clears BOTH the platform and toolchain-part-1 gates, reaching the external claude-CLI step"
+else bad "Darwin install with real python3+node did not clear the platform gate as the new contract requires:"$'\n'"$DARWIN_OK_OUT"; fi
+
+# (c) The doctor's RAIL verdict is untouched by the fence change: still nonzero,
+# still reaches its final verdict line. Wording is narrowed under Q2/D1 (start-key
+# no longer blamed; only per-process environ discovery is), so pin the substring
+# that survives that rename, not the retired sentence.
 set +e
-DARWIN_INSTALL_OUT="$(env HOME="$DOC_HOME" XDG_DATA_HOME="$TMP/darwin-xdg" PI_CODING_AGENT_DIR="$DOC_AGENT" PATH="$PLATFORM_BIN:$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-install.sh" 2>&1)"
-DARWIN_INSTALL_CODE=$?
-DARWIN_DOCTOR_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" PATH="$PLATFORM_BIN:$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+DARWIN_DOCTOR_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" PATH="$FAKE_UNAME_BIN:$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
 DARWIN_DOCTOR_CODE=$?
-DARWIN_UNINSTALL_OUT="$(env HOME="$TMP/darwin-clean-home" XDG_DATA_HOME="$TMP/darwin-clean-xdg" PATH="$PLATFORM_BIN:$PATH" bash "$REPO/scripts/meta-bridge-uninstall.sh" 2>&1)"
+set -e
+if [ "$DARWIN_DOCTOR_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'NOT CERTIFIED' && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'meta-bridge doctor: FAIL'; then
+  ok "Darwin doctor stays nonzero and reaches its final NOT-CERTIFIED verdict (rail certification is a separate, unmoved axis)"
+else bad "Darwin doctor did not hold the rail-certification evidence boundary:"$'\n'"$DARWIN_DOCTOR_OUT"; fi
+
+# (d) Uninstall precedent, unchanged by this lane: it was ALREADY open to Darwin
+# before 0.20.0 (legacy-cleanup capability, never install certification).
+set +e
+DARWIN_UNINSTALL_OUT="$(env HOME="$TMP/darwin-clean-home" XDG_DATA_HOME="$TMP/darwin-clean-xdg" PATH="$FAKE_UNAME_BIN:$PATH" bash "$REPO/scripts/meta-bridge-uninstall.sh" 2>&1)"
 DARWIN_UNINSTALL_CODE=$?
 set -e
-if [ "$DARWIN_INSTALL_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_INSTALL_OUT" | grep -q 'not yet verified/certified for this repair cut'; then
-  ok "Darwin install is refused fail-loud as not-yet-certified (future validation may reopen)"
-else bad "Darwin install did not enforce the repair-cut evidence boundary:"$'\n'"$DARWIN_INSTALL_OUT"; fi
-if [ "$DARWIN_DOCTOR_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'NOT YET VERIFIED/CERTIFIED for this repair cut' && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'meta-bridge doctor: FAIL'; then
-  ok "Darwin doctor stays nonzero and reaches its final NOT-YET-CERTIFIED verdict"
-else bad "Darwin doctor did not hold the repair-cut evidence boundary:"$'\n'"$DARWIN_DOCTOR_OUT"; fi
 if [ "$DARWIN_UNINSTALL_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_UNINSTALL_OUT" | grep -q 'install state missing' && ! printf '%s\n' "$DARWIN_UNINSTALL_OUT" | grep -q 'unsupported platform'; then
   ok "Darwin uninstall passes the platform gate and reaches honest state preflight (legacy inverse retained)"
 else bad "Darwin uninstall was blocked by the support hard-cut instead of reaching honest inverse preflight:"$'\n'"$DARWIN_UNINSTALL_OUT"; fi

package/scripts/smoke-omp-bridge-state.sh

@@ -114,6 +114,44 @@ kill "$CARRIER_PID"
 wait "$CARRIER_PID" 2>/dev/null || true
 CARRIER_PID=""
 
+# THE CANDIDATE SET ITSELF CAN BE UNKNOWN, AND UNKNOWN IS NOT EMPTY (#78 B1). `pgrep`
+# answers three ways and only two of them are facts about omp: 0 = it enumerated and
+# matched, 1 = it enumerated and NOTHING matched (a real, positive absence), anything
+# else = it never enumerated. The doctor used to `|| true` that third answer into the
+# second, so a broken enumeration produced an empty candidate set, the clean carrier
+# line and a PASS — with a contaminated session possibly live on the host.
+#
+# BOTH DIRECTIONS ARE PINNED, because a repair that also reddened the honest "nothing
+# matched" would be a different defect. `ENTWURF_OMP_CARRIER_PIDS` must be UNSET for
+# these two: that seam short-circuits the very enumeration under test, which is why it
+# is a narrowing seam and never production proof.
+PGREP_SHIM="$SB/pgrep-shim"
+mkdir -p "$PGREP_SHIM"
+printf '#!/usr/bin/env bash\nexit 1\n' > "$PGREP_SHIM/pgrep"
+chmod +x "$PGREP_SHIM/pgrep"
+if OUT="$(env -u ENTWURF_OMP_CARRIER_PIDS PATH="$PGREP_SHIM:$PATH" "$RUN" doctor-omp-bridge 2>&1)"; then
+  printf '%s\n' "$OUT" | grep -q "no live omp process carries" || die "an enumerated-and-empty candidate set did not print the clean carrier verdict"
+  ok "a \`pgrep\` that enumerated and matched NOTHING is a real absence and stays green"
+else
+  printf '%s\n' "$OUT" >&2
+  die "a \`pgrep\` exit 1 (nothing matched) turned the carrier axis red"
+fi
+printf '#!/usr/bin/env bash\nexit 2\n' > "$PGREP_SHIM/pgrep"
+if OUT="$(env -u ENTWURF_OMP_CARRIER_PIDS PATH="$PGREP_SHIM:$PATH" "$RUN" doctor-omp-bridge 2>&1)"; then
+  printf '%s\n' "$OUT" >&2
+  die "[QK:OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE] a FAILED process enumeration left the doctor green — it printed a carrier verdict with no candidate set, so a live omp session carrying a foreign pi garden id would read as clean"
+fi
+if ! printf '%s\n' "$OUT" | grep -q "UNVERIFIABLE — 'pgrep -x omp' FAILED (exit 2)"; then
+  printf '%s\n' "$OUT" >&2
+  die "the doctor went red without naming the failed enumeration as UNVERIFIABLE"
+fi
+if printf '%s\n' "$OUT" | grep -q "no live omp process carries"; then
+  printf '%s\n' "$OUT" >&2
+  die "the doctor claimed a clean carrier axis while the candidate set was unknown"
+fi
+ok "a FAILED enumeration is UNVERIFIABLE and red, and it claims neither contamination nor absence"
+rm -rf "$PGREP_SHIM"
+
 # ── 2. reinstall is idempotent ───────────────────────────────────────────────
 "$RUN" install-omp-bridge >/dev/null || die "reinstall over our own state failed"
 "$RUN" doctor-omp-bridge >/dev/null || die "doctor red after a reinstall"