@junghanacs/entwurf 0.19.0 → 0.20.1

package/scripts/smoke-meta-install-state.sh

@@ -962,31 +962,82 @@ else
   bad "doctor did not surface enabled-but-cache-miss as a hard load failure:"$'\n'"$DOC_CACHE_OUT"
 fi
 
-# #51 repair support boundary. Fake only `uname -s`: no macOS implementation is
-# emulated. New Darwin install must refuse as not-yet-certified, doctor must stay
-# nonzero with the same evidence wording, while uninstall MUST get past the platform
-# gate so an older managed install is not stranded (it then honestly fails on our
-# fixture's intentionally absent state file).
-PLATFORM_BIN="$TMP/platform-bin"; mkdir -p "$PLATFORM_BIN"
-cat > "$PLATFORM_BIN/uname" <<'SH'
-#!/usr/bin/env bash
+# 0.20.0 D4: the platform fence moved from a bare `uname -s` refusal to the
+# installer's own REAL dependency (python3; see meta-bridge-install.sh's platform
+# gate comment). This gate must therefore pin the NEW contract, not the retired one:
+#   (a) Darwin install no longer refuses on platform name — it reaches PAST the
+#       platform line to its own toolchain gate, and dies there ONLY when a real
+#       dependency is actually missing;
+#   (b) with the real dependency present, Darwin clears the platform gate entirely
+#       and reaches the external claude-CLI toolchain step (never "unsupported
+#       platform", never the retired "not yet verified/certified" wording);
+#   (c) meta-bridge-doctor.sh's Darwin RAIL verdict is a SEPARATE, unmoved evidence
+#       axis (Hard Rule 17) — it still refuses (nonzero), on a narrowed reason (Q2:
+#       start-key no longer needs /proc; per-process environ discovery still does);
+#   (d) uninstall was ALREADY open to Darwin (precedent) and is untouched here.
+FAKE_UNAME_BIN="$TMP/fake-uname-bin"; mkdir -p "$FAKE_UNAME_BIN"
+# Bake the ABSOLUTE bash path into the shebang: the two cells below deliberately
+# narrow PATH (no bash on it), and `#!/usr/bin/env bash` would need `env` to find
+# `bash` on THAT narrowed PATH — this fixture's own launcher must not depend on it.
+cat > "$FAKE_UNAME_BIN/uname" <<SH
+#!$(command -v bash)
 printf '%s\n' Darwin
 SH
-chmod +x "$PLATFORM_BIN/uname"
+chmod +x "$FAKE_UNAME_BIN/uname"
+
+# (a) A minimal PATH carrying ONLY `dirname` (the sole external command
+# meta-bridge-install.sh calls before its own python3 check) plus the fake Darwin
+# `uname`. No real python3/node/claude can leak in from the host — the death point
+# is fully controlled by this fixture, not by what happens to be installed here.
+NOPY_BIN="$TMP/nopy-bin"; mkdir -p "$NOPY_BIN"
+ln -sf "$(command -v dirname)" "$NOPY_BIN/dirname"
+set +e
+DARWIN_NOPY_OUT="$(env HOME="$TMP/darwin-nopy-home" XDG_DATA_HOME="$TMP/darwin-nopy-xdg" PATH="$FAKE_UNAME_BIN:$NOPY_BIN" "$BASH" "$REPO/scripts/meta-bridge-install.sh" 2>&1)"
+DARWIN_NOPY_CODE=$?
+set -e
+if [ "$DARWIN_NOPY_CODE" -ne 0 ] \
+   && printf '%s\n' "$DARWIN_NOPY_OUT" | grep -q "python3' not on PATH" \
+   && ! printf '%s\n' "$DARWIN_NOPY_OUT" | grep -qi 'unsupported platform'; then
+  ok "Darwin install clears the platform gate and refuses on the REAL missing dependency (python3), never on platform name"
+else bad "Darwin install did not reach the python3 dependency gate as the new fence contract requires:"$'\n'"$DARWIN_NOPY_OUT"; fi
+
+# (b) The mirror proof: Darwin WITH python3+node present must clear the platform
+# gate AND the toolchain gate, refusing only because `claude` is absent from this
+# fixture's deliberately narrow PATH (never on platform name, never on the retired
+# "not yet verified/certified" wording).
+OK_BIN="$TMP/darwin-ok-bin"; mkdir -p "$OK_BIN"
+ln -sf "$(command -v dirname)" "$OK_BIN/dirname"
+ln -sf "$(command -v node)" "$OK_BIN/node"
+ln -sf "$(command -v python3)" "$OK_BIN/python3"
+set +e
+DARWIN_OK_OUT="$(env HOME="$TMP/darwin-ok-home" XDG_DATA_HOME="$TMP/darwin-ok-xdg" PI_CODING_AGENT_DIR="$TMP/darwin-ok-agent" PATH="$FAKE_UNAME_BIN:$OK_BIN" "$BASH" "$REPO/scripts/meta-bridge-install.sh" 2>&1)"
+DARWIN_OK_CODE=$?
+set -e
+if [ "$DARWIN_OK_CODE" -ne 0 ] \
+   && printf '%s\n' "$DARWIN_OK_OUT" | grep -q "'claude' CLI not on PATH" \
+   && ! printf '%s\n' "$DARWIN_OK_OUT" | grep -qi 'unsupported platform' \
+   && ! printf '%s\n' "$DARWIN_OK_OUT" | grep -qi 'not yet verified'; then
+  ok "Darwin install with real python3+node clears BOTH the platform and toolchain-part-1 gates, reaching the external claude-CLI step"
+else bad "Darwin install with real python3+node did not clear the platform gate as the new contract requires:"$'\n'"$DARWIN_OK_OUT"; fi
+
+# (c) The doctor's RAIL verdict is untouched by the fence change: still nonzero,
+# still reaches its final verdict line. Wording is narrowed under Q2/D1 (start-key
+# no longer blamed; only per-process environ discovery is), so pin the substring
+# that survives that rename, not the retired sentence.
 set +e
-DARWIN_INSTALL_OUT="$(env HOME="$DOC_HOME" XDG_DATA_HOME="$TMP/darwin-xdg" PI_CODING_AGENT_DIR="$DOC_AGENT" PATH="$PLATFORM_BIN:$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-install.sh" 2>&1)"
-DARWIN_INSTALL_CODE=$?
-DARWIN_DOCTOR_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" PATH="$PLATFORM_BIN:$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+DARWIN_DOCTOR_OUT="$(env HOME="$DOC_HOME" CLAUDE_CONFIG_DIR="$DOC_CFG" PI_CODING_AGENT_DIR="$DOC_AGENT" ENTWURF_META_SESSIONS_DIR="$DOC_STORE" PATH="$FAKE_UNAME_BIN:$DOC_BIN:$PATH" bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
 DARWIN_DOCTOR_CODE=$?
-DARWIN_UNINSTALL_OUT="$(env HOME="$TMP/darwin-clean-home" XDG_DATA_HOME="$TMP/darwin-clean-xdg" PATH="$PLATFORM_BIN:$PATH" bash "$REPO/scripts/meta-bridge-uninstall.sh" 2>&1)"
+set -e
+if [ "$DARWIN_DOCTOR_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'NOT CERTIFIED' && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'meta-bridge doctor: FAIL'; then
+  ok "Darwin doctor stays nonzero and reaches its final NOT-CERTIFIED verdict (rail certification is a separate, unmoved axis)"
+else bad "Darwin doctor did not hold the rail-certification evidence boundary:"$'\n'"$DARWIN_DOCTOR_OUT"; fi
+
+# (d) Uninstall precedent, unchanged by this lane: it was ALREADY open to Darwin
+# before 0.20.0 (legacy-cleanup capability, never install certification).
+set +e
+DARWIN_UNINSTALL_OUT="$(env HOME="$TMP/darwin-clean-home" XDG_DATA_HOME="$TMP/darwin-clean-xdg" PATH="$FAKE_UNAME_BIN:$PATH" bash "$REPO/scripts/meta-bridge-uninstall.sh" 2>&1)"
 DARWIN_UNINSTALL_CODE=$?
 set -e
-if [ "$DARWIN_INSTALL_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_INSTALL_OUT" | grep -q 'not yet verified/certified for this repair cut'; then
-  ok "Darwin install is refused fail-loud as not-yet-certified (future validation may reopen)"
-else bad "Darwin install did not enforce the repair-cut evidence boundary:"$'\n'"$DARWIN_INSTALL_OUT"; fi
-if [ "$DARWIN_DOCTOR_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'NOT YET VERIFIED/CERTIFIED for this repair cut' && printf '%s\n' "$DARWIN_DOCTOR_OUT" | grep -q 'meta-bridge doctor: FAIL'; then
-  ok "Darwin doctor stays nonzero and reaches its final NOT-YET-CERTIFIED verdict"
-else bad "Darwin doctor did not hold the repair-cut evidence boundary:"$'\n'"$DARWIN_DOCTOR_OUT"; fi
 if [ "$DARWIN_UNINSTALL_CODE" -ne 0 ] && printf '%s\n' "$DARWIN_UNINSTALL_OUT" | grep -q 'install state missing' && ! printf '%s\n' "$DARWIN_UNINSTALL_OUT" | grep -q 'unsupported platform'; then
   ok "Darwin uninstall passes the platform gate and reaches honest state preflight (legacy inverse retained)"
 else bad "Darwin uninstall was blocked by the support hard-cut instead of reaching honest inverse preflight:"$'\n'"$DARWIN_UNINSTALL_OUT"; fi

package/scripts/smoke-omp-bridge-state.sh

@@ -114,6 +114,44 @@ kill "$CARRIER_PID"
 wait "$CARRIER_PID" 2>/dev/null || true
 CARRIER_PID=""
 
+# THE CANDIDATE SET ITSELF CAN BE UNKNOWN, AND UNKNOWN IS NOT EMPTY (#78 B1). `pgrep`
+# answers three ways and only two of them are facts about omp: 0 = it enumerated and
+# matched, 1 = it enumerated and NOTHING matched (a real, positive absence), anything
+# else = it never enumerated. The doctor used to `|| true` that third answer into the
+# second, so a broken enumeration produced an empty candidate set, the clean carrier
+# line and a PASS — with a contaminated session possibly live on the host.
+#
+# BOTH DIRECTIONS ARE PINNED, because a repair that also reddened the honest "nothing
+# matched" would be a different defect. `ENTWURF_OMP_CARRIER_PIDS` must be UNSET for
+# these two: that seam short-circuits the very enumeration under test, which is why it
+# is a narrowing seam and never production proof.
+PGREP_SHIM="$SB/pgrep-shim"
+mkdir -p "$PGREP_SHIM"
+printf '#!/usr/bin/env bash\nexit 1\n' > "$PGREP_SHIM/pgrep"
+chmod +x "$PGREP_SHIM/pgrep"
+if OUT="$(env -u ENTWURF_OMP_CARRIER_PIDS PATH="$PGREP_SHIM:$PATH" "$RUN" doctor-omp-bridge 2>&1)"; then
+  printf '%s\n' "$OUT" | grep -q "no live omp process carries" || die "an enumerated-and-empty candidate set did not print the clean carrier verdict"
+  ok "a \`pgrep\` that enumerated and matched NOTHING is a real absence and stays green"
+else
+  printf '%s\n' "$OUT" >&2
+  die "a \`pgrep\` exit 1 (nothing matched) turned the carrier axis red"
+fi
+printf '#!/usr/bin/env bash\nexit 2\n' > "$PGREP_SHIM/pgrep"
+if OUT="$(env -u ENTWURF_OMP_CARRIER_PIDS PATH="$PGREP_SHIM:$PATH" "$RUN" doctor-omp-bridge 2>&1)"; then
+  printf '%s\n' "$OUT" >&2
+  die "[QK:OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE] a FAILED process enumeration left the doctor green — it printed a carrier verdict with no candidate set, so a live omp session carrying a foreign pi garden id would read as clean"
+fi
+if ! printf '%s\n' "$OUT" | grep -q "UNVERIFIABLE — 'pgrep -x omp' FAILED (exit 2)"; then
+  printf '%s\n' "$OUT" >&2
+  die "the doctor went red without naming the failed enumeration as UNVERIFIABLE"
+fi
+if printf '%s\n' "$OUT" | grep -q "no live omp process carries"; then
+  printf '%s\n' "$OUT" >&2
+  die "the doctor claimed a clean carrier axis while the candidate set was unknown"
+fi
+ok "a FAILED enumeration is UNVERIFIABLE and red, and it claims neither contamination nor absence"
+rm -rf "$PGREP_SHIM"
+
 # ── 2. reinstall is idempotent ───────────────────────────────────────────────
 "$RUN" install-omp-bridge >/dev/null || die "reinstall over our own state failed"
 "$RUN" doctor-omp-bridge >/dev/null || die "doctor red after a reinstall"

package/scripts/smoke-setup-verdict.sh

@@ -287,6 +287,106 @@ rm -rf "$HOME/.omp" "$XDG_DATA_HOME/entwurf/omp-bridge" "$XDG_DATA_HOME/entwurf/
   "$XDG_DATA_HOME/entwurf/omp-config" "$XDG_DATA_HOME/entwurf/omp-receive" \
   "$XDG_DATA_HOME/entwurf/meta-bridge-omp" "$XDG_DATA_HOME/entwurf/omp-receive"
 
+# ── S-9: rail certification is a SEPARATE axis from install success (#78 D1) ──
+# The 0.20.0 macOS lane opened the installers to Darwin (meta-bridge-install.sh's
+# platform gate became its own python3/node dependency instead of the platform
+# name), and that removed the only thing which used to keep a detected Mac host
+# non-green: the installer's refusal. A detected harness on Darwin now INSTALLS,
+# every harness doctor still refuses there (NOT CERTIFIED — pending physical
+# host), and `setup` runs no doctor. Hard Rule 17 names that shape non-green, so
+# setup_harness_result does — and these cells are its ONLY executing consumer,
+# because nothing else in this repo ever takes the Darwin branch.
+#
+# `uname` is faked on PATH exactly the way smoke-meta-install-state.sh already
+# fakes it for the installer's own platform gate. Both directions are pinned so
+# the fixture cannot pass for the wrong reason: the Linux twin below is the SAME
+# sandbox, the SAME stub harnesses and the SAME fixture with one byte different,
+# and S-3/S-8 above are the unfaked real-host Linux evidence.
+FAKE_UNAME="$SB/fake-uname-darwin"; mkdir -p "$FAKE_UNAME"
+# Absolute bash in the shebang, same reason as the sibling fixture: a cell may
+# hand this script a PATH that does not carry `env`/`bash` itself.
+cat > "$FAKE_UNAME/uname" <<SH
+#!$(command -v bash)
+printf '%s\n' Darwin
+SH
+chmod +x "$FAKE_UNAME/uname"
+FAKE_UNAME_LINUX="$SB/fake-uname-linux"; mkdir -p "$FAKE_UNAME_LINUX"
+cat > "$FAKE_UNAME_LINUX/uname" <<SH
+#!$(command -v bash)
+printf '%s\n' Linux
+SH
+chmod +x "$FAKE_UNAME_LINUX/uname"
+
+omp_reset() {
+  rm -rf "$HOME/.omp" "$XDG_DATA_HOME/entwurf/omp-bridge" "$XDG_DATA_HOME/entwurf/omp-mcp" \
+    "$XDG_DATA_HOME/entwurf/omp-config" "$XDG_DATA_HOME/entwurf/omp-receive" \
+    "$XDG_DATA_HOME/entwurf/meta-bridge-omp"
+}
+
+# ── S-9a: fake Darwin + DETECTED harnesses → named non-green, install intact ──
+# Two harness FAMILIES on purpose (the pi adapter rail and the four omp units):
+# a rule applied to one backend and not the next is a new defect, not half a fix.
+echo "[smoke-setup-verdict] S-9a detected harnesses on an uncertified platform"
+PROJ9="$SB/proj9"; mkdir -p "$PROJ9"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-ok" OMP_BIN="$FAKE_OMP/omp" ENTWURF_OMP_AGENT_DIR="$HOME/.omp/agent" PATH="$FAKE_UNAME:$FAKE_OMP:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9" 2>&1)"; RC=$?; set -e
+want "S-9a: a detected harness on an uncertified platform owns a nonzero setup exit" "[ '$RC' -ne 0 ]"
+want "S-9a: the pi adapter rail is named non-green, never a cosmetic PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'pi: PASS'"
+want "S-9a: all four omp units are named non-green, none cosmetically PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: FAIL' && printf '%s' \"\$OUT\" | grep -q 'omp-mcp: FAIL' && printf '%s' \"\$OUT\" | grep -q 'omp-config: FAIL' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: FAIL' && ! printf '%s' \"\$OUT\" | grep -q 'omp-[a-z]*: PASS'"
+want "S-9a: the reason says the wiring WAS written (this is not an install failure)" \
+  "printf '%s' \"\$OUT\" | grep -q 'the wiring WAS written and nothing failed to install'"
+want "S-9a: the reason names the RAIL evidence state and the platform" \
+  "printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED — pending physical host on Darwin'"
+want "S-9a: the reason names the doctor that owns the rail axis, per component" \
+  "printf '%s' \"\$OUT\" | grep -qF \"owned by './run.sh doctor-omp-bridge'\" && printf '%s' \"\$OUT\" | grep -qF \"owned by './run.sh doctor-pi-provider'\""
+want "S-9a: the reason points at the tracking issue" "printf '%s' \"\$OUT\" | grep -q 'Tracking: #78'"
+want "S-9a: it never reads as an install refusal (no unsupported-platform / did-not-complete vocabulary)" \
+  "! printf '%s' \"\$OUT\" | grep -qi 'unsupported platform' && ! printf '%s' \"\$OUT\" | grep -q 'did not complete'"
+want "S-9a: the summary is NON-GREEN and names the uncertified components" \
+  "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL:' && ! printf '%s' \"\$OUT\" | grep -q 'result: green'"
+# The load-bearing half: the installs genuinely SUCCEEDED. Without this the cell
+# would also pass if the platform had merely broken the installers.
+want "S-9a: the wiring really landed — pi project settings plus both omp extensions and the MCP hand" \
+  "[ -f '$PROJ9/.pi/settings.json' ] && [ -d '$HOME/.omp/agent/extensions/entwurf-meta-omp' ] && [ -d '$HOME/.omp/agent/extensions/entwurf-receive-omp' ] && [ -f '$HOME/.omp/agent/mcp.json' ]"
+want_auth_untouched "S-9a"
+omp_reset
+
+# ── S-9b: the Linux twin — same fixture, one byte different → still PASS/green ──
+# This is the regression axis that matters most: the certified platform's behavior
+# must not have moved at all.
+echo "[smoke-setup-verdict] S-9b the same detected harnesses on the certified platform"
+PROJ9B="$SB/proj9b"; mkdir -p "$PROJ9B"
+seed_auth
+set +e; OUT="$(PI_BIN="$SB/harness/pi-ok" OMP_BIN="$FAKE_OMP/omp" ENTWURF_OMP_AGENT_DIR="$HOME/.omp/agent" PATH="$FAKE_UNAME_LINUX:$FAKE_OMP:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9B" 2>&1)"; RC=$?; set -e
+want "S-9b: the certified platform still exits 0" "[ '$RC' -eq 0 ]"
+want "S-9b: pi and all four omp units still compose as PASS" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-config: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS'"
+want "S-9b: a PASS row is byte-identical to the pre-#78 wording (the operator surface did not move)" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS — birth extension installed — verify: ./run.sh doctor-omp-bridge'"
+want "S-9b: the computed summary is green and carries no rail-certification wording" \
+  "printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)' && ! printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED'"
+want_auth_untouched "S-9b"
+omp_reset
+
+# ── S-9c: fake Darwin + NO harness → still green (the macOS CI job's contract) ──
+# The macos-install-surface job asserts exactly this shape on a real Darwin runner:
+# five zero-state SKIPs, core PASS, computed green. The rule above must not reach
+# an absent harness — SKIP is not a completed integration.
+echo "[smoke-setup-verdict] S-9c harness-free host on an uncertified platform"
+PROJ9C="$SB/proj9c"; mkdir -p "$PROJ9C"
+seed_auth
+set +e; OUT="$(PATH="$FAKE_UNAME:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9C" 2>&1)"; RC=$?; set -e
+want "S-9c: a harness-free uncertified host still exits 0" "[ '$RC' -eq 0 ]"
+want "S-9c: all five harness probes are still zero-state SKIPs" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP'"
+want "S-9c: core still PASSes and the computed summary is still green" \
+  "printf '%s' \"\$OUT\" | grep -q 'core: PASS' && printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
+want "S-9c: an absent harness is never given a rail verdict it did not earn" \
+  "! printf '%s' \"\$OUT\" | grep -q 'NOT CERTIFIED'"
+want_auth_untouched "S-9c"
+
 # ── S-5: installed mode is a NAMED first verdict, never the source bootstrap ──
 # A bare copy of run.sh under a fake node_modules root pins the mode seam
 # cheaply: the copy is NOT a runnable installed package (no dist), so this cell

package/scripts/smoke-user-scope-citizen.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # smoke-user-scope-citizen — deterministic gate for pi packages[] citizen
-# registration/removal (register-pi-package.py). Offline/hermetic: a fake
-# settings file + a fake REPO_DIR under $TMP, no pi, no network, no ~/.pi touched.
+# registration/removal (register-pi-package.py). Offline/hermetic: fake settings
+# files and fake REPO_DIRs under $TMP, sandboxed HOME/PI_CODING_AGENT_DIR/XDG,
+# no network, nothing of the operator's ~/.pi read or written.
 #
 # Guards the wiring that dropped when `pi install` was removed from setup
 # (2026-07-03: `--entwurf-control` / `--emacs-agent-socket` unknown in a foreign
@@ -10,10 +11,14 @@
 # in another repo. This gate is that missing tripwire: if the registration ever
 # regresses, `pnpm run check:full` goes red.
 #
-# Cells 11–13 close the second omission (#53 B): every case here drove a fake
-# settings file with ABSOLUTE entries, so the portable, settings-relative form this
-# repo actually commits was never registered against — and `setup` duplicated and
-# restyled the tracked file for four cuts without a single gate seeing it.
+# Cells 11–13 close the second omission (#53 B): every case before them drove a fake
+# settings file with ABSOLUTE entries, so the portable, settings-relative form was
+# never registered against — and `setup` duplicated and restyled a tracked file for
+# four cuts without a single gate seeing it.
+#
+# Cell 15 closes the third (#110), and it is the one cell here that SPAWNS pi: the
+# defect is not a byte, it is which of two checkouts wins `--entwurf-control`, and
+# only the real loader can say. It uses the pinned devDep pi, never PATH.
 set -euo pipefail
 export PYTHONDONTWRITEBYTECODE=1 # snapshot purity: no ignored scripts/__pycache__ writes under qualification
 
@@ -193,69 +198,64 @@ assert d['defaultProvider']=='openai-codex', 'run.sh remove-user-scope dropped a
 # idempotent: a second remove-user-scope is a clean no-op (no crash on absent entry)
 if XDG_DATA_HOME="$TMP/xdg" PI_CODING_AGENT_DIR="$AGENT_DIR" bash "$RUN" remove-user-scope >/dev/null 2>&1; then ok "run.sh remove-user-scope is idempotent (no-op second run)"; else bad "run.sh remove-user-scope second run crashed"; fi
 
-# ── 11–13. #53 B: install must not dirty a tracked, formatter-governed settings file
+# ── 11–13. #53 B: a settings-relative self entry is source, never install state
 # The cell whose ABSENCE let this ship. Every case above drove a fake settings file
-# with absolute entries, so the one shape this repo actually commits — the portable,
-# settings-relative `".."` that check-install-surface S7c pins — was never registered
-# against. `setup` therefore appended the absolute path BESIDE it and rewrote the
-# tracked, biome-owned bytes at indent=2, and `pnpm check` died at step 1 reading
-# "format error" instead of "install wrote this".
+# with ABSOLUTE entries, so the portable, settings-relative form — the one shape
+# register never WRITES, and must therefore never duplicate, absolutize or restyle —
+# was never registered against. `setup` appended the absolute path BESIDE it and
+# rewrote the file at indent=2, and `pnpm check` died at step 1 reading "format
+# error" instead of "install wrote this".
 #
-# The seed is the repo's OWN committed settings, copied into a stand-in checkout so
-# `".."` resolves to that clone rather than to the real repo (nothing here touches
-# $REPO). Setup landing is PROVEN before any product verdict: if the seed is not the
-# portable form, this says SETUP MISS in its own name instead of blaming the code.
+# The seed is a FIXTURE. It used to be this repo's OWN committed `.pi/settings.json`,
+# because the repo shipped `packages: [".."]`; #110 retired that entry (entwurf's own
+# checkout self-registers through user scope alone, so a second checkout can no
+# longer register a rival copy of pi-extensions). A witness that depends on us still
+# SHIPPING the shape it tests dies with the shape — and the shape it tests did not
+# die. An operator may hand-write a settings-relative entry, and
+# `is_settings_relative_self` is also what stops an unrelated relative package
+# (`../../repos/gh/andenken`) from being read as ours. Dropping the fixture to a
+# literal here makes the reason honest: the predicate is the subject, not our bytes.
 CLONE="$TMP/selfclone"; mkdir -p "$CLONE/.pi"
 CS="$CLONE/.pi/settings.json"
-seed_src=""
-if (cd "$REPO" && git show :.pi/settings.json) > "$CS" 2>/dev/null && [ -s "$CS" ]; then
-  seed_src="candidate index"
-elif cp "$REPO/.pi/settings.json" "$CS" 2>/dev/null; then
-  seed_src="worktree"
+# Tab-indented with a compact array on purpose: cell 13 pins that a genuine rewrite
+# preserves the file's own indent unit, and 11b below pins that this file is not
+# rewritten at all. A seed written in the writer's default style could not tell the
+# two apart.
+printf '{\n\t"skills": ["../.claude/skills"],\n\t"packages": [".."]\n}\n' > "$CS"
+BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
+OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
+AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
+if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
+  ok "11 register against a settings-relative self entry is a no-op"
+else
+  bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
 fi
-if [ ! -s "$CS" ]; then
-  bad "11 SETUP MISS: could not seed this repo's own .pi/settings.json (no git object, no worktree file)"
-elif ! python3 -c "
-import json,sys
-p=json.load(open(sys.argv[1])).get('packages')
-sys.exit(0 if p==['..'] else 1)" "$CS"; then
-  bad "11 SETUP MISS: the seed ($seed_src) is not the committed portable form (packages != ['..']) — product verdict withheld"
+if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
+  ok "11b the formatter-governed bytes are UNCHANGED (sha256 + mtime)"
 else
-  BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
-  OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
-  AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
-  if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
-    ok "11 register against this repo's OWN committed settings is a no-op (seed: $seed_src)"
-  else
-    bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
-  fi
-  if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
-    ok "11b the tracked, formatter-governed bytes are UNCHANGED (sha256 + mtime)"
-  else
-    bad "11b install rewrote the tracked settings file (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
-  fi
-  # The inverse direction of the same asymmetry: the shared matcher now RECOGNIZES
-  # `".."`, so an uninstall that deleted it would edit committed source — the same
-  # defect pointed the other way. remove leaves it and says so; dry-run agrees,
-  # because both ask one predicate.
-  BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
-  OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
-  OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
-  if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
-    ok "11c --remove does NOT delete the committed portable entry (bytes unchanged)"
-  else
-    bad "11c --remove edited the repo's committed settings source" "$OUT_RM"
-  fi
-  if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
-    ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
-  else
-    bad "11d --remove left the entry without saying so" "$OUT_RM"
-  fi
-  if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
-    ok "11e --dry-run agrees with remove (one predicate, no over-report)"
-  else
-    bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
-  fi
+  bad "11b register rewrote a settings file it only recognizes (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
+fi
+# The inverse direction of the same asymmetry: the shared matcher RECOGNIZES `".."`,
+# so an uninstall that deleted it would edit source it never wrote — the same defect
+# pointed the other way. remove leaves it and says so; dry-run agrees, because both
+# ask one predicate.
+BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
+OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
+OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
+if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
+  ok "11c --remove does NOT delete a settings-relative self entry (bytes unchanged)"
+else
+  bad "11c --remove edited settings source it never authored" "$OUT_RM"
+fi
+if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
+  ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
+else
+  bad "11d --remove left the entry without saying so" "$OUT_RM"
+fi
+if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
+  ok "11e --dry-run agrees with remove (one predicate, no over-report)"
+else
+  bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
 fi
 
 # 12. the state a pre-fix `setup` already left on real hosts: the portable entry AND
@@ -291,12 +291,20 @@ if grep -q $'^\t"packages"' "$S"; then ok "13 a rewrite preserves the file's tab
 # indent=2 — semantically a no-op, byte-wise a RED `pnpm check` diagnosed as "formatting".
 # A per-writer cell can never see that; only the real drive can. So this one runs
 # `run.sh install <checkout>` for real and demands sha256 + mtime invariance.
-#
 # The checkout is a stand-in: run.sh resolves its OWN symlinks to find REPO_DIR, so
 # run.sh is COPIED (a link would point the drive back at the operator's real repo) while
 # the trees it only reads are linked. That makes REPO_DIR == the stand-in, which is the
-# shape that matters — `".."` in <checkout>/.pi/settings.json resolves to the very repo
-# being registered, exactly as it does in a dev clone.
+# shape that matters — the drive installs entwurf INTO entwurf's own checkout, exactly
+# as `./run.sh setup` does from a dev clone (PROJECT_DIR_DEFAULT=$(pwd)).
+#
+# #110 raised what this cell demands. "install is a no-op here" used to hold because
+# the committed `packages: [".."]` already satisfied the writer. That entry is gone,
+# so the writer must instead RECOGNIZE that the project it is installing into IS this
+# root and skip project scope entirely — user scope already registers it, and a second
+# entry naming a different checkout is what made pi load two rival copies of
+# pi-extensions/entwurf-control.ts. The invariant, tested end to end below: entwurf's
+# own checkout carries no project-scope self-registration, in tracked bytes OR in
+# bytes a writer produced.
 CK="$TMP/checkout"
 mkdir -p "$CK/.pi"
 cp "$REPO/run.sh" "$CK/run.sh"
@@ -317,8 +325,8 @@ if [ ! -s "$CKS" ]; then
 elif ! python3 -c "
 import json,sys
 d=json.load(open(sys.argv[1]))
-sys.exit(0 if d.get('packages')==['..'] and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
-  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed portable form (packages ['..'] + entwurfProvider)"
+sys.exit(0 if d.get('packages') is None and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
+  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed form (no packages key + entwurfProvider)"
 else
   CK_BEFORE="$(sha256sum "$CKS" | cut -d' ' -f1)"; CK_MT="$(stat -c %Y "$CKS")"
   sleep 1
@@ -359,6 +367,124 @@ else
     else
       bad "14d the user-scope citizen was not written under the sandboxed PI_CODING_AGENT_DIR" "$ck_out"
     fi
+    # The invariant, read off the file the drive just wrote through: no writer put a
+    # project-scope self-registration back. 14b already pins the bytes, but a writer
+    # that ADDED `packages` to a file with no `packages` key would fail 14b for a
+    # reason a reader could mistake for formatting; this says the thing #110 is about,
+    # in its own words.
+    L14E="14e install into entwurf's OWN checkout wrote no project-scope packages[] self-registration [QK:SELF-CHECKOUT-PROJECT-REGISTRATION]"
+    if python3 -c "
+import json,sys
+sys.exit(0 if json.load(open(sys.argv[1])).get('packages') is None else 1)" "$CKS"; then
+      ok "$L14E"
+    else
+      bad "$L14E — violated: install self-registered this checkout, so a second checkout will load a rival copy of pi-extensions" "$(cat "$CKS")"
+    fi
+    case "$ck_out" in
+      *"project-scope packages[] skipped"*) ok "14f the drive REPORTS the skip (a silent skip and a silent write read alike)" ;;
+      *) bad "14f install skipped project scope without saying so — 14e cannot tell that apart from a writer that never ran" "$ck_out" ;;
+    esac
+  fi
+fi
+
+# ── 15. #110: the operator-observable this whole contract exists for ───────────
+# Cells 11–14 read settings bytes. Bytes are the mechanism; the SYMPTOM is what pi
+# does with them, and that is what nobody could see: a second checkout booted pi,
+# printed all seven `entwurf` model rows, and looked fine, while `--entwurf-control`
+# — the flag that makes a pi session a garden citizen — was being served by the
+# branch copy, and the INSTALLED extension failed to load with an error naming the
+# installed path as the loser. Not silent. Designed to be misread.
+#
+# pi's package identity is `local:<resolved path>` and dedupePackages collapses only
+# EQUAL identities (package-manager.js getPackageIdentity/dedupePackages), so two
+# real checkouts can never merge — no realpath rule, ours or pi's, would fix this.
+# The only lever is not registering the second one.
+#
+# The cell is control-then-assert on purpose. A sandbox where pi loads no project
+# settings at all (untrusted cwd, missing extension deps, a probe that dies early)
+# would report "no conflicts" for reasons that have nothing to do with the contract,
+# and that green would be a lie. So it first PLANTS the retired entry and demands the
+# conflict APPEAR; only a cell that has just watched the defect happen is allowed to
+# assert its absence.
+# Two different absences, and only one of them is allowed to be quiet. A tree with no
+# `node_modules` at all is a genuinely reduced checkout and the property is untestable
+# there — a named skip. A tree that HAS dependencies but no pinned pi is a broken dev
+# checkout, and skipping it would hide the breakage behind an exit-0 gate, so that one
+# fails loud. (The qualification snapshot is the first case only in principle: it
+# symlinks the origin's node_modules in after its baseline commit — mutation-qualify.ts
+# createRepoSnapshot — so cell 15 really runs there, which is what lets the two mutants
+# below cover this skip. A skip nobody can reach with a planted defect would be exactly
+# the quiet green this cell is built to refuse.)
+PI_BIN_PINNED="$REPO/node_modules/.bin/pi"
+if [ ! -d "$REPO/node_modules" ]; then
+  echo "  skip  15 second-checkout probe skipped: this tree has no node_modules (reduced checkout); the property is untestable here, not violated"
+elif [ ! -x "$PI_BIN_PINNED" ]; then
+  bad "15 the pinned pi is missing from a checkout that HAS dependencies ($PI_BIN_PINNED) — a broken dev checkout, not a reduced one; re-run pnpm install"
+else
+  A15="$TMP/dual/installed"; B15="$TMP/dual/second"
+  AG15="$TMP/agent15"
+  mkdir -p "$A15/.pi" "$B15/.pi" "$AG15"
+  # pi-extensions is COPIED into each root, not linked: the defect is two DISTINCT
+  # real paths declaring the same flag, and a shared symlink target would be one path
+  # wearing two names — a fixture that cannot reproduce what two checkouts do.
+  for root in "$A15" "$B15"; do
+    cp -R "$REPO/pi-extensions" "$root/pi-extensions"
+    for entry in node_modules package.json protocol.js; do
+      [ -e "$REPO/$entry" ] && ln -s "$REPO/$entry" "$root/$entry"
+    done
+  done
+  # user scope registers the INSTALLED root, absolutely — what `register_user_scope_citizen`
+  # writes on a real host. Trust is seeded for the second checkout because `.pi/` is a
+  # trust-gated input: an untrusted cwd loads no project settings, which would silence
+  # the control below and make the assertion vacuous.
+  printf '{"packages": ["%s"]}\n' "$A15" > "$AG15/settings.json"
+  printf '{"%s": true}\n' "$B15" > "$AG15/trust.json"
+  # Two fences on the probe child, and BOTH are load-bearing.
+  #
+  # `< /dev/null`: `pi --print` reads a non-tty stdin as piped prompt input, so it
+  # inherits whatever the CALLER handed this gate. Under an interactive shell or a
+  # /dev/null stdin that ends immediately and the probe returns in ~2s; under a
+  # supervised runner — which hands the process an open socket — it blocks forever.
+  # Measured 2026-09-10: a release-gate run sat 1h56m on this line with `pi` alive
+  # and no output, and the gate has no timeout of its own to catch it. A gate must
+  # read the loader, never the stdin of whoever started it.
+  #
+  # `timeout 60`: even so, a probe that cannot finish must go RED rather than hang.
+  # 124 lands in the captured output, the conflict grep misses, and the cell fails
+  # with its own name — the honest outcome for "the loader never answered".
+  #
+  # Ambient identity carriers are stripped for the same reason: a live pi/ACP session
+  # exports PI_SESSION_ID/PI_AGENT_ID and CLAUDE_CONFIG_DIR into children.
+  probe15() {
+    (cd "$B15" && env -u PI_SESSION_ID -u PI_AGENT_ID -u CLAUDE_CONFIG_DIR \
+      HOME="$TMP/home" PI_CODING_AGENT_DIR="$AG15" \
+      XDG_DATA_HOME="$TMP/xdg" XDG_STATE_HOME="$TMP/state" XDG_CACHE_HOME="$TMP/cache" \
+      timeout 60 "$PI_BIN_PINNED" --model zzz-no-such-provider/zzz-no-such-model --print x \
+      </dev/null 2>&1 || true)
+  }
+  # CONTROL: the retired shape, re-planted. `".."` resolves against <B>/.pi, so the
+  # project entry names B while user scope names A — two identities, both loaded.
+  printf '{"packages": [".."]}\n' > "$B15/.pi/settings.json"
+  OUT15_CTL="$(probe15)"
+  if printf '%s' "$OUT15_CTL" | grep -q 'conflicts with'; then
+    ok "15 control: a second checkout that registers itself DOES collide on the extension flags"
+  else
+    bad "15 SETUP MISS: the planted second registration produced no conflict — this sandbox cannot observe the defect, so 15b would be vacuous" "$OUT15_CTL"
+  fi
+  # ASSERT: this repo's real `.pi/settings.json`, read from the WORKING TREE — not
+  # from the candidate index the way cells 11/14 read theirs. The subject here is
+  # what pi's loader does with the file that exists ON DISK when a session starts;
+  # the index is a different question and check-install-surface S7c already owns it.
+  # Reading the index here also made this cell blind to its own replant: a mutation
+  # writes the file, git show reads the staged bytes, and the gate stayed green over
+  # a planted defect (measured — qualification reported SURVIVED, 2026-09-10).
+  cp "$REPO/.pi/settings.json" "$B15/.pi/settings.json"
+  OUT15="$(probe15)"
+  L15B="15b a second checkout of this repo boots pi with zero extension conflicts [QK:SECOND-CHECKOUT-EXTENSION-COLLISION]"
+  if printf '%s' "$OUT15" | grep -q 'conflicts with'; then
+    bad "$L15B — violated: the branch copy wins --entwurf-control and the INSTALLED extension fails, printing the installed path as the loser" "$OUT15"
+  else
+    ok "$L15B"
   fi
 fi
 
@@ -740,14 +866,16 @@ if [ "$RC34B" -ne 0 ] && printf '%s' "$OUT34B" | grep -q 'CORRUPT'; then
   ok "34b doctor coupling FAILs on a wrong-type provider installerRoot (named CORRUPT) $QK34"
 else bad "34b doctor stayed green/silent over a corrupt installerRoot (rc=$RC34B): $OUT34B $QK34"; fi
 
-# 15. WIRING: both writers of this one file must share the serializer, not copy it.
+# 35. WIRING: both writers of this one file must share the serializer, not copy it.
 #     A duplicated indent-detector is how the provider writer stayed open after the
 #     package writer was closed; a parity check is cheaper than a third round.
+#     (Numbered 35, after the ownership block: it used to be a second "15", which
+#     stopped being merely untidy once #110 added the real cell 15 above.)
 for w in register-pi-package.py register-pi-provider.py; do
   if grep -q "from pi_settings_io import" "$REPO/scripts/$w"; then
-    ok "15 $w routes through the shared pi_settings_io serializer"
+    ok "35 $w routes through the shared pi_settings_io serializer"
   else
-    bad "15 $w serializes settings on its own again (copied rule = the #53 B shape)"
+    bad "35 $w serializes settings on its own again (copied rule = the #53 B shape)"
   fi
 done