@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/mutants/v2-surface.json

@@ -25,7 +25,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SEND-INBAND-REJECT-REASON]",
-			"signatureSource": "scripts/check-entwurf-v2-send.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
 		},
 		{
 			"claim": "V2PROD-INBAND-ERROR-WIRED",
@@ -206,7 +206,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-native-push"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY]",
-			"signatureSource": "scripts/check-entwurf-v2-native-push.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-native-push.test.ts"
 		}
 	]
 }

package/scripts/mutants/v2-visible-resume.json

@@ -11,7 +11,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-LIVE-REFUSED]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-INDETERMINATE-NO-START",
@@ -22,7 +22,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-INDETERMINATE-NO-START]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-CONFLICT-NO-START",
@@ -33,7 +33,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-CONFLICT-NO-START]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-LOCKED-NO-RESOLVE",
@@ -44,7 +44,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-LOCKED-NO-RESOLVE]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-NO-TRANSCRIPT-FAILS-LOUD",
@@ -67,7 +67,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-NO-TRANSCRIPT-FAILS-LOUD]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-OBSERVE-IS-BOUNDED-WAIT",
@@ -78,7 +78,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-OBSERVE-IS-BOUNDED-WAIT]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-UNOBSERVED-IS-REAL",
@@ -89,7 +89,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-UNOBSERVED-IS-REAL]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-RELEASE-FAILURE-LOUD",
@@ -100,7 +100,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-RELEASE-FAILURE-LOUD]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-ARGV-FROM-RECORD",
@@ -111,7 +111,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-ARGV-FROM-RECORD]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-RECEIPTS-SEPARATE",
@@ -124,7 +124,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-RECEIPTS-SEPARATE]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-RENDER-SEPARATES",
@@ -137,7 +137,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-RENDER-SEPARATES]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-IDENTITY-BEFORE-WINDOW",
@@ -148,7 +148,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-IDENTITY-BEFORE-WINDOW]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-TIMEOUT-RELEASES",
@@ -161,7 +161,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-TIMEOUT-RELEASES]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-LOCK-BEFORE-LIVENESS",
@@ -172,7 +172,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-LOCK-BEFORE-LIVENESS]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-NOT-PI-REFUSED",
@@ -183,7 +183,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-NOT-PI-REFUSED]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-NOT-PI-BY-FIELD",
@@ -198,7 +198,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-NOT-PI-BY-FIELD]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
 			"claim": "V2RESUME-SHARED-ID-GRAMMAR",
@@ -209,7 +209,7 @@
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-SHARED-ID-GRAMMAR]",
-			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }

package/scripts/peer-facts.ts

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+/**
+ * peer-facts — the read-only JSON projection of the OBSERVED peer listing (#116 M2-a).
+ *
+ * `meta-facts` (#65) emits what the meta-record STORE owns. This emits what the fact
+ * PROVIDER owns: the same `listEntwurfFacts` assembly `entwurf_peers` renders, serialized
+ * instead of drawn. It exists for the same reason #65 exists — so a consumer stops
+ * carrying a decaying copy of a join it does not own.
+ *
+ * THE COPY THIS REFUSES. The placement axis joins a herdr pane to a citizen on
+ * `nativeSessionId`, and on the pi side that key is recovered from a session FILENAME by a
+ * strict conversion measured against one vendor floor (`herdr-placement.ts`
+ * piNativeSessionIdFromPath). A consumer that re-implements that join forks a vendor floor
+ * into a file no gate covers and no document owns (`docs/mux-launch-rail.md` §7). With this
+ * verb the consumer's whole join becomes ONE opaque pane-id string equality, which is a
+ * thing a shell script may correctly do.
+ *
+ * ONE PROVIDER, ONE RENDERER, NO SECOND JOIN. The payload is `renderEntwurfPeers().payload`
+ * — the same provider (`listEntwurfFacts`) through the same renderer the MCP `entwurf_peers`
+ * surface uses, so the SHAPE is that surface's payload shape and each row is a `PeerFact`
+ * whose keyset `check-entwurf-peers-surface` pins to `{peers, diagnostics}`. Nothing here
+ * recomputes, filters, re-sorts or re-words a provider fact, and nothing here re-implements
+ * the join.
+ *
+ * It is NOT the same bytes as an `entwurf_peers` call, and the difference is deliberate, not
+ * a drift: that surface is a human listing, so it passes `observationLimit` and returns only
+ * rendered TEXT over the wire. This is a machine projection, so its observation is
+ * UNBOUNDED — a rationed row would say `unobserved`, which a machine consumer cannot tell
+ * apart from "nobody could look". Older rows can therefore read `exists`/`active` here where
+ * the human surface says `unobserved`. Same facts, measured for more rows.
+ *
+ * `placement` STAYS STRUCTURED. The human surface prints `herdr <pane>` so a reader never
+ * mistakes a pane id for one of ours; a machine consumer needs the tagged union itself
+ * (`{kind:"herdr-pane",paneId}` / `unobserved` / `none` / `ambiguous`), so `renderPlacement`
+ * is NOT applied here. A pane is an ephemeral view (Hard Rule 16), never an address.
+ *
+ * WHAT IS DELIBERATELY ABSENT. No herdr `agent_status`, no `interactive_ready`, no screen
+ * text: those are herdr's own display verdicts, they are not delivery evidence
+ * (`docs/herdr-launch-rail.md` §9), and keeping them out of every entwurf payload is what
+ * makes "observed activity" unable to drift into delivery liveness. A consumer that wants
+ * to show them reads herdr itself and labels them as herdr's report.
+ *
+ * ONE PLACEMENT READ. `readPlacementIndex` is left undefined, so the provider performs its
+ * own single read per listing — the anti-watcher shape `entwurf-fact-provider.ts` documents.
+ * This verb never loops, retries, or waits for a pane whose session reference has not landed.
+ *
+ * NO SOCKET COORDINATE LEAVES THIS VERB. `ENTWURF_DIR` selects the socket world that is
+ * PROBED, and that is all it does: the control dir is never emitted. #50 C4 retired the
+ * legacy `sessions` projection "with the `controlDir` it exposed" because the record is the
+ * sole address axis and socket paths are dispatch-internal transport
+ * (`entwurf-peers-render.ts` header). Re-publishing that path under a new verb would undo
+ * that retirement, and no renderer needs it.
+ *
+ * stdout (deterministic, 2-space indent, trailing newline):
+ *   {
+ *     "schemaVersion": 1,        // of THIS projection
+ *     "storeDir":    "/abs",     // the meta-record store that was read
+ *     "peers":       [ <PeerFact, verbatim, provider order> ],
+ *     "diagnostics": [ <EntwurfDiagnostic, verbatim> ]
+ *   }
+ *
+ * EXIT CONTRACT — identical in shape to meta-facts, for the same reason:
+ *   0 — the store was readable; the JSON above is on stdout (diagnostics in-band).
+ *       A store that does not exist is a readable EMPTY store (ENOENT only).
+ *   2 — usage error (bad argv).
+ *   3 — the store could not be READ. No JSON is emitted: an unreadable host must
+ *       never look like an empty one.
+ * A provider wiring invariant (duplicate identity / unprobed in-domain citizen) is left to
+ * THROW. It is not an unreadable store and must not be dressed as one (Hard Rule 15).
+ */
+
+import os from "node:os";
+import { defaultControlSocketDir } from "../pi-extensions/lib/control-socket-path.js";
+import { listEntwurfFacts } from "../pi-extensions/lib/entwurf-fact-provider.ts";
+import { renderEntwurfPeers } from "../pi-extensions/lib/entwurf-peers-render.ts";
+import {
+	type ActiveStoreEntry,
+	defaultMetaSessionsDir,
+	makeStoreRecordReader,
+	readActiveStoreEntries,
+} from "../pi-extensions/lib/meta-session.ts";
+
+const arg = process.argv[2];
+// A dash argv is a flag this command does not have, not a store directory — treating it as
+// a path would answer `--help` with "empty store, exit 0", a silent wrong fact.
+if (process.argv.length > 3 || (arg !== undefined && arg.startsWith("-"))) {
+	console.error("usage: entwurf peer-facts [meta-sessions-dir]");
+	process.exit(2);
+}
+
+const storeDir = arg ?? defaultMetaSessionsDir();
+// The SAME override the bridge honours (`mcp/entwurf-bridge/src/index.ts` ENTWURF_DIR), so
+// this verb and `entwurf_peers` probe one socket world. The pi side has no such override;
+// the path grammar is the shared leaf either way. This value is an INPUT to the probe and
+// never an output — see NO SOCKET COORDINATE LEAVES THIS VERB above.
+const controlDir = process.env.ENTWURF_DIR ?? defaultControlSocketDir(os.homedir());
+
+let metaEntries: ActiveStoreEntry[];
+try {
+	// Entries WITH their kind, never bare names: the listing must be able to refuse a
+	// symlinked record without following it (Hard Rule 7). ENOENT is the empty store.
+	metaEntries = readActiveStoreEntries(storeDir);
+} catch (err) {
+	console.error(`FAIL: ${err instanceof Error ? err.message : String(err)}`);
+	process.exit(3); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one
+}
+
+const result = await listEntwurfFacts({
+	metaEntries,
+	readRecord: makeStoreRecordReader(storeDir),
+	socket: { dir: controlDir },
+	// No `observationLimit`: a budget would emit `unobserved` for rows nobody chose to
+	// skip, and in a machine payload that is indistinguishable from "no herdr here". The
+	// human surface may ration its own rows; a projection may not ration its facts.
+});
+
+const { payload } = renderEntwurfPeers(result);
+const projection = { schemaVersion: 1, storeDir, ...payload };
+
+process.stdout.write(`${JSON.stringify(projection, null, 2)}\n`);

package/scripts/register-pi-package.py

@@ -120,6 +120,14 @@ from pathlib import Path
 # the first one was closed (#53 B). sys.path[0] already holds this directory when the
 # script is run by path, which is how run.sh and every gate invoke it; the explicit
 # insert keeps the import true under any other invocation form.
+# The sibling import below would otherwise leave `scripts/__pycache__/pi_settings_io.*.pyc`
+# behind — a write into the checkout this script was merely READ from. It is git-ignored, so
+# `git status --porcelain` never shows it, and on a host where the cache already exists nothing
+# changes; but in the gate-qualification snapshot the file is NEW, and the tree manifest that
+# certifies "the runner never wrote the tree" reads bytes, not porcelain. Measured on the #116
+# M3-b3 candidate: that one path was the whole of `IMPURE: treeClean=false porcelainClean=true`.
+# Same guard, same reason as codex-mcp-config.py / codex-statusline-config.py.
+sys.dont_write_bytecode = True
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from pi_settings_io import classify_installer_root, detect_indent, dumps  # noqa: E402
 

package/scripts/register-pi-provider.py

@@ -76,6 +76,14 @@ import sys
 # `install` — semantically a no-op, byte-wise a RED `pnpm check`. sys.path[0] already
 # holds this directory when the script is run by path (how run.sh and the gates invoke
 # it); the explicit insert keeps the import true under any other invocation form.
+# The sibling import below would otherwise leave `scripts/__pycache__/pi_settings_io.*.pyc`
+# behind — a write into the checkout this script was merely READ from. It is git-ignored, so
+# `git status --porcelain` never shows it, and on a host where the cache already exists nothing
+# changes; but in the gate-qualification snapshot the file is NEW, and the tree manifest that
+# certifies "the runner never wrote the tree" reads bytes, not porcelain. Measured on the #116
+# M3-b3 candidate: that one path was the whole of `IMPURE: treeClean=false porcelainClean=true`.
+# Same guard, same reason as codex-mcp-config.py / codex-statusline-config.py.
+sys.dont_write_bytecode = True
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from pi_settings_io import classify_installer_root, detect_indent, dumps, unchanged  # noqa: E402
 
@@ -170,11 +178,49 @@ def _now() -> str:
     return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
 
-def _classify(existing_cmd, repo_dir: str) -> str:
+# #116 M3-b2 — the ONE alternative managed command, and it is DERIVED, never supplied.
+# A Herdr plugin activates on a host where nothing entwurf is on PATH, so the bare bin cannot
+# resolve. The plugin mode therefore names the bridge by its absolute path under the certified
+# stable active runtime — and that is the whole freedom it gets: the caller passes the runtime ROOT,
+# this function appends the fixed suffix, and any other string is refused. There is deliberately no
+# flag or environment variable that accepts an arbitrary command or path: that would be a generic
+# "write whatever you like into the operator's pi settings" authority wearing a plugin's clothes.
+PLUGIN_BIN_SUFFIX = os.path.join("node_modules", ".bin", SERVER_KEY)
+
+
+def stable_active_root() -> str:
+    """The ONE runtime address, derived from this process's XDG/HOME exactly as the runtime owner
+    derives it (`scripts/herdr-runtime.mjs` resolveRuntimeLayout). A gate pins the two
+    implementations equal; nothing here reads a caller-supplied root as authority."""
+    data_home = os.environ.get("XDG_DATA_HOME") or os.path.join(os.path.expanduser("~"), ".local", "share")
+    return os.path.join(data_home, "entwurf", "herdr-plugin", "runtime", "active")
+
+
+def plugin_command_for(runtime_root: str) -> str:
+    # The caller may NAME the root, but it is only accepted when it IS this host's stable root. An
+    # absolute path was never the contract — "the stable runtime" was — and a mode that takes any
+    # absolute directory is a way to point every pi session at an executable of the caller's choice.
+    if not isinstance(runtime_root, str) or not os.path.isabs(runtime_root):
+        _die(2, f"register-pi-provider: --plugin-runtime must be an ABSOLUTE stable runtime root, got {runtime_root!r}")
+    if runtime_root != os.path.normpath(runtime_root) or runtime_root.endswith(os.sep):
+        _die(2, f"register-pi-provider: --plugin-runtime must be a normalised path, got {runtime_root!r}")
+    expected = stable_active_root()
+    if runtime_root != expected:
+        _die(2, f"register-pi-provider: --plugin-runtime must be this host's stable runtime root {expected!r}, "
+                f"got {runtime_root!r} — an arbitrary absolute directory is not a plugin runtime.")
+    return os.path.join(runtime_root, PLUGIN_BIN_SUFFIX)
+
+
+def _classify(existing_cmd, repo_dir: str, managed_command: str = BARE_COMMAND) -> str:
     if existing_cmd is None:
         return "absent"
-    if existing_cmd == BARE_COMMAND:
+    if existing_cmd == managed_command:
         return "managed-current"
+    # The OTHER shape we own is adoptable, so bare↔plugin is a normalisation rather than a
+    # takeover. In DEFAULT mode this is exactly the historical set (the bare bin is
+    # managed-current above and never reaches here), so default bytes and verdicts are unchanged.
+    if managed_command != BARE_COMMAND and existing_cmd == BARE_COMMAND:
+        return "managed-legacy"
     if isinstance(existing_cmd, str) and (
         existing_cmd == f"{repo_dir}/mcp/{SERVER_KEY}/start.sh"
         or existing_cmd.endswith(f"/entwurf/mcp/{SERVER_KEY}/start.sh")
@@ -210,7 +256,8 @@ def _load_state_file(state_path: str) -> dict | None:
 
 
 def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str, takeover: bool = False,
-                preflight: bool = False) -> None:
+                preflight: bool = False, plugin_runtime: str | None = None) -> None:
+    managed_command = plugin_command_for(plugin_runtime) if plugin_runtime else BARE_COMMAND
     if os.path.islink(settings_path):
         target = os.readlink(settings_path)
         _die(3, f"register-pi-provider: refusing to adopt {settings_path} — it is a symlink to {target} "
@@ -254,7 +301,7 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str,
     _prune_legacy(servers, repo_dir)   # independent of entwurf-bridge ownership
     existing = servers.get(SERVER_KEY)
     existing_cmd = existing.get("command") if isinstance(existing, dict) else existing
-    ownership = _classify(existing_cmd, repo_dir)
+    ownership = _classify(existing_cmd, repo_dir, managed_command)
 
     if preflight:
         # Read-only half of the atomic user-scope operation: the ownership decision
@@ -282,8 +329,8 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str,
             sys.stdout.write(f"install: no change — {settings_path} left untouched (bytes and mtime stable)\n")
         return
 
-    # absent / managed-current / managed-legacy → normalize to the bare stable bin.
-    newval = {"command": BARE_COMMAND}
+    # absent / managed-current / managed-legacy → normalize to the managed command for this mode.
+    newval = {"command": managed_command}
     # preserve non-empty custom args if the operator set them; else default [].
     if isinstance(existing, dict) and existing.get("args") not in (None, []):
         newval["args"] = existing["args"]
@@ -292,7 +339,8 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str,
     servers[SERVER_KEY] = newval
     wrote = _persist(settings_path, before, data, raw)
     sys.stdout.write(
-        f"install: {ownership} → entwurfProvider.mcpServers.{SERVER_KEY} = {BARE_COMMAND} (bare stable bin)\n"
+        f"install: {ownership} → entwurfProvider.mcpServers.{SERVER_KEY} = {managed_command} "
+        f"({'stable plugin runtime' if plugin_runtime else 'bare stable bin'})\n"
     )
     # The desired value AND the legacy prune both already held: nothing to say to the
     # file. Reported so an operator (and the gate) can tell "already correct" from
@@ -317,7 +365,7 @@ def cmd_install(settings_path: str, repo_dir: str, scope: str, state_path: str,
                 "managedSettingsPath": os.path.abspath(settings_path),
                 "scope": "user",
                 "key": f"entwurfProvider.mcpServers.{SERVER_KEY}",
-                "command": BARE_COMMAND,
+                "command": managed_command,
                 "ownership": ownership,       # absent | managed-current | managed-legacy
                 "installerRoot": repo_dir,     # #86 C2: the root whose inverse may remove this key
                 "preimage": existing,          # raw prior value (audit only; NOT restored)
@@ -387,8 +435,23 @@ def cmd_remove(settings_path: str, repo_dir: str, scope: str, state_path: str, o
             before = _parse_settings(managed, raw)     # dies 4 on corrupt — preflight and writer alike
             data = _parse_settings(managed, raw)
             provider, servers = _provider_servers(data, create=False)
+        # #116 M3-b2 — DRIFT IS NOT OURS TO DELETE. The user-scope inverse is admitted by the
+        # ownership record, not by the command string, so without this it would remove whatever now
+        # sits at our key. The state records the exact command we wrote (bare bin, or the absolute
+        # bridge under a stable plugin runtime); if the live value is PRESENT and different, someone
+        # replaced our key after we installed it and the honest move is to refuse by name rather
+        # than delete their override. An ABSENT key stays an idempotent no-op.
+        recorded_cmd = state.get("command")
+        live = servers.get(SERVER_KEY) if isinstance(servers, dict) else None
+        live_cmd = live.get("command") if isinstance(live, dict) else live
+        if isinstance(recorded_cmd, str) and live_cmd is not None and live_cmd != recorded_cmd:
+            _die(6, f"register-pi-provider: the user-scope {SERVER_KEY} command drifted since install — "
+                    f"we wrote {recorded_cmd!r}, {managed} now holds {live_cmd!r}. That is somebody's override, "
+                    "not our key; zero settings bytes written and the ownership state is left intact.")
         if preflight:
-            sys.stdout.write("preflight: remove ok (owner verified; managed target bound and parseable)\n")
+            sys.stdout.write(
+                f"preflight: remove ok (owner verified; managed target bound and parseable; command={recorded_cmd!r})\n"
+            )
             return
         if os.path.exists(managed):
             # honest inverse: absent/managed-* → remove OUR key (a legacy repo path is NOT
@@ -442,6 +505,7 @@ def cmd_remove(settings_path: str, repo_dir: str, scope: str, state_path: str, o
 
 
 def _parse(argv: list):
+    plugin_runtime = None
     # positional: settings_path repo_dir ; flags: --scope <s> [--state <p>] [--takeover] [--orphan-cleanup] [--preflight]
     pos, scope, state_path = [], None, ""
     takeover, orphan, preflight = False, False, False
@@ -460,17 +524,24 @@ def _parse(argv: list):
             orphan = True
         elif a == "--preflight":
             preflight = True
+        elif a == "--plugin-runtime":
+            i += 1
+            # A flag with no value must NOT fall through to bare mode: the caller asked for the
+            # plugin runtime and would otherwise be told, silently, that it got it.
+            if i >= len(argv) or not argv[i]:
+                _die(5, "register-pi-provider.py: --plugin-runtime requires a value")
+            plugin_runtime = argv[i]
         else:
             pos.append(a)
         i += 1
-    return pos, scope, state_path, takeover, orphan, preflight
+    return pos, scope, state_path, takeover, orphan, preflight, plugin_runtime
 
 
 def main(argv: list) -> None:
     if len(argv) < 2:
         _die(5, "usage: register-pi-provider.py <install|remove> <settings_path> <repo_dir> --scope <user|project> [--state <path>]")
     sub = argv[1]
-    pos, scope, state_path, takeover, orphan, preflight = _parse(argv[2:])
+    pos, scope, state_path, takeover, orphan, preflight, plugin_runtime = _parse(argv[2:])
     if sub not in ("install", "remove"):
         _die(5, f"register-pi-provider.py: unknown subcommand {sub!r}")
     if len(pos) != 2:
@@ -486,8 +557,13 @@ def main(argv: list) -> None:
         _die(5, "register-pi-provider.py: --takeover is an install action")
     if orphan and sub != "remove":
         _die(5, "register-pi-provider.py: --orphan-cleanup is a remove action")
+    # The plugin mode is an INSTALL-side USER-scope decision only. `remove` needs no mode: it
+    # recognises every shape we own through the same classifier, so an inverse never has to be told
+    # which one it is undoing — and a mode flag on remove would be a way to aim a deletion.
+    if plugin_runtime is not None and (sub != "install" or scope != "user"):
+        _die(5, "register-pi-provider.py: --plugin-runtime is a user-scope install action")
     if sub == "install":
-        cmd_install(settings_path, repo_dir, scope, state_path, takeover, preflight)
+        cmd_install(settings_path, repo_dir, scope, state_path, takeover, preflight, plugin_runtime)
     else:
         cmd_remove(settings_path, repo_dir, scope, state_path, orphan, preflight)
 

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.76.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.79.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).