@junghanacs/entwurf 0.24.0 → 0.25.1

package/scripts/qualification-oracle.ts

@@ -0,0 +1,124 @@
+/**
+ * qualification-oracle — launcher for the exact-SHA composite release oracle (#124 P1).
+ *
+ * It JUDGES NOTHING. It clones the target SHA cleanly, then runs THAT SHA's own
+ * `scripts/lib/qualification-oracle-core.ts` inside the clone and relays its output and
+ * exit code. The operator's checkout — possibly dirty or stale — never evaluates a SHA
+ * with its own bytes.
+ *
+ *   1. tripwire the origin checkout: HEAD, porcelain, work-surface content hash;
+ *   2. `git clone --no-hardlinks --no-checkout <origin> <tmp>`; `checkout --detach <sha>`;
+ *      the clone must be exactly <sha> and clean, its surface stable across two reads;
+ *   3. no core source at <sha> → ABORT oracle-source-missing (every SHA before the core
+ *      landed, 8d508d3 included, is judged this way — by design, not by accident);
+ *   4. run `node --experimental-strip-types <clone>/scripts/lib/qualification-oracle-core.ts`
+ *      with cwd = the clone;
+ *   5. ALWAYS (child failure, child signal, our own SIGINT/SIGTERM): remove the clone, then
+ *      re-read the origin tripwire. A moved origin overrides any child result with ABORT.
+ *
+ * Nothing here writes the origin's .git, worktree or index (no `worktree add`).
+ */
+
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { originHead, originWorkSurfaceSha } from "./lib/mutation-qualify.ts";
+import { ORACLE_CORE_PATH, parseOracleArgs } from "./lib/qualification-oracle-core.ts";
+import { checkReceiptPath } from "./lib/qualification-receipt.ts";
+
+const SELF_REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function tripwire(dir: string): string {
+	const porcelain = spawnSync("git", ["-C", dir, "status", "--porcelain"], { encoding: "utf8" }).stdout;
+	return JSON.stringify({ head: originHead(dir), porcelain, surface: originWorkSurfaceSha(dir) });
+}
+
+export function launch(argv: string[], log = console.log, logError = console.error): number {
+	let origin: string;
+	let sha: string;
+	let ledgerOut: string | undefined;
+	try {
+		const args = parseOracleArgs(argv, true);
+		origin = path.resolve(args.origin ?? SELF_REPO);
+		sha = args.sha;
+		ledgerOut = args.ledgerOut;
+		if (ledgerOut) checkReceiptPath(ledgerOut, origin);
+	} catch (err) {
+		logError(`[qualification-oracle] ABORT: ${err instanceof Error ? err.message : String(err)}`);
+		return 2;
+	}
+	const passArgs = argv.filter((_, i) => argv[i] !== "--origin" && argv[i - 1] !== "--origin");
+
+	let interrupted: NodeJS.Signals | null = null;
+	const onSignal = (sig: NodeJS.Signals) => {
+		interrupted = sig;
+	};
+	process.on("SIGINT", onSignal);
+	process.on("SIGTERM", onSignal);
+	const before = tripwire(origin);
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-oracle-clone-"));
+	const clone = path.join(tmp, "repo");
+	let code = 2;
+	try {
+		const git = (...a: string[]) => spawnSync("git", a, { encoding: "utf8" });
+		if (git("clone", "-q", "--no-hardlinks", "--no-checkout", origin, clone).status !== 0) {
+			logError("[qualification-oracle] ABORT clone-failed");
+			return 2;
+		}
+		if (git("-C", clone, "-c", "advice.detachedHead=false", "checkout", "-q", "--detach", sha).status !== 0) {
+			logError(`[qualification-oracle] ABORT sha-unknown: ${sha} is not in ${origin}`);
+			return 2;
+		}
+		const head = git("-C", clone, "rev-parse", "HEAD").stdout.trim();
+		const clean = git("-C", clone, "status", "--porcelain").stdout === "";
+		const s1 = originWorkSurfaceSha(clone);
+		const s2 = originWorkSurfaceSha(clone);
+		if (head !== sha || !clean || s1 !== s2) {
+			logError(
+				`[qualification-oracle] ABORT clone-not-exact: head ${head}, clean ${clean}, surface stable ${s1 === s2}`,
+			);
+			return 2;
+		}
+		if (!fs.existsSync(path.join(clone, ORACLE_CORE_PATH))) {
+			logError(`[qualification-oracle] ABORT oracle-source-missing: ${sha} does not carry ${ORACLE_CORE_PATH}`);
+			return 2;
+		}
+		const child = spawnSync(process.execPath, ["--experimental-strip-types", ORACLE_CORE_PATH, ...passArgs], {
+			cwd: clone,
+			encoding: "utf8",
+			maxBuffer: 64 * 1024 * 1024,
+		});
+		if (child.stdout) log(child.stdout.replace(/\n$/, ""));
+		if (child.stderr) logError(child.stderr.replace(/\n$/, ""));
+		code = child.status === null ? 2 : child.status;
+		if (child.signal) {
+			logError(`[qualification-oracle] ABORT the oracle core ended by ${child.signal}`);
+			code = 2;
+		}
+	} finally {
+		fs.rmSync(tmp, { recursive: true, force: true });
+		process.off("SIGINT", onSignal);
+		process.off("SIGTERM", onSignal);
+		let after = "";
+		try {
+			after = tripwire(origin);
+		} catch (err) {
+			after = `unreadable: ${err instanceof Error ? err.message : String(err)}`;
+		}
+		if (after !== before) {
+			logError("[qualification-oracle] ABORT origin-moved: the origin checkout changed while the oracle ran");
+			code = 2;
+		}
+		if (interrupted) {
+			logError(`[qualification-oracle] ABORT interrupted by ${interrupted}`);
+			code = 2;
+		}
+	}
+	return code;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+	process.exit(launch(process.argv.slice(2)));
+}

package/scripts/smoke-codex-fresh-live.ts

@@ -669,12 +669,75 @@ async function run(): Promise<void> {
 			"set LIVE=1 plus ENTWURF_CODEX_APP_SERVER_PID, ENTWURF_CODEX_FRESH_MODEL, and ENTWURF_CODEX_FRESH_PI_MODEL to run; this opens real Codex and Pi windows and spends model turns.",
 		);
 	}
+
+	// ── THE OPERATOR-SUPPLIED PREREQUISITE TRIPLE, AND WHY ITS ABSENCE IS A SKIP ──
+	//
+	// Entwurf does not own the Codex app-server (VERIFY: "The A cell takes no inferred
+	// server or models"), so these three values can only come from the operator. That
+	// stays true. What was wrong is the CLASSIFICATION of their absence.
+	//
+	// `[측정 2026-09-23]` the skip line directly above promised four prerequisites in one
+	// breath — LIVE=1 *plus* the three env names — but only the first could ever produce a
+	// SKIP. The other three were `ok()` assertions, and `ok()` throws, so a missing
+	// operator input exited as FAIL. `release_gate()` supplies none of them, so this MUST
+	// step declined as a FAILURE inside every aggregate on every host: 0.25.0's own
+	// candidate receipt reads `MUST PASS=23 FAIL=1`, and the release record had to carry a
+	// prose classification explaining that the one red was "the shape of that step", and the
+	// cut stayed BLOCKED. A contract that manufactures a red every cut and then needs a human
+	// to excuse it is not a floor.
+	//
+	// `scripts/lib/step-outcome.sh` already wrote the rule this violated: "a step that RAN
+	// AND BROKE and a step that NEVER RAN are different facts, and a release record that
+	// blurs them is worthless: the first is a defect to fix, the second is a prerequisite to
+	// supply." An absent operator input is the second.
+	//
+	// So the axis is split, and the split is the whole repair:
+	//   ABSENT  (unset/empty) -> skipLive: nothing ran, the missing names are printed, and
+	//                            `--cut` still refuses it as BLOCKED (MUST SKIP). Nothing is
+	//                            excused — a cut without this receipt remains impossible.
+	//   PRESENT BUT WRONG     -> FAIL, unchanged: a malformed or dead PID, a process whose
+	//                            argv is not a Codex app-server, a foreign uid, A == S. The
+	//                            operator answered, and the answer is a defect.
+	// Nothing is inferred either way, and no default is invented for a value the operator
+	// did not give. The reproducible green is the invocation VERIFY and the release skill's
+	// P5 both now spell out, and `release_gate` needs no plumbing for it: measured on this
+	// source, that function exports no scrub and unsets nothing, so an exported triple
+	// already reaches this step.
+	//
+	// DELIBERATELY NOT MOVED: the installed-config preflights below (`codexFreshPreflight`,
+	// `codexCallerFreshPreflight`, `codexLaunchCwdFreshPreflight`). Those are host state
+	// `setup` establishes and the Codex doctors cover, and the file header's contract
+	// already decided them — "missing system birth, user MCP/status/terminal-title config,
+	// app-server, models, runtime, bridge, or tmux seat is a FAIL". A one-time answered
+	// launch directory is host setup, not a per-invocation input, and reclassifying it would
+	// be a second contract change riding this one.
+	const OPERATOR_INPUTS = [
+		["ENTWURF_CODEX_APP_SERVER_PID", "the pid of the app-server YOU started (never inferred)"],
+		["ENTWURF_CODEX_FRESH_MODEL", "the Codex-side model this cell may spend a turn on"],
+		["ENTWURF_CODEX_FRESH_PI_MODEL", "the pi-side model of the callback sibling"],
+	] as const;
+	const absentInputs = OPERATOR_INPUTS.filter(([name]) => (process.env[name]?.trim() ?? "") === "");
+	if (absentInputs.length > 0) {
+		skipLive(
+			LABEL,
+			`this cell takes no inferred server or models, and ${absentInputs.length} operator-supplied ` +
+				`prerequisite(s) are absent: ${absentInputs.map(([name, why]) => `${name} (${why})`).join("; ")}. ` +
+				"Supply them on the invocation — LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<pid> " +
+				"ENTWURF_CODEX_FRESH_MODEL=<codex-model> ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> — either for the " +
+				"standalone run or for `./run.sh release-gate <scratch> --cut`, which inherits them. " +
+				"A cut is still blocked without this receipt: --cut reads a MUST SKIP as red.",
+		);
+	}
+
 	ok("the measured/certified host axis is Linux", process.platform === "linux", `host=${process.platform}`);
 
+	// Present, so a malformed value is the operator's answer being wrong — a FAIL, not a
+	// declined prerequisite. The absence arm above already left.
 	const pidText = process.env.ENTWURF_CODEX_APP_SERVER_PID?.trim() ?? "";
 	ok(
 		"ENTWURF_CODEX_APP_SERVER_PID explicitly names the existing operator-owned app-server",
 		/^[1-9]\d*$/.test(pidText),
+		`ENTWURF_CODEX_APP_SERVER_PID=${JSON.stringify(pidText)} is not a positive decimal pid`,
 	);
 	const appServerPid = Number(pidText);
 	const procDir = `/proc/${appServerPid}`;
@@ -749,10 +812,13 @@ async function run(): Promise<void> {
 		`fixture-session=${fixtureCoordinate.sessionId}\nfixture-name=${fixtureSessionName}\n` +
 		`fixture-window=${fixtureCoordinate.windowId}`;
 
+	// Both are non-empty: the prerequisite arm at the top of `run` left otherwise. Asserting
+	// `.length > 0` again here would be a tautology dressed as a check, so the pair is
+	// RECORDED instead — the tier a live receipt is read on is a fact the evidence needs, and
+	// 0.25.0 already had to explain in prose that its pi leg ran on terra rather than luna.
 	const codexModel = process.env.ENTWURF_CODEX_FRESH_MODEL?.trim() ?? "";
 	const piModel = process.env.ENTWURF_CODEX_FRESH_PI_MODEL?.trim() ?? "";
-	ok("ENTWURF_CODEX_FRESH_MODEL explicitly names the Codex runtime model", codexModel.length > 0);
-	ok("ENTWURF_CODEX_FRESH_PI_MODEL explicitly names the Pi callback sibling model", piModel.length > 0);
+	receipts["1b-operator-supplied-models"] = `codex=${codexModel}\npi=${piModel}`;
 	const codexRuntime = resolveExecutable("codex", appServerEnv);
 	ok("the Codex runtime resolves on the app-server PATH", codexRuntime !== null);
 	const bridgeRuntime = resolveExecutable("entwurf-bridge", appServerEnv);
@@ -1016,11 +1082,19 @@ async function run(): Promise<void> {
 		message: initialPiInstruction,
 	});
 	receipts["5-fixture-to-initial-pi-v2"] = instructInitialPi.text;
+	// #120 P2: the control-socket rail answers with the ACCEPTANCE BOUNDARY the receiver observed,
+	// and every member of that closed set is a success. The initial Pi is mid-turn while the fixture
+	// addresses it, so `queued-follow-up` is an ORDINARY answer here — measured 2026-09-23, this
+	// exact step. The old `sent|delivered` pin passed only when the caller happened to be idle, and
+	// before P2 it passed on the busy path too because the rail said `sent` either way; `delivered`
+	// was never a member of the set at all. The sibling LIVE smokes took this widening in 6d90d73
+	// (`smoke-herdr-fresh-call-live.ts`, `smoke-mux-lifecycle-live.ts`); this step was missed.
 	ok(
 		"the fixture addressed the real initial Pi caller through an actual control-socket entwurf_v2 receipt",
 		!instructInitialPi.isError &&
-			/control-socket/i.test(instructInitialPi.text) &&
-			/(?:sent|delivered)/i.test(instructInitialPi.text),
+			/entwurf_v2 control-socket → (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/.test(
+				instructInitialPi.text,
+			),
 		instructInitialPi.text,
 	);
 
@@ -1325,15 +1399,22 @@ async function run(): Promise<void> {
 	assertExactSourceToolCalls(
 		piSourceToolReceipts(readInitialPiEntries()),
 		[
-			{
-				toolName: "entwurf_v2",
-				arguments: {
-					target: callerGid,
-					intent: "fire-and-forget",
-					message: initialPiNonce,
-					wants_reply: false,
-				},
-			},
+			// 0.24.0 moved a pi sibling's first action to the ZERO-ARGUMENT eighth verb, and this
+			// smoke's own launch receipt says so in the same run: "its first action is the
+			// zero-argument callback verb (codex is the one arm that still sends the nonce as
+			// arguments)". The Codex audit below therefore keeps its `entwurf_v2` shape, and only
+			// this one moves. `{}` is matched by deep-strict equality, so it pins the verb's actual
+			// contract — a target or message typed here would be a second address axis and the verb
+			// refuses it by name.
+			//
+			// Nothing is weakened by dropping the nonce from THIS expectation: the correlation is
+			// proven earlier and from the delivered body, which is where a nonce can actually be
+			// corrupted — `the initial Pi callback carries the exact launch nonce` (:970-973) reads
+			// the fixture's own mailbox, requires exactly one exact match and refuses duplicates,
+			// and the two cells beside it bind that callback's sender envelope to a real pi V3
+			// citizen. This audit's job is the different one its name says: exactly these calls,
+			// once each, and nothing else.
+			{ toolName: "entwurf_callback", arguments: {} },
 			{
 				toolName: "entwurf_fresh_call",
 				arguments: {

package/scripts/smoke-herdr-fresh-call-live.ts

@@ -83,6 +83,16 @@ import { joinKeyOf, parseHerdrPaneList } from "../pi-extensions/lib/herdr-placem
 import { assessLauncherCleanup, snapshotClaudeLauncher, verifyClaudeLauncher } from "./lib/claude-launcher-fence.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
+/**
+ * #120 P2: the control-socket rail answers with the ACCEPTANCE BOUNDARY the receiver observed, and
+ * every member of that set is a success. The caller here is mid-turn while its child calls back,
+ * so `queued-steer` is the ORDINARY answer — the old literal `→ sent` pin would have gone red on
+ * the common case and passed only when the caller happened to be idle. What must still be absent
+ * is a REFUSAL, which the negative beside it now names directly (`rejected` / `failed`) instead of
+ * as "anything that is not the word sent".
+ */
+const CONTROL_ACCEPTED = /entwurf_v2 control-socket → (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/;
+
 const LABEL = "smoke-herdr-fresh-call-live";
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const REAL_HOME = process.env.HOME ?? os.homedir();
@@ -849,10 +859,7 @@ async function main(): Promise<void> {
 					callId === null
 						? -1
 						: childRecords.findIndex(
-								(record, i) =>
-									i > callAt &&
-									record.includes("entwurf_v2 control-socket → sent") &&
-									toolResultIdOf(record) === callId,
+								(record, i) => i > callAt && CONTROL_ACCEPTED.test(record) && toolResultIdOf(record) === callId,
 							);
 				// The LAST mention of the task token, so the birth prompt — which carries it, first —
 				// cannot be what satisfies "the work came after".
@@ -864,14 +871,14 @@ async function main(): Promise<void> {
 					}
 				}
 				ok(
-					`${cell.label}: the child decoded the one-line birth argv and ran the task only AFTER its callback — the \`sent\` outcome belongs, by toolCallId, to the very call that carried the delivered nonce, and the task token appears in a record after it`,
+					`${cell.label}: the child decoded the one-line birth argv and ran the task only AFTER its callback — the ACCEPTED outcome belongs, by toolCallId, to the very call that carried the delivered nonce, and the task token appears in a record after it`,
 					nonce.length > 0 && callAt >= 0 && sentAt > callAt && workedAt > sentAt,
 				);
 				ok(
-					`${cell.label}: the child's OWN tool result says the callback was DELIVERED on the rail its caller answers on — \`entwurf_v2 control-socket → sent\` — not a timeout, not a reject, not a dirty lock`,
-					childText.includes("entwurf_v2 control-socket → sent") &&
+					`${cell.label}: the child's OWN tool result says the callback was ACCEPTED on the rail its caller answers on — one of \`sent|queued-steer|queued-follow-up|accepted-unknown-boundary\` — not a timeout, not a reject, not a dirty lock`,
+					CONTROL_ACCEPTED.test(childText) &&
 						!/entwurf_v2 [a-z-]+ (?:execution failed:|DELIVERED \()/.test(childText) &&
-						!/entwurf_v2 control-socket → (?!sent)[a-z-]+/.test(childText),
+						!/entwurf_v2 control-socket → (?:rejected|failed)/.test(childText),
 				);
 			} else {
 				const childActivity = mcpActivityBySession(root).get(childNative) ?? [];

package/scripts/smoke-herdr-raw-install-live.sh

@@ -490,7 +490,7 @@ for (const name of ["entwurf", "entwurf-bridge", "entwurf-statusline"]) {
 }
 
 // The REAL subcommand, from the installed bin, under node_modules — which is the branch of
-// start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (run.sh:5187), so a
+// start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (`EXPECT_TOOLS` in run.sh check-bridge), so a
 // zero exit here is the artifact listing all seven garden verbs and no eighth.
 const run = spawnSync(path.join(binDir, "entwurf"), ["check-bridge"], { encoding: "utf8" });
 const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
@@ -507,6 +507,7 @@ const verbs = (said.match(/entwurf_[a-z0-9_]+/g) ?? []).filter((v, i, a) => a.in
 // one; the two disagreeing is the signal, and a verb genuinely added upstream reddens this
 // smoke until somebody says so here too.
 const EXPECTED_VERBS = [
+  "entwurf_callback",
   "entwurf_fresh_call",
   "entwurf_inbox_read",
   "entwurf_peers",
@@ -519,7 +520,7 @@ console.log(`  VERBS ${verbs.join(",") || "<none>"}`);
 if (run.status === 0) ok(`entwurf check-bridge exit 0 from the installed bin (${verbs.length} verbs listed)`);
 else no(`entwurf check-bridge exit ${run.status}: ${said.trim().slice(0, 400)}`);
 JSON.stringify(verbs) === JSON.stringify(EXPECTED_VERBS)
-  ? ok(`the receipt names EXACTLY the seven garden verbs (${EXPECTED_VERBS.length}), parsed from what the installed bin answered`)
+  ? ok(`the receipt names EXACTLY the eight garden verbs (${EXPECTED_VERBS.length}), parsed from what the installed bin answered`)
   : no(`verb set mismatch — want ${JSON.stringify(EXPECTED_VERBS)} got ${JSON.stringify(verbs)}`);
 process.exit(bad);
 ' "$ACTIVE" "$REGISTRY" "$PLUGIN_ID" || fail=1
@@ -713,8 +714,13 @@ run_fan() {
 fan_no_server="$(run_fan)"; fan_no_server_rc=$?
 echo "$fan_no_server" | sed 's/^/    /'
 echo "    → exit $fan_no_server_rc"
-if [ "$fan_no_server_rc" -ne 0 ] && printf '%s' "$fan_no_server" | grep -q '^herdr-agent-list-failed'; then
-  ok "with no herdr server the fan names herdr-agent-list-failed and goes red (not an empty table)"
+# Since #120, each block owns its own verdict: a failed `agent list` is indented inside
+# [4] CITIZENS, not at column zero above the report. Anchor both the owner block and its
+# exact failure line; a mention in the closing guidance or a different block is no receipt.
+if [ "$fan_no_server_rc" -ne 0 ] &&
+   printf '%s\n' "$fan_no_server" | grep -q '^\[4\] CITIZENS — owner: entwurf; read now, this open$' &&
+   printf '%s\n' "$fan_no_server" | grep -q '^  herdr-agent-list-failed: exit [1-9]'; then
+  ok "with no herdr server the CITIZENS block names herdr-agent-list-failed and goes red (not an empty table)"
 else
   bad "with no herdr server the fan answered rc=$fan_no_server_rc without naming herdr-agent-list-failed"
 fi
@@ -740,6 +746,62 @@ if printf '%s' "$fan_with_server" | grep -qx '1 citizen(s) not shown: nobody cou
 else
   bad "the fan drew no '1 citizen(s) not shown ... (unobserved)' accounting for the citizen born in [7]"
 fi
+
+# ── 8b. the SAME fan with the ENTWURF_BIN crutch REMOVED (#116 A-D3=C) ──────
+# The two runs above hand the pane `ENTWURF_BIN`, which is exactly the operator crutch D3=C exists
+# to delete: with it, this cell stays green whether or not the ledger fallback exists, so it can
+# certify nothing about the first screen a real user sees. `plugins/herdr/README.md` says the plugin
+# puts NOTHING on PATH, so pathless is the state a correct install actually leaves behind.
+# The herdr server from [8] is still up — the fan's second read needs it, and [9] stops it below.
+PATHLESS="$(printf '%s' "$PATH" | tr ':' '\n' | while IFS= read -r d; do [ -n "$d" ] && [ -x "$d/entwurf" ] || printf '%s\n' "$d"; done | paste -sd:)"
+run_fan_pathless() {
+  env -u ENTWURF_BIN PATH="$PATHLESS" HERDR_BIN_PATH="$(command -v herdr)" node "$FAN" </dev/null 2>&1
+}
+if command -v entwurf >/dev/null 2>&1 && PATH="$PATHLESS" command -v entwurf >/dev/null 2>&1; then
+  bad "the pathless PATH still resolves an entwurf — this cell would prove nothing"
+else
+  ok "the pathless PATH resolves no entwurf (the crutch is really gone, not merely unset)"
+fi
+
+fan_pathless="$(run_fan_pathless)"; fan_pathless_rc=$?
+echo "$fan_pathless" | sed 's/^/    /'
+echo "    → exit $fan_pathless_rc"
+# The IDENTICAL literal the crutched run asserts at the cell above, so the two runs are comparable
+# rather than two different claims.
+if [ "$fan_pathless_rc" -eq 0 ] && printf '%s' "$fan_pathless" | grep -qx '1 citizen(s) not shown: nobody could observe placement for them (unobserved)\.'; then
+  ok "[QK:HRIL-FAN-LEDGER-FALLBACK] with NO ENTWURF_BIN and no entwurf on PATH, the certified activation ledger supplies the runtime and the citizen read completes — the same accounting sentence, from a binary nobody put on PATH"
+else
+  bad "the ledger-fallback claim failed: pathless fan rc=$fan_pathless_rc did not reproduce the crutched run's citizen accounting"
+fi
+if printf '%s' "$fan_pathless" | grep -q 'via activation-ledger'; then
+  ok "the pathless run says WHICH source supplied the binary, so the fallback cannot be mistaken for a PATH hit"
+else
+  bad "the pathless run did not name activation-ledger as the binary's source"
+fi
+
+# ── 8c. pathless AND no ledger: the CITIZEN axis alone skips, and it is not red ──
+# The other half of the same contract. A host that never activated must not read as broken, and the
+# three blocks that need no entwurf binary must still answer.
+# XDG_STATE_HOME is redirected TOO, and that is the whole isolation: the ledger lives under XDG
+# **state** ($LEDGER above) while the runtime lives under XDG **data**. Moving only the second would
+# leave this cell reading the real host's ledger, and "no ledger here" would be unfalsifiable.
+HOMELESS="$(mktemp -d)"
+fan_no_ledger="$(env -u ENTWURF_BIN PATH="$PATHLESS" HOME="$HOMELESS" XDG_DATA_HOME="$HOMELESS/.local/share" \
+  XDG_STATE_HOME="$HOMELESS/.local/state" \
+  HERDR_BIN_PATH="$(command -v herdr)" node "$FAN" </dev/null 2>&1)"; fan_no_ledger_rc=$?
+echo "$fan_no_ledger" | sed 's/^/    /'
+echo "    → exit $fan_no_ledger_rc"
+if [ "$fan_no_ledger_rc" -eq 0 ] &&
+   printf '%s' "$fan_no_ledger" | grep -q 'entwurf-not-found' &&
+   printf '%s' "$fan_no_ledger" | grep -q '\[1\] HERDR INTEGRATION' &&
+   printf '%s' "$fan_no_ledger" | grep -q '\[2\] ENTWURF ACTIVATION' &&
+   printf '%s' "$fan_no_ledger" | grep -q '\[3\] RAILS'; then
+  ok "[QK:HRIL-FAN-NO-LEDGER-SKIPS-CITIZENS-ONLY] with no ledger and no runtime the CITIZEN block alone skips by name at exit 0, and blocks 1-3 still render — never activating is a state, not a defect, and this is what stops D3=C drifting into 'install it from the pane'"
+else
+  bad "the no-ledger citizen-skip claim failed: fan rc=$fan_no_ledger_rc did not render blocks 1-3 with a citizen-only skip"
+fi
+rm -rf "$HOMELESS"
+
 herdr server stop >/dev/null 2>&1 || true
 
 # ── 8a. the SHIPPED LAUNCHER, from the bin the user actually received ───────

package/scripts/smoke-meta-install-state.sh

@@ -380,6 +380,74 @@ cell(
     "#94 compaction keys relinquish across nested/string axes: restore, delete, operator-changed, fresh, type-strict",
     compaction_cells,
 )
+
+TURN_DURATION = "showTurnDuration"
+
+def turn_duration_cells():
+    # GLG's ruling: showTurnDuration reports how long a turn took. That is
+    # operator INFORMATION, not a single-driver policy surface, so entwurf must
+    # neither own it nor force it to false.
+    #
+    # The claim is measured against the two constants and the real leaf, never
+    # quoted from a comment: a drift that puts the key back under management has
+    # to redden HERE and not only at the drive level, because the drive level
+    # runs one install shape while the constant governs every host.
+    managed = m.managed_keys()["settings"]["scalar"]
+    assert TURN_DURATION not in managed, managed
+    assert TURN_DURATION not in m._managed_scalar_names
+    assert TURN_DURATION in m._retired_scalar_names
+    retired = {name: last for name, _path, last in m.RETIRED_SETTINGS_SCALARS}
+    # The last managed value is the comparison relinquishment turns on. A wrong
+    # one here would either skip a value we really wrote or overwrite one we
+    # never did, so it is pinned by type as well as equality.
+    assert retired[TURN_DURATION] is False, retired[TURN_DURATION]
+
+    path = [TURN_DURATION]
+
+    def call(current=MISSING, old=MISSING):
+        settings = {} if current is MISSING else {TURN_DURATION: current}
+        keys = {} if old is MISSING else {TURN_DURATION: copy.deepcopy(old)}
+        state = {"files": {"settings": {"keys": keys}}}
+        m.relinquish_retired_scalar(state, settings, TURN_DURATION, path, False)
+        return state, settings
+
+    def led(existed, value):
+        return {"kind": "scalar", "path": path, "original": {"existed": existed, "value": value}}
+
+    # THE MEASURED HOST SHAPE (2026-09-23): ledger says we wrote false over a
+    # pre-install false, and the operator has since set true. Their true must
+    # survive, and the entry must be consumed so uninstall cannot reach back.
+    state, settings = call(True, led(True, False))
+    assert settings[TURN_DURATION] is True, settings
+    assert TURN_DURATION not in state["files"]["settings"]["keys"]
+    # Consumption is the inverse: restore_entry is the only writer uninstall has,
+    # and with the row gone there is no entry left to hand it.
+    before = copy.deepcopy((state, settings))
+    m.relinquish_retired_scalar(state, settings, TURN_DURATION, path, False)
+    assert (state, settings) == before
+
+    # Still carrying OUR false, with provenance -> undo our own write honestly.
+    state, settings = call(False, led(True, False))
+    assert settings[TURN_DURATION] is False, settings
+    state, settings = call(False, led(False, None))
+    assert TURN_DURATION not in settings, settings
+
+    # No provenance at all -> the value is the operator's whatever it says.
+    for current in [True, False, MISSING]:
+        state, settings = call(current)
+        assert settings == ({} if current is MISSING else {TURN_DURATION: current})
+
+    # Type strictness on the bool axis: `0 == False` while `type(0) is not bool`,
+    # so an untyped comparison would rewrite a value that was never ours.
+    state, settings = call(0, led(True, False))
+    assert settings[TURN_DURATION] == 0 and type(settings[TURN_DURATION]) is int
+
+cell(
+    "[QK:META-RETIRE-TURN-DURATION-OPERATOR-OWNED]",
+    "showTurnDuration is operator-owned: unmanaged in the SSOT, retired at false, "
+    "and relinquishment preserves the measured live true while consuming the ledger entry",
+    turn_duration_cells,
+)
 sys.exit(failed)
 PY
 then ok "#71 retirement leaf: provenance, bool strictness, malformed refusal, one-shot convergence"
@@ -409,6 +477,10 @@ assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['va
 assert 'autoCompactEnabled' not in s['files']['settings']['keys']
 assert 'env.DISABLE_AUTOCOMPACT' not in s['files']['settings']['keys']
 assert 'skipDangerousModePermissionPrompt' not in s['files']['settings']['keys']
+# Same for showTurnDuration: a fresh install takes no ownership evidence for it,
+# so on a host entwurf meets for the first time there is nothing to relinquish
+# and nothing uninstall could ever restore.
+assert 'showTurnDuration' not in s['files']['settings']['keys']
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
 PY
 then ok "state captures original scalar/map values, excludes the retired scalar, and is mode 0600"; else bad "state did not capture original values / retirement / mode 0600"; fi
@@ -440,6 +512,18 @@ state['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']={
   'kind':'scalar', 'path':['env','DISABLE_AUTOCOMPACT'],
   'original':{'existed':True, 'value':'0'}
 }
+# showTurnDuration: the upgrade shape MEASURED on the source host 2026-09-23,
+# planted verbatim so apply() is judged against the state a real prior version
+# left behind. The ledger proves entwurf wrote `false` over a pre-install
+# `false`; the live value is the `true` the operator set afterwards. This is the
+# only branch where relinquishment could plausibly damage an operator choice —
+# restoring the snapshot here would hand `false` back to somebody who had since
+# turned the display on — so it is the branch the drive level must carry.
+settings['showTurnDuration']=True
+state['files']['settings']['keys']['showTurnDuration']={
+  'kind':'scalar', 'path':['showTurnDuration'],
+  'original':{'existed':True, 'value':False}
+}
 json.dump(settings, open(sp,'w'), indent=2); open(sp,'a').write('\n')
 json.dump(state, open(stp,'w'), indent=2); open(stp,'a').write('\n')
 PY
@@ -459,9 +543,16 @@ assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
 assert 'autoCompactEnabled' not in settings
 assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
-for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
+for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert settings[key] is False, key
 assert settings['skipDangerousModePermissionPrompt'] is False
+# showTurnDuration retirement, drive level. Two facts that must not be read off
+# one assertion: the operator's PRE-install `true` (fixture) is still `true`
+# AFTER apply, and it is still `true` because apply never wrote the key rather
+# than because it happened to write the same value. The upgrade shape planted
+# above supplies the second half — a ledger entry proving entwurf wrote `false`
+# here, over a live `true` the operator set afterwards.
+assert settings['showTurnDuration'] is True
 # #94 drive-level relinquishment, both branches:
 #   nested path  -> the operator's pre-entwurf '0' is back, and the env map that
 #                   carries it survives with the neighbour key untouched.
@@ -473,6 +564,9 @@ state=json.load(open(cfg + '/entwurf.install-state.json'))
 assert 'skipDangerousModePermissionPrompt' not in state['files']['settings']['keys']
 assert 'autoCompactEnabled' not in state['files']['settings']['keys']
 assert 'env.DISABLE_AUTOCOMPACT' not in state['files']['settings']['keys']
+# The consumed entry is the whole inverse: with no ledger row left, uninstall()
+# has no authority over this key and can never write our `false` back.
+assert 'showTurnDuration' not in state['files']['settings']['keys']
 for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
     assert item in settings['permissions']['allow'], item
 assert settings['permissions']['allow'].count('Read') == 1
@@ -493,6 +587,13 @@ then ok "apply installs managed keyset without clobbering unrelated keys"; else
 if py check >/dev/null 2>&1; then ok "survival check passes after relinquishing the retired scalar"; else bad "survival check failed right after retirement apply"; fi
 MANAGED_JSON="$(py managed-keys)"
 if printf '%s' "$MANAGED_JSON" | grep -q 'skipDangerousModePermissionPrompt'; then bad "managed-keys still claims the retired operator key"; else ok "managed-keys returns skipDangerousModePermissionPrompt to the operator"; fi
+# managed-keys is the CROSS-REPO contract: check-keyset-overlap and the
+# agent-config fragment read it to stay disjoint. Measured 2026-09-23 —
+# `check-keyset-overlap agent-config/claude/settings.fragment.json` failed on
+# exactly one key, showTurnDuration, because both sides claimed it. Dropping our
+# claim is what resolves that collision, so the SSOT output is asserted here and
+# not only in the Python constants.
+if printf '%s' "$MANAGED_JSON" | grep -q 'showTurnDuration'; then bad "managed-keys still claims showTurnDuration — a consumer fragment setting the operator's own value would keep colliding"; else ok "managed-keys returns showTurnDuration to the operator (cross-repo collision resolved at the SSOT)"; fi
 # A provenance-less true cannot be changed safely, but doctor/check must make it visible.
 python3 - <<'PY'
 import json, os
@@ -577,6 +678,11 @@ assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == '/old/user/statusline.sh'
 assert settings['promptSuggestionEnabled'] is True
 assert settings['skipDangerousModePermissionPrompt'] is False
+# showTurnDuration survives uninstall at the operator's value. The install above
+# ran against a ledger row saying entwurf had written `false` here; relinquish
+# consumed that row, so uninstall reaches this key with no authority at all and
+# the `true` the operator set is still `true`. The key must also be ABSENT from
+# the removal list below — a retired key is neither restored nor deleted.
 assert settings['showTurnDuration'] is True
 # One list, one meaning: these are the keys UNINSTALL removed. `autoCompactEnabled`
 # is not among them post-#94 — that entwurf never introduced it is a different

package/scripts/smoke-mux-lifecycle-live.ts

@@ -786,9 +786,16 @@ async function main(): Promise<void> {
 				mode: "follow_up",
 				message: `Scene 2 (${liveNeedle}): you were told a color. Reply with that color only, then stop.`,
 			});
+			// #120 P2: the rail answers with the ACCEPTANCE BOUNDARY, and this send names `follow_up`
+			// against a citizen that may well be mid-turn — `queued-follow-up` is a correct, normal
+			// answer here. Pinning the word `sent` would have demanded an idle receiver the scene
+			// never promises. What is asserted is the rail plus an accepted boundary; a refusal
+			// still fails through `isError`.
 			ok(
-				`${cell}: tools/call entwurf_v2 fire-and-forget delivered on the CONTROL-SOCKET rail to the fresh citizen`,
-				!send.isError && send.text.includes("control-socket") && send.text.includes("sent"),
+				`${cell}: tools/call entwurf_v2 fire-and-forget was ACCEPTED on the CONTROL-SOCKET rail by the fresh citizen`,
+				!send.isError &&
+					send.text.includes("control-socket") &&
+					/→ (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/.test(send.text),
 				`--- response ---\n${send.text}\n--- bridge stderr ---\n${bridge.stderrTail()}`,
 			);
 			receipts[`${cell}/3-live-send`] = send.text;