@junghanacs/entwurf 0.12.5 → 0.12.6

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.6 — 2026-07-03
+
+### Fixed
+
+- **Claude Code meta-bridge live marketplace sources now live outside the checkout for dev and npm installs alike.** Development clones and installed packages both assemble the plugin bundle under `$XDG_DATA_HOME/entwurf/meta-bridge/.assembled`; the checkout or `node_modules` tree is now only the source origin. This removes the class where `pnpm check`, `git clean -xfd`, or a repo-local uninstall smoke could delete a user-scope Claude marketplace source and leave new Claude Code sessions at statusline `?`. The installer still chooses `.ts` vs compiled `.js` hook artifacts by source origin, but the live registration path is the same XDG artifact lane.
+- **Meta-bridge uninstall now uses the recorded live-artifact path and fails before side effects when the state is corrupt.** The install state's `assembledMarketplacePath` is the SSOT for uninstall, doctor, and state checks. Uninstall validates the full `…/entwurf/meta-bridge/.assembled` suffix before removing Claude plugin/MCP registrations or deleting state, so malformed paths such as `/` or `…/entwurf/meta-bridge/not-assembled` fail loud with zero Claude side effects and leave state/artifacts intact. `state.py check` also rejects missing, empty, or malformed recorded paths even when settings agree with the corruption.
+- **User-scope pi package registration is now part of setup.** `./run.sh setup` registers `entwurf` in user-scope pi settings so `--entwurf-control` and the provider surface load from foreign cwd sessions, not only from a project-local `.pi/settings.json`. A hermetic `smoke-user-scope-citizen` covers idempotency, stale normalization, remove symmetry, unrelated-key preservation, and corrupt-shape fail-loud behavior.
+
+### Changed
+
+- **The install toolchain is now aligned to one pnpm 11 lane and one setup surface.** The repo dropped the obsolete `packageManager` pin and `.npmrc`, moved pnpm policy to `pnpm-workspace.yaml`, updated CI to pnpm 11.9, and treats `./run.sh setup` as the single local install path instead of a split `pi install` flow.
+- **The next delivery lane is pinned before implementation.** `NEXT.md` now records the agy/Antigravity delivery adapter constraints: direct-inject/native-push is separate from pi's control-socket liveness domain, registration is explicit, receiver markers are not reused for native-push replyability, and install/doctor/uninstall must inherit the source-origin/live-artifact boundary proven by this release.
+- **The future fresh-spawn lane stays mux-visible by default.** The mux driver plan now keeps minting and mux transport separate, treats tmux/zmx as drivers behind a leaf interface, and keeps fresh pi-native GPT launch visible instead of reviving hidden background one-shots as the default.
+
+### Verification
+
+- `pnpm check` passed on 2026-07-03 after the XDG live-artifact move, recorded-path uninstall hardening, user-scope citizen smoke, pnpm 11 setup cleanup, and NEXT lane updates.
+- `./run.sh smoke-meta-install-state` passed with the new direct install→XDG proof, recorded-path mismatch case, corrupt basename/missing-field fail-loud cases, and checkout-internal `.assembled` boundary fingerprint.
+- `./run.sh doctor-meta-bridge` passed on 2026-07-03 with source/assembled/installed writer parity all v2 and the assembled bundle under `$XDG_DATA_HOME/entwurf/meta-bridge/.assembled`.
+- `./run.sh check-pack-install` passed on 2026-07-03, proving the npm consumer path keeps the stable XDG marketplace source and user-scope pi citizen registration.
+- `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.6.ddCcmz` passed on 2026-07-03; log `/tmp/pi-tmux-entwurf-release-gate-0126.log`; summary `MUST: PASS=17 FAIL=0 SKIP=0`, advisory `BEHAVIOR: PASS=0 FAIL=1` (`smoke-resident-garden-guard` positive `/gnew T3` model-in-loop identity turn; non-blocking).
+
 ## 0.12.5 — 2026-07-01
 
 ### Fixed

package/VERIFY.md

@@ -88,46 +88,36 @@ The goal is not merely "invoke Claude Code." We want:
 
 ## 1. Setup
 
-entwurf supports two install paths; both end in the same runtime state (a valid `.pi/settings.json` with `entwurfProvider.mcpServers` wired) and differ only in who owns the checkout.
+**One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
-| Path | Who | Shape |
-|------|-----|-------|
-| **A — Consumer** | end-user of pi | `pi install git:…` + one `run.sh install .` |
-| **B — Developer** | contributor / first user | `git clone …` + `pi install ./` + `run.sh install …` |
-
-### 1.1 Path A — consumer install
+1. `pnpm install` — bundles pi (a dev/peer dependency; no separate `pi install` step) and builds the bridge
+2. project wiring → `<project>/.pi/settings.json` `entwurfProvider.mcpServers.entwurf-bridge`
+3. meta-bridge global plugin — only when a native harness (`claude`) is on PATH; a pi-only host skips it cleanly
+4. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
 
 ```bash
-pi install git:github.com/junghan0611/entwurf          # pi auto-clones + installs deps
-cd /path/to/consumer-project
-~/.pi/agent/git/github.com/junghan0611/entwurf/run.sh install .   # wire bundled mcpServers
-pi --list-models entwurf                               # curated model surface
-pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
+git clone https://github.com/junghan0611/entwurf /path/to/entwurf && cd $_
+./run.sh setup /path/to/consumer-project
+# re-run the SAME command any time to repair a broken install
 ```
 
-Expected: the package appears under pi's `User packages`; `install .` logs `added entwurfProvider.mcpServers.entwurf-bridge` + `updated <project>/.pi/settings.json`; the smoke returns a one-word reply (full bootstrap → ACP session → bridge → clean shutdown). Note: `~/.pi/agent/git/.../entwurf` is pi-managed — do not edit it (a `pi update` overwrites). Step 2 is still required after `pi install git:…`.
+Expected tail: `DONE: entwurf setup (pi package + meta-bridge + v2 install smoke) green.` On a host with `claude`, verify the native wiring with `./run.sh doctor-meta-bridge`.
+
+The wiring / meta-bridge / smoke steps are internal building blocks of `setup` (`install_local_package`, `scripts/meta-bridge-install.sh`, `validate_entwurf_bridge`) — call `setup`, never the parts. Consumers who `npm install @junghanacs/entwurf` get the obvious npm surface; that path is not the developer concern here.
 
-### 1.2 Path B — developer install
+### 1.1 Variables (optional)
 
 ```bash
-git clone https://github.com/junghan0611/entwurf /path/to/entwurf && cd $_
-pnpm install                                   # pnpm is the pinned packageManager
-pi install ./
-./run.sh install /path/to/consumer-project
-pnpm check                                     # full deterministic floor
-pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"
-LIVE=1 ./run.sh release-gate /path/to/consumer-project
+export REPO_DIR=/path/to/entwurf
+export PROJECT_DIR=/path/to/consumer-project
+cd "$REPO_DIR" && ./run.sh setup "$PROJECT_DIR"
 ```
 
-`install` is idempotent; user-authored `mcpServers.<name>` overrides survive a re-run (`preserved (user override: …)`). `run.sh remove <dir>` deletes only entries whose command matches the repo-authored launcher.
-
-### 1.3 Setup shortcut + variables
+### 1.2 Live acceptance (optional)
 
 ```bash
-export REPO_DIR=...        # Path A: $HOME/.pi/agent/git/github.com/junghan0611/entwurf ; Path B: your clone
-export PROJECT_DIR=/path/to/consumer-project
-export CACHE_DIR=$HOME/.pi/agent/cache/entwurf/sessions
-cd "$REPO_DIR" && ./run.sh setup "$PROJECT_DIR"
+LIVE=1 ./run.sh release-gate /path/to/consumer-project
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
 ```
 
 `setup` runs `pnpm install` + `install` + meta-bridge (native harness) + the v2 install smoke; a green `setup` implies the settings.json wiring and install surface are healthy. The full live floor is still `LIVE=1 ./run.sh release-gate`.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.5",
+	"version": "0.12.6",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -65,7 +65,6 @@
 	"engines": {
 		"node": ">=22.6.0"
 	},
-	"packageManager": "pnpm@10.33.0",
 	"dependencies": {
 		"@agentclientprotocol/claude-agent-acp": "0.54.1",
 		"@agentclientprotocol/sdk": "1.1.0",
@@ -120,7 +119,7 @@
 		"format": "biome check --write .",
 		"check-meta-manifest-schema": "./run.sh check-meta-manifest-schema",
 		"check-package-source-routing": "./run.sh check-package-source-routing",
-		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-record-v2 && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-meta-dual-read && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-migration && ./run.sh check-meta-dual-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-entwurf-mailbox-guard && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-pack"
+		"check": "pnpm lint && pnpm typecheck && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-record-v2 && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-meta-dual-read && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-migration && ./run.sh check-meta-dual-consumers && ./run.sh check-meta-capability-source && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh smoke-meta-install-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-package-source-routing && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-install-preflight && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-boot && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-v2-spawn && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-spawn-production && ./run.sh check-entwurf-facts && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-entwurf-mailbox-guard && ./run.sh check-auth-boundary && ./run.sh check-acp-provider-surface && ./run.sh check-acp-sdk-surface && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-acp-carrier-augment && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [

package/run.sh

@@ -91,12 +91,13 @@ Usage:
   ./run.sh smoke-meta-async-drift     # 1.0.0 meta-bridge step 1: drift sentinel — version pins + Claude binary undocumented-behavior markers (LIVE=1 adds plugin watch-arm probe)
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
   ./run.sh smoke-claude-native-resume-live # LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path
 
-  ./run.sh install-meta-bridge        # 1.0.0 meta-bridge Phase 2: stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
+  ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # 1.0.0 meta-bridge Phase 2: fail-loud doctor — toolchain + state + plugin/MCP + store scan + hook errors + SessionStart evidence + writer-version parity (source↔assembled↔installed: FAIL on a stale deployed meta-record writer)
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
@@ -106,7 +107,7 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with 0.80.x peers
   ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
-  ./run.sh install [project-dir]      # install this local package into project .pi/settings.json
+  ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh setup:links [--force]      # repair ~/.pi/agent/entwurf-targets.json link (use --force to replace a stale operator file or wrong symlink; a .bak is taken)
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json
 
@@ -239,11 +240,67 @@ preflight_dep_integrity() {
   fi
 }
 
+preflight_pi_settings_shapes() {
+  local project_settings="$1"
+  local user_settings="$2"
+  python3 - "$project_settings" "$user_settings" <<'PY'
+import json, sys
+from pathlib import Path
+
+project = Path(sys.argv[1])
+user = Path(sys.argv[2])
+
+def load_object(path: Path, label: str):
+    if not path.exists():
+        return None
+    data = json.loads(path.read_text())
+    if not isinstance(data, dict):
+        raise SystemExit(f"{label} settings is not a JSON object: {path}")
+    return data
+
+def check_packages(data, path: Path, label: str):
+    if data is None:
+        return
+    packages = data.get("packages")
+    if packages is not None and not isinstance(packages, list):
+        raise SystemExit(f"{label} settings packages is not a JSON array: {path}")
+
+def check_project_provider(data, path: Path):
+    if data is None:
+        return
+    provider = data.get("entwurfProvider")
+    if provider is None:
+        return
+    if not isinstance(provider, dict):
+        raise SystemExit(f"project settings entwurfProvider is not an object: {path}")
+    servers = provider.get("mcpServers")
+    if servers is not None and not isinstance(servers, dict):
+        raise SystemExit(f"project settings entwurfProvider.mcpServers is not an object: {path}")
+
+project_data = load_object(project, "project")
+user_data = load_object(user, "user")
+check_packages(project_data, project, "project")
+check_packages(user_data, user, "user")
+check_project_provider(project_data, project)
+PY
+}
+
 install_local_package() {
-  local project_dir
+  local project_dir agent_dir
   project_dir=$(normalize_project_dir "$1")
+  agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   preflight_dep_integrity
+  # Fail BEFORE any settings write if either target config already has a corrupt
+  # shape. The packages[] SSOT and provider writer run in two separate steps, so
+  # without this preflight a bad entwurfProvider could leave a half-installed
+  # packages[] entry behind (2026-07-03 install-boundary hardening).
+  preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$agent_dir/settings.json"
   mkdir -p "$project_dir/.pi"
+  # packages[] registration via the shared SSOT — same is_entwurf_source
+  # predicate + idempotency as user-scope and remove (not a substring match).
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  # entwurfProvider.mcpServers + legacy prune (project-scope only; packages[] was
+  # already written above by register-pi-package.py).
   python3 - "$project_dir/.pi/settings.json" "$REPO_DIR" <<'PY'
 import json, sys
 from pathlib import Path
@@ -258,23 +315,6 @@ if settings_path.exists():
 else:
     data = {}
 
-# --- packages[] registration --------------------------------------------------
-packages = data.get("packages")
-if not isinstance(packages, list):
-    packages = []
-
-filtered = []
-for item in packages:
-    source = item.get("source") if isinstance(item, dict) else item
-    if isinstance(source, str) and ("entwurf" in source) and source != repo_dir:
-        continue
-    filtered.append(item)
-
-if repo_dir not in filtered:
-    filtered.append(repo_dir)
-
-data["packages"] = filtered
-
 # --- entwurfProvider.mcpServers bundled entries ---------------------------
 # Ship the two in-repo MCP adapters pre-wired so `pi install` produces a
 # working setup without the consumer hand-editing settings.json. User-authored
@@ -334,9 +374,25 @@ for name, reason in LEGACY_BUNDLED.items():
 
 settings_path.write_text(json.dumps(data, indent=2) + "\n")
 print(f"install: updated {settings_path}")
-print(f"install: package source -> {repo_dir}")
 PY
   ensure_agent_dir_symlinks
+  register_user_scope_citizen
+}
+
+# Register entwurf as a pi USER-SCOPE citizen so its extensions
+# (entwurf-control.ts → --entwurf-control / --emacs-agent-socket) load from ANY
+# cwd, not only inside the entwurf checkout. project-scope `.pi/settings.json`
+# only applies when pi runs inside the repo; the `pit`/`pia`/`pihome` global
+# launchers and the npm consumer's "installs → just works" both need the entry
+# in ~/.pi/agent/settings.json's packages[]. This is the wiring that dropped when
+# `pi install` was removed from setup (2026-07-03: `--entwurf-control` unknown in
+# a foreign cwd). Idempotent: absent → append, present → no-op; a stale entwurf
+# entry at a different path is normalized to REPO_DIR. Every other package and key
+# in the operator's user settings is preserved untouched.
+register_user_scope_citizen() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR"
 }
 
 # Ensure agent-level resources that entwurf code reads from
@@ -424,6 +480,14 @@ ensure_agent_dir_symlinks() {
 remove_local_package() {
   local project_dir
   project_dir=$(normalize_project_dir "$1")
+  # Same fail-before-write rule as install: remove has two writers too
+  # (packages[] SSOT, then entwurfProvider cleanup), so a malformed provider must
+  # not leave a half-removed packages[] entry behind.
+  preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$(mktemp -u)"
+  # packages[] cleanup via the shared SSOT — same is_entwurf_source predicate as
+  # install, so remove never over-deletes a look-alike repo (entwurf-notes, …)
+  # that install would never have registered.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR" --remove
   python3 - "$project_dir/.pi/settings.json" "$REPO_DIR" <<'PY'
 import json, sys
 from pathlib import Path
@@ -438,19 +502,6 @@ data = json.loads(settings_path.read_text())
 if not isinstance(data, dict):
     raise SystemExit("settings.json is not an object")
 
-# --- packages[] cleanup -------------------------------------------------------
-packages = data.get("packages")
-pkg_removed = 0
-if isinstance(packages, list):
-    filtered = []
-    for item in packages:
-        source = item.get("source") if isinstance(item, dict) else item
-        if isinstance(source, str) and ("entwurf" in source):
-            pkg_removed += 1
-            continue
-        filtered.append(item)
-    data["packages"] = filtered
-
 # --- entwurfProvider.mcpServers cleanup ------------------------------------
 # Only remove entries that look like they came from ./run.sh install: either
 # the command matches the current $REPO_DIR anchor exactly, or it ends with
@@ -484,7 +535,7 @@ if isinstance(provider, dict):
         data.pop("entwurfProvider", None)
 
 settings_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"remove: removed {pkg_removed} packages[] entries, {mcp_removed} mcpServers entries from {settings_path}")
+print(f"remove: removed {mcp_removed} mcpServers entries from {settings_path}")
 PY
 }
 
@@ -1469,6 +1520,87 @@ check_install_preflight() {
   fi
   rm -rf "$fake" "$proj"
   ok "[check-install-preflight] representative dangling symlink (test -d blind spot) → fails before writing settings, names the dep"
+
+  # negative 3 — corrupt project provider shape. install_local_package now has a
+  # two-step writer (packages[] SSOT, then entwurfProvider.mcpServers), so a
+  # malformed provider MUST fail before the packages[] step writes anything.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$proj/.pi" "$fake/home"
+  printf '{"entwurfProvider": []}\n' > "$proj/.pi/settings.json"
+  local before after
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider was partially rewritten (packages[] leak)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "entwurfProvider is not an object"; then
+    fail "[check-install-preflight] corrupt entwurfProvider failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ -f "$fake/home/.pi/agent/settings.json" ]; then
+    fail "[check-install-preflight] corrupt project provider still wrote user-scope settings"; cat "$fake/home/.pi/agent/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt project entwurfProvider → fails before any project/user settings write"
+
+  # negative 4 — corrupt project mcpServers shape, same no-partial-write contract.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$proj/.pi" "$fake/home"
+  printf '{"entwurfProvider": {"mcpServers": []}}\n' > "$proj/.pi/settings.json"
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider.mcpServers did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt mcpServers was partially rewritten (packages[] leak)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "entwurfProvider.mcpServers is not an object"; then
+    fail "[check-install-preflight] corrupt mcpServers failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt project entwurfProvider.mcpServers → fails before any project settings write"
+
+  # negative 5 — corrupt user-scope packages shape. Since install writes project
+  # settings before user registration, this preflight must catch the user file up
+  # front so a bad ~/.pi/agent/settings.json cannot leave the project half-wired.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$fake/home/.pi/agent"
+  printf '{"packages": {"broken": true}}\n' > "$fake/home/.pi/agent/settings.json"
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt user packages did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ -f "$proj/.pi/settings.json" ]; then
+    fail "[check-install-preflight] corrupt user packages still wrote project settings (partial install)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "user settings packages is not a JSON array"; then
+    fail "[check-install-preflight] corrupt user packages failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt user-scope packages → fails before project settings write"
+
+  # negative 6 — remove has the same two-step write risk (packages[] remove,
+  # then provider cleanup). A corrupt provider must fail before packages[] is
+  # altered, otherwise uninstall becomes a partial destructive write.
+  proj=$(mktemp -d)
+  mkdir -p "$proj/.pi"
+  printf '{"entwurfProvider": [], "packages": ["%s"]}\n' "$REPO_DIR" > "$proj/.pi/settings.json"
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$("$REPO_DIR/run.sh" remove "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt provider did NOT fail remove"; echo "$out"; rm -rf "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt provider remove partially rewrote packages[]"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$proj"; exit 1
+  fi
+  rm -rf "$proj"
+  ok "[check-install-preflight] remove with corrupt provider → fails before packages[] removal"
 }
 
 check_pi_preflight() {
@@ -2002,8 +2134,14 @@ check_pack_install() {
     return 1
   fi
 
-  local loader_out
-  loader_out=$(cd "$tmp" && pi -e "$tmp/node_modules/@junghanacs/entwurf" --list-models entwurf 2>&1) || {
+  # HOME/PI_CODING_AGENT_DIR redirected to a throwaway dir: this loader smoke must
+  # depend ONLY on the -e package path, never on the operator's real
+  # ~/.pi/agent/settings.json — otherwise a live-config change could silently
+  # pass/fail the gate (the exact "check must not depend on live wiring" impurity
+  # this whole lane is about).
+  local loader_out loader_home="$tmp/loader-home"
+  mkdir -p "$loader_home/.pi/agent"
+  loader_out=$(cd "$tmp" && HOME="$loader_home" PI_CODING_AGENT_DIR="$loader_home/.pi/agent" pi -e "$tmp/node_modules/@junghanacs/entwurf" --list-models entwurf 2>&1) || {
     fail "[check-pack-install] pi loader smoke failed (exit non-zero):"
     echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
     return 1
@@ -2075,6 +2213,43 @@ check_pack_install() {
   fi
   echo "[check-pack-install] npm-managed install regression pass (hoisted-dep run.sh install wrote settings)"
 
+  # THE 2026-07-03 regression gate: removing `pi install` from setup dropped
+  # user-scope citizen registration, so `--entwurf-control` was Unknown in a
+  # foreign cwd. Prove the npm consumer path closes it end-to-end: run.sh install
+  # (run above under HOME="$npmhome") must have registered the package in the USER
+  # settings, and pi must then load the entwurf extension + its flags from a cwd
+  # OUTSIDE the project. Fully isolated in the temp HOME — never touches ~/.pi.
+  local npm_user_settings="$npmhome/.pi/agent/settings.json"
+  if [ ! -f "$npm_user_settings" ]; then
+    fail "[check-pack-install] npm-managed install did not register a user-scope citizen at $npm_user_settings"
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/entwurf') for s in srcs) else 1)
+"; then
+    fail "[check-pack-install] user-scope settings.json lacks the npm entwurf package in packages[]:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  # Foreign cwd ($tmp — NOT the project, no project .pi): --entwurf-control must be
+  # a KNOWN flag and the entwurf provider must load, sourced only from user scope.
+  # Before the fix this printed "Unknown options: --entwurf-control".
+  local foreign_out
+  foreign_out=$(cd "$tmp" && HOME="$npmhome" PI_CODING_AGENT_DIR="$npmhome/.pi/agent" pi --entwurf-control --list-models entwurf 2>&1) || {
+    fail "[check-pack-install] foreign-cwd --entwurf-control smoke failed (user-scope citizen not loading?):"
+    echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  }
+  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-4-8" <<<"$foreign_out"; then
+    fail "[check-pack-install] foreign-cwd --entwurf-control did not load the entwurf extension from user scope:"
+    echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] user-scope citizen regression pass (npm consumer: --entwurf-control loads from a foreign cwd)"
+
   # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
   # bake versioned pnpm-store paths into Claude settings. MCP already uses the
   # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
@@ -2998,6 +3173,14 @@ case "$cmd" in
     # duplicate/drift records. Offline + deterministic (deps bash+node+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-meta-install-state.sh)
     ;;
+  smoke-user-scope-citizen)
+    # 0.12.6 install-boundary gate: register-pi-package.py is the shared
+    # packages[] SSOT for project/user install and remove; user scope makes
+    # --entwurf-control load from any cwd. Idempotent, preserves unrelated
+    # packages/keys, normalizes stale entries, remove is symmetric, and corrupt
+    # settings fail loud. The tripwire the 2026-07-03 `pi install` removal lacked.
+    (cd "$REPO_DIR" && bash scripts/smoke-user-scope-citizen.sh)
+    ;;
   smoke-claude-native-resume-live)
     # LIVE-only Detour A probe: two real Claude Code native turns (fresh +
     # --resume) in a scratch cwd. Verifies native resume works while the
@@ -3007,9 +3190,10 @@ case "$cmd" in
     ;;
   install-meta-bridge)
     # 1.0.0 meta-bridge step 5: operator-grade GLOBAL install of the garden-native
-    # receive plugin. Assembles a self-contained, node-path-baked copy under
-    # pi/meta-bridge/.assembled and runs marketplace add + install --scope user, so
-    # every native Claude Code session auto-loads it (no manual --plugin-dir).
+    # receive plugin. Assembles a self-contained, node-path-baked copy under the
+    # XDG data dir ($XDG_DATA_HOME/entwurf/meta-bridge/.assembled — dev clone and
+    # installed package alike, never the checkout) and runs marketplace add +
+    # install --scope user, so every native Claude Code session auto-loads it.
     # Idempotent; Linux/macOS only (Windows fail-fast).
     (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh "$@")
     ;;

package/scripts/meta-bridge-doctor.sh

@@ -17,18 +17,22 @@ MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 CLAUDE_CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# LIB_EXT tracks the hook artifact mode (0.12.5): installed packages ship the
+# The live artifact lives under the XDG data dir (dev clone and installed package
+# alike — never the checkout). Prefer the path RECORDED in install-state so a doctor
+# run under a different XDG_DATA_HOME than install still hashes the REAL assembled
+# bundle (and state.py check compares the same recorded marketplace path); fall back
+# to the current-XDG computation only when no state exists yet (fresh host).
+# LIB_EXT still tracks the hook artifact mode (0.12.5): installed packages ship the
 # tsc-emitted `.js` closure (node_modules-safe), dev clones run the `.ts` source.
 # The writer-version parity below hashes meta-session.<LIB_EXT> so an installed
 # `.js` bundle is compared against the SAME-pipeline dist `.js`, never against the
 # `.ts` source (which would hash-mismatch and false-STALE).
+ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
+RECORDED_ASM="$(python3 "$REPO/scripts/meta-bridge-state.py" assembled-path --repo "$REPO" 2>/dev/null || true)"
+[ -n "$RECORDED_ASM" ] && ASM="$RECORDED_ASM"
 case "$REPO" in
-  */node_modules/@junghanacs/entwurf)
-    ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
-    LIB_EXT="js" ;;
-  *)
-    ASM="$REPO/pi/meta-bridge/.assembled"
-    LIB_EXT="ts" ;;
+  */node_modules/@junghanacs/entwurf) LIB_EXT="js" ;;
+  *)                                  LIB_EXT="ts" ;;
 esac
 # shellcheck source=scripts/meta-bridge-hook-log.sh
 source "$REPO/scripts/meta-bridge-hook-log.sh"

package/scripts/meta-bridge-install.sh

@@ -4,7 +4,8 @@
 # needs, so a user never hand-edits hook/plugin settings or passes --plugin-dir.
 #
 # Mechanism (all proven on 2026-06-05):
-#   1. ASSEMBLE a self-contained plugin under pi/meta-bridge/.assembled/ (gitignored):
+#   1. ASSEMBLE a self-contained plugin under the version-stable XDG data dir
+#      ($XDG_DATA_HOME/entwurf/meta-bridge/.assembled) — NEVER inside the checkout:
 #      copy the committed skeleton, copy the entry shell + its lib (so
 #      ${CLAUDE_PLUGIN_ROOT} self-locates them), and BAKE the node abspath into
 #      hooks.json. The node path is the ONLY templated surface — the mailbox /
@@ -13,9 +14,10 @@
 #      entwurf_inbox_read tool comes from USER-scope entwurf-bridge MCP wiring
 #      (`claude mcp add -s user ...`). Project-scoped .mcp.json is deliberately
 #      not enough: a /tmp native session would wake without a receipt tool.
-#   2. marketplace add <stable .assembled>  (dev: repo-local; installed package:
-#      version-stable XDG data dir; NOT /tmp — ephemeral source would break
-#      `claude plugin marketplace update`).
+#   2. marketplace add <stable XDG .assembled>  (both dev clone and installed
+#      package assemble into the same version-stable XDG data dir; NOT /tmp —
+#      ephemeral source would break `claude plugin marketplace update`, and NOT
+#      the checkout — repo housekeeping must never cut the live user-scope wiring).
 #   3. install entwurf-meta-receive@meta-bridge-local --scope user  (= global:
 #      every native session auto-loads it; no manual --plugin-dir).
 #   4. install/update USER-scope entwurf-bridge MCP, so every native session has
@@ -31,26 +33,27 @@ REPO="$(cd "$HERE/.." && pwd)"
 MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 SRC="$REPO/pi/meta-bridge"
-# Dev clone: keep the marketplace source inside the checkout for transparent
-# inspection. Installed package: assemble into a version-stable operator path;
-# Claude settings store this directory path and package-manager upgrades do not
-# rewrite it, so a pnpm-store path would go stale on version/peer churn.
-#
-# The SAME installed-vs-dev split also picks the hook artifact (0.12.5): an
-# installed marketplace source lives below node_modules, where Node REFUSES
-# `--experimental-strip-types` on `.ts` (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING),
-# so installed packages run the tsc-emitted `meta-bridge-hook.js` closure (mirrors
-# start.sh/store-doctor). Dev clones live outside node_modules and run the `.ts`
-# source directly for transparent editing. HOOK_ENTRY is baked into hooks.json.
+# The live marketplace artifact ALWAYS assembles under the version-stable XDG data
+# dir — dev clone and installed package alike. Claude settings store this directory
+# path and package-manager upgrades do not rewrite it (a pnpm-store path would go
+# stale on version/peer churn). Critically it lives OUTSIDE the checkout, so repo
+# housekeeping (git clean -xfd, check/smoke) can never cut the global user-scope
+# wiring: dev vs installed is a difference of SOURCE ORIGIN (repo tree vs npm
+# package we assemble FROM), never of where the live artifact lands.
+ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
+# The hook ARTIFACT form still splits by install shape (0.12.5): an installed
+# package lives below node_modules, where Node REFUSES `--experimental-strip-types`
+# on `.ts` (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING), so it runs the tsc-emitted
+# `meta-bridge-hook.js` closure (mirrors start.sh/store-doctor). A dev clone lives
+# outside node_modules — and so does the XDG artifact — so it runs the `.ts` source
+# directly. HOOK_ENTRY is baked into hooks.json.
 case "$REPO" in
   */node_modules/@junghanacs/entwurf)
-    ASM="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge/.assembled"
     HOOK_ENTRY="meta-bridge-hook.js"
     HOOK_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
     LIB_SRC="$REPO/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     LIB_EXT="js" ;;
   *)
-    ASM="$SRC/.assembled"
     HOOK_ENTRY="meta-bridge-hook.ts"
     HOOK_SRC="$REPO/pi-extensions/meta-bridge-hook.ts"
     LIB_SRC="$REPO/pi-extensions/lib/meta-session.ts"

package/scripts/meta-bridge-state.py

@@ -513,9 +513,33 @@ def check(repo: Path, asm: Path) -> None:
         failures.append(f"{claude_root_config_path()} root is not an object")
         root = {}
 
+    # The marketplace source path in settings was written by apply() from the
+    # RECORDED assembledMarketplacePath. Compare against that recorded value, not the
+    # --asm passed here: a doctor/check run under a different XDG_DATA_HOME than
+    # install must not false-FAIL a correctly-wired marketplace. Fall back to --asm
+    # only if the recorded field is somehow absent.
+    recorded_asm = state.get("assembledMarketplacePath")
+    # Shape-validate the recorded path (basename included). Every state our code
+    # writes carries this field (init_state/prepare/apply), so a missing/empty/
+    # non-string value is itself corruption — NOT a reason to fall back to --asm and
+    # PASS. And a malformed value that matches a same-malformed settings entry (both
+    # hand-corrupted) would otherwise slip the comparison below and greenlight a
+    # bogus marketplace source. This mirrors the uninstall.sh honest-inverse guard:
+    # only the exact install suffix …/entwurf/meta-bridge/.assembled is valid.
+    ASM_SUFFIX = "/entwurf/meta-bridge/.assembled"
+    if not isinstance(recorded_asm, str) or not recorded_asm.endswith(ASM_SUFFIX):
+        failures.append(
+            f"install-state assembledMarketplacePath is missing/malformed ('{recorded_asm}'); "
+            f"must end in {ASM_SUFFIX} — repair state or re-run install-meta-bridge"
+        )
+    marketplace_expected = (
+        {"source": {"source": "directory", "path": recorded_asm}}
+        if recorded_asm
+        else desired_marketplace(asm)
+    )
     checks = [
         (["enabledPlugins", PLUGIN_REF], True, "enabled plugin"),
-        (["extraKnownMarketplaces", MARKETPLACE], desired_marketplace(asm), "known marketplace"),
+        (["extraKnownMarketplaces", MARKETPLACE], marketplace_expected, "known marketplace"),
         (["statusLine"], desired_statusline(repo), "statusLine"),
     ] + [(path_, desired, name) for name, path_, desired in MANAGED_SETTINGS_SCALARS]
     for path_, expected, label in checks:
@@ -554,6 +578,7 @@ def main() -> int:
             "apply",
             "preflight-uninstall",
             "uninstall",
+            "assembled-path",
             "check",
             "managed-keys",
             "desired-mcp",
@@ -564,7 +589,13 @@ def main() -> int:
     parser.add_argument("--asm", default=None, type=Path)
     args = parser.parse_args()
     repo = args.repo.resolve()
-    asm = (args.asm or (repo / "pi" / "meta-bridge" / ".assembled")).resolve()
+    # The live artifact always lives under the XDG data dir — dev clone and
+    # installed package alike (mirror meta-bridge-install.sh's ASM resolution).
+    # install/doctor pass --asm explicitly; this default is the same XDG path so a
+    # bare invocation never falls back to a repo-internal marketplace source.
+    xdg_data = Path(os.environ.get("XDG_DATA_HOME") or (Path.home() / ".local" / "share"))
+    default_asm = xdg_data / "entwurf" / "meta-bridge" / ".assembled"
+    asm = (args.asm or default_asm).resolve()
     try:
         if args.command == "prepare":
             prepare(repo, asm)
@@ -574,6 +605,13 @@ def main() -> int:
             preflight_uninstall()
         elif args.command == "uninstall":
             uninstall()
+        elif args.command == "assembled-path":
+            # Print the RECORDED assembled marketplace path so the honest inverse
+            # (uninstall) removes exactly what install created — not a path
+            # recomputed from a possibly-changed XDG_DATA_HOME. Requires state.
+            state = load_state(required=True)
+            assert state is not None  # load_state(required=True) dies otherwise
+            print(state.get("assembledMarketplacePath", ""))
         elif args.command == "check":
             check(repo, asm)
         elif args.command == "managed-keys":

package/scripts/meta-bridge-uninstall.sh

@@ -26,6 +26,23 @@ command -v python3 >/dev/null || die "'python3' not on PATH. It is required for
 # delete live plugin/MCP entries before failing — guessing by side effect.
 python3 "$REPO/scripts/meta-bridge-state.py" preflight-uninstall --repo "$REPO"
 
+# Read + shape-validate the RECORDED assembled path BEFORE any side effect. The
+# honest inverse must remove exactly what install created; recomputing from
+# ${XDG_DATA_HOME} would orphan the real artifact if it changed since install. If
+# the recorded path is missing/corrupt we CANNOT safely remove the artifact, so we
+# fail loud HERE — before touching any Claude registration or the state file (no
+# guessing, no partial uninstall, no side-effect-then-WARN).
+ASM_RECORDED="$(python3 "$REPO/scripts/meta-bridge-state.py" assembled-path --repo "$REPO")"
+# Validate the FULL recorded path — basename included, not just the parent dir. The
+# rm below targets MB_DIR (the parent meta-bridge dir), so a parent-only check would
+# let a corrupt basename (…/entwurf/meta-bridge/not-assembled) pass as "well-formed"
+# and still nuke the real .assembled + Claude registrations. Only the exact install
+# suffix …/entwurf/meta-bridge/.assembled is a safe honest-inverse target.
+case "$ASM_RECORDED" in
+  */entwurf/meta-bridge/.assembled) MB_DIR="$(dirname "$ASM_RECORDED")" ;;   # …/entwurf/meta-bridge
+  *) die "install-state assembledMarketplacePath is missing/corrupt ('$ASM_RECORDED'); refusing to uninstall so the live artifact is not orphaned. Repair the state file or re-run install-meta-bridge, then uninstall." ;;
+esac
+
 if command -v claude >/dev/null; then
   claude plugin uninstall "$PLUGIN@$MKT_NAME" >/dev/null 2>&1 || true
   claude plugin marketplace remove "$MKT_NAME" >/dev/null 2>&1 || true
@@ -37,16 +54,10 @@ fi
 
 python3 "$REPO/scripts/meta-bridge-state.py" uninstall --repo "$REPO"
 
-# Remove the assembled marketplace source too — an honest inverse must not orphan
-# it. Installed packages assemble into a version-stable operator data dir
-# (~/.local/share/entwurf/meta-bridge/.assembled); leaving that tree behind is the
-# only meta-bridge footprint uninstall would otherwise leak. Dev clones drop their
-# gitignored in-checkout .assembled. Mirror install-meta-bridge's ASM resolution.
-case "$REPO" in
-  */node_modules/@junghanacs/entwurf)
-    rm -rf "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/meta-bridge"
-    rmdir "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf" 2>/dev/null || true ;;
-  *)
-    rm -rf "$REPO/pi/meta-bridge/.assembled" ;;
-esac
+# Remove the assembled marketplace source (validated above): the parent meta-bridge
+# dir of the RECORDED .assembled, then the now-empty entwurf dir. This rm can NEVER
+# reach inside the checkout, so repo housekeeping and this uninstall are structurally
+# disjoint (the 0.12.x statusline-`?` impurity class is extinct, not guarded).
+rm -rf "$MB_DIR"
+rmdir "$(dirname "$MB_DIR")" 2>/dev/null || true   # …/entwurf if empty
 echo "[meta-bridge-uninstall] DONE"

package/scripts/register-pi-package.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""Register (or --remove) entwurf in a pi settings.json packages[].
+
+The SINGLE predicate / idempotency / fail-loud SSOT shared by BOTH scopes and by
+remove, so install and uninstall can never drift to different meanings:
+  - project  <repo>/.pi/settings.json     (run.sh install_local_package / remove_local_package)
+  - user     ~/.pi/agent/settings.json    (run.sh register_user_scope_citizen)
+
+Register is idempotent: absent → append REPO_DIR; already the sole canonical
+entry → no-op (file not rewritten, mtime stable); any other entwurf entry (object
+form, stale path, duplicate) collapses into one canonical string form. Remove
+drops every entwurf entry. Both use is_entwurf_source(), so a look-alike repo
+(entwurf-notes, openclaw-entwurf) is neither wrongly registered-over nor wrongly
+removed. Every non-entwurf package and every other settings key is preserved.
+
+This wiring (user scope) dropped when `pi install` was removed from setup
+(2026-07-03: `--entwurf-control` unknown in a foreign cwd). Extracting it here
+lets run.sh (both scopes + remove) and smoke-user-scope-citizen share ONE
+implementation — mirrors the meta-bridge-state.py split.
+
+Usage: register-pi-package.py <settings.json> <repo_dir> [--remove]
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+
+def source_of(item: object) -> object:
+    """The package spec of a packages[] entry — string form or {"source": …}."""
+    return item.get("source") if isinstance(item, dict) else item
+
+
+def is_entwurf_source(source: str, repo_dir: str) -> bool:
+    """True iff this package entry points at THIS entwurf — the only entries
+    register/remove may touch. Strict on purpose: user-scope settings are GLOBAL,
+    so a substring "entwurf" match would wrongly eat unrelated repos like
+    entwurf-notes, openclaw-entwurf, or somebody else's git repo named entwurf.
+
+    Managed shapes:
+      - the exact resolved repo dir;
+      - an npm install path ending in node_modules/@junghanacs/entwurf;
+      - an explicit npm package source for @junghanacs/entwurf;
+      - a local filesystem path whose final directory is literally "entwurf"
+        (dev clone / stale move). Remote URL/git-like strings are NOT treated as
+        local paths merely because their last segment is "entwurf".
+    """
+    p = source.rstrip("/")
+    if p == repo_dir or p.endswith("/node_modules/@junghanacs/entwurf"):
+        return True
+    if p == "npm:@junghanacs/entwurf" or p.startswith("npm:@junghanacs/entwurf@"):
+        return True
+    local_like = p.startswith(("/", "./", "../", "~"))
+    return local_like and Path(p).name == "entwurf"
+
+
+def _load(settings_path: Path) -> dict:
+    if settings_path.exists():
+        data = json.loads(settings_path.read_text())
+        if not isinstance(data, dict):
+            raise SystemExit(f"{settings_path} is not a JSON object")
+        return data
+    return {}
+
+
+def _packages(settings_path: Path, data: dict) -> list:
+    packages = data.get("packages")
+    if packages is None:
+        return []
+    if not isinstance(packages, list):
+        # A settings file with a corrupt packages shape must NOT be silently
+        # coerced to [] — that would drop the operator's real packages.
+        raise SystemExit(f"{settings_path}: packages is not a JSON array")
+    return packages
+
+
+def _entwurf_matches(packages: list, repo_dir: str) -> list:
+    return [
+        item for item in packages
+        if isinstance(source_of(item), str) and is_entwurf_source(source_of(item), repo_dir)  # type: ignore[arg-type]
+    ]
+
+
+def register(settings_path: Path, repo_dir_arg: str) -> str:
+    """"noop" if entwurf is already the sole canonical entry (file untouched),
+    else "registered" (rewritten with a single canonical entry)."""
+    repo_dir = str(Path(repo_dir_arg).resolve())
+    settings_path.parent.mkdir(parents=True, exist_ok=True)
+    data = _load(settings_path)
+    packages = _packages(settings_path, data)
+
+    entwurf_entries = _entwurf_matches(packages, repo_dir)
+    # Already correct iff exactly ONE entwurf entry and it is the canonical string
+    # form at repo_dir. Order-insensitive; no rewrite → mtime stable.
+    if len(entwurf_entries) == 1 and entwurf_entries[0] == repo_dir:
+        return "noop"
+
+    filtered = [item for item in packages if item not in entwurf_entries]
+    data["packages"] = filtered + [repo_dir]
+    settings_path.write_text(json.dumps(data, indent=2) + "\n")
+    return "registered"
+
+
+def remove(settings_path: Path, repo_dir_arg: str) -> int:
+    """Drop every entwurf entry (any shape/path). Returns the count removed."""
+    repo_dir = str(Path(repo_dir_arg).resolve())
+    if not settings_path.exists():
+        return 0
+    data = _load(settings_path)
+    packages = _packages(settings_path, data)
+
+    entwurf_entries = _entwurf_matches(packages, repo_dir)
+    if not entwurf_entries:
+        return 0
+    data["packages"] = [item for item in packages if item not in entwurf_entries]
+    settings_path.write_text(json.dumps(data, indent=2) + "\n")
+    return len(entwurf_entries)
+
+
+def main(argv: list[str]) -> int:
+    args = [a for a in argv[1:] if a != "--remove"]
+    do_remove = "--remove" in argv[1:]
+    if len(args) != 2:
+        raise SystemExit("usage: register-pi-package.py <settings.json> <repo_dir> [--remove]")
+    settings_path = Path(args[0])
+    repo_dir_arg = args[1]
+    resolved = str(Path(repo_dir_arg).resolve())
+
+    if do_remove:
+        n = remove(settings_path, repo_dir_arg)
+        if n:
+            print(f"remove: removed {n} entwurf packages[] entr{'y' if n == 1 else 'ies'} from {settings_path}")
+        else:
+            print(f"remove: no entwurf packages[] entry to remove ({settings_path})")
+        return 0
+
+    result = register(settings_path, repo_dir_arg)
+    if result == "noop":
+        print(f"install: entwurf package already registered (no-op) -> {resolved}")
+    else:
+        print(f"install: registered entwurf package -> {settings_path}")
+        print(f"install: package source -> {resolved}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))

package/scripts/smoke-meta-install-state.sh

@@ -22,10 +22,58 @@ TMP="$(mktemp -d -t psa-meta-install-state.XXXXXX)"
 cleanup() { rm -rf "$TMP"; }
 trap cleanup EXIT
 
+# ⓪ 설치 경계 봉쇄 (2026-07-03 `?` 사건의 구조적 소멸): source origin(repo/npm)과
+# live artifact(XDG)를 분리한다. dev clone과 installed 소비자는 같은 user-scope
+# install이고, 둘 다 marketplace source를 XDG data dir에 조립한다 — 절대 checkout
+# 내부가 아니다. 이 smoke의 어떤 단계도 repo 안에 live source를 만들지 않음을
+# top/bottom fingerprint로 감싸 증명하고, 아래 fake-install로 "install → XDG"를 직접 건다.
+# present/absent만 보면 present→present 덮어쓰기를 놓치므로 내용 해시까지 비교한다.
+asm_fingerprint() {
+  if [ -e "$REPO/pi/meta-bridge/.assembled" ]; then (cd "$REPO/pi/meta-bridge/.assembled" && find . -type f -exec sha256sum {} + 2>/dev/null | sort); else echo ABSENT; fi
+}
+REPO_ASM_FP_START="$(asm_fingerprint)"
+
+# 실제 meta-bridge-install.sh를 격리된 HOME + XDG_DATA_HOME + fake claude로 돌려
+# live marketplace source가 XDG 아래에 조립되고 `plugin marketplace add`가 그 XDG
+# 경로를 받는지 직접 증명한다(오프라인: 실제 claude 없음).
+INS_HOME="$TMP/ins-home"; INS_XDG="$TMP/ins-xdg"; INS_BIN="$TMP/ins-bin"
+mkdir -p "$INS_HOME/.claude" "$INS_BIN"
+echo '{}' > "$INS_HOME/.claude/settings.json"
+echo '{}' > "$INS_HOME/.claude.json"
+INS_LOG="$TMP/ins-claude.log"
+cat > "$INS_BIN/claude" <<'SH'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
+case "$1${2:+ $2}" in
+  "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
+  "mcp get")     printf '%s\n' "Scope: User config" "Status: Connected" ;;
+  *) : ;;
+esac
+exit 0
+SH
+chmod +x "$INS_BIN/claude"
+if env HOME="$INS_HOME" CLAUDE_CONFIG_DIR="$INS_HOME/.claude" XDG_DATA_HOME="$INS_XDG" \
+       FAKE_CLAUDE_LOG="$INS_LOG" PATH="$INS_BIN:$PATH" \
+       bash "$REPO/scripts/meta-bridge-install.sh" >/dev/null 2>&1; then
+  if [ -e "$INS_XDG/entwurf/meta-bridge/.assembled/entwurf-meta-receive" ]; then ok "dev install assembles the live marketplace source under XDG (not the checkout)"; else bad "dev install did not assemble under XDG_DATA_HOME"; fi
+  MKT_ADD="$(grep '^plugin marketplace add ' "$INS_LOG" | head -1 || true)"
+  if printf '%s' "$MKT_ADD" | grep -Fq "$INS_XDG/entwurf/meta-bridge/.assembled"; then ok "claude plugin marketplace add received the XDG artifact path"; else bad "marketplace add did not point at XDG: $MKT_ADD"; fi
+else
+  bad "real install-meta-bridge failed under isolated HOME/XDG/fake-claude:"$'\n'"$(cat "$INS_LOG" 2>/dev/null)"
+fi
+
 export HOME="$TMP/home"
+# The wrapper-uninstall below removes ${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/
+# meta-bridge. Pin XDG_DATA_HOME into the sandbox too, so a developer who runs this
+# smoke with XDG_DATA_HOME set in their shell can never have their real live
+# artifact removed — the boundary that keeps check/smoke off global user wiring.
+export XDG_DATA_HOME="$TMP/xdg"
 export CLAUDE_CONFIG_DIR="$HOME/.claude"
 mkdir -p "$CLAUDE_CONFIG_DIR"
-ASM="$TMP/assembled-marketplace"
+# Canonical-suffix asm: production install ALWAYS records a path ending in
+# …/entwurf/meta-bridge/.assembled, and state.py check now shape-validates that
+# suffix — so the survival harness must use a realistic path, not a bare stub.
+ASM="$TMP/asm-xdg/entwurf/meta-bridge/.assembled"
 export ASM
 mkdir -p "$ASM"
 
@@ -213,8 +261,10 @@ then ok "uninstall restores scalars/maps and removes only managed array addition
 
 if py uninstall >/dev/null 2>&1; then bad "state manager uninstall without state should not guess"; else ok "state manager uninstall without state fails instead of guessing"; fi
 
-# The wrapper must ALSO refuse before side effects. A fake claude records whether
-# plugin/MCP removals were attempted; no state means the log must stay empty.
+# ⓪ 봉쇄: wrapper-uninstall을 실제 $REPO 스크립트로 직접 돌린다. 이제 uninstall이
+# 지우는 live artifact는 ${XDG_DATA_HOME}/entwurf/meta-bridge 하나뿐이고, 위에서
+# HOME + XDG_DATA_HOME를 샌드박스로 고정했으므로 실제 개발자 배선/체크아웃에는
+# 닿을 수 없다(2026-07-03 `?` 사건의 구조적 소멸 — 사본 repo 우회가 더는 불필요).
 FAKE_BIN="$TMP/fake-bin"; mkdir -p "$FAKE_BIN"
 cat > "$FAKE_BIN/claude" <<'SH'
 #!/usr/bin/env bash
@@ -222,6 +272,9 @@ printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
 exit 0
 SH
 chmod +x "$FAKE_BIN/claude"
+
+# The wrapper must refuse before side effects. A fake claude records whether
+# plugin/MCP removals were attempted; no state means the log must stay empty.
 FAKE_CLAUDE_LOG="$TMP/fake-claude-nostate.log"
 if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
   bad "wrapper uninstall without state should fail"
@@ -229,10 +282,14 @@ else
   if [ ! -s "$FAKE_CLAUDE_LOG" ]; then ok "wrapper uninstall without state has zero Claude side effects"; else bad "wrapper uninstall without state touched Claude: $(cat "$FAKE_CLAUDE_LOG")"; fi
 fi
 
-# With valid state, the wrapper may remove Claude registrations and then restore
-# JSON state. This proves the preflight gate is ordered before side effects.
-py prepare >/dev/null
-py apply >/dev/null
+# With valid state, the wrapper removes Claude registrations, restores JSON state,
+# AND removes the XDG live artifact RECORDED in state — never the checkout, never a
+# path recomputed from the env. Record an XDG-structured assembled path and seed the
+# sentinel artifact so we can prove uninstall drops exactly the recorded tree.
+WASM="$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$WASM" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$WASM" >/dev/null
+mkdir -p "$WASM"; : > "$WASM/.sentinel"
 FAKE_CLAUDE_LOG="$TMP/fake-claude-state.log"
 if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
   if grep -q 'plugin uninstall entwurf-meta-receive@meta-bridge-local' "$FAKE_CLAUDE_LOG" && grep -q 'mcp remove entwurf-bridge -s user' "$FAKE_CLAUDE_LOG" && [ ! -f "$STATE_FILE" ]; then
@@ -240,10 +297,97 @@ if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts
   else
     bad "wrapper uninstall with state missed expected side effects/state removal"
   fi
+  # 봉쇄가 회피가 아니라 구조임을 증명: uninstall이 지우는 건 recorded XDG artifact뿐.
+  if [ ! -e "$XDG_DATA_HOME/entwurf/meta-bridge" ]; then ok "wrapper removes the recorded XDG live artifact tree, not the checkout"; else bad "wrapper did not remove the recorded XDG live artifact"; fi
 else
   bad "wrapper uninstall with valid state failed"
 fi
 
+# Honest inverse under a CHANGED XDG_DATA_HOME (GPT hardening): uninstall must remove
+# the RECORDED artifact path, never one recomputed from the current env. Record A,
+# run uninstall with the env pointing at B, and prove A is gone while B is untouched.
+XDGA="$TMP/xdgA"; XDGB="$TMP/xdgB"
+ASM_A="$XDGA/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$ASM_A" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$ASM_A" >/dev/null
+mkdir -p "$ASM_A"; : > "$ASM_A/.sentinel"
+mkdir -p "$XDGB/entwurf/meta-bridge/.assembled"; : > "$XDGB/entwurf/meta-bridge/.assembled/.sentinel"
+if XDG_DATA_HOME="$XDGB" PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$TMP/fake-claude-mismatch.log" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+  if [ ! -e "$XDGA/entwurf/meta-bridge" ]; then ok "uninstall removes the RECORDED artifact (XDG A) even when env XDG_DATA_HOME differs"; else bad "uninstall did not remove the recorded artifact A — recomputed from env instead"; fi
+  if [ -e "$XDGB/entwurf/meta-bridge/.assembled/.sentinel" ]; then ok "uninstall leaves the current-env XDG (B) untouched (no env recompute)"; else bad "uninstall wrongly removed the current-env XDG B"; fi
+else
+  bad "wrapper uninstall (recorded-path mismatch case) failed"
+fi
+
+# GPT hardening: a corrupt recorded assembledMarketplacePath must fail the wrapper
+# uninstall LOUD and BEFORE any side effect — no Claude removal, state file intact
+# (honest inverse never guesses / never partially uninstalls / never WARN-then-DONE).
+# Two corrupt shapes: a trivially-bad "/" AND the basename-corrupt case that a
+# PARENT-ONLY guard would silently pass (…/entwurf/meta-bridge/not-assembled) — the
+# rm targets the parent meta-bridge dir, so that shape must be refused by the FULL
+# suffix guard or it nukes the real artifact + Claude registrations (2026-07-03).
+for CORRUPT in "/" "$XDG_DATA_HOME/entwurf/meta-bridge/not-assembled"; do
+  python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+  python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+  # seed the real artifact so an over-broad rm would be observable as its removal
+  mkdir -p "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"; : > "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel"
+  CORRUPT="$CORRUPT" python3 - <<'PY'
+import json, os
+p = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(p)); s['assembledMarketplacePath'] = os.environ['CORRUPT']
+json.dump(s, open(p, 'w'), indent=2)
+PY
+  FAKE_CLAUDE_LOG="$TMP/fake-claude-corrupt.log"; : > "$FAKE_CLAUDE_LOG"
+  if PATH="$FAKE_BIN:$PATH" FAKE_CLAUDE_LOG="$FAKE_CLAUDE_LOG" bash "$REPO/scripts/meta-bridge-uninstall.sh" >/dev/null 2>&1; then
+    bad "wrapper uninstall with corrupt recorded path '$CORRUPT' should fail loud"
+  elif [ -s "$FAKE_CLAUDE_LOG" ] || [ ! -f "$STATE_FILE" ] || [ ! -e "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel" ]; then
+    bad "corrupt-path uninstall '$CORRUPT' leaked side effects/removed artifact: claude_log=[$(cat "$FAKE_CLAUDE_LOG")] state_exists=$([ -f "$STATE_FILE" ] && echo yes || echo no) artifact=$([ -e "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled/.sentinel" ] && echo intact || echo REMOVED)"
+  else
+    ok "corrupt recorded path '$CORRUPT' → uninstall fails BEFORE side effects (no Claude removal, state + artifact intact)"
+  fi
+  rm -f "$STATE_FILE"; rm -rf "$XDG_DATA_HOME/entwurf/meta-bridge"
+done
+
+# GPT hardening: state.py check must compare the RECORDED marketplace path, not the
+# --asm handed in. Install/apply with A, then check with a DIFFERENT --asm B: it must
+# still PASS (Claude settings + state both hold A; only the caller's XDG differs).
+CKA="$TMP/ck-xdgA/entwurf/meta-bridge/.assembled"
+CKB="$TMP/ck-xdgB/entwurf/meta-bridge/.assembled"
+python3 "$STATE" prepare --repo "$REPO" --asm "$CKA" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$CKA" >/dev/null
+if python3 "$STATE" check --repo "$REPO" --asm "$CKB" >/dev/null 2>&1; then ok "state.py check passes when --asm differs from the recorded path (compares recorded, no XDG false-fail)"; else bad "state.py check false-FAILed on a recorded≠--asm mismatch"; fi
+rm -f "$STATE_FILE"
+
+# GPT hardening: check must shape-validate the recorded path, not just compare it to
+# settings. Corrupt BOTH state + settings to the same basename-bad value: a pure
+# consistency compare would PASS (both agree) and greenlight a bogus marketplace
+# source. The suffix guard must FAIL it instead.
+python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 - <<'PY'
+import json, os
+xdg = os.environ['XDG_DATA_HOME']; corrupt = xdg + '/entwurf/meta-bridge/not-assembled'
+sp = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(sp)); s['assembledMarketplacePath'] = corrupt; json.dump(s, open(sp, 'w'), indent=2)
+cp = os.environ['CLAUDE_CONFIG_DIR'] + '/settings.json'
+c = json.load(open(cp)); c['extraKnownMarketplaces']['meta-bridge-local'] = {'source': {'source': 'directory', 'path': corrupt}}; json.dump(c, open(cp, 'w'), indent=2)
+PY
+if python3 "$STATE" check --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null 2>&1; then bad "state.py check greenlit a both-corrupt (state+settings) malformed marketplace path"; else ok "state.py check fails a malformed recorded path even when settings agree (shape guard, not just consistency)"; fi
+rm -f "$STATE_FILE"
+
+# GPT hardening: a MISSING/empty recorded path is corruption too — every state our
+# code writes carries the field, so check must NOT fall back to --asm and PASS.
+# Delete the field with settings still valid; the shape guard must FAIL, not greenlight.
+python3 "$STATE" prepare --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 "$STATE" apply   --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null
+python3 - <<'PY'
+import json, os
+sp = os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
+s = json.load(open(sp)); s.pop('assembledMarketplacePath', None); json.dump(s, open(sp, 'w'), indent=2)
+PY
+if python3 "$STATE" check --repo "$REPO" --asm "$XDG_DATA_HOME/entwurf/meta-bridge/.assembled" >/dev/null 2>&1; then bad "state.py check PASSed with a MISSING recorded assembledMarketplacePath (fell back to --asm)"; else ok "state.py check fails a missing/empty recorded path (no --asm fallback greenlight)"; fi
+rm -f "$STATE_FILE"
+
 # Doctor hook-log recovery predicate: only a later `INFO armed watch` clears an
 # ERROR. A UserPromptSubmit `INFO attach record` is degraded backfill, not wake
 # recovery.
@@ -365,7 +509,7 @@ if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; the
 # chain to its final summary line — i.e. no early set -e death anywhere.
 DOC_HOME="$TMP/doctor-home"; DOC_CFG="$DOC_HOME/.claude"
 DOC_AGENT="$TMP/doctor-agent"; DOC_STORE="$DOC_AGENT/meta-sessions"
-DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$REPO/pi/meta-bridge/.assembled"  # SAME asm the doctor's check uses, so only the MCP drifts
+DOC_BIN="$TMP/doctor-bin"; DOC_ASM="$XDG_DATA_HOME/entwurf/meta-bridge/.assembled"  # SAME asm the doctor computes (XDG), so only the MCP drifts
 mkdir -p "$DOC_CFG" "$DOC_STORE" "$DOC_BIN"
 echo '{}' > "$DOC_CFG/settings.json"
 echo '{}' > "$DOC_HOME/.claude.json"
@@ -405,5 +549,11 @@ if printf '%s\n' "$DOC_OUT" | grep -q 'user MCP entwurf-bridge'; then ok "doctor
 if printf '%s\n' "$DOC_OUT" | grep -q '\[plugin install'; then ok "doctor continues to a later section after the drift (no early set -e death)"; else bad "doctor did not reach a later section header after the drift:"$'\n'"$DOC_OUT"; fi
 if printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: FAIL'; then ok "doctor runs the whole chain to its final summary line"; else bad "doctor did not reach its final summary line (mid-run death):"$'\n'"$DOC_OUT"; fi
 
+# ⓪ 경계 종료 단언: 이 smoke 전체(install 조립 + state + wrapper-uninstall + doctor)가
+# 끝난 뒤에도 checkout 안에는 live marketplace source가 생기지 않았다 — source
+# origin(repo)과 live artifact(XDG)가 구조적으로 분리됐다는 최종 증명. 미래 회귀가
+# repo 내부 ASM을 되살리거나 덮어쓰면(내용 해시 변화 포함) 여기서 잡힌다.
+if [ "$(asm_fingerprint)" = "$REPO_ASM_FP_START" ]; then ok "checkout-internal marketplace source is byte-identical before/after — no op created or mutated \$REPO/.assembled (source origin ≠ live artifact)"; else bad "a meta-bridge operation created/mutated \$REPO/pi/meta-bridge/.assembled — repo boundary breached"; fi
+
 echo
 if [ "$fail" -eq 0 ]; then echo "smoke-meta-install-state: PASS"; else echo "smoke-meta-install-state: FAIL (see above)"; exit 1; fi

package/scripts/smoke-user-scope-citizen.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# smoke-user-scope-citizen — deterministic gate for pi packages[] citizen
+# registration/removal (register-pi-package.py). Offline/hermetic: a fake
+# settings file + a fake REPO_DIR under $TMP, no pi, no network, no ~/.pi touched.
+#
+# Guards the wiring that dropped when `pi install` was removed from setup
+# (2026-07-03: `--entwurf-control` / `--emacs-agent-socket` unknown in a foreign
+# cwd because entwurf was absent from ~/.pi/agent/settings.json packages[]).
+# statusline `?` had a tripwire; THIS omission had none and hid until GLG hit it
+# in another repo. This gate is that missing tripwire: if the registration ever
+# regresses, `pnpm check` goes red.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$HERE/.." && pwd)"
+REG="$REPO/scripts/register-pi-package.py"
+
+fail=0
+ok()  { echo "  ok    $*"; }
+bad() { echo "  FAIL  $*"; fail=1; }
+
+command -v python3 >/dev/null || { echo "FAIL: python3 not on PATH"; exit 1; }
+
+TMP="$(mktemp -d -t psa-user-citizen.XXXXXX)"
+trap 'rm -rf "$TMP"' EXIT
+S="$TMP/settings.json"
+FAKE_REPO="$TMP/fake/entwurf"; mkdir -p "$FAKE_REPO"
+RESOLVED="$(cd "$FAKE_REPO" && pwd)"
+
+has_pkg() { python3 -c "import json,sys;p=json.load(open('$S'))['packages'];sys.exit(0 if '$1' in p else 1)"; }
+count_entwurf() { python3 -c "import json;p=json.load(open('$S'))['packages'];print(sum(1 for x in p if isinstance((x if isinstance(x,str) else x.get('source')),str) and (x if isinstance(x,str) else x.get('source')).rstrip('/').split('/')[-1]=='entwurf' or (x if isinstance(x,str) else x.get('source'))=='$RESOLVED'))"; }
+
+# 1. absent settings file → created with entwurf registered
+python3 "$REG" "$S" "$FAKE_REPO" >/dev/null
+if [ -f "$S" ] && has_pkg "$RESOLVED"; then ok "absent settings → entwurf registered (file created)"; else bad "entwurf not registered into a fresh settings file"; fi
+
+# 2. idempotent: second run is a no-op AND does not even rewrite the file (mtime stable)
+MT1="$(stat -c %Y "$S")"
+sleep 1
+OUT2="$(python3 "$REG" "$S" "$FAKE_REPO")"
+MT2="$(stat -c %Y "$S")"
+if printf '%s' "$OUT2" | grep -q 'no-op'; then ok "second run is a no-op (idempotent)"; else bad "second run was not a no-op: $OUT2"; fi
+if [ "$MT1" = "$MT2" ]; then ok "no-op does NOT rewrite the file (mtime stable — strongest idempotence)"; else bad "no-op rewrote the file (mtime changed $MT1 -> $MT2)"; fi
+if [ "$(count_entwurf)" = "1" ]; then ok "no duplicate entwurf entry after idempotent re-run"; else bad "duplicate entwurf entries: $(count_entwurf)"; fi
+
+# 3. preserves unrelated packages AND unrelated keys — including look-alike repos
+#    whose path merely CONTAINS 'entwurf' and remote repos whose last segment is
+#    'entwurf' but are not THIS package.
+cat > "$S" <<'JSON'
+{
+  "defaultProvider": "openai-codex",
+  "theme": "glg-dark",
+  "packages": ["../../repos/gh/andenken", "git:github.com/badlogic/pi-telegram",
+               "/home/me/entwurf-notes", "/x/openclaw-entwurf",
+               "git:github.com/someone/entwurf", "https://github.com/someone/entwurf"]
+}
+JSON
+python3 "$REG" "$S" "$FAKE_REPO" >/dev/null
+if python3 -c "
+import json
+d=json.load(open('$S')); p=d['packages']
+assert '../../repos/gh/andenken' in p, 'andenken dropped'
+assert 'git:github.com/badlogic/pi-telegram' in p, 'pi-telegram dropped'
+assert '/home/me/entwurf-notes' in p, 'entwurf-notes wrongly filtered (substring false-positive)'
+assert '/x/openclaw-entwurf' in p, 'openclaw-entwurf wrongly filtered (substring false-positive)'
+assert 'git:github.com/someone/entwurf' in p, 'foreign git repo named entwurf wrongly filtered'
+assert 'https://github.com/someone/entwurf' in p, 'foreign URL repo named entwurf wrongly filtered'
+assert '$RESOLVED' in p, 'entwurf missing'
+assert d['defaultProvider']=='openai-codex' and d['theme']=='glg-dark', 'unrelated key dropped'
+" 2>/dev/null; then ok "preserves unrelated packages incl. look-alikes/foreign entwurf repos and keys"; else bad "clobbered unrelated packages/keys or a look-alike repo"; fi
+
+# 4. stale entwurf paths (bare local 'entwurf' dir, npm install path, explicit npm
+#    package source) normalize to one canonical REPO_DIR.
+cat > "$S" <<'JSON'
+{"packages": ["/old/moved/entwurf", "/some/root/node_modules/@junghanacs/entwurf",
+              "npm:@junghanacs/entwurf@0.12.4", "../../repos/gh/andenken"]}
+JSON
+python3 "$REG" "$S" "$FAKE_REPO" >/dev/null
+if python3 -c "
+import json
+p=json.load(open('$S'))['packages']
+assert '/old/moved/entwurf' not in p, 'stale bare-entwurf path not dropped'
+assert '/some/root/node_modules/@junghanacs/entwurf' not in p, 'stale npm path not dropped'
+assert 'npm:@junghanacs/entwurf@0.12.4' not in p, 'stale explicit npm source not dropped'
+assert '$RESOLVED' in p, 'entwurf not normalized to REPO_DIR'
+assert '../../repos/gh/andenken' in p, 'andenken dropped'
+ent=[x for x in p if isinstance((x if isinstance(x,str) else x.get('source')),str) and ((x if isinstance(x,str) else x.get('source')).rstrip('/').split('/')[-1]=='entwurf' or (x if isinstance(x,str) else x.get('source')).endswith('/node_modules/@junghanacs/entwurf') or (x if isinstance(x,str) else x.get('source'))=='$RESOLVED')]
+assert len(ent)==1, f'expected exactly 1 entwurf entry, got {ent}'
+" 2>/dev/null; then ok "stale entwurf paths/sources (bare + npm) normalized to a single REPO_DIR"; else bad "stale entwurf normalization failed"; fi
+
+# 5. object-form entwurf entries collapse to one canonical string (no duplicate)
+cat > "$S" <<JSON
+{"packages": [{"source": "$RESOLVED"}, "../../repos/gh/andenken"]}
+JSON
+python3 "$REG" "$S" "$FAKE_REPO" >/dev/null
+python3 "$REG" "$S" "$FAKE_REPO" >/dev/null   # twice → still one
+if python3 -c "
+import json
+p=json.load(open('$S'))['packages']
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+assert srcs.count('$RESOLVED')==1, f'object-form produced duplicate/none: {p}'
+assert all(not isinstance(x,dict) or x.get('source')!='$RESOLVED' for x in p), 'object-form entwurf survived (should collapse to string)'
+assert '../../repos/gh/andenken' in p, 'andenken dropped'
+" 2>/dev/null; then ok "object-form entwurf collapses to a single canonical string (no dup across re-runs)"; else bad "object-form entwurf caused a duplicate or survived as object"; fi
+
+# 6. a non-object settings file fails loud (never silently wipes operator config)
+echo '[]' > "$S"
+if python3 "$REG" "$S" "$FAKE_REPO" >/dev/null 2>&1; then bad "non-object settings should fail, not overwrite"; else ok "non-object settings fails loud (no silent clobber)"; fi
+
+# 7. a non-array packages value fails loud (never silently coerced to [])
+echo '{"packages": {"broken": true}}' > "$S"
+if python3 "$REG" "$S" "$FAKE_REPO" >/dev/null 2>&1; then bad "non-array packages should fail, not coerce to []"; else ok "non-array packages fails loud (no silent drop of operator packages)"; fi
+
+# 8. --remove drops every entwurf entry but preserves unrelated + look-alikes
+#    (symmetric with install: same is_entwurf_source predicate, no over-delete).
+cat > "$S" <<JSON
+{"packages": ["$RESOLVED", "../../repos/gh/andenken", "/home/me/entwurf-notes"]}
+JSON
+python3 "$REG" "$S" "$FAKE_REPO" --remove >/dev/null
+if python3 -c "
+import json
+p=json.load(open('$S'))['packages']
+assert '$RESOLVED' not in p, 'entwurf not removed'
+assert '../../repos/gh/andenken' in p, 'andenken over-removed'
+assert '/home/me/entwurf-notes' in p, 'entwurf-notes over-removed (substring over-delete)'
+" 2>/dev/null; then ok "--remove drops entwurf, preserves unrelated + look-alikes (symmetric with install)"; else bad "--remove over-deleted a look-alike or missed entwurf"; fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "smoke-user-scope-citizen: PASS"; else echo "smoke-user-scope-citizen: FAIL (see above)"; exit 1; fi