@junghanacs/entwurf 0.12.5 → 0.12.7

package/run.sh

@@ -38,6 +38,37 @@ PACKAGE_NAME="@junghanacs/entwurf"
 # saved session anchor.
 PROVIDER_ID="entwurf"
 
+# THE strip-types fence, in one place. Node REFUSES `--experimental-strip-types`
+# for any .ts below node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING), so
+# an installed package MUST run the prepack-emitted JS twin — the same boundary
+# start.sh (0.12.1), the store-doctor (0.12.4), the plugin hook (0.12.5), and the
+# agy imprint (0.12.7) each cross. Every .ts entrypoint routes through here so a
+# NEW one cannot silently reintroduce the class: it was hand-written per surface
+# before, and three operator commands (doctor-pi-provider / new-session-id /
+# meta-bridge-prune) shipped dead under node_modules because of exactly that.
+#
+# A dev-only gate has no emitted twin by design (check-*/smoke-* are not shipped
+# surfaces). Under an installed package it REFUSES rather than falling back to raw
+# .ts — a fallback would just re-raise the fence error with a worse message.
+# check-install-surface pins both halves statically.
+run_ts() {
+  local rel="$1"; shift
+  case "$REPO_DIR" in
+    */node_modules/*)
+      local dist="$REPO_DIR/mcp/entwurf-bridge/dist/${rel%.ts}.js"
+      if [ ! -f "$dist" ]; then
+        echo "entwurf: '$rel' is a dev-clone-only surface — the installed package ships no compiled twin." >&2
+        echo "         (Node cannot strip types below node_modules; run this from a checkout.)" >&2
+        return 1
+      fi
+      (cd "$REPO_DIR" && node "$dist" "$@")
+      ;;
+    *)
+      (cd "$REPO_DIR" && node --experimental-strip-types "$rel" "$@")
+      ;;
+  esac
+}
+
 usage() {
   cat <<'EOF'
 Usage:
@@ -76,6 +107,7 @@ Usage:
   ./run.sh smoke-entwurf-v2-spawn-live # LIVE phase gate (0.11 Stage 0 step 5c-3c, D5) — OUT of pnpm check, needs LIVE=1. Exercises the production SpawnBgResumeDeps against REAL OS objects: S1 real unix socket → awaitSocketAlive resolves (real lstat+probe), symlink→forged, absent→abort settles; S2 real child → spawn-event resolve + SIGTERM kill + exit-code capture; S3 watcher integration → real timeout→kill→child-exited→release ×1. Does NOT spawn a real pi resume (that=5d matrix). Run before 5d: LIVE=1 ./run.sh smoke-entwurf-v2-spawn-live
   ./run.sh smoke-entwurf-v2-spawn-resume-live # 0.11.0 (A) ACCEPTANCE gate — OUT of pnpm check, needs LIVE=1. The FULL spawn-bg resident lifecycle: mint backend=pi identity → seed a REAL dormant pi session (one-shot into ~/.pi/agent/sessions) → runEntwurfV2(owned-outcome) routes dormant→spawn-bg resume → a REAL detached pi --entwurf-control child stands its socket up, resumes, DOES a model turn. Asserts executed/spawn-bg/socket-alive/released + lock released ×1 + no lock file + pid alive + socket connectable + resume USER & assistant OK nonces in the session JSONL. Model-in-loop IN. The gate v1 deprecation (0.12) is predicated on. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-spawn-resume-live
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b socket-only (record-less live pi → control-socket sent / owned→bad-target, A1 narrow), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
+  ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), owned-outcome→native-push-no-resume-authority, bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b pi 4-value, facts-only keyset; union: PeerFact+SocketOnlyFact by gardenId, dormant→dead, F3 indeterminate preserved, non-pi+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-listing          # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4a): META-STORE axis listAllMetaIdentities — explicit-partial: parse failure / body-filename drift → explicit {filename,message} error (verbatim, no synthetic fields), valid records still listed (corrupt doesn't blind); mode strict throws / collect partial; entries/readRecord injected, no IO
@@ -84,6 +116,9 @@ Usage:
   ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows); SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected. meta watchArmed wired in slice 2 (same release block)
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
   ./run.sh check-entwurf-mailbox-guard # deterministic gate (SE-1/SE-2 slice 2d): guarded mailbox enqueue — PURE 0-call (undeliverable target leaves injected enqueue uncalled) + TMPDIR snapshot (refused send leaves mailbox byte-identical, accepted writes one .msg) + fact gathering from record/capability/receiver-marker
+  ./run.sh check-native-push-adapter # deterministic gate (봉인 3/8): native-push adapter leaf (antigravity) via a FAKE runner — FULL pid scan (not head -1), dead vs indeterminate, VOLATILE route re-discovery (no cache), send argv+ANTIGRAVITY_LS_ADDRESS env, non-zero exit throws, NO adapter-level retry (executor-owned), resolveNativePushAdapter fail-fast
+  ./run.sh check-native-push-register # deterministic gate (봉인 5): registerNativeConversation (entwurf_register_native core) via fake adapter + isolated mkdtemp store — live probe→CREATE, re-register→ATTACH (same gid, cwd refreshed, no dup), not-live probe→REFUSE (throws, no record), receiver-marker abstinence (보정① source guard)
+  ./run.sh check-agy-sender-identity # deterministic gate (#46 sender lane): WHO is calling the bridge — real agy hook as a child process writes an antigravity sender marker keyed by its PARENT pid (never on upsert failure), and resolveTrustedMetaSenderIdentity over isolated stores yields 0→null / 1→identity on EITHER backend / two distinct live identities on one owner pid→THROW (never guess, never downgrade to anonymous). This is what turns an agy send from external-mcp/unknown-host into a replyable garden citizen
   ./run.sh check-package-source-routing # deterministic gate (#29): package-source -> install-root mapping + fail-fast routing (local/git/npm/missing/project/no-source × local+remote, self-root, resume), no backend
   ./run.sh smoke-session-id-name      # live 3-turn substrate smoke (Phase 3a): Pi 0.78 --session-id/--name through the bridge — header id/cwd, session_info name, append-not-recreate, spawn-only name, wrong-cwd footgun evidence
   ./run.sh new-session-id             # print one fresh garden-native session id for operator launchers (--session-id)
@@ -91,14 +126,27 @@ Usage:
   ./run.sh smoke-meta-async-drift     # 1.0.0 meta-bridge step 1: drift sentinel — version pins + Claude binary undocumented-behavior markers (LIVE=1 adds plugin watch-arm probe)
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
+  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression (120): isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
+  ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression (62). Offline/deterministic
+  ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression (37). Offline/deterministic
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
   ./run.sh smoke-claude-native-resume-live # LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path
 
-  ./run.sh install-meta-bridge        # 1.0.0 meta-bridge Phase 2: stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
+  ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # 1.0.0 meta-bridge Phase 2: fail-loud doctor — toolchain + state + plugin/MCP + store scan + hook errors + SessionStart evidence + writer-version parity (source↔assembled↔installed: FAIL on a stale deployed meta-record writer)
+  ./run.sh install-agy-bridge         # 봉인 7: agy MCP install adapter — register ONE entwurf-bridge server in the agy mcp_config (adopt file / create / REFUSE symlink), stable bin command, install-state under $XDG_DATA_HOME/entwurf/agy-bridge/
+  ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
+  ./run.sh doctor-agy-bridge          # fail-loud doctor: MCP config + exact permission rule + state + live probe label
+  ./run.sh install-agy-statusline     # own the agy statusLine subtree with bare entwurf-agy-statusline; preserve unrelated settings
+  ./run.sh uninstall-agy-statusline   # honest inverse from statusline install-state
+  ./run.sh doctor-agy-statusline      # fail-loud statusLine config/bin/state doctor + honest live SKIP
+  ./run.sh install-agy-hooks          # #46 agy birth imprint hook — named PreInvocation hook running bare entwurf-agy-imprint, preserving other hooks
+  ./run.sh uninstall-agy-hooks        # honest inverse of install-agy-hooks from install-state
+  ./run.sh doctor-agy-hooks           # fail-loud doctor for agy hooks.json imprint wiring
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
   ./run.sh meta-bridge-managed-keys   # 0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)
   ./run.sh check-keyset-overlap <fragment.json...>  # 0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)
@@ -106,9 +154,10 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with 0.80.x peers
   ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
-  ./run.sh install [project-dir]      # install this local package into project .pi/settings.json
+  ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh setup:links [--force]      # repair ~/.pi/agent/entwurf-targets.json link (use --force to replace a stale operator file or wrong symlink; a .bak is taken)
-  ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json
+  ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
+  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project)
 
 Notes:
   - project-dir defaults to current directory
@@ -239,104 +288,113 @@ preflight_dep_integrity() {
   fi
 }
 
-install_local_package() {
-  local project_dir
-  project_dir=$(normalize_project_dir "$1")
-  preflight_dep_integrity
-  mkdir -p "$project_dir/.pi"
-  python3 - "$project_dir/.pi/settings.json" "$REPO_DIR" <<'PY'
+preflight_pi_settings_shapes() {
+  local project_settings="$1"
+  local user_settings="$2"
+  python3 - "$project_settings" "$user_settings" <<'PY'
 import json, sys
 from pathlib import Path
 
-settings_path = Path(sys.argv[1])
-repo_dir = str(Path(sys.argv[2]).resolve())
-settings_path.parent.mkdir(parents=True, exist_ok=True)
-if settings_path.exists():
-    data = json.loads(settings_path.read_text())
-    if not isinstance(data, dict):
-        raise SystemExit("settings.json is not an object")
-else:
-    data = {}
+project = Path(sys.argv[1])
+user = Path(sys.argv[2])
 
-# --- packages[] registration --------------------------------------------------
-packages = data.get("packages")
-if not isinstance(packages, list):
-    packages = []
-
-filtered = []
-for item in packages:
-    source = item.get("source") if isinstance(item, dict) else item
-    if isinstance(source, str) and ("entwurf" in source) and source != repo_dir:
-        continue
-    filtered.append(item)
-
-if repo_dir not in filtered:
-    filtered.append(repo_dir)
-
-data["packages"] = filtered
-
-# --- entwurfProvider.mcpServers bundled entries ---------------------------
-# Ship the two in-repo MCP adapters pre-wired so `pi install` produces a
-# working setup without the consumer hand-editing settings.json. User-authored
-# overrides (different command/args) are preserved untouched.
-provider = data.setdefault("entwurfProvider", {})
-if not isinstance(provider, dict):
-    raise SystemExit("entwurfProvider is not an object")
-servers = provider.setdefault("mcpServers", {})
-if not isinstance(servers, dict):
-    raise SystemExit("entwurfProvider.mcpServers is not an object")
-
-BUNDLED = ("entwurf-bridge",)
-# 0.4.14: session-bridge MCP was retracted (issue #7 — unified entwurf surface).
-# Install path now only wires entwurf-bridge. Existing operator settings that
-# carry the old bundled session-bridge entry are pruned below during install;
-# `./run.sh remove` also keeps session-bridge in its cleanup tuple so legacy
-# entries are removed on uninstall too.
-for name in BUNDLED:
-    desired_cmd = f"{repo_dir}/mcp/{name}/start.sh"
-    desired = {"command": desired_cmd, "args": []}
-    existing = servers.get(name)
-    if existing is None:
-        servers[name] = desired
-        print(f"install: added entwurfProvider.mcpServers.{name}")
-    elif isinstance(existing, dict) and existing.get("command") == desired_cmd:
-        # Already managed by us at the current repo path. Add the default args
-        # field when missing, but never overwrite user-customized args.
-        if "args" not in existing:
-            existing["args"] = []
-            print(f"install: normalized entwurfProvider.mcpServers.{name}.args -> []")
-        elif existing.get("args") != []:
-            print(f"install: preserved entwurfProvider.mcpServers.{name}.args (custom args)")
-    else:
-        cmd_repr = existing.get("command") if isinstance(existing, dict) else existing
-        print(f"install: preserved entwurfProvider.mcpServers.{name} (user override: {cmd_repr})")
-
-# Legacy-bundled MCP names that prior versions of this installer wrote and that
-# the current cutover supersedes. One-shot install-time prune (NOT a runtime
-# alias): only remove entries whose command matches the bundled start.sh path,
-# so user-customized commands are left alone.
-#   - session-bridge: retracted in 0.4.14 (issue #7, unified entwurf surface).
-#   - pi-tools-bridge: renamed to entwurf-bridge in 0.11 S2 cutover.
-LEGACY_BUNDLED = {
-    "session-bridge": "retracted in 0.4.14, issue #7",
-    "pi-tools-bridge": "renamed to entwurf-bridge in 0.11 S2 cutover",
-}
-for name, reason in LEGACY_BUNDLED.items():
-    existing = servers.get(name)
-    if not isinstance(existing, dict):
-        continue
-    cmd = existing.get("command")
-    if not isinstance(cmd, str):
-        continue
-    if cmd == f"{repo_dir}/mcp/{name}/start.sh" or cmd.endswith(f"/entwurf/mcp/{name}/start.sh"):
-        del servers[name]
-        print(f"install: pruned legacy entwurfProvider.mcpServers.{name} ({reason})")
-
-settings_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"install: updated {settings_path}")
-print(f"install: package source -> {repo_dir}")
+def load_object(path: Path, label: str):
+    if not path.exists():
+        return None
+    data = json.loads(path.read_text())
+    if not isinstance(data, dict):
+        raise SystemExit(f"{label} settings is not a JSON object: {path}")
+    return data
+
+def check_packages(data, path: Path, label: str):
+    if data is None:
+        return
+    packages = data.get("packages")
+    if packages is not None and not isinstance(packages, list):
+        raise SystemExit(f"{label} settings packages is not a JSON array: {path}")
+
+def check_project_provider(data, path: Path):
+    if data is None:
+        return
+    provider = data.get("entwurfProvider")
+    if provider is None:
+        return
+    if not isinstance(provider, dict):
+        raise SystemExit(f"project settings entwurfProvider is not an object: {path}")
+    servers = provider.get("mcpServers")
+    if servers is not None and not isinstance(servers, dict):
+        raise SystemExit(f"project settings entwurfProvider.mcpServers is not an object: {path}")
+
+project_data = load_object(project, "project")
+user_data = load_object(user, "user")
+check_packages(project_data, project, "project")
+check_packages(user_data, user, "user")
+check_project_provider(project_data, project)
 PY
+}
+
+install_local_package() {
+  local project_dir agent_dir
+  project_dir=$(normalize_project_dir "$1")
+  agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  preflight_dep_integrity
+  # Fail BEFORE any settings write if either target config already has a corrupt
+  # shape. The packages[] SSOT and provider writer run in two separate steps, so
+  # without this preflight a bad entwurfProvider could leave a half-installed
+  # packages[] entry behind (2026-07-03 install-boundary hardening).
+  preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$agent_dir/settings.json"
+  mkdir -p "$project_dir/.pi"
+  # packages[] registration via the shared SSOT — same is_entwurf_source
+  # predicate + idempotency as user-scope and remove (not a substring match).
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  # entwurfProvider.mcpServers.entwurf-bridge (project scope — checkout-local, NO state; #46
+  # Task 2) via the shared register-pi-provider SSOT: normalize the command to the bare stable
+  # bin `entwurf-bridge` (ownership-classified: absent/managed-current/managed-legacy adopt, a
+  # true user-override is left untouched) + prune legacy bundles. project remove is the inverse.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$project_dir/.pi/settings.json" "$REPO_DIR" --scope project
   ensure_agent_dir_symlinks
+  register_user_scope_citizen
+}
+
+# Register entwurf as a pi USER-SCOPE citizen so its extensions
+# (entwurf-control.ts → --entwurf-control / --emacs-agent-socket) load from ANY
+# cwd, not only inside the entwurf checkout. project-scope `.pi/settings.json`
+# only applies when pi runs inside the repo; the `pit`/`pia`/`pihome` global
+# launchers and the npm consumer's "installs → just works" both need the entry
+# in ~/.pi/agent/settings.json's packages[]. This is the wiring that dropped when
+# `pi install` was removed from setup (2026-07-03: `--entwurf-control` unknown in
+# a foreign cwd). Idempotent: absent → append, present → no-op; a stale entwurf
+# entry at a different path is normalized to REPO_DIR. Every other package and key
+# in the operator's user settings is preserved untouched.
+register_user_scope_citizen() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR"
+  # #46 Task 2: own entwurfProvider.mcpServers.entwurf-bridge as the bare stable bin at USER scope
+  # (GLOBAL/durable →파급s to every cwd), so its inverse needs an install-state honest inverse
+  # under $XDG_DATA_HOME/entwurf/pi-provider/ (Task 0/1 discipline). project scope is checkout-
+  # local and covered by `run.sh remove` (no state) — deliberate, reasoned asymmetry.
+  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+}
+
+# The honest inverse of register_user_scope_citizen: drop entwurf from the GLOBAL
+# ~/.pi/agent/settings.json packages[]. Deliberately NOT folded into `run.sh remove`
+# (project scope): the user-scope citizen is a single GLOBAL entry keyed on this
+# checkout and SHARED by every project + every foreign cwd, so tearing it down as a
+# side effect of one project's remove would break `--entwurf-control` everywhere else
+# (the exact "install → just works from any cwd" invariant register_user_scope_citizen
+# exists to hold). Same explicit-global-lifecycle shape as install/uninstall-meta-bridge.
+# Uses the same is_entwurf_source SSOT + --remove, so it never over-deletes a look-alike
+# (entwurf-notes, openclaw-entwurf) and preserves every other package/key. Idempotent:
+# no entwurf entry → no-op.
+remove_user_scope_citizen() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" --remove
+  # #46 Task 2: honest inverse of the user-scope entwurfProvider ownership — the install-state
+  # drives it (absent/managed-* → remove OUR key; a user-override we never owned is untouched).
+  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
 }
 
 # Ensure agent-level resources that entwurf code reads from
@@ -424,68 +482,29 @@ ensure_agent_dir_symlinks() {
 remove_local_package() {
   local project_dir
   project_dir=$(normalize_project_dir "$1")
-  python3 - "$project_dir/.pi/settings.json" "$REPO_DIR" <<'PY'
-import json, sys
-from pathlib import Path
-
-settings_path = Path(sys.argv[1])
-repo_dir = str(Path(sys.argv[2]).resolve())
-if not settings_path.exists():
-    print(f"remove: nothing to do ({settings_path} missing)")
-    raise SystemExit(0)
-
-data = json.loads(settings_path.read_text())
-if not isinstance(data, dict):
-    raise SystemExit("settings.json is not an object")
-
-# --- packages[] cleanup -------------------------------------------------------
-packages = data.get("packages")
-pkg_removed = 0
-if isinstance(packages, list):
-    filtered = []
-    for item in packages:
-        source = item.get("source") if isinstance(item, dict) else item
-        if isinstance(source, str) and ("entwurf" in source):
-            pkg_removed += 1
-            continue
-        filtered.append(item)
-    data["packages"] = filtered
-
-# --- entwurfProvider.mcpServers cleanup ------------------------------------
-# Only remove entries that look like they came from ./run.sh install: either
-# the command matches the current $REPO_DIR anchor exactly, or it ends with
-# the bundled "/entwurf/mcp/<name>/start.sh" pattern (covers a rebuilt
-# checkout under a different directory). Anything else is treated as a user
-# override and left in place.
-BUNDLED = ("entwurf-bridge", "session-bridge", "pi-tools-bridge")
-provider = data.get("entwurfProvider")
-mcp_removed = 0
-if isinstance(provider, dict):
-    servers = provider.get("mcpServers")
-    if isinstance(servers, dict):
-        for name in BUNDLED:
-            existing = servers.get(name)
-            if not isinstance(existing, dict):
-                continue
-            cmd = existing.get("command")
-            if not isinstance(cmd, str):
-                continue
-            exact = cmd == f"{repo_dir}/mcp/{name}/start.sh"
-            pattern = cmd.endswith(f"/entwurf/mcp/{name}/start.sh")
-            if exact or pattern:
-                del servers[name]
-                mcp_removed += 1
-                print(f"remove: removed entwurfProvider.mcpServers.{name}")
-            else:
-                print(f"remove: preserved entwurfProvider.mcpServers.{name} (user override: {cmd})")
-        if not servers:
-            provider.pop("mcpServers", None)
-    if not provider:
-        data.pop("entwurfProvider", None)
-
-settings_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"remove: removed {pkg_removed} packages[] entries, {mcp_removed} mcpServers entries from {settings_path}")
-PY
+  # Same fail-before-write rule as install: remove has two writers too
+  # (packages[] SSOT, then entwurfProvider cleanup), so a malformed provider must
+  # not leave a half-removed packages[] entry behind.
+  preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$(mktemp -u)"
+  # packages[] cleanup via the shared SSOT — same is_entwurf_source predicate as
+  # install, so remove never over-deletes a look-alike repo (entwurf-notes, …)
+  # that install would never have registered.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR" --remove
+  # entwurfProvider.mcpServers.entwurf-bridge cleanup (project scope) via the shared SSOT: strip
+  # our-managed shapes (the bare stable bin AND the legacy repo start.sh path — a true user
+  # override is left in place) + prune legacy bundles. Mirrors install's ownership predicate so it
+  # never over-deletes a look-alike, and now also catches the bare bin the Task-2 install writes.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$project_dir/.pi/settings.json" "$REPO_DIR" --scope project
+  # `remove` is project-scope only. The GLOBAL user-scope citizen in
+  # ~/.pi/agent/settings.json (written by install's register_user_scope_citizen)
+  # is shared across every project + foreign cwd, so it is left intact here to
+  # avoid breaking `--entwurf-control` elsewhere. Point the operator at the
+  # explicit global inverse so the install↔remove asymmetry is never silent.
+  local agent_settings="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}/settings.json"
+  if python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_settings" "$REPO_DIR" --remove --dry-run 2>/dev/null | grep -q 'would remove'; then
+    log "note: global user-scope citizen still registered in $agent_settings"
+    log "      run './run.sh remove-user-scope' to remove it (affects ALL cwds)"
+  fi
 }
 
 check_model_lock() {
@@ -493,7 +512,7 @@ check_model_lock() {
   # No pi process, no network, no API cost. Mocks ExtensionAPI/Context and
   # drives the model_select handler through every quadrant + edge case
   # (see scripts/check-model-lock.ts header for the full matrix).
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-model-lock.ts)
+  run_ts scripts/check-model-lock.ts
 }
 
 check_shell_quote() {
@@ -502,7 +521,7 @@ check_shell_quote() {
   # across the two duplication sites AND behavioral correctness on the
   # payload classes that caused the 2026-05-18 remote entwurf incident
   # (backtick / $(...) / $VAR / korean tokens). No process spawn, no SSH.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-shell-quote.ts)
+  run_ts scripts/check-shell-quote.ts
 }
 
 check_entwurf_session_identity() {
@@ -512,7 +531,7 @@ check_entwurf_session_identity() {
   # models, titleSlug canonicalization, registry exact-tuple membership, name=
   # info-only invariants, and header-scan collision pre-check. Isolates registry
   # + sessions base to a temp dir. No backend, no API, no spawn.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-session-identity.ts)
+  run_ts scripts/check-entwurf-session-identity.ts
 }
 
 check_meta_session() {
@@ -522,7 +541,7 @@ check_meta_session() {
   # real temp dir), idempotent existence-keyed decideUpsert + identity-drift
   # refusal, and the pre-drilled read-receipt mutators. Pure functions; no
   # backend, no hook, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-session.ts)
+  run_ts scripts/check-meta-session.ts
 }
 
 check_meta_record_v2() {
@@ -532,7 +551,7 @@ check_meta_record_v2() {
   # and v2 field-contract crashes. Reader/normalizer only — no v2 writer yet.
   # Kept separate from check-meta-session so 3D's v1-gate rewrites leave this
   # back-compat golden untouched. Pure functions; no backend, no hook, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-record-v2.ts)
+  run_ts scripts/check-meta-record-v2.ts
 }
 
 check_mailbox_receipt_state() {
@@ -542,7 +561,7 @@ check_mailbox_receipt_state() {
   # keyset, then the fs store (stamp → persist → read-back) in a temp mailbox
   # dir. Schema/store only — no live enqueue/read dual-write (that is 3D). No
   # backend, no hook, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-mailbox-receipt-state.ts)
+  run_ts scripts/check-mailbox-receipt-state.ts
 }
 
 check_entwurf_capabilities() {
@@ -553,7 +572,7 @@ check_entwurf_capabilities() {
   # META_BACKEND_DESCRIPTORS for the three existing backends (drift guard), and
   # strict keyset/coverage/field crashes. Parser/gate only — no live routing,
   # no record/descriptor consumer change (that is 3D). No backend, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-capabilities.ts)
+  run_ts scripts/check-entwurf-capabilities.ts
 }
 
 check_meta_dual_read() {
@@ -563,7 +582,7 @@ check_meta_dual_read() {
   # unknown-version crash. Pure functions only — no fs upsert wiring, no
   # readMetaInbox/enqueueMetaMessage change, no record.delivery removal (3D-2/3/4).
   # No backend, no hook, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-dual-read.ts)
+  run_ts scripts/check-meta-dual-read.ts
 }
 
 check_meta_mailbox_state_write() {
@@ -575,7 +594,7 @@ check_meta_mailbox_state_write() {
   # carries lastEnqueuedAt/lastReadAt with field isolation, lastDeliveredAt is never
   # invented, an empty inbox is a no-op on BOTH record and state (⑥), and a state
   # drift surfaces fail-loud. v2 citizen seeded via upsertMetaSession. No API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-mailbox-state-write.ts)
+  run_ts scripts/check-meta-mailbox-state-write.ts
 }
 
 check_meta_receiver_marker() {
@@ -588,7 +607,7 @@ check_meta_receiver_marker() {
   # from "no marker"); armProvenance constrained to the arm-capable events so
   # UserPromptSubmit cannot mint presence; reader does NOT gate on record existence
   # (recordBacked is the deliverability predicate's fact). Real tmpdir, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-receiver-marker.ts)
+  run_ts scripts/check-meta-receiver-marker.ts
 }
 
 check_meta_migration() {
@@ -598,7 +617,7 @@ check_meta_migration() {
   # state.json). Crash-order: a v1 record's receipts migrate to state BEFORE the v2
   # rewrite (proven via upsert attach), and a drift'd state makes migrate throw with
   # the record STILL v1 (recoverable: next attach re-migrates). Temp dir, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-migration.ts)
+  run_ts scripts/check-meta-migration.ts
 }
 
 check_meta_dual_consumers() {
@@ -610,7 +629,7 @@ check_meta_dual_consumers() {
   # authority ambiguity → throw, so the v2 upsert never duplicate-mints) + v1 normalize +
   # body/filename drift fail-fast. The v1-only raw readers remain for v1-fixture gates.
   # Temp dir, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-dual-consumers.ts)
+  run_ts scripts/check-meta-dual-consumers.ts
 }
 
 check_meta_capability_source() {
@@ -623,7 +642,7 @@ check_meta_capability_source() {
   # 3 backends). The record.delivery.wakeMode SLOT stays (removal is 3D-4); only the
   # SOURCE moves. check-entwurf-capabilities still owns the registry ≡ const drift
   # guard. Pure — no fs writes, no backend, no hook, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-capability-source.ts)
+  run_ts scripts/check-meta-capability-source.ts
 }
 
 check_socket_probe() {
@@ -634,7 +653,7 @@ check_socket_probe() {
   # invariant. Listing lists alive only. Pure classify + GC/listing policy +
   # a two-socket integration (live listener → alive survives; nonexistent →
   # dead GC-eligible). No wire timeout fixture, no backend, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-socket-probe.ts)
+  run_ts scripts/check-socket-probe.ts
 }
 
 check_project_trust_handler() {
@@ -646,7 +665,7 @@ check_project_trust_handler() {
   # never undefined. Plus the thin adapter: fake ctx.ui.select, single-writer
   # (handler never calls store.set — pi persists on remember:true), F5a evidence
   # in the prompt title. No real UI, no backend, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-project-trust-handler.ts)
+  run_ts scripts/check-project-trust-handler.ts
 }
 
 check_entwurf_v2_contract() {
@@ -660,7 +679,7 @@ check_entwurf_v2_contract() {
   # Q2 owned-outcome+live never auto-sends. R5 taxonomy covers table reasons +
   # pre-claims bad-target/untrusted-fail-fast/target-locked (bucket B F2). Plus
   # a schema↔types drift guard on the TypeBox input/receipt. Pure, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-contract.ts)
+  run_ts scripts/check-entwurf-v2-contract.ts
 }
 
 check_entwurf_v2_lock() {
@@ -675,7 +694,7 @@ check_entwurf_v2_lock() {
   # fail-closed to conflict. Empty/corrupt lockfile = conflict, never
   # auto-deleted. F2-P1: a malformed gid throws before any path is built. Real
   # temp dir (wx atomicity under test); clock/nonce/pid/host/kill injected.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-lock.ts)
+  run_ts scripts/check-entwurf-v2-lock.ts
 }
 
 check_entwurf_v2_decider() {
@@ -689,7 +708,7 @@ check_entwurf_v2_decider() {
   # takes NO lock (？7); resume plan has no mode/wantsReply/provider/model but has
   # expectedSocketPath/observeTimeoutMs/releaseWhen; an invalid gid throws before
   # any lookup (F2-P1). Pure, no IO, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-decider.ts)
+  run_ts scripts/check-entwurf-v2-decider.ts
 }
 
 check_entwurf_v2_matrix() {
@@ -703,7 +722,7 @@ check_entwurf_v2_matrix() {
   # FAILS if any transport / lock class / pre-probe reject is missing — a dropped
   # decider cell cannot pass silently. Thin coverage, NOT a decider re-impl; surface
   # parity stays in check-entwurf-v2-surface. Pure, no IO, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-matrix.ts)
+  run_ts scripts/check-entwurf-v2-matrix.ts
 }
 
 check_entwurf_v2_release() {
@@ -715,7 +734,7 @@ check_entwurf_v2_release() {
   # release on the FIRST observed transition (socket-alive ∨ child-exited any code)
   # or a failed start; socket↔exit race idempotent (single release either order);
   # decideReleasePolicy enforces the lock-nullness invariant (？7). Pure, no IO.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-release.ts)
+  run_ts scripts/check-entwurf-v2-release.ts
 }
 
 check_entwurf_v2_send() {
@@ -727,7 +746,7 @@ check_entwurf_v2_send() {
   # indeterminate->failed+rethrow with deadFallback+mailbox NEVER called (no
   # double-delivery on an alive-but-stalled socket). Release fires exactly once per
   # send-final; a releaseLock throw never masks the send failure (5b). IO-via-dep.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-send.ts)
+  run_ts scripts/check-entwurf-v2-send.ts
 }
 
 check_entwurf_v2_send_fallback() {
@@ -740,7 +759,7 @@ check_entwurf_v2_send_fallback() {
   # / bad-target + address-conflict->reject pre-probe. Mis-wire (plan/lock gid) fails loud
   # before IO; inspect/probe throws PROPAGATE (the hand owns failed+release); the resolver
   # has NO release seam; every execute plan keeps the held gid and is never spawn-bg.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-send-fallback.ts)
+  run_ts scripts/check-entwurf-v2-send-fallback.ts
 }
 
 check_entwurf_v2_mailbox() {
@@ -757,7 +776,19 @@ check_entwurf_v2_mailbox() {
   # every access throws still resolves). Source guard: the lib code has NO release seam
   # and NO routing seam (no releaseLock / inspect / probe / resolve) — a lock leak or
   # re-route is structurally impossible.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-mailbox.ts)
+  run_ts scripts/check-entwurf-v2-mailbox.ts
+}
+
+check_entwurf_v2_native_push() {
+  # Deterministic gate for 봉인 3/4: the native-push SEND hand (deliverViaNativePush +
+  # makeNativePushSend), the executor half of the native-push rail — where the 1-shot retry
+  # lives (moved out of the adapter leaf). Proves over a fake adapter (no agy/socket): success
+  # first try -> {retried:false}, ONE send over the planted route, ZERO re-probe; fail ->
+  # re-probe alive -> re-send success -> {retried:true}, TWO sends, the 2nd over the RE-
+  # DISCOVERED route; re-send FAIL -> throws (no 3rd attempt); re-probe dead/indeterminate ->
+  # throws (not retried), NO second send. makeNativePushSend resolves the adapter from
+  # plan.backend and IGNORES the lock (lock-free rail).
+  run_ts scripts/check-entwurf-v2-native-push.ts
 }
 
 check_entwurf_v2_runner() {
@@ -771,7 +802,7 @@ check_entwurf_v2_runner() {
   # SendDeliveredReleaseFailedError -> execution-failed{finalizedOutcome, releaseFailed,
   # retrySafe:false}; a plain hand throw -> execution-failed{retrySafe:false} with no
   # finalizedOutcome. Exactly one hand runs per execute.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-runner.ts)
+  run_ts scripts/check-entwurf-v2-runner.ts
 }
 
 check_entwurf_v2_surface() {
@@ -782,7 +813,7 @@ check_entwurf_v2_surface() {
   # lock-retained, N1 delivered-but-dirty) / surface ctx-free source guard / entwurf-control
   # registers entwurf_v2 + reaches the fence via a NON-LITERAL dynamic import (no static fence
   # import → TS5097 stays closed) + decorates sender origin:pi-session/replyable:true.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-surface.ts)
+  run_ts scripts/check-entwurf-v2-surface.ts
 }
 
 check_entwurf_bridge_boot() {
@@ -793,7 +824,7 @@ check_entwurf_bridge_boot() {
   # registered on the runtime surface with its schema (G1b). tools/list only → no tools/call,
   # no lock/fs side effect, no auth → safe in pnpm check. Broad protocol/negative suite stays
   # in check-bridge/test.sh (D1=A안).
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-bridge-boot.ts)
+  run_ts scripts/check-entwurf-bridge-boot.ts
 }
 
 check_entwurf_bridge_pi_free() {
@@ -804,7 +835,7 @@ check_entwurf_bridge_pi_free() {
   # value-imports @earendil-works/pi-*. Type-only imports and dynamic `await import()`
   # (the intended lazy preflight boundary) are excluded — the runtime boot smoke is the
   # final authority that peers/self/list/mailbox-deliver come up pi-free.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-bridge-pi-free.ts)
+  run_ts scripts/check-entwurf-bridge-pi-free.ts
 }
 
 check_entwurf_v2_production() {
@@ -815,7 +846,7 @@ check_entwurf_v2_production() {
   # lockDir / QB3 the spawn watcher releases via the SHARED lockDir release (not the spawn
   # factory default) / the mailbox hand enqueues onto the wired dirs / a dead control send
   # re-resolves to the SAME sendViaMailbox instance on the SAME dirs (Q3+Q5 no drift).
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-production.ts)
+  run_ts scripts/check-entwurf-v2-production.ts
 }
 
 check_entwurf_control_rpc() {
@@ -826,7 +857,7 @@ check_entwurf_control_rpc() {
   # sendRpcCommand from the lib and no longer defines its own / real short unix-socket round-trip
   # (write command -> matched {type:response,command,success:true} -> resolve) / close-before-
   # response rejects 'connection closed before response'. net.Server only, no model/pi process.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-control-rpc.ts)
+  run_ts scripts/check-entwurf-control-rpc.ts
 }
 
 check_entwurf_v2_spawn() {
@@ -840,7 +871,7 @@ check_entwurf_v2_spawn() {
   # obtainable (grace elapses, or a post-spawn watch dep throws and the exit can't be
   # observed) -> lock-retained fail-closed (released:false, pid/socket/lockPath surfaced) —
   # there is NO direct-release hatch; deps.releaseLock is reached ONLY via reduceRelease.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-spawn.ts)
+  run_ts scripts/check-entwurf-v2-spawn.ts
 }
 
 check_entwurf_resume_args() {
@@ -853,7 +884,7 @@ check_entwurf_resume_args() {
   # and the prompt-as-turn positional (`-p` NOT dropped in v2); explicitExtensionArgs
   # preserved exactly once (provider-resolution footgun #29); v2 includes plan.launchArgs
   # (--approve) before the prompt; null provider emits no --provider; no cross-contamination.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-resume-args.ts)
+  run_ts scripts/check-entwurf-resume-args.ts
 }
 
 check_entwurf_v2_spawn_production() {
@@ -867,7 +898,7 @@ check_entwurf_v2_spawn_production() {
   # (symlink) rejects without connecting, dead→wait→alive, abort clears the sleep. awaitChildExit
   # resolves the code + removes the listener on abort. awaitTimeout schedules + abort-clears.
   # killChild=SIGTERM; releaseLock delegates; a proc-less child fails loud (mis-wire).
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-v2-spawn-production.ts)
+  run_ts scripts/check-entwurf-v2-spawn-production.ts
 }
 
 
@@ -883,7 +914,7 @@ smoke_entwurf_v2_spawn_live() {
     echo "[smoke-entwurf-v2-spawn-live] skipped — set LIVE=1 to run (spawns real children + opens a real unix socket)."
     return 0
   fi
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-entwurf-v2-spawn-live.ts)
+  run_ts scripts/smoke-entwurf-v2-spawn-live.ts
 }
 
 smoke_acp_socket_citizen_live() {
@@ -896,7 +927,7 @@ smoke_acp_socket_citizen_live() {
   # citizenship, never a backend turn (that is S2). Honest skip when LIVE!=1.
   # Model override: ENTWURF_S1_MODEL (default claude-opus-4-8).
   #   LIVE=1 ./run.sh smoke-acp-socket-citizen-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-socket-citizen-live.ts)
+  run_ts scripts/smoke-acp-socket-citizen-live.ts
 }
 
 smoke_acp_raw_turn_live() {
@@ -910,7 +941,7 @@ smoke_acp_raw_turn_live() {
   # fails acceptance unless ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK=1, debug).
   # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-raw-turn-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-raw-turn-live.ts)
+  run_ts scripts/smoke-acp-raw-turn-live.ts
 }
 
 smoke_acp_overlay_live() {
@@ -928,7 +959,7 @@ smoke_acp_overlay_live() {
   # fallback fails acceptance unless ENTWURF_ACP_OVERLAY_ALLOW_PATH_FALLBACK=1).
   # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-overlay-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-overlay-live.ts)
+  run_ts scripts/smoke-acp-overlay-live.ts
 }
 
 smoke_acp_memory_containment_live() {
@@ -943,7 +974,7 @@ smoke_acp_memory_containment_live() {
   # fallback fails acceptance unless ENTWURF_ACP_MEMORY_ALLOW_PATH_FALLBACK=1).
   # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-memory-containment-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-memory-containment-live.ts)
+  run_ts scripts/smoke-acp-memory-containment-live.ts
 }
 
 smoke_acp_provider_live() {
@@ -958,7 +989,7 @@ smoke_acp_provider_live() {
   # event-mapper gate owns the tool→notice contract.
   # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-provider-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-provider-live.ts)
+  run_ts scripts/smoke-acp-provider-live.ts
 }
 
 smoke_acp_session_reuse_live() {
@@ -972,7 +1003,7 @@ smoke_acp_session_reuse_live() {
   # smoke-acp-provider-live.
   # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-session-reuse-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-session-reuse-live.ts)
+  run_ts scripts/smoke-acp-session-reuse-live.ts
 }
 
 smoke_acp_carrier_augment_live() {
@@ -984,7 +1015,7 @@ smoke_acp_carrier_augment_live() {
   # check via SMOKE_ACP_CARRIER_PRESENT=1 (non-blocking).
   # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
   #   LIVE=1 ./run.sh smoke-acp-carrier-augment-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-carrier-augment-live.ts)
+  run_ts scripts/smoke-acp-carrier-augment-live.ts
 }
 
 smoke_acp_mcp_live() {
@@ -997,7 +1028,7 @@ smoke_acp_mcp_live() {
   # fix). Isolated probe (not entwurf-bridge) so a failure does not blur into
   # identity/env wiring. Model override: ENTWURF_ACP_PROVIDER_MODEL.
   #   LIVE=1 ./run.sh smoke-acp-mcp-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-mcp-live.ts)
+  run_ts scripts/smoke-acp-mcp-live.ts
 }
 
 smoke_acp_skill_live() {
@@ -1009,7 +1040,7 @@ smoke_acp_skill_live() {
   # the Skill/Skill(*) auto-add reach the live session (the other half of the GLG
   # baseline). Model override: ENTWURF_ACP_PROVIDER_MODEL.
   #   LIVE=1 ./run.sh smoke-acp-skill-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-skill-live.ts)
+  run_ts scripts/smoke-acp-skill-live.ts
 }
 
 smoke_acp_bundled_mcp_live() {
@@ -1025,7 +1056,7 @@ smoke_acp_bundled_mcp_live() {
   # diagnostic backlog, not the 0.11.0 release circuit). Model override:
   # ENTWURF_ACP_PROVIDER_MODEL.
   #   LIVE=1 ./run.sh smoke-acp-bundled-mcp-live
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-acp-bundled-mcp-live.ts)
+  run_ts scripts/smoke-acp-bundled-mcp-live.ts
 }
 
 smoke_acp_rgg_live() {
@@ -1062,7 +1093,7 @@ smoke_entwurf_v2_matrix_live() {
     echo "[smoke-entwurf-v2-matrix-live] skipped — set LIVE=1 to run (spawns a real pi --entwurf-control + opens a real socket)."
     return 0
   fi
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-entwurf-v2-matrix-live.ts)
+  run_ts scripts/smoke-entwurf-v2-matrix-live.ts
 }
 
 smoke_entwurf_v2_spawn_resume_live() {
@@ -1084,7 +1115,7 @@ smoke_entwurf_v2_spawn_resume_live() {
     echo "[smoke-entwurf-v2-spawn-resume-live] skipped — set LIVE=1 to run (spawns a real pi resume child + opens a real socket)."
     return 0
   fi
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-entwurf-v2-spawn-resume-live.ts)
+  run_ts scripts/smoke-entwurf-v2-spawn-resume-live.ts
 }
 
 check_entwurf_facts() {
@@ -1096,7 +1127,7 @@ check_entwurf_facts() {
   # (no proof ≠ dead). facts-only keyset: identity facts + liveness, NO
   # verb-routing (resumable/sendable/transport/dispatch/action) and NO
   # transcriptPath (동결결정 10). Pure, no IO, no API.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-facts.ts)
+  run_ts scripts/check-entwurf-facts.ts
 }
 
 check_socket_discovery() {
@@ -1108,7 +1139,7 @@ check_socket_discovery() {
   # indeterminate (F3), never folded to dead by an alive-only listing. Dir
   # hygiene (non-.sock / malformed names ignored), dedup, missing-dir, sort, and
   # an end-to-end scanSocketProbes→resolveFactList. readdir/probe injected, no IO.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-socket-discovery.ts)
+  run_ts scripts/check-socket-discovery.ts
 }
 
 check_meta_listing() {
@@ -1119,7 +1150,7 @@ check_meta_listing() {
   # becomes an explicit error carrying ONLY {filename, message}, verbatim (a
   # salvaged gid string as a fact = synthetic backdoor). mode strict throws on
   # any error, collect returns partial. entries/readRecord injected, no IO.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-meta-listing.ts)
+  run_ts scripts/check-meta-listing.ts
 }
 
 check_entwurf_fact_provider() {
@@ -1131,7 +1162,7 @@ check_entwurf_fact_provider() {
   # survives; impossible wiring invariant (resolveFactList duplicate/unprobed) →
   # throw, never swallowed. A collision quarantines BOTH the PeerFact and the
   # socket (gid is the universal address). meta + socket deps injected, no IO.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-fact-provider.ts)
+  run_ts scripts/check-entwurf-fact-provider.ts
 }
 
 check_entwurf_peers_surface() {
@@ -1145,7 +1176,7 @@ check_entwurf_peers_surface() {
   # diagnostics in both surfaces; empty → "(none)"; unsupported shown; enrich null
   # → "(not enriched)". WIRING guard: bridge calls listEntwurfFacts+renderEntwurfPeers,
   # getLiveSessions gone. Facts fabricated, no IO (only static source read).
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-peers-surface.ts)
+  run_ts scripts/check-entwurf-peers-surface.ts
 }
 
 
@@ -1162,7 +1193,7 @@ check_entwurf_self_address() {
   # probes the socket, and entwurf_self renders alive vs expected (no path lie).
   # Slice boundary: meta watchArmed is wired from the slice-2 presence marker; do NOT
   # claim slice 1 green standalone (1+2 close in the same release block).
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-self-address.ts)
+  run_ts scripts/check-entwurf-self-address.ts
 }
 
 check_entwurf_deliverability() {
@@ -1174,7 +1205,7 @@ check_entwurf_deliverability() {
   # (pi) refused even when active (SE-1, no mailbox drain), self-fetch + dead-owner/unarmed
   # refused (SE-2, would rot); WIRING that the self-addressability predicate shares the
   # SAME active-receiver atom (one source of truth). Pure, no IO.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-deliverability.ts)
+  run_ts scripts/check-entwurf-deliverability.ts
 }
 
 check_entwurf_mailbox_guard() {
@@ -1185,7 +1216,47 @@ check_entwurf_mailbox_guard() {
   # one calls it exactly once; TMPDIR SNAPSHOT with the real enqueueMetaMessage — a refused
   # send leaves the mailbox tree byte-identical (file list + content hash, not just mtime),
   # an accepted send writes exactly one .msg; plus fact gathering from record/capability/marker.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-entwurf-mailbox-guard.ts)
+  run_ts scripts/check-entwurf-mailbox-guard.ts
+}
+
+check_native_push_adapter() {
+  # Deterministic gate for the native-push adapter LEAF (봉인 3/8). Drives
+  # createAntigravityAdapter with a FAKE runner (no real agy/ss/pgrep). Asserts: FULL pid
+  # scan (only the 2nd host pid serves the conv → probe still finds the route; raw-agy-send
+  # head -1 corrected); dead (no host) vs indeterminate (host alive, no LS port served the
+  # conv, never coerced to dead); VOLATILE route / no cache (a repeated probe re-discovers a
+  # CHANGED route); send argv === [binary,agentapi,send-message,conv,body] with
+  # ANTIGRAVITY_LS_ADDRESS env, non-zero exit THROWS; NO retry in the adapter (single send,
+  # no re-probe — retry is the executor hand's job, step ⑥); resolveNativePushAdapter fail-fast.
+  run_ts scripts/check-native-push-adapter.ts
+}
+
+check_native_push_register() {
+  # Deterministic gate for 봉인 5: registerNativeConversation (the core of the
+  # entwurf_register_native MCP tool). Drives it with a FAKE adapter + an ISOLATED mkdtemp
+  # store (never the real ~/.pi). Asserts: live probe -> CREATE (record carries backend/
+  # nativeSessionId/caller-cwd); re-register -> ATTACH (SAME garden id, cwd refreshed, ONE
+  # record, no duplicate mint); dead/indeterminate probe -> REFUSE (throws, NO record written);
+  # RECEIVER-MARKER ABSTINENCE (보정①) — the register source references no receiver-marker
+  # writer (writeMetaReceiverMarker / armProvenance / META_RECEIVER_ARM_PROVENANCES).
+  run_ts scripts/check-native-push-register.ts
+}
+
+check_agy_sender_identity() {
+  # Deterministic gate for the #46 sender-identity lane — WHO is calling the bridge.
+  # A birthed agy conversation could already CALL entwurf_v2 for real, yet its message
+  # landed as external-mcp/unknown-host (non-replyable): the hook wrote only the
+  # meta-record, and the bridge's resolver looked markers up under `claude-code` alone.
+  # Behavioral, not source-regex: the real hook runs as a child process (so the marker's
+  # ownerPid is the gate's own pid — the same parent-pid join production performs), and
+  # the resolver runs against isolated marker/record stores.
+  # Rows: hook writes an antigravity marker keyed by its PARENT pid; an upsert failure
+  # writes NO marker (record authority first); resolver 0→null, 1→identity on EITHER
+  # backend, no-record/drifted marker→null, two distinct live identities on one owner pid
+  # →THROW (never guess, never downgrade to anonymous), two markers naming the SAME
+  # identity→not a conflict; antigravity is native-push so its replyable comes from the
+  # adapter probe, never from a mailbox watch it can never arm (보정①).
+  run_ts scripts/check-agy-sender-identity.ts
 }
 
 
@@ -1200,7 +1271,7 @@ check_package_source_routing() {
   # plus self-root fallback and the resume unresolvedAcpIntent signal. Isolated
   # via a temp PI_CODING_AGENT_DIR — the real ~/.pi/agent is never touched. No
   # backend, no spawn, no API cost.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-package-source-routing.ts)
+  run_ts scripts/check-package-source-routing.ts
 }
 
 
@@ -1216,7 +1287,7 @@ smoke_session_id_name() {
     fail "[smoke-session-id-name] pi binary not on PATH — cannot run live substrate proof"
     return 1
   fi
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/smoke-session-id-name.ts) || {
+  run_ts scripts/smoke-session-id-name.ts || {
     fail "[smoke-session-id-name] live substrate smoke failed"
     return 1
   }
@@ -1469,6 +1540,87 @@ check_install_preflight() {
   fi
   rm -rf "$fake" "$proj"
   ok "[check-install-preflight] representative dangling symlink (test -d blind spot) → fails before writing settings, names the dep"
+
+  # negative 3 — corrupt project provider shape. install_local_package now has a
+  # two-step writer (packages[] SSOT, then entwurfProvider.mcpServers), so a
+  # malformed provider MUST fail before the packages[] step writes anything.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$proj/.pi" "$fake/home"
+  printf '{"entwurfProvider": []}\n' > "$proj/.pi/settings.json"
+  local before after
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider was partially rewritten (packages[] leak)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "entwurfProvider is not an object"; then
+    fail "[check-install-preflight] corrupt entwurfProvider failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ -f "$fake/home/.pi/agent/settings.json" ]; then
+    fail "[check-install-preflight] corrupt project provider still wrote user-scope settings"; cat "$fake/home/.pi/agent/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt project entwurfProvider → fails before any project/user settings write"
+
+  # negative 4 — corrupt project mcpServers shape, same no-partial-write contract.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$proj/.pi" "$fake/home"
+  printf '{"entwurfProvider": {"mcpServers": []}}\n' > "$proj/.pi/settings.json"
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt entwurfProvider.mcpServers did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt mcpServers was partially rewritten (packages[] leak)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "entwurfProvider.mcpServers is not an object"; then
+    fail "[check-install-preflight] corrupt mcpServers failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt project entwurfProvider.mcpServers → fails before any project settings write"
+
+  # negative 5 — corrupt user-scope packages shape. Since install writes project
+  # settings before user registration, this preflight must catch the user file up
+  # front so a bad ~/.pi/agent/settings.json cannot leave the project half-wired.
+  fake=$(mktemp -d); proj=$(mktemp -d)
+  mkdir -p "$fake/home/.pi/agent"
+  printf '{"packages": {"broken": true}}\n' > "$fake/home/.pi/agent/settings.json"
+  rc=0; out=$(HOME="$fake/home" PI_CODING_AGENT_DIR="$fake/home/.pi/agent" "$REPO_DIR/run.sh" install "$proj" 2>&1) || rc=$?
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt user packages did NOT fail install"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if [ -f "$proj/.pi/settings.json" ]; then
+    fail "[check-install-preflight] corrupt user packages still wrote project settings (partial install)"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  if ! printf '%s' "$out" | grep -q "user settings packages is not a JSON array"; then
+    fail "[check-install-preflight] corrupt user packages failed for the WRONG reason:"; echo "$out"; rm -rf "$fake" "$proj"; exit 1
+  fi
+  rm -rf "$fake" "$proj"
+  ok "[check-install-preflight] corrupt user-scope packages → fails before project settings write"
+
+  # negative 6 — remove has the same two-step write risk (packages[] remove,
+  # then provider cleanup). A corrupt provider must fail before packages[] is
+  # altered, otherwise uninstall becomes a partial destructive write.
+  proj=$(mktemp -d)
+  mkdir -p "$proj/.pi"
+  printf '{"entwurfProvider": [], "packages": ["%s"]}\n' "$REPO_DIR" > "$proj/.pi/settings.json"
+  before=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  rc=0; out=$("$REPO_DIR/run.sh" remove "$proj" 2>&1) || rc=$?
+  after=$(sha256sum "$proj/.pi/settings.json" | cut -d' ' -f1)
+  if [ "$rc" -eq 0 ]; then
+    fail "[check-install-preflight] corrupt provider did NOT fail remove"; echo "$out"; rm -rf "$proj"; exit 1
+  fi
+  if [ "$before" != "$after" ]; then
+    fail "[check-install-preflight] corrupt provider remove partially rewrote packages[]"; echo "$out"; cat "$proj/.pi/settings.json"; rm -rf "$proj"; exit 1
+  fi
+  rm -rf "$proj"
+  ok "[check-install-preflight] remove with corrupt provider → fails before packages[] removal"
 }
 
 check_pi_preflight() {
@@ -1476,7 +1628,7 @@ check_pi_preflight() {
   # decision 8 precedence (saved false > saved true > prefix > no-inputs >
   # fail-fast) and decision 7's separator-boundary prefix against pi's own
   # ProjectTrustStore in a temp agentDir. Deterministic, no network/backend.
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-pi-preflight.ts)
+  run_ts scripts/check-pi-preflight.ts
 }
 
 
@@ -1531,7 +1683,7 @@ check_acp_provider_surface() {
   # sentinel shape, and a FAIL-LOUD streamSimple (calling it throws — no native
   # fallback, no empty-but-successful stream). Pure, no pi runtime, no API.
   section "ACP provider surface (S0 loader/fence)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-provider-surface.ts)
+  run_ts scripts/check-acp-provider-surface.ts
 }
 
 check_acp_sdk_surface() {
@@ -1543,7 +1695,7 @@ check_acp_sdk_surface() {
   # turn needs (silent-rename gate), and forbids any source-level anthropic SDK
   # import / API-client use (the anthropic dep is a peer-pin ONLY).
   section "ACP SDK surface (S2a dep pin + peer-resolution + no-client-use)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-sdk-surface.ts)
+  run_ts scripts/check-acp-sdk-surface.ts
 }
 
 check_acp_overlay() {
@@ -1556,7 +1708,7 @@ check_acp_overlay() {
   # stale symlinks cleaned; binary-owned files preserved; CLAUDE_CONFIG_DIR
   # launch-env planted; idempotent. Pure, no live model.
   section "ACP overlay (S2b claude-config-overlay)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-overlay.ts)
+  run_ts scripts/check-acp-overlay.ts
 }
 
 check_acp_tool_surface() {
@@ -1567,7 +1719,7 @@ check_acp_tool_surface() {
   # extraArgs/plugins) + the S2b billing-carrier guard (no _meta.systemPrompt
   # unless a caller supplies one). Pure preflight — NOT a backend wire read.
   section "ACP tool surface (S2b exclude-tools preflight + session meta)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-tool-surface.ts)
+  run_ts scripts/check-acp-tool-surface.ts
 }
 
 check_acp_event_mapper() {
@@ -1579,7 +1731,7 @@ check_acp_event_mapper() {
   # context→ACP-prompt transcript passthrough (excludes systemPrompt/thinking,
   # single text block). Pure, no live backend.
   section "ACP event mapper (S2c notification→stream + context)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-event-mapper.ts)
+  run_ts scripts/check-acp-event-mapper.ts
 }
 
 check_acp_prompt_builder() {
@@ -1590,7 +1742,7 @@ check_acp_prompt_builder() {
   # excluded so a reuse session is not re-injected its own history). Pure, no
   # session store yet — locks the builder before S2d wires the reuse paths.
   section "ACP prompt builder (S2d bootstrapPath prompt scope)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-prompt-builder.ts)
+  run_ts scripts/check-acp-prompt-builder.ts
 }
 
 check_acp_config() {
@@ -1603,7 +1755,7 @@ check_acp_config() {
   # headers, and envelope enrich (PI_SESSION_ID/PI_AGENT_ID into entwurf-bridge
   # only, stale filtered, post-hash). Pure + temp-dir settings I/O, no child/spawn.
   section "ACP provider config (S2g operator mcpServers/skillPlugins/tools passthrough)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-config.ts)
+  run_ts scripts/check-acp-config.ts
 }
 
 check_acp_session_store() {
@@ -1614,7 +1766,7 @@ check_acp_session_store() {
   # (turn-scoped/-p one-shot is ALWAYS new — no in-memory reuse, no persisted
   # resume/load in the first cut). Pure + temp-dir record I/O, no child/spawn.
   section "ACP session store (S2d-1b-1 signature/compat/bootstrap decision)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-session-store.ts)
+  run_ts scripts/check-acp-session-store.ts
 }
 
 check_acp_backend_preflight() {
@@ -1625,7 +1777,7 @@ check_acp_backend_preflight() {
   # assertExcludeToolsHonored is wired into the live provider path, not just the
   # pure gate. No backend launched (preflight throws first). Pure.
   section "ACP backend preflight (S2c runtime exclude-tools wiring)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-backend-preflight.ts)
+  run_ts scripts/check-acp-backend-preflight.ts
 }
 
 check_acp_session_reuse() {
@@ -1638,7 +1790,7 @@ check_acp_session_reuse() {
   # never torn down between turns, and source-locks buildAcpPrompt wiring +
   # single-site applyAcpSessionUpdate via the router. No real child launched.
   section "ACP session reuse (S2d-1b-2b delta-only capture + mutable routing)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-session-reuse.ts)
+  run_ts scripts/check-acp-session-reuse.ts
 }
 
 check_acp_carrier_augment() {
@@ -1650,7 +1802,7 @@ check_acp_carrier_augment() {
   # so it never enters contextMessageSignatures — with entwurf cwd/AGENTS.md
   # de-dup. Pure + temp-dir fs, no spawn.
   section "ACP carrier + augment (S2d-1c engraving + first-user augment)"
-  (cd "$REPO_DIR" && node --experimental-strip-types scripts/check-acp-carrier-augment.ts)
+  run_ts scripts/check-acp-carrier-augment.ts
 }
 
 check_pack() {
@@ -1676,7 +1828,11 @@ check_pack() {
   # npm's own lifecycle banner stay off stdout; otherwise they pollute the --json
   # payload this parses. prepack runs on dry-run too, which is how dist lands in
   # this gate's file list.
-  json=$(cd "$REPO_DIR" && npm pack --dry-run --json --silent 2>/dev/null) || {
+  # with-dist-lock wraps the WHOLE pack (prepack build-bridge emit + npm's
+  # post-build dist read) so a concurrent pack/build can't `rm -rf dist` mid-read
+  # (the 2026-07-03 phantom "dist missing" race). The nested prepack build-bridge
+  # is reentrant via ENTWURF_BUILD_LOCK_HELD.
+  json=$(cd "$REPO_DIR" && bash scripts/with-dist-lock.sh npm pack --dry-run --json --silent 2>/dev/null) || {
     fail "[check-pack] npm pack --dry-run failed"
     return 1
   }
@@ -1735,6 +1891,14 @@ check_pack() {
     # doctor.sh runs this prebuilt JS when installed under node_modules (strip-types
     # refuses the .ts there), same boundary start.sh crosses. build-bridge emits it.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+    # 0.12.7 — node_modules-safe agy PreInvocation hook. The stable npm bin
+    # dispatches here because Node refuses raw .ts below node_modules.
+    "mcp/entwurf-bridge/dist/scripts/agy-imprint.js"
+    # 0.12.7 — the three OPERATOR commands run.sh dispatches. Installed, REPO_DIR is
+    # under node_modules, so run_ts must find a compiled twin or the command is dead.
+    "mcp/entwurf-bridge/dist/scripts/doctor-pi-provider.js"
+    "mcp/entwurf-bridge/dist/scripts/new-session-id.js"
+    "mcp/entwurf-bridge/dist/scripts/meta-bridge-prune.js"
     # 0.12.5 — the node_modules-safe plugin hook + its lib. install-meta-bridge copies
     # these compiled JS into the assembled plugin when installed (raw .ts can't
     # strip-types under node_modules). meta-session.js is shared with the store-doctor
@@ -1772,6 +1936,13 @@ check_pack() {
     '\.tmp-verify/'
     '\.agent-(reports|shell)/'
     'pi/meta-bridge/\.assembled/'
+    # Python bytecode residue — `scripts/` ships whole via the files allowlist,
+    # which BYPASSES .gitignore/.npmignore for its contents, so a `pnpm check`
+    # run's generated scripts/__pycache__/*.pyc rode into the 0.12.6 tarball. The
+    # files-array `!**/__pycache__` / `!**/*.pyc` negations exclude it; this is the
+    # tripwire that fails loud if that negation is ever dropped (결합 규칙).
+    '__pycache__'
+    '\.pyc$'
   )
 
   local pass=1 f pat hit
@@ -1804,7 +1975,7 @@ check_pack() {
   return 1
 }
 
-check_pack_install() {
+_check_pack_install_impl() {
   # Heavy publish gate. Runs the remaining three checks in #13's
   # publish checklist that check_pack (dry-run only) does not cover:
   #
@@ -1833,8 +2004,15 @@ check_pack_install() {
   # that lands as `junghanacs-entwurf-<version>.tgz`. Hardcoded against
   # the scope above so a name change cannot silently slide past this gate.
   tgz_name="junghanacs-entwurf-${version}.tgz"
-  tgz_path="${REPO_DIR}/${tgz_name}"
-  rm -f "$tgz_path"
+  # Pack into a UNIQUE per-run dir, never the repo root. Writing/removing a fixed
+  # ${REPO_DIR}/<tgz> pollutes the working tree (a crash leaves a stray tarball) AND
+  # lets two concurrent packs corrupt/delete each other's artifact ("tarball data
+  # seems corrupted" / ENOENT; a half-installed package then fails the later
+  # install-meta-bridge check downstream). A per-run pack dir makes the tarball
+  # instance-private end-to-end — every consumer below + the trap follow $pack_tmp.
+  local pack_tmp
+  pack_tmp=$(mktemp -d -t entwurf-pack.XXXXXX)
+  tgz_path="${pack_tmp}/${tgz_name}"
 
   # 0.12.1 C — stale-dist guard. `tsc` emit does NOT prune orphaned files from
   # outDir, and `files: ["mcp/"]` would carry any leftover dist file into the
@@ -1846,7 +2024,11 @@ check_pack_install() {
   printf 'module.exports = "stale";\n' > "$stale_probe"
 
   echo "[check-pack-install] npm pack -> ${tgz_name}"
-  (cd "$REPO_DIR" && npm pack --dry-run=false 2>&1 | tail -1) || {
+  # with-dist-lock: same whole-pack serialization as check-pack — this heavy gate
+  # and a background check-pack (via `pnpm check`) both pack, and unserialized they
+  # race the shared dist dir. The stale-dist sentinel planted just above still
+  # proves build-bridge's own `rm -rf dist` clean step under the lock.
+  (cd "$REPO_DIR" && bash scripts/with-dist-lock.sh npm pack --dry-run=false --pack-destination "$pack_tmp" 2>&1 | tail -1) || {
     fail "[check-pack-install] npm pack failed"
     return 1
   }
@@ -1867,7 +2049,7 @@ check_pack_install() {
   # If it did, build-bridge's `rm -rf dist` clean step regressed and stale/orphan
   # emit can ship. (See the plant just before npm pack above.)
   if grep -qxF "mcp/entwurf-bridge/dist/__stale_probe__.js" <<<"$tar_files"; then
-    rm -f "$tgz_path"
+    rm -rf "$pack_tmp"
     fail "[check-pack-install] stale dist file shipped — build-bridge did not clean dist before emit (orphan-emit publish risk)"
     return 1
   fi
@@ -1893,6 +2075,14 @@ check_pack_install() {
     # 0.12.4 — prebuilt node_modules-safe store-scan artifact for the doctor
     # (see check-pack). The installed-scan smoke below runs exactly this file.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js"
+    # 0.12.7 — node_modules-safe agy PreInvocation hook. The installed bin smoke
+    # below executes this exact compiled leaf from under node_modules.
+    "mcp/entwurf-bridge/dist/scripts/agy-imprint.js"
+    # 0.12.7 — the three operator commands (see check-pack). The installed-command
+    # regression below drives each one through the real `entwurf` bin.
+    "mcp/entwurf-bridge/dist/scripts/doctor-pi-provider.js"
+    "mcp/entwurf-bridge/dist/scripts/new-session-id.js"
+    "mcp/entwurf-bridge/dist/scripts/meta-bridge-prune.js"
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
     # hook regression below runs exactly this compiled JS from under node_modules.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
@@ -1924,6 +2114,10 @@ check_pack_install() {
     '^plugins/' '^node_modules/'
     '\.tmp-verify/' '\.agent-(reports|shell)/'
     'pi/meta-bridge/\.assembled/'
+    # Python bytecode residue (see check-pack forbidden note): scripts/ ships
+    # whole, so generated pyc bypasses ignore files — this cross-checks the actual
+    # tarball, not just the dry-run resolver.
+    '__pycache__' '\.pyc$'
   )
   for pat in "${tar_forbidden[@]}"; do
     local hit
@@ -1936,7 +2130,7 @@ check_pack_install() {
   done
 
   if [ "$pass" != "1" ]; then
-    rm -f "$tgz_path"
+    rm -rf "$pack_tmp"
     fail "[check-pack-install] tar -tf invariants violated"
     return 1
   fi
@@ -1955,7 +2149,7 @@ check_pack_install() {
   # nested under $tmp, whose pnpm-add node_modules/package.json would make npm
   # climb the parent and choke ("Cannot read properties of null").
   npm_tmp=$(mktemp -d -t entwurf-npm-managed.XXXXXX)
-  trap 'rm -rf "$tmp" "$npm_tmp" "$tgz_path"' RETURN
+  trap 'rm -rf "$tmp" "$npm_tmp" "$pack_tmp"' RETURN
 
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
@@ -2002,8 +2196,14 @@ check_pack_install() {
     return 1
   fi
 
-  local loader_out
-  loader_out=$(cd "$tmp" && pi -e "$tmp/node_modules/@junghanacs/entwurf" --list-models entwurf 2>&1) || {
+  # HOME/PI_CODING_AGENT_DIR redirected to a throwaway dir: this loader smoke must
+  # depend ONLY on the -e package path, never on the operator's real
+  # ~/.pi/agent/settings.json — otherwise a live-config change could silently
+  # pass/fail the gate (the exact "check must not depend on live wiring" impurity
+  # this whole lane is about).
+  local loader_out loader_home="$tmp/loader-home"
+  mkdir -p "$loader_home/.pi/agent"
+  loader_out=$(cd "$tmp" && HOME="$loader_home" XDG_DATA_HOME="$loader_home/.local/share" XDG_STATE_HOME="$loader_home/.local/state" XDG_CACHE_HOME="$loader_home/.cache" PI_CODING_AGENT_DIR="$loader_home/.pi/agent" pi -e "$tmp/node_modules/@junghanacs/entwurf" --list-models entwurf 2>&1) || {
     fail "[check-pack-install] pi loader smoke failed (exit non-zero):"
     echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
     return 1
@@ -2053,12 +2253,12 @@ check_pack_install() {
     fail "[check-pack-install] npm-managed layout missing executable run.sh (postinstall-chmod did not run?) at $npm_pkg"
     return 1
   fi
-  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-statusline" ]; then
-    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge / entwurf-statusline)"
+  if [ ! -x "$npmroot/node_modules/.bin/entwurf" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-bridge" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-statusline" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-agy-statusline" ] || [ ! -x "$npmroot/node_modules/.bin/entwurf-agy-imprint" ]; then
+    fail "[check-pack-install] npm-managed neutral install missing package bins (entwurf / entwurf-bridge / entwurf-statusline / entwurf-agy-statusline / entwurf-agy-imprint)"
     ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
     return 1
   fi
-  wire_log=$(HOME="$npmhome" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
+  wire_log=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
     fail "[check-pack-install] npm-managed run.sh install failed (preflight rejected hoisted deps?):"
     echo "$wire_log" | tail -15 | sed 's/^/    /' >&2
     return 1
@@ -2075,6 +2275,43 @@ check_pack_install() {
   fi
   echo "[check-pack-install] npm-managed install regression pass (hoisted-dep run.sh install wrote settings)"
 
+  # THE 2026-07-03 regression gate: removing `pi install` from setup dropped
+  # user-scope citizen registration, so `--entwurf-control` was Unknown in a
+  # foreign cwd. Prove the npm consumer path closes it end-to-end: run.sh install
+  # (run above under HOME="$npmhome") must have registered the package in the USER
+  # settings, and pi must then load the entwurf extension + its flags from a cwd
+  # OUTSIDE the project. Fully isolated in the temp HOME — never touches ~/.pi.
+  local npm_user_settings="$npmhome/.pi/agent/settings.json"
+  if [ ! -f "$npm_user_settings" ]; then
+    fail "[check-pack-install] npm-managed install did not register a user-scope citizen at $npm_user_settings"
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/entwurf') for s in srcs) else 1)
+"; then
+    fail "[check-pack-install] user-scope settings.json lacks the npm entwurf package in packages[]:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  # Foreign cwd ($tmp — NOT the project, no project .pi): --entwurf-control must be
+  # a KNOWN flag and the entwurf provider must load, sourced only from user scope.
+  # Before the fix this printed "Unknown options: --entwurf-control".
+  local foreign_out
+  foreign_out=$(cd "$tmp" && HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" PI_CODING_AGENT_DIR="$npmhome/.pi/agent" pi --entwurf-control --list-models entwurf 2>&1) || {
+    fail "[check-pack-install] foreign-cwd --entwurf-control smoke failed (user-scope citizen not loading?):"
+    echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  }
+  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-4-8" <<<"$foreign_out"; then
+    fail "[check-pack-install] foreign-cwd --entwurf-control did not load the entwurf extension from user scope:"
+    echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] user-scope citizen regression pass (npm consumer: --entwurf-control loads from a foreign cwd)"
+
   # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
   # bake versioned pnpm-store paths into Claude settings. MCP already uses the
   # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
@@ -2104,7 +2341,7 @@ SH
   chmod +x "$fake_claude_dir/claude"
   local mb_home="$npm_tmp/meta-home" mb_cfg="$npm_tmp/meta-claude" mb_log
   mkdir -p "$mb_home" "$mb_cfg"
-  mb_log=$(HOME="$mb_home" XDG_DATA_HOME="$mb_home/.local/share" CLAUDE_CONFIG_DIR="$mb_cfg" FAKE_CLAUDE_LOG="$fake_claude_log" PATH="$fake_claude_dir:$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-meta-bridge 2>&1) || {
+  mb_log=$(HOME="$mb_home" XDG_DATA_HOME="$mb_home/.local/share" XDG_STATE_HOME="$mb_home/.local/state" XDG_CACHE_HOME="$mb_home/.cache" CLAUDE_CONFIG_DIR="$mb_cfg" FAKE_CLAUDE_LOG="$fake_claude_log" PATH="$fake_claude_dir:$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-meta-bridge 2>&1) || {
     fail "[check-pack-install] installed install-meta-bridge failed under fake claude:"
     echo "$mb_log" | tail -20 | sed 's/^/    /' >&2
     return 1
@@ -2239,7 +2476,7 @@ function finish(trimmed) {
   try { msg = JSON.parse(trimmed); }
   catch { console.error('unparseable tools/list:', trimmed.slice(0, 300)); if (stderr.trim()) console.error(stderr.trim()); process.exit(1); }
   const names = (msg?.result?.tools ?? []).map((t) => t?.name).sort();
-  for (const need of ['entwurf_v2', 'entwurf_peers', 'entwurf_self', 'entwurf_inbox_read']) {
+  for (const need of ['entwurf_v2', 'entwurf_peers', 'entwurf_self', 'entwurf_inbox_read', 'entwurf_register_native']) {
     if (!names.includes(need)) { console.error('missing MCP tool from installed boot:', need, '— got', names.join(',')); process.exit(1); }
   }
   console.log(names.join(','));
@@ -2259,6 +2496,109 @@ JS
   fi
   echo "[check-pack-install] installed bridge boot pass (dist boots under node_modules, pi-free: $boot_out)"
 
+  # 0.12.7 — installed AGY IMPRINT regression. The npm bin resolves through a
+  # node_modules symlink; raw scripts/agy-imprint.ts is therefore forbidden by
+  # Node's strip-types fence. Execute the real installed bin with an isolated
+  # agent dir and prove the neutral hook response + one record write. This is the
+  # exact package bug that a dev-only hook smoke cannot see.
+  local installed_agy_imprint="$npmroot/node_modules/.bin/entwurf-agy-imprint"
+  local agy_imprint_agent="$npm_tmp/agy-imprint-agent" agy_imprint_out agy_record_count
+  mkdir -p "$agy_imprint_agent"
+  if ! agy_imprint_out=$(printf '%s\n' '{"conversationId":"pack-install-agy-conversation","workspacePaths":["/tmp/entwurf-pack-install"],"modelName":"probe-model"}' | HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" PI_CODING_AGENT_DIR="$agy_imprint_agent" "$installed_agy_imprint" 2>&1); then
+    fail "[check-pack-install] installed entwurf-agy-imprint FAILED under node_modules (raw-.ts strip-types regression or emitted hook missing):"
+    echo "$agy_imprint_out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if [ "$agy_imprint_out" != '{"injectSteps":[]}' ]; then
+    fail "[check-pack-install] installed entwurf-agy-imprint returned a non-neutral hook response: $agy_imprint_out"
+    return 1
+  fi
+  agy_record_count=$(find "$agy_imprint_agent/meta-sessions" -maxdepth 1 -name '*.meta.json' -type f 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$agy_record_count" != "1" ]; then
+    fail "[check-pack-install] installed entwurf-agy-imprint did not write exactly one isolated meta-record (got $agy_record_count)"
+    return 1
+  fi
+  echo "[check-pack-install] installed agy imprint pass (compiled JS runs under node_modules; neutral response + record write)"
+
+  # 0.12.7 — installed OPERATOR COMMAND regression. `entwurf <cmd>` dispatches through
+  # run.sh, whose REPO_DIR is under node_modules once installed, so a raw-.ts entrypoint
+  # dies on the strip-types fence. These three are operator surfaces, not dev gates:
+  # doctor-pi-provider is the pi-ownership verdict, new-session-id is the alias that mints
+  # a garden citizen (docs/setup-clean-host.md tells operators to run the installed bin),
+  # and meta-bridge-prune is the store maintenance verb. All three shipped DEAD through
+  # 0.12.6 because the only installed smokes drove bins, never subcommands.
+  #
+  # Assert MEANING, not just the absence of the fence string: a command that regressed to
+  # a stub or an empty exit would still "not crash". So: the id must be well-formed, the
+  # doctor must reach its own verdict body, and prune must actually walk a 0-record store.
+  local installed_entwurf="$npmroot/node_modules/.bin/entwurf"
+  local op_agent="$npm_tmp/op-agent" op_out
+  mkdir -p "$op_agent/meta-sessions"
+
+  # Same sandbox root set on every operator-command drive: doctor-pi-provider READS install-state
+  # below XDG_DATA_HOME, so an inherited real root would make this gate's verdict depend on the
+  # operator's host instead of the sandbox (non-hermetic even when nothing is written).
+  local op_xdg_data="$npmhome/.local/share" op_xdg_state="$npmhome/.local/state" op_xdg_cache="$npmhome/.cache"
+  if ! op_out=$(HOME="$npmhome" XDG_DATA_HOME="$op_xdg_data" XDG_STATE_HOME="$op_xdg_state" XDG_CACHE_HOME="$op_xdg_cache" PI_CODING_AGENT_DIR="$op_agent" "$installed_entwurf" new-session-id 2>&1); then
+    fail "[check-pack-install] installed 'entwurf new-session-id' FAILED under node_modules (strip-types fence or missing compiled twin):"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  # Same shape as SESSION_ID_RE (the garden id SSOT): <denote-stamp>-<6 hex>. A stub or a
+  # truncated id would still "not crash", so the gate reads the id, not just the exit code.
+  if ! printf '%s' "$op_out" | grep -qE '^[0-9]{8}T[0-9]{6}-[0-9a-f]{6}$'; then
+    fail "[check-pack-install] installed 'entwurf new-session-id' did not print a well-formed garden session id: $op_out"
+    return 1
+  fi
+
+  if ! op_out=$(HOME="$npmhome" XDG_DATA_HOME="$op_xdg_data" XDG_STATE_HOME="$op_xdg_state" XDG_CACHE_HOME="$op_xdg_cache" PI_CODING_AGENT_DIR="$op_agent" "$installed_entwurf" doctor-pi-provider 2>&1); then
+    # A doctor may exit non-zero on an unadopted host — that is a VERDICT, not a crash.
+    # The fence, by contrast, kills it before any verdict body is printed.
+    if printf '%s' "$op_out" | grep -q ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING; then
+      fail "[check-pack-install] installed 'entwurf doctor-pi-provider' hit the node_modules strip-types fence:"
+      echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+      return 1
+    fi
+  fi
+  if ! printf '%s' "$op_out" | grep -q '\[pi-provider doctor\]' || ! printf '%s' "$op_out" | grep -q 'EFFECTIVE'; then
+    fail "[check-pack-install] installed 'entwurf doctor-pi-provider' never reached its verdict body (no scopes/EFFECTIVE report):"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+
+  if ! op_out=$(HOME="$npmhome" XDG_DATA_HOME="$op_xdg_data" XDG_STATE_HOME="$op_xdg_state" XDG_CACHE_HOME="$op_xdg_cache" PI_CODING_AGENT_DIR="$op_agent" "$installed_entwurf" meta-bridge-prune "$op_agent/meta-sessions" 2>&1); then
+    fail "[check-pack-install] installed 'entwurf meta-bridge-prune' FAILED on a 0-record store:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! printf '%s' "$op_out" | grep -q 'prune candidates' || ! printf '%s' "$op_out" | grep -q "store: $op_agent/meta-sessions"; then
+    fail "[check-pack-install] installed 'entwurf meta-bridge-prune' did not scan the store it was given:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed operator commands pass (new-session-id id-shaped, doctor-pi-provider reaches its verdict, meta-bridge-prune walks a 0-record store)"
+
+  # A dev-only gate has NO compiled twin by design. Under an installed package run_ts must
+  # REFUSE it with a legible message — never fall back to raw .ts (that just re-raises the
+  # fence error) and never exit 0 (a silent no-op would let CI "pass" a gate it never ran).
+  local devgate_out devgate_rc=0
+  devgate_out=$(HOME="$npmhome" XDG_DATA_HOME="$op_xdg_data" XDG_STATE_HOME="$op_xdg_state" XDG_CACHE_HOME="$op_xdg_cache" PI_CODING_AGENT_DIR="$op_agent" "$installed_entwurf" check-meta-session 2>&1) || devgate_rc=$?
+  if [ "$devgate_rc" -eq 0 ]; then
+    fail "[check-pack-install] a dev-only gate (check-meta-session) exited 0 from an installed package — it cannot have run; run_ts must refuse it"
+    return 1
+  fi
+  if printf '%s' "$devgate_out" | grep -q ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING; then
+    fail "[check-pack-install] a dev-only gate leaked the raw strip-types fence error instead of run_ts's refusal:"
+    echo "$devgate_out" | tail -6 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! printf '%s' "$devgate_out" | grep -q 'dev-clone-only surface'; then
+    fail "[check-pack-install] a dev-only gate under an installed package did not produce run_ts's refusal message:"
+    echo "$devgate_out" | tail -6 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] dev-only gate refusal pass (installed package refuses check-* legibly, no raw-.ts fallback, no silent exit 0)"
+
   # 0.12.4 — installed STORE-DOCTOR regression. meta-bridge-doctor.sh's full store
   # scan runs the prebuilt dist JS when it lives under node_modules (strip-types
   # refuses the .ts there — the same class as the bridge boot above). Before the dist
@@ -2309,6 +2649,41 @@ JS
   return 0
 }
 
+check_pack_install() {
+  # SELF-FENCE wrapper (rule 11). Keep this OUTSIDE the implementation so every exit path —
+  # including an early failure before the implementation's cleanup trap is installed — returns
+  # through the comparison. The DATA tree is byte-fenced. STATE cannot be byte-fenced because a
+  # live native session may append legitimate lines concurrently, so fence the gate's unique fake
+  # conversation marker instead; any increase proves that agy-imprint escaped its sandbox.
+  trap - RETURN
+  local real_data_root="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf"
+  local real_imprint_log="${XDG_STATE_HOME:-$HOME/.local/state}/entwurf/agy-imprint.log"
+  local data_before data_after fake_before fake_after rc=0
+  data_before="$( (find "$real_data_root" -type f -print0 2>/dev/null | sort -z | xargs -0r sha256sum) 2>/dev/null || true)"
+  fake_before="$(grep -Fc 'conversationId=pack-install-agy-conversation' "$real_imprint_log" 2>/dev/null || true)"
+
+  _check_pack_install_impl "$@" || rc=$?
+  # _check_pack_install_impl installs a RETURN cleanup trap after allocating its temp roots.
+  # It has fired now; clear it before this wrapper returns so it cannot leak into its caller.
+  trap - RETURN
+
+  data_after="$( (find "$real_data_root" -type f -print0 2>/dev/null | sort -z | xargs -0r sha256sum) 2>/dev/null || true)"
+  fake_after="$(grep -Fc 'conversationId=pack-install-agy-conversation' "$real_imprint_log" 2>/dev/null || true)"
+  if [ "$data_before" != "$data_after" ]; then
+    fail "[check-pack-install] SELF-FENCE: this gate changed the operator's REAL install-state tree ($real_data_root) — a sandbox drive is leaking through an inherited XDG root:"
+    diff <(printf '%s\n' "$data_before") <(printf '%s\n' "$data_after") | sed 's/^/    /' >&2 || true
+    rc=1
+  fi
+  if [ "$fake_before" != "$fake_after" ]; then
+    fail "[check-pack-install] SELF-FENCE: this gate appended its fake agy birth marker to the operator's REAL state log ($real_imprint_log): before=$fake_before after=$fake_after"
+    rc=1
+  fi
+  if [ "$rc" -eq 0 ]; then
+    echo "[check-pack-install] self-fence pass (real DATA tree byte-identical; fake STATE marker count unchanged)"
+  fi
+  return "$rc"
+}
+
 
 # --- v2 install/runtime verification gates ---
 #
@@ -2350,7 +2725,7 @@ function finishOk(trimmed) {
     process.exit(1);
   }
   const names = tools.map((t) => t?.name).sort();
-  const expected = ['entwurf_peers', 'entwurf_self', 'entwurf_inbox_read', 'entwurf_v2'];
+  const expected = ['entwurf_peers', 'entwurf_self', 'entwurf_inbox_read', 'entwurf_register_native', 'entwurf_v2'];
   for (const name of expected) {
     if (!names.includes(name)) {
       console.error(`missing MCP tool: ${name}`);
@@ -2452,7 +2827,7 @@ setup_all() {
 
   echo "[setup] repo:    $REPO_DIR"
   echo "[setup] project: $project_dir"
-  echo "[setup] scope:   entwurf v2 orchestration install (pi-native; ACP backends dropped)"
+  echo "[setup] scope:   entwurf v2 package + detected native-harness bridges + pi adapter"
   echo "[setup] verification: v2 install smoke (entwurf-bridge; LIVE substrate = release-gate)"
 
   (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
@@ -2472,6 +2847,28 @@ setup_all() {
     echo "[setup] no native harness (claude) on PATH — skipping meta-bridge wiring (pi-only host)"
   fi
 
+  # Expose entwurf's STABLE bins on PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the
+  # agy mcp_config, settings.statusLine, and hooks.json record the bare names `entwurf-bridge` /
+  # `entwurf-agy-statusline` / `entwurf-agy-imprint`, so they must resolve for the agy doctors
+  # to pass. NON-FATAL — a foreign bin already on PATH is left as-is.
+  expose_dev_bin
+
+  # Fold agy (Antigravity) MCP bridge wiring into setup (막힘 ①, GLG 2026-07-04: install
+  # ownership moves to entwurf). Same detection-gated, idempotent, NON-FATAL posture as the
+  # meta-bridge block above — agy is an OPTIONAL harness, so a refused/corrupt agy config warns
+  # but never bricks a pi/Claude setup. The hard gate stays doctor-agy-bridge.
+  wire_agy_bridge
+
+  # Fold agy statusLine wiring into setup (#46 Task 1: own the ambient status area so it shows
+  # driver + garden id, the claude meta-bridge symmetry). Same detection-gated NON-FATAL posture
+  # — an explicit install-agy-statusline is fail-loud, but the setup wrapper WARNs + continues.
+  wire_agy_statusline
+
+  # Fold agy PreInvocation birth imprint wiring into setup (#46 close criterion: manual register 0).
+  # The hook runs the thin `entwurf-agy-imprint` bin and returns {"injectSteps":[]} so agy's loop
+  # survives while the meta-record is created/attached by conversationId.
+  wire_agy_hooks
+
   # Deterministic preflight lives in `pnpm check`; live substrate acceptance lives
   # in `LIVE=1 ./run.sh release-gate <scratch>`. Setup is the install path, so it
   # verifies the installed MCP bridge boundary only and does NOT run the legacy
@@ -2480,13 +2877,175 @@ setup_all() {
   validate_entwurf_bridge
 
   echo ""
-  echo "DONE: entwurf setup (pi package + meta-bridge + v2 install smoke) green."
+  echo "DONE: entwurf setup (pi adapter + detected native bridges + v2 install smoke) green."
   if command -v claude >/dev/null 2>&1; then
-    echo "Verify native-harness wiring with: ./run.sh doctor-meta-bridge"
+    echo "Verify Claude wiring with: ./run.sh doctor-meta-bridge"
+  fi
+  if command -v agy >/dev/null 2>&1; then
+    echo "Verify agy wiring with:    ./run.sh doctor-agy-bridge"
+    echo "                           ./run.sh doctor-agy-statusline"
+    echo "                           ./run.sh doctor-agy-hooks"
   fi
   echo "Run 'LIVE=1 ./run.sh release-gate <scratch>' for live substrate acceptance."
 }
 
+# wire_agy_bridge — detection-gated, NON-FATAL agy (Antigravity) MCP bridge wiring, folded into
+# setup so a relocate/clone needs ONE idempotent command (막힘 ①). Mirrors the meta-bridge
+# block: agy on PATH → idempotent install-agy-bridge; no agy → honest skip, NO state ("있으면
+# 설정, 없으면 담아준다"). NON-FATAL by contract: agy is an OPTIONAL harness, so a refused/corrupt
+# agy config must NOT brick a pi/Claude setup — the hard gate is doctor-agy-bridge (issue #45:
+# the '?' surfaces in doctor, not by killing setup). WARNs are reason-specific so a transitional
+# symlink (someone else's SSOT) and a corrupt config (invalid JSON) are never conflated.
+wire_agy_bridge() {
+  # Detection = the agy binary on PATH. AGY_BIN pins the target (default `agy`) so the
+  # hermetic smoke can point at a fake agy or a definitely-absent path without depending on
+  # whatever agy the CI/dev host happens to have — production leaves it unset (= `command -v
+  # agy`, no regression). Same override spirit as agy-bridge.sh's AGY_MCP_CONFIG/AGY_BRIDGE_COMMAND.
+  if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
+    echo "[setup] no agy on PATH — skipping agy bridge wiring (no state; pi/Claude-only host)"
+    return 0
+  fi
+  section "agy bridge install (native harness detected: Antigravity)"
+  local out rc
+  set +e
+  out="$(bash "$REPO_DIR/scripts/agy-bridge.sh" install 2>&1)"
+  rc=$?
+  set -e
+  printf '%s\n' "$out"
+  if [ "$rc" -eq 0 ]; then
+    echo "[setup] agy bridge wired (idempotent). Verify with: ./run.sh doctor-agy-bridge"
+    return 0
+  fi
+  # NON-FATAL: keep setup alive, surface the reason honestly (never a silent pass).
+  # ORDER MATTERS: the permission failures carry the same words as the mcp_config ones ("refused
+  # (symlink)", "invalid JSON") and MUST be matched first — otherwise a settings.json problem gets
+  # reported as an mcp_config problem and sends the operator to repair the wrong file.
+  case "$out" in
+    *"permission refused (symlink)"*|*"permission invalid JSON"*|*"permission could not be granted"*)
+      # The MCP server IS registered — only the allow rule failed. agy defaults every mcp action to
+      # Ask, so the bridge works but stops for a y/n on EVERY entwurf_v2 call. Half-wired, and said
+      # so: the explicit installer fails loud on this; setup only degrades it, never hides it.
+      echo "[setup] WARN: agy settings.json could not take our permission rule — bridge REGISTERED but NOT GRANTED." >&2
+      echo "[setup]       agy will prompt on every entwurf_v2 call until 'mcp(entwurf-bridge/entwurf_v2)'" >&2
+      echo "[setup]       is in its permissions.allow (see the line above for why). setup continues." >&2
+      ;;
+    *"refused (symlink)"*)
+      echo "[setup] WARN: agy mcp_config is a symlink — someone else's SSOT (transitional)." >&2
+      echo "[setup]       Bridge NOT wired; expected until install ownership moves to entwurf." >&2
+      echo "[setup]       Re-run setup once the symlink is dropped. setup continues." >&2
+      ;;
+    *"invalid JSON"*)
+      echo "[setup] WARN: your agy mcp_config is CORRUPT (invalid JSON) — bridge NOT wired." >&2
+      echo "[setup]       doctor-agy-bridge will KEEP FAILING until you repair that file." >&2
+      echo "[setup]       (Not a silent skip — fix the config, then re-run setup.) setup continues." >&2
+      ;;
+    *)
+      echo "[setup] WARN: agy bridge install did not complete (rc=$rc; see the line above)." >&2
+      echo "[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues." >&2
+      ;;
+  esac
+  return 0
+}
+
+# wire_agy_statusline — detection-gated, NON-FATAL agy statusLine wiring, folded into setup (#46
+# Task 1). Mirrors wire_agy_bridge: agy on PATH → idempotent install-agy-statusline; no agy →
+# honest skip, NO state. NON-FATAL by contract (agy is OPTIONAL — a refused/corrupt settings must
+# not brick a pi/Claude setup); the hard gate is doctor-agy-statusline. The renderer is the
+# stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
+wire_agy_statusline() {
+  if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
+    echo "[setup] no agy on PATH — skipping agy statusLine wiring (no state; pi/Claude-only host)"
+    return 0
+  fi
+  section "agy statusLine install (native harness detected: Antigravity)"
+  local out rc
+  set +e
+  out="$(bash "$REPO_DIR/scripts/agy-statusline-bridge.sh" install 2>&1)"
+  rc=$?
+  set -e
+  printf '%s\n' "$out"
+  if [ "$rc" -eq 0 ]; then
+    echo "[setup] agy statusLine wired (idempotent). Verify with: ./run.sh doctor-agy-statusline"
+    return 0
+  fi
+  case "$out" in
+    *"refused (symlink)"*)
+      echo "[setup] WARN: agy settings.json is a symlink — someone else's SSOT (transitional)." >&2
+      echo "[setup]       statusLine NOT wired; expected until install ownership moves to entwurf." >&2
+      echo "[setup]       Re-run setup once the symlink is dropped. setup continues." >&2
+      ;;
+    *"invalid JSON"*)
+      echo "[setup] WARN: your agy settings.json is CORRUPT (invalid JSON) — statusLine NOT wired." >&2
+      echo "[setup]       doctor-agy-statusline will KEEP FAILING until you repair that file." >&2
+      echo "[setup]       (Not a silent skip — fix the config, then re-run setup.) setup continues." >&2
+      ;;
+    *)
+      echo "[setup] WARN: agy statusLine install did not complete (rc=$rc; see the line above)." >&2
+      echo "[setup]       statusLine NOT wired; verify with ./run.sh doctor-agy-statusline. setup continues." >&2
+      ;;
+  esac
+  return 0
+}
+
+# wire_agy_hooks — detection-gated, NON-FATAL agy PreInvocation imprint wiring. Same setup posture
+# as the MCP/statusLine adapters, but this one is the birth writer that turns statusLine '?' into a
+# garden id after the first invocation.
+wire_agy_hooks() {
+  if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
+    echo "[setup] no agy on PATH — skipping agy hooks wiring (no state; pi/Claude-only host)"
+    return 0
+  fi
+  section "agy hooks install (native harness detected: Antigravity)"
+  local out rc
+  set +e
+  out="$(bash "$REPO_DIR/scripts/agy-hooks-bridge.sh" install 2>&1)"
+  rc=$?
+  set -e
+  printf '%s\n' "$out"
+  if [ "$rc" -eq 0 ]; then
+    echo "[setup] agy hooks wired (idempotent). Verify with: ./run.sh doctor-agy-hooks"
+    return 0
+  fi
+  case "$out" in
+    *"refused (symlink)"*)
+      echo "[setup] WARN: agy hooks.json is a symlink — someone else's SSOT (transitional)." >&2
+      echo "[setup]       birth imprint NOT wired; re-run setup once the symlink is dropped. setup continues." >&2
+      ;;
+    *"invalid JSON"*)
+      echo "[setup] WARN: your agy hooks.json is CORRUPT (invalid JSON) — birth imprint NOT wired." >&2
+      echo "[setup]       doctor-agy-hooks will KEEP FAILING until you repair that file. setup continues." >&2
+      ;;
+    *)
+      echo "[setup] WARN: agy hooks install did not complete (rc=$rc; see the line above)." >&2
+      echo "[setup]       Birth imprint NOT wired; verify with ./run.sh doctor-agy-hooks. setup continues." >&2
+      ;;
+  esac
+  return 0
+}
+
+# expose_dev_bin — make the `entwurf-bridge` STABLE bin resolve for a DEV checkout (막힘 ②).
+# setup IS the dev install command (consumers get the bin from npm bin-linking), so setup owns a
+# managed ~/.local/bin/entwurf-bridge symlink into this checkout via scripts/dev-bin.sh, recorded
+# for an honest inverse (remove-dev-bin). NON-FATAL like wire_agy_bridge: a foreign bin already on
+# PATH (a real npm install) is REFUSED not clobbered, and a BIN_DIR off PATH only WARNs — neither
+# bricks setup. The hard gate stays doctor-agy-bridge (a missing/dangling bin FAILs there).
+expose_dev_bin() {
+  section "dev bin: expose entwurf-bridge on PATH (dev checkout)"
+  local rc
+  set +e
+  bash "$REPO_DIR/scripts/dev-bin.sh" expose
+  rc=$?
+  set -e
+  [ "$rc" -eq 0 ] && return 0
+  if [ "$rc" -eq 3 ]; then
+    echo "[setup] WARN: entwurf-bridge is already on PATH as someone else's bin (not ours) — left as-is." >&2
+    echo "[setup]       If that is a stale/foreign bin, remove it and re-run setup. setup continues." >&2
+  else
+    echo "[setup] WARN: dev bin exposure did not complete (rc=$rc; see above). setup continues." >&2
+  fi
+  return 0
+}
+
 # release-gate — the single command that, when GREEN, is sufficient to cut
 # release cuts. Runs the full static floor (`pnpm check`) followed by the
 # v2-native live gates, then emits one PASS/FAIL/SKIP summary. Everything is
@@ -2783,6 +3342,13 @@ case "$cmd" in
   check-shell-quote)
     check_shell_quote
     ;;
+  check-install-surface)
+    # 0.12.7 — structural half of the node_modules strip-types fence: run_ts is the only
+    # crossing, every operator subcommand has a compiled twin, bin wrappers branch, dev
+    # gates stay out of the tarball, and offline smokes never touch the real $HOME.
+    # check-pack-install owns the dynamic half (it drives the installed commands).
+    run_ts scripts/check-install-surface.ts
+    ;;
   check-entwurf-session-identity)
     check_entwurf_session_identity
     ;;
@@ -2846,6 +3412,9 @@ case "$cmd" in
   check-entwurf-v2-mailbox)
     check_entwurf_v2_mailbox
     ;;
+  check-entwurf-v2-native-push)
+    check_entwurf_v2_native_push
+    ;;
   check-entwurf-v2-runner)
     check_entwurf_v2_runner
     ;;
@@ -2939,11 +3508,20 @@ case "$cmd" in
   check-entwurf-mailbox-guard)
     check_entwurf_mailbox_guard
     ;;
+  check-native-push-adapter)
+    check_native_push_adapter
+    ;;
+  check-native-push-register)
+    check_native_push_register
+    ;;
+  check-agy-sender-identity)
+    check_agy_sender_identity
+    ;;
   new-session-id)
     # Garden launcher helper: print one fresh garden sessionId (SSOT:
     # generateSessionId). Used by the operator alias to make every
     # --entwurf-control session a garden citizen. Stdout = the id only.
-    (cd "$REPO_DIR" && node --experimental-strip-types scripts/new-session-id.ts)
+    run_ts scripts/new-session-id.ts
     ;;
   smoke-resident-garden-guard)
     # LIVE negative (0 tokens) + opt-in positive gate for the resident
@@ -2998,6 +3576,55 @@ case "$cmd" in
     # duplicate/drift records. Offline + deterministic (deps bash+node+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-meta-install-state.sh)
     ;;
+  smoke-agy-install-state)
+    # 봉인 8 regression gate for the agy MCP install adapter: install→doctor→uninstall in an
+    # ISOLATED HOME+XDG with a fake stable bin + fake pgrep/ss — adopt (preserve unrelated) +
+    # state, doctor static-clean/live-SKIP (+live-PASS with a fake agy), honest-inverse
+    # uninstall, symlink refuse, dangling FAIL, create-new inverse, and ⓪ checkout impurity 0.
+    # Offline + deterministic (deps: bash+python3).
+    (cd "$REPO_DIR" && bash scripts/smoke-agy-install-state.sh)
+    ;;
+  smoke-agy-statusline-state)
+    # #46 Task 1 regression gate for the agy statusLine install adapter: install→doctor→uninstall
+    # in an ISOLATED HOME+XDG with a fake stable bin (entwurf-agy-statusline) + fake pgrep —
+    # own the statusLine subtree WHOLE (preserve unrelated keys) + state (stable command, prior
+    # subtree as preimage), doctor static-clean/live-SKIP (+live-consistent with a fake agy) /
+    # drift-FAIL / dangling-command-FAIL / not-ours note, honest-inverse uninstall, symlink +
+    # dangling-symlink refuse, create-new inverse, the NON-FATAL wire wrapper, and checkout
+    # impurity 0. Offline + deterministic (deps: bash+python3).
+    (cd "$REPO_DIR" && bash scripts/smoke-agy-statusline-state.sh)
+    ;;
+  smoke-agy-hooks-state)
+    # #46 birth imprint regression gate: hooks.json named hook ownership + direct
+    # PreInvocation stdin → upsertMetaSession antigravity record, isolated HOME/XDG/PI agent.
+    (cd "$REPO_DIR" && bash scripts/smoke-agy-hooks-state.sh)
+    ;;
+  smoke-pi-provider-state)
+    # #46 Task 2 regression gate for the pi provider install adapter: register-pi-provider.py
+    # (ownership-classified install/remove, user+project scopes) + read-only doctor-pi-provider.ts
+    # (effective shadow view). ISOLATED HOME+XDG + fake stable bin — user ownership matrix
+    # (absent/managed-legacy/managed-current/user-override), state honest-inverse (legacy NOT
+    # restored), sibling + legacy prune, project no-state strip, doctor effective/drift/dangling/
+    # malformed/project-stale/'?', symlink refuse, and checkout impurity 0. Offline (bash+python3+node).
+    (cd "$REPO_DIR" && bash scripts/smoke-pi-provider-state.sh)
+    ;;
+  smoke-agy-native-push-live)
+    # 봉인 8 LIVE acceptance gate for the native-push (agy) delivery rail. Drives the REAL
+    # antigravity adapter + register core + runEntwurfV2 (production deps) against a live agy
+    # conversation (AGY_CONVERSATION_ID): probe route, register create/attach idempotency,
+    # fire→native-push delivered, owned-outcome reject, bogus-conv probe-indeterminate reject.
+    # Meta-store is isolated to a temp dir (only the agy round-trip is real); honest SKIP when
+    # LIVE!=1. doctor-static preflight FAILs before the agy bridge is wired (③).
+    run_ts scripts/smoke-agy-native-push-live.ts
+    ;;
+  smoke-user-scope-citizen)
+    # 0.12.6 install-boundary gate: register-pi-package.py is the shared
+    # packages[] SSOT for project/user install and remove; user scope makes
+    # --entwurf-control load from any cwd. Idempotent, preserves unrelated
+    # packages/keys, normalizes stale entries, remove is symmetric, and corrupt
+    # settings fail loud. The tripwire the 2026-07-03 `pi install` removal lacked.
+    (cd "$REPO_DIR" && bash scripts/smoke-user-scope-citizen.sh)
+    ;;
   smoke-claude-native-resume-live)
     # LIVE-only Detour A probe: two real Claude Code native turns (fresh +
     # --resume) in a scratch cwd. Verifies native resume works while the
@@ -3007,9 +3634,10 @@ case "$cmd" in
     ;;
   install-meta-bridge)
     # 1.0.0 meta-bridge step 5: operator-grade GLOBAL install of the garden-native
-    # receive plugin. Assembles a self-contained, node-path-baked copy under
-    # pi/meta-bridge/.assembled and runs marketplace add + install --scope user, so
-    # every native Claude Code session auto-loads it (no manual --plugin-dir).
+    # receive plugin. Assembles a self-contained, node-path-baked copy under the
+    # XDG data dir ($XDG_DATA_HOME/entwurf/meta-bridge/.assembled — dev clone and
+    # installed package alike, never the checkout) and runs marketplace add +
+    # install --scope user, so every native Claude Code session auto-loads it.
     # Idempotent; Linux/macOS only (Windows fail-fast).
     (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh "$@")
     ;;
@@ -3027,6 +3655,101 @@ case "$cmd" in
     # zero claude-code meta-records is a SILENT MISS -> non-zero exit.
     (cd "$REPO_DIR" && bash scripts/meta-bridge-doctor.sh "$@")
     ;;
+  install-agy-bridge)
+    # 봉인 7: the agy (Antigravity) MCP install ADAPTER (SEPARATE from the Claude
+    # marketplace install — only runner/reporting is shared). Registers ONE entwurf-bridge
+    # server entry in the agy mcp_config: adopt a regular file / create a new one / REFUSE a
+    # symlink (someone else's SSOT). Records an install-state under $XDG_DATA_HOME/entwurf/
+    # agy-bridge/ for an honest inverse. The command written is a STABLE bin (entwurf-bridge),
+    # never a repo/git-hash path (the oracle dangling lesson).
+    (cd "$REPO_DIR" && bash scripts/agy-bridge.sh install "$@")
+    ;;
+  uninstall-agy-bridge)
+    # 봉인 7: honest inverse of install-agy-bridge from the install-state (restore the
+    # captured preimage / remove our key; remove the file if we created it empty). Refuses if
+    # the managed config became a symlink since install; no state → nothing to undo.
+    (cd "$REPO_DIR" && bash scripts/agy-bridge.sh uninstall "$@")
+    ;;
+  doctor-agy-bridge)
+    # 봉인 7: 2-tier fail-loud doctor. STATIC proves both candidate configs (global
+    # ~/.gemini/config/mcp_config.json — the file live agy actually reads — + legacy
+    # ~/.gemini/antigravity-cli which install now cleans) resolve, parse, and carry a
+    # RESOLVABLE command (a dangling command FAILS). LIVE proves runtime-effectiveness only
+    # when an agy process exists; with no agy it is an honest SKIP (never a PASS in disguise).
+    (cd "$REPO_DIR" && bash scripts/agy-bridge.sh doctor "$@")
+    ;;
+  wire-agy-bridge)
+    # 막힘 ①: the detection-gated, NON-FATAL setup wrapper around install-agy-bridge (agy on
+    # PATH → idempotent install; no agy → honest skip, no state). HIDDEN/internal — setup calls
+    # this; it is exposed as a subcommand only so smoke-agy-install-state can drive it
+    # deterministically. The hard gate stays doctor-agy-bridge (issue #45: the '?' is a doctor
+    # signal, not a setup-killer).
+    wire_agy_bridge
+    ;;
+  install-agy-statusline)
+    # #46 Task 1: own the WHOLE statusLine subtree of agy settings.json → the stable-bin renderer
+    # entwurf-agy-statusline (driver + garden id), the claude meta-bridge statusLine symmetry.
+    # Adopt a regular file / create / REFUSE a symlink. install-state under $XDG_DATA_HOME/
+    # entwurf/agy-statusline/ for an honest inverse. The command is a BARE stable bin — dev AND
+    # installed (the checkout path lives only in the dev-bin symlink state, never in settings).
+    (cd "$REPO_DIR" && bash scripts/agy-statusline-bridge.sh install "$@")
+    ;;
+  uninstall-agy-statusline)
+    # #46 Task 1: honest inverse of install-agy-statusline — restore the captured statusLine
+    # subtree preimage (remove the key if absent, else set it back; remove the file if we created
+    # it empty). Refuses if settings.json became a symlink since install; no state → nothing.
+    (cd "$REPO_DIR" && bash scripts/agy-statusline-bridge.sh uninstall "$@")
+    ;;
+  doctor-agy-statusline)
+    # #46 Task 1: fail-loud doctor. STATIC proves the SINGLE settings root agy reads statusLine
+    # from (~/.gemini/antigravity-cli/settings.json — Task-1 capture, not the 2-candidate mcp
+    # root) parses and carries OUR RESOLVABLE command (dangling FAILs, state drift FAILs). LIVE
+    # proves runtime-effectiveness only with an agy process; else an honest SKIP.
+    (cd "$REPO_DIR" && bash scripts/agy-statusline-bridge.sh doctor "$@")
+    ;;
+  install-agy-hooks)
+    # #46 birth writer: install the Antigravity PreInvocation named hook that runs
+    # entwurf-agy-imprint and returns {"injectSteps":[]}.
+    (cd "$REPO_DIR" && bash scripts/agy-hooks-bridge.sh install "$@")
+    ;;
+  uninstall-agy-hooks)
+    # Honest inverse of install-agy-hooks: restore/remove only our named hook.
+    (cd "$REPO_DIR" && bash scripts/agy-hooks-bridge.sh uninstall "$@")
+    ;;
+  doctor-agy-hooks)
+    # Fail-loud doctor for agy hooks.json imprint wiring.
+    (cd "$REPO_DIR" && bash scripts/agy-hooks-bridge.sh doctor "$@")
+    ;;
+  doctor-pi-provider)
+    # #46 Task 2: read-only fail-loud doctor for the pi provider ownership (entwurfProvider.
+    # mcpServers.entwurf-bridge). Uses config.ts readProviderSettingsFile SSOT for the EFFECTIVE
+    # (project-shadows-user) command — never a re-implemented merge. Reports user/project/effective,
+    # gates on stable-bin resolvability, and distinguishes state-owned drift (FAIL) from an
+    # unowned user override (honest note). No agy/pi process needed — pure settings inspection.
+    run_ts scripts/doctor-pi-provider.ts "$@"
+    ;;
+  wire-agy-statusline)
+    # #46 Task 1: the detection-gated, NON-FATAL setup wrapper around install-agy-statusline.
+    # HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can drive it
+    # deterministically. The hard gate stays doctor-agy-statusline.
+    wire_agy_statusline
+    ;;
+  wire-agy-hooks)
+    # #46 birth writer setup wrapper around install-agy-hooks.
+    wire_agy_hooks
+    ;;
+  expose-dev-bin)
+    # 막힘 ②: expose the entwurf-bridge STABLE bin on PATH for a DEV checkout (a managed symlink
+    # into this checkout, recorded for an honest inverse). HIDDEN/internal — setup calls the
+    # NON-FATAL expose_dev_bin wrapper; exposed here so smoke-agy-install-state can drive the
+    # foreign-refuse WARN path. The exposure logic lives in scripts/dev-bin.sh.
+    expose_dev_bin
+    ;;
+  remove-dev-bin)
+    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed link + state (REFUSE if
+    # it became foreign). The raw script (no wrapper) so an operator sees a loud failure.
+    (cd "$REPO_DIR" && bash scripts/dev-bin.sh remove "$@")
+    ;;
   meta-bridge-prune)
     # 1.0.0 meta-bridge Phase 4: LISTING-ONLY janitor for the meta-session store.
     # doctor reds on corrupt/duplicate/drift but intentionally does NOT fail on
@@ -3037,7 +3760,7 @@ case "$cmd" in
     # surviving authority). Default store = defaultMetaSessionsDir(); pass [dir]
     # + [--ttl-days N] to override.
     shift || true
-    (cd "$REPO_DIR" && node --experimental-strip-types scripts/meta-bridge-prune.ts "$@")
+    run_ts scripts/meta-bridge-prune.ts "$@"
     ;;
   meta-bridge-managed-keys)
     # 0.10.0 meta-bridge: emit the SSOT of settings.json/~/.claude.json keys that
@@ -3134,6 +3857,9 @@ case "$cmd" in
   remove)
     remove_local_package "$TARGET_PROJECT_DIR"
     ;;
+  remove-user-scope)
+    remove_user_scope_citizen
+    ;;
   -h|--help|help|"")
     usage
     ;;