@junghanacs/entwurf 0.13.0 → 0.14.0

package/run.sh

@@ -51,6 +51,22 @@ PROVIDER_ID="entwurf"
 # surfaces). Under an installed package it REFUSES rather than falling back to raw
 # .ts — a fallback would just re-raise the fence error with a worse message.
 # check-install-surface pins both halves statically.
+# Release-gate STEP OUTCOME protocol (P1) — loaded LAZILY, never at top level.
+#
+# Only two surfaces need it: `release_gate`, which classifies each step's exit
+# code, and the LIVE smoke wrappers, which return `$ENTWURF_STEP_SKIP_EXIT` when
+# a prerequisite is missing. Both are dev-only. Sourcing it unconditionally at
+# the top made EVERY subcommand depend on `scripts/lib/` being present, and
+# check-fresh-cut-gate I9c caught the consequence immediately: on an installed
+# tree assembled without that path, run.sh died with a bash "No such file"
+# instead of printing the refusal it is supposed to print. An operator verb must
+# never fail on a dev-only dependency, so the load happens where it is used.
+entwurf_require_step_outcome() {
+  [ -n "${ENTWURF_STEP_SKIP_EXIT:-}" ] && return 0
+  # shellcheck source=scripts/lib/step-outcome.sh
+  . "$REPO_DIR/scripts/lib/step-outcome.sh"
+}
+
 run_ts() {
   local rel="$1"; shift
   case "$REPO_DIR" in
@@ -69,13 +85,44 @@ run_ts() {
   esac
 }
 
+# Vitest-backed gate lanes (issue #62). Same authority boundary as run_ts's dev-clone
+# refusal: vitest is a devDependency, so an installed package has no runner and the
+# gate refuses legibly instead of silently passing or crashing on a missing binary.
+run_vitest() {
+  case "$REPO_DIR" in
+    */node_modules/*)
+      echo "entwurf: this gate is a dev-clone-only surface — vitest is a devDependency the installed package does not ship." >&2
+      echo "         (Run it from a checkout after 'pnpm install'.)" >&2
+      return 1
+      ;;
+  esac
+  local bin="$REPO_DIR/node_modules/.bin/vitest"
+  if [ ! -x "$bin" ]; then
+    echo "entwurf: vitest is not installed — run 'pnpm install' in the checkout first." >&2
+    return 1
+  fi
+  if [ -n "${ENTWURF_MUTATION_VITEST_REPORT:-}" ]; then
+    # Qualification asked for structured attribution: a kill is attributed from the
+    # failed TEST TITLES in this report, never from Vitest's code frame (which quotes
+    # the source lines around the assertion — including an adjacent PASSING test's
+    # [QK:…] title). The marker declares the lane structured; the report goes to a
+    # FILE because the runner merges stdout+stderr and one warning line ahead of the
+    # JSON would break the parse. Human output still rides stdout.
+    echo "__ENTWURF_VITEST_JSON__"
+    (cd "$REPO_DIR" && "$bin" run --reporter=default --reporter=json \
+      --outputFile.json="$ENTWURF_MUTATION_VITEST_REPORT" "$@")
+    return
+  fi
+  (cd "$REPO_DIR" && "$bin" run "$@")
+}
+
 usage() {
   cat <<'EOF'
 Usage:
   ./run.sh setup [project-dir]        # ONE confident install: pnpm install + install + meta-bridge (if native harness) + v2 install smoke (LIVE substrate = release-gate)
-  ./run.sh release-gate [project-dir] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm check) + the v2-native live gates (v2 matrix/spawn-resume-live, check-bridge, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). LIVE-gated MUST steps HONEST-SKIP when LIVE!=1 (a CUT needs LIVE=1, SKIP=0). --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
+  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
-  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b, IN pnpm check): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 registered/schema; tools/list only, no auth/side-effect
+  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
   ./run.sh check-model-lock           # deterministic unit test for pi-extensions/model-lock.ts (4-quadrant + edge cases, no API)
   ./run.sh check-shell-quote          # POSIX-safety gate for shellQuote (remote SSH arg quoting in entwurf paths) — source parity + behavior matrix, no SSH
@@ -86,7 +133,7 @@ Usage:
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
-  ./run.sh check-bridge-delivery      # deterministic gate (IN pnpm check): demo scene 3 recovered — seed strict meta-sender + armed receiver citizens in an isolated temp world, scrub ambient pi/sender carriers, drive the BUILT DIST ENTRY over MCP stdio through a real tools/call entwurf_v2, assert the .msg landed under the seeded sender + doorbell poked. DELIVERS through the artifact, not from source. ENTWURF_DELIVERY_SUBJECT=<launcher> replays the same scene against another consumer artifact (check-pack-install passes the npm-installed bin). No model/network/cost; stale or missing dist FAILS
+  ./run.sh check-bridge-delivery      # deterministic gate (IN pnpm run check:full): demo scene 3 recovered — seed strict meta-sender + armed receiver citizens in an isolated temp world, scrub ambient pi/sender carriers, drive the BUILT DIST ENTRY over MCP stdio through a real tools/call entwurf_v2, assert the .msg landed under the seeded sender + doorbell poked. DELIVERS through the artifact, not from source. ENTWURF_DELIVERY_SUBJECT=<launcher> replays the same scene against another consumer artifact (check-pack-install passes the npm-installed bin). No model/network/cost; stale or missing dist FAILS
   ./run.sh check-meta-mailbox-state-write # deterministic gate (0.11 Stage 0 step 3D-4 commit2): post-cut receipt is state-only — meta-record file byte-identical across enqueue/read, state carries lastEnqueuedAt/lastReadAt (field isolation), empty inbox no-op on record+state, drift surfaces; no API
   ./run.sh check-meta-receiver-marker # deterministic gate (SE-2): receiver marker round-trip/start-key/provenance, UserPromptSubmit cannot mint presence, reader does not gate on record existence — marker SEMANTICS only; launch topology moved to check-hook-launch-topology
   ./run.sh check-hook-launch-topology # #51 gate 1: shipped hooks.json is exec form through hook-launch.sh, launcher is loud on an empty argv (older Claude's silent args drop), exec preserves the pid so the hook's parent is Claude, and a space/$/backtick plugin path survives as one argv element
@@ -94,24 +141,27 @@ Usage:
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
-  ./run.sh check-entwurf-v2-contract   # deterministic gate (0.11 Stage 0 step 4-pre, 동결결정 10 + Fable R1-R5): FROZEN entwurf_v2 contract — R1 control-socket domain (currently pi; claude/codex/agy=unsupported, not folded), 6-cell intent×liveness table (single verdict, 2 allow/4 reject), N1 indeterminate-no-spawn, Q2 owned-live-no-autosend, R3 table↔receipt round-trip, R5 taxonomy, schema↔types drift; pure, no API
+  ./run.sh check-entwurf-v2-contract   # deterministic gate (0.11 Stage 0 step 4-pre, 동결결정 10 + Fable R1-R5): FROZEN entwurf_v2 contract — R1 control-socket domain (currently pi; claude/codex/agy=unsupported, not folded), 3-cell intent×liveness table (single verdict, 1 allow/2 reject after the visible-first cut), N1 indeterminate-no-spawn, R3 table↔receipt round-trip, R5 taxonomy, schema↔types drift; pure, no API
   ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
   ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
-  ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/spawn-bg + bad-target/conflict/locked/undeliverable/owned-live/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
-  ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — Fable-3 release-after-observation as a state machine; spawn-started is NOT a release event, release on first socket-alive ∨ child-exited (any code) or failed start, socket↔exit race idempotent (single release), lock-nullness invariant enforced; pure, no IO
+  ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/native-push + bad-target/conflict/locked/undeliverable/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
+  ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — the spawn-observation policy and its four release events went with the transport in the visible-first cut, so the shipped machine is meta-mailbox=never release (no lock) + control-socket=release once on send-final; decideReleasePolicy still enforces the lock-nullness invariant; pure, no IO
   ./run.sh check-entwurf-v2-send       # deterministic gate (0.11 Stage 0 step 5c-2a): control-socket SEND hand (executeControlSocketSend) wiring transport IO onto the 5c-1 reducer — ack→sent, in-band reject→rejected (no fallback), dead→same-lock one-shot re-resolve (control retry / mailbox enqueue), indeterminate→failed+rethrow with NO fallback (no double-delivery); release exactly once, releaseLock throw never masks the send error; IO-via-dep
-  ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (NEVER spawn-bg), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
-  ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/spawn/mailbox→matching hand with decision.lock verbatim / spawn lock-retained rides executed (fail-closed) / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
+  ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (nothing is ever launched), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
+  ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/mailbox→matching hand with decision.lock verbatim / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
   ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
-  ./run.sh check-entwurf-v2-spawn      # deterministic gate (0.11 Stage 0 step 5c-3a): spawn-bg RESUME watcher hand (executeSpawnBgResume) wiring spawn + socket-observe IO onto the 5c-1 reducer — Fable-3: TIMEOUT IS NOT A RELEASE (bare observeTimeout→killChild, release 0; bounded killGrace then real socket-alive ∨ child-exited releases ×1); spawnChild throw→spawn-start-failed; no observation obtainable (grace elapses / post-spawn watch dep throws)→lock-retained fail-closed (released:false, evidence surfaced), NO direct-release hatch; IO-via-dep, controlled promises
-  ./run.sh check-entwurf-resume-args   # deterministic gate (0.11 Stage 0 step 5c-3b): resume-argv SSOT (buildResumePiArgs) for the v2 spawn-bg RESIDENT citizen — the `legacy` one-shot variant and its async worker were removed 2026-07-27, so the shipped posture is the only one the gate drives: v2-control=--entwurf-control + no --no-extensions (keep-alive is the goal, resumed session stays addressable); keeps --mode json -p + prompt-as-turn (-p NOT dropped); explicitExtensionArgs preserved exactly once (#29); plan.launchArgs (--approve) ride before the prompt; null provider→no --provider
-  ./run.sh check-entwurf-v2-spawn-production # deterministic gate (0.11 Stage 0 step 5c-3c): production SpawnBgResumeDeps factory (makeProductionSpawnBgResumeDeps) wiring the 5c-3a watcher's 6 IO seams — no real pi/socket/timer (that=opt-in smoke-entwurf-v2-spawn-live, OUT of pnpm check). socketWatchVerdict: address-conflict→forged (reject, never wait)/alive→alive/dead·indeterminate→wait; spawnChild builds v2-control argv (--entwurf-control, no --no-extensions, -p+prompt, --approve, cwd authority); awaitSocketAlive connectable→resolve / symlink→reject without connect / dead→wait→alive / abort-clears; awaitChildExit code + listener cleanup; awaitTimeout schedule + abort-clear; killChild=SIGTERM; proc-less child fails loud
-  ./run.sh smoke-entwurf-v2-spawn-live # LIVE phase gate (0.11 Stage 0 step 5c-3c, D5) — OUT of pnpm check, needs LIVE=1. Exercises the production SpawnBgResumeDeps against REAL OS objects: S1 real unix socket → awaitSocketAlive resolves (real lstat+probe), symlink→forged, absent→abort settles; S2 real child → spawn-event resolve + SIGTERM kill + exit-code capture; S3 watcher integration → real timeout→kill→child-exited→release ×1. Does NOT spawn a real pi resume (that=5d matrix). Run before 5d: LIVE=1 ./run.sh smoke-entwurf-v2-spawn-live
-  ./run.sh smoke-entwurf-v2-spawn-resume-live # 0.11.0 (A) ACCEPTANCE gate — OUT of pnpm check, needs LIVE=1. The FULL spawn-bg resident lifecycle: mint backend=pi identity → seed a REAL dormant pi session (one-shot into ~/.pi/agent/sessions) → runEntwurfV2(owned-outcome) routes dormant→spawn-bg resume → a REAL detached pi --entwurf-control child stands its socket up, resumes, DOES a model turn. Asserts executed/spawn-bg/socket-alive/released + lock released ×1 + no lock file + pid alive + socket connectable + resume USER & assistant OK nonces in the session JSONL. Model-in-loop IN. The gate v1 deprecation (0.12) is predicated on. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-spawn-resume-live
+  ./run.sh check-entwurf-resume-args   # deterministic gate: resume-argv SSOT (buildResumePiArgs) for the S1 VISIBLE resume. The headless shape was measured wrong for a window before the consumer was written (`-p` is pi's own non-interactive mode), so the one shipped posture is `--entwurf-control` FIRST + ext args exactly once + `--session <abs file>` + optional `--provider` + `--model <m>` — and the gate pins the ABSENCES as hard as the presences: no --mode, no -p, no positional prompt (a resume runs no turn), no --no-extensions, never --session-id (which MINTS a session instead of resuming one)
+  ./run.sh check-mux-resume-call       # deterministic gate: S1 resume PLACEMENT composition (mux-resume-call.ts). No fake tmux. cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while being wrong: a nonexistent `-c` exits 0 and lands the child in $HOME (so it is refused HERE), `-c` is FORMAT-EXPANDED so `#{…}` silently rewrites the path and `#(…)` was observed running a command (so `#` is refused), and whitespace measured SAFE (so no escaping layer is owed). Also pins `-c` reaching tmux, runtime after `--`, carrier-free argv, zero identity in this module, and the surface seam that keeps the v2 composition from importing mux
+  ./run.sh check-mux-parent-artifact  # deterministic gate for the tracked scrubbed parent-transcript fixture — a version-pinned sample of the PARENT-SIDE shape (fresh_call toolResult + the later callback custom_message) so downstream never opens a private transcript. Pins event order, the toolCallId join on the RESULT (pi writes no separate toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info> envelope field names, and the absence of operator paths / real garden ids / real uuids. NOT placement evidence
+  ./run.sh check-mux-launcher-fence   # deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes
+  ./run.sh check-entwurf-v2-visible-resume # deterministic gate: S1 visible-resume COMPOSITION (entwurf-v2-visible-resume.ts) with every seam injected — the whole state machine incl. the timeout branch runs with no tmux/lock/socket/clock. Pins lock BEFORE liveness, identity under the lock and before any window (no-transcript citizen fails loud, opens nothing), live/indeterminate/address-conflict refused unlaunched, observation as a BOUNDED WAIT (measured: socket answers ~2–4s after launch, so one immediate probe would call a successful resume unobserved), exactly ONE launch on every path, timeout → lock released + window left open + nothing retried/killed, failed release throws, and the two receipts staying separate in type and text
+  ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
-  ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), owned-outcome→native-push-no-resume-authority, bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+  ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+  ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
+  ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
   ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — listAllMetaIdentities→scanSocketProbes→pre-quarantine out-of-socket-domain/socket conflicts→resolveFactList(clean)→{facts,diagnostics}; C-원칙: expected corruption (parse/collision)→diagnostics (listing survives), impossible invariant (dup/unprobed)→throw; collision quarantines BOTH PeerFact+socket; deps injected, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
@@ -129,9 +179,11 @@ Usage:
   ./run.sh check-meta-doctor-oracle   # 0.12.8 (#51): detection power of the release ORACLE — healthy fixture must reach `doctor: PASS`, then 21 planted defects (retired shell form, partial hand-patch, launcher bypass/repoint/provenance loss, malformed exec args, owner type drift, extra leaf/group, doorbell asyncRewake/path/timeout, no live bridge, stale receiver, ambiguous/missing cache, missing hook log/writer, failing CLI probes) must each turn it FAIL naming their own cause, plus a positive case pinning that a long-writing CLI is NOT a false negative. Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
   ./run.sh check-agy-permission-matrix # AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)
+  ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
+  ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
-  ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; kill-proofed via scripts/mutants/probe-ordering.json
-  ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; kill-proofed via scripts/mutants/probe-ordering.json
+  ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
+  ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
   ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
@@ -154,12 +206,13 @@ Usage:
   ./run.sh doctor-agy-hooks           # fail-loud doctor for agy hooks.json imprint wiring
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
   ./run.sh meta-bridge-fresh-cut      # the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only. EXIT CONTRACT (#54, `--help` prints it): 0 complete / 1 NOTHING MOVED (re-run, do not setup) / 2 usage / 3 cut transition incomplete (inspect) / 4 cut complete but residue cleanup failed (`setup` may run; re-run only before new citizen birth, otherwise remove residue manually)
+  ./run.sh meta-facts                 # #65 owner-normalized READ-ONLY store projection: deterministic JSON {schemaVersion:1, storeDir, citizens: full v3 records sorted by gardenId, defects: {filename,message}} — THE listing contract emitted by the owner so consumers stop copying the certification. No liveness/sockets/transcript contents. EXIT: 0 readable (defects in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
   ./run.sh meta-bridge-managed-keys   # 0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)
   ./run.sh check-keyset-overlap <fragment.json...>  # 0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm check): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
+  ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (0.82.x) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
   ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
@@ -362,7 +415,7 @@ preflight_dep_integrity() {
   #   pi-managed install — pi omits peers (--legacy-peer-deps) and its own loader
   #     supplies the runtime, so the trio is legitimately absent.
   #   neutral npm/pnpm install — nothing supplies it. The optional peer is simply
-  #     unresolved (entwurf-preflight.ts:51), and the owned-outcome lane that needs it
+  #     unresolved (entwurf-preflight.ts:51), and the project-trust lane that needs it
   #     is dead on that host. Excluding the trio from this probe is still right (a hard
   #     require would reject every consumer install), but it is a KNOWN GAP, not proof
   #     that the runtime is present by another route.
@@ -517,7 +570,7 @@ remove_user_scope_citizen() {
 
 # The ~/.pi/agent/entwurf-targets.json symlink machinery (ensure_agent_dir_symlinks
 # + the `setup:links` command) is GONE (#50 C3): the target registry it linked has
-# no reader anymore — v2 resumes record-backed citizens and never resolves a spawn
+# no reader anymore — v2 addresses record-backed citizens and never resolves a spawn
 # model from a file. An operator's existing link/copy is inert; nothing reads it.
 
 remove_local_package() {
@@ -649,7 +702,7 @@ smoke_pi_attach() {
   # ARTIFACT routes that garden id to its control socket. Two halves, deliberately
   # different in kind: the record+address half drives `birthPiCitizen` (the exact seam
   # entwurf-control's session_start calls) so the gate is deterministic and lives in
-  # `pnpm check`; the delivery half spawns the dist entry as its own process and speaks
+  # `pnpm run check:full`; the delivery half spawns the dist entry as its own process and speaks
   # MCP stdio (check-bridge-delivery's driver, socket-rail fixture). P4 is the one with
   # teeth — re-opening the same pi session must ATTACH to the same gardenId, never mint
   # a second address under peers that already hold it. P8 (#50 C3 tail) gates goal 3:
@@ -749,17 +802,17 @@ check_entwurf_v2_contract() {
   # decision table is a constant; the "table cell ↔ dispatch receipt" round-trip
   # is asserted exhaustively — THE executable proof F6 demands ("산문 금지").
   # R1 control-socket capability domain (currently pi; claude-code/codex/antigravity =
-  # unsupported, never folded into dead/indeterminate). 6-cell table, single
-  # verdict per cell (Q2), 2 allow / 4 reject. N1 indeterminate never spawns;
-  # Q2 owned-outcome+live never auto-sends. R5 taxonomy covers table reasons +
-  # pre-claims bad-target/untrusted-fail-fast/target-locked (bucket B F2). Plus
+  # unsupported, never folded into dead/indeterminate). 3-cell table since the
+  # visible-first cut, single verdict per cell, 1 allow / 2 reject. N1
+  # indeterminate never dispatches, and nothing on any cell starts a process.
+  # R5 taxonomy covers table reasons + pre-claims bad-target/target-locked. Plus
   # a schema↔types drift guard on the TypeBox input/receipt. Pure, no API.
   run_ts scripts/check-entwurf-v2-contract.ts
 }
 
 check_entwurf_v2_lock() {
   # Deterministic gate for 0.11 Stage 0 step 5a (버킷 B F2): the per-gid dispatch
-  # LOCK primitive — the only guard against a double-spawn of the same dormant
+  # LOCK primitive — what serializes concurrent in-domain dispatch at one
   # target (pi self-guards CREATE but not RESUME, 검증원장 F2). acquire =
   # openSync(lockPath,"wx") atomic; a second acquire without release =
   # target-locked conflict carrying the holder JSON (F2-P2 human cleanup). release
@@ -778,10 +831,8 @@ check_entwurf_v2_decider() {
   # lookup / lock / socket inspect+probe / preflight / capability), tracking lock
   # acquire+release so "reject ⇒ no plan AND no lock retained" is PROVEN. Covers:
   # bad-target/target-locked/target-address-conflict carry observedLiveness=null
-  # (pre-probe), every other reject + untrusted-fail-fast carry a measured value;
-  # control-socket send + spawn-bg resume execute KEEP the lock, meta-mailbox send
-  # takes NO lock (？7); resume plan has no mode/wantsReply/provider/model but has
-  # expectedSocketPath/observeTimeoutMs/releaseWhen; an invalid gid throws before
+  # (pre-probe), every other reject carries a measured value; a control-socket send
+  # executes KEEPING the lock, meta-mailbox send takes NO lock (？7); an invalid gid throws before
   # any lookup (F2-P1). Pure, no IO, no API.
   run_ts scripts/check-entwurf-v2-decider.ts
 }
@@ -791,9 +842,9 @@ check_entwurf_v2_matrix() {
   # TABLE. Drives the REAL decideDispatch over minimal injected fakes and fixes, as
   # one readable table, every (target kind → transport → lock class) cell the 5d-5
   # claim covers: bad-target/address-conflict/target-locked rejects, unsupported
-  # meta-mailbox (deliverable) vs mailbox-undeliverable (inactive) vs owned reject,
-  # in-domain control-socket (live) / spawn-bg (dormant owned) / released rejects
-  # (owned-live, ff-dormant, indeterminate, under-lock conflict). A coverage pass
+  # meta-mailbox (deliverable) vs mailbox-undeliverable (inactive) reject,
+  # in-domain control-socket (live) / released rejects
+  # (ff-dormant, indeterminate, under-lock conflict). A coverage pass
   # FAILS if any transport / lock class / pre-probe reject is missing — a dropped
   # decider cell cannot pass silently. Thin coverage, NOT a decider re-impl; surface
   # parity stays in check-entwurf-v2-surface. Pure, no IO, no API.
@@ -804,11 +855,10 @@ check_entwurf_v2_release() {
   # Deterministic gate for 0.11 Stage 0 step 5c-1: the PURE release-policy reducer
   # (decideReleasePolicy + reduceRelease) for the 5c transport hand. Proves the
   # Fable-3 "release-after-observation" timing as a pure state machine BEFORE any
-  # spawn/send IO: meta-mailbox=never release (no lock), control-socket=release once
-  # on send-final, spawn-bg=spawn-started is NOT a release event (load-bearing) →
-  # release on the FIRST observed transition (socket-alive ∨ child-exited any code)
-  # or a failed start; socket↔exit race idempotent (single release either order);
-  # decideReleasePolicy enforces the lock-nullness invariant (？7). Pure, no IO.
+  # send IO: meta-mailbox=never release (no lock), control-socket=release once
+  # on send-final. The spawn-observation policy and its four release events went with
+  # the transport in the visible-first cut; decideReleasePolicy still enforces the
+  # lock-nullness invariant (？7). Pure, no IO.
   run_ts scripts/check-entwurf-v2-release.ts
 }
 
@@ -829,11 +879,11 @@ check_entwurf_v2_send_fallback() {
   # (resolveDeadControlSendFallback) the 5c-2a hand calls on a dead connect. Proves the
   # fire-and-forget re-resolve routing over injected fakes (no filesystem): alive->
   # control-socket retry (inspected socketPath) / dead(absent)->reject (dormant-fire-
-  # forget-unsupported, NEVER spawn-bg) / indeterminate->reject / unsupported+deliverable
+  # forget-unsupported, and nothing is launched) / indeterminate->reject / unsupported+deliverable
   # ->meta-mailbox plan (mini-table, no inspect/probe) / unsupported+undeliverable->reject
   # / bad-target + address-conflict->reject pre-probe. Mis-wire (plan/lock gid) fails loud
   # before IO; inspect/probe throws PROPAGATE (the hand owns failed+release); the resolver
-  # has NO release seam; every execute plan keeps the held gid and is never spawn-bg.
+  # has NO release seam; every execute plan keeps the held gid.
   run_ts scripts/check-entwurf-v2-send-fallback.ts
 }
 
@@ -871,8 +921,7 @@ check_entwurf_v2_runner() {
   # routes an already-decided DispatchDecision to its 5c transport hand and maps the outcome
   # to one outcome-rich EntwurfV2RunResult. Proves over injected fake hands (no socket/spawn/
   # timer): reject -> rejected (receipt+diagnostic carried, NO hand called) / control-socket ->
-  # sendControl(plan, lock) / spawn-bg -> resumeSpawnBg (socket-alive AND lock-retained both
-  # ride `executed`, fail-closed is not a failure) / meta-mailbox -> sendMailbox(plan, NULL
+  # sendControl(plan, lock) / meta-mailbox -> sendMailbox(plan, NULL
   # lock, ？7). Carry-overs: N3 control `rejected` carries rejectReason verbatim; N1
   # SendDeliveredReleaseFailedError -> execution-failed{finalizedOutcome, releaseFailed,
   # retrySafe:false}; a plain hand throw -> execution-failed{retrySafe:false} with no
@@ -884,8 +933,9 @@ check_entwurf_v2_surface() {
   # Deterministic gate for 0.11 Stage 0 step 5d-3a: the ctx-free surface adapter
   # (entwurf-v2-surface.ts) + the entwurf-control.ts wiring contract. Proves the pure parts:
   # toDispatchInput (wants_reply→wantsReply, absent mode/wants_reply undefined) / renderEntwurfV2Result
-  # per result kind ({text,isError} surfacing reject diagnostic, control N3 rejectReason, spawn
-  # lock-retained, N1 delivered-but-dirty) / surface ctx-free source guard / entwurf-control
+  # per result kind ({text,isError} surfacing reject diagnostic, control N3 rejectReason,
+  # N1 delivered-but-dirty) + the dormant/indeterminate reject HINTS an operator meets after the
+  # visible-first cut / surface ctx-free source guard / entwurf-control
   # registers entwurf_v2 + reaches the fence via a NON-LITERAL dynamic import (no static fence
   # import → TS5097 stays closed) + decorates sender origin:pi-session/replyable:true.
   run_ts scripts/check-entwurf-v2-surface.ts
@@ -897,7 +947,7 @@ check_entwurf_bridge_boot() {
   # source-shape gate check-entwurf-v2-surface cannot — that the whole v2 fence graph LOADS at
   # boot under strip-types (G1a: a parseable tools/list proves it) and that entwurf_v2 is
   # registered on the runtime surface with its schema (G1b). tools/list only → no tools/call,
-  # no lock/fs side effect, no auth → safe in pnpm check. Broad protocol/negative suite stays
+  # no lock/fs side effect, no auth → safe in pnpm run check:full. Broad protocol/negative suite stays
   # in check-bridge/test.sh (D1=A안).
   run_ts scripts/check-entwurf-bridge-boot.ts
 }
@@ -916,10 +966,9 @@ check_entwurf_bridge_pi_free() {
 check_entwurf_v2_production() {
   # Deterministic gate for 0.11 Stage 0 step 5d-2b: makeProductionEntwurfV2Deps — the ctx-free
   # PRODUCTION assembly of runEntwurfV2's deps. Proves the wiring over fake leaf-IO spies (no
-  # real socket/lock/spawn/meta-record): decide wraps decideDispatch and acquires under the
+  # real socket/lock/meta-record): decide wraps decideDispatch and acquires under the
   # wired lockDir / control sendOverSocket builds the RpcSendCommand + maps + releases under
-  # lockDir / QB3 the spawn watcher releases via the SHARED lockDir release (not the spawn
-  # factory default) / the mailbox hand enqueues onto the wired dirs / a dead control send
+  # lockDir / the mailbox hand enqueues onto the wired dirs / a dead control send
   # re-resolves to the SAME sendViaMailbox instance on the SAME dirs (Q3+Q5 no drift).
   run_ts scripts/check-entwurf-v2-production.ts
 }
@@ -935,62 +984,166 @@ check_entwurf_control_rpc() {
   run_ts scripts/check-entwurf-control-rpc.ts
 }
 
-check_entwurf_v2_spawn() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-3a: the spawn-bg RESUME watcher hand
-  # (executeSpawnBgResume) wiring spawn + socket-observe IO onto the 5c-1 reducer. Proves
-  # Fable-3 over injected deferred promises (no real child/socket/timer): TIMEOUT IS NOT A
-  # RELEASE — a bare observeTimeout escalates to killChild (release 0), then a BOUNDED
-  # killGrace waits for a real socket-alive / child-exited to release. socket-alive ∨
-  # child-exited(any code incl. null) -> release exactly once; the loser settling later is a
-  # no-op. spawnChild throw -> spawn-start-failed (release, nothing to watch). No observation
-  # obtainable (grace elapses, or a post-spawn watch dep throws and the exit can't be
-  # observed) -> lock-retained fail-closed (released:false, pid/socket/lockPath surfaced) —
-  # there is NO direct-release hatch; deps.releaseLock is reached ONLY via reduceRelease.
-  run_ts scripts/check-entwurf-v2-spawn.ts
-}
-
 check_entwurf_resume_args() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-3b: the resume-argv SSOT
-  # (buildResumePiArgs). v2-control is the only shipped shape (the legacy one-shot variant and
-  # its launcher were removed 2026-07-27). Pins the resident posture: `--entwurf-control`
-  # present + `--no-extensions` never (the keep-alive is the goal — a resumed session stands
-  # its socket up and stays addressable), the headless `--mode json -p` prefix and the
-  # prompt-as-turn positional (`-p` NOT dropped), explicitExtensionArgs preserved exactly once
-  # (provider-resolution footgun #29), plan.launchArgs (--approve) before the prompt, and a
-  # null provider emitting no --provider.
+  # Deterministic gate for the resume-argv SSOT (buildResumePiArgs). S1 replaced the headless
+  # shape with the VISIBLE one, measured against the runtime before the consumer was written:
+  # `-p` is pi's own non-interactive mode, so the old `--mode json -p … <prompt>` prefix would
+  # put a JSON stream in the operator's window instead of a session they can use. Pins the one
+  # shipped posture — `--entwurf-control` FIRST (the resumed session stands its socket up), no
+  # --mode/-p/positional prompt (a resume runs no turn), explicitExtensionArgs exactly once
+  # between the control flag and --session (#29 provider-resolution footgun), --session <abs
+  # file> never --session-id (which MINTS), and a null provider emitting no --provider.
   run_ts scripts/check-entwurf-resume-args.ts
 }
 
-check_entwurf_v2_spawn_production() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-3c: the production SpawnBgResumeDeps factory
-  # (makeProductionSpawnBgResumeDeps) wiring the 5c-3a watcher's six IO seams onto the real
-  # world — proven WITHOUT a real pi spawn/socket/timer (that is the opt-in
-  # smoke-entwurf-v2-spawn-live, kept OUT of pnpm check). socketWatchVerdict (R2 policy):
-  # address-conflict→forged (reject, never wait), alive→alive, dead/indeterminate→wait.
-  # spawnChild builds the v2-control argv (--entwurf-control, no --no-extensions, -p+prompt,
-  # --approve, ext/provider/model, header cwd). awaitSocketAlive: connectable resolves, forged
-  # (symlink) rejects without connecting, dead→wait→alive, abort clears the sleep. awaitChildExit
-  # resolves the code + removes the listener on abort. awaitTimeout schedules + abort-clears.
-  # killChild=SIGTERM; releaseLock delegates; a proc-less child fails loud (mis-wire).
-  run_ts scripts/check-entwurf-v2-spawn-production.ts
-}
-
-
-smoke_entwurf_v2_spawn_live() {
-  # LIVE phase gate for 0.11 Stage 0 step 5c-3c (D5) — kept OUT of `pnpm check`. Exercises the
-  # production SpawnBgResumeDeps against REAL OS objects (a real unix socket, real child
-  # processes, real timers, real abort teardown) to catch what the deterministic gate's fakes
-  # cannot: actual spawn/exit/error event semantics, real lstat+connect liveness, and the
-  # 5c-3a watcher's timeout→kill→child-exited→release integration on a live process. It does
-  # NOT spawn a real `pi --entwurf-control` resume (that is the 5d surface matrix). Run once
-  # before 5d and record the result:  LIVE=1 ./run.sh smoke-entwurf-v2-spawn-live
-  if [ "${LIVE:-}" != "1" ]; then
-    echo "[smoke-entwurf-v2-spawn-live] skipped — set LIVE=1 to run (spawns real children + opens a real unix socket)."
-    return 0
-  fi
-  run_ts scripts/smoke-entwurf-v2-spawn-live.ts
+check_mux_launcher_fence() {
+  # Deterministic gate for the shared operator-launcher fence (issue #67):
+  # scripts/lib/claude-launcher-fence.ts plus its wiring into BOTH mux LIVE smokes. Replants the
+  # observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets
+  # the real `claude` launcher into the fixture tree, teardown deletes it) entirely inside
+  # disposable mkdtemp roots — the operator's real launcher is never inspected or touched. Pins:
+  # fail-closed preflight (launcher and resolved target present, regular, executable, OUTSIDE the
+  # fixture cleanup root), retarget/content-change detection before cleanup, removal BLOCKED when
+  # the launcher references the fixture OR safety cannot be proven OR tracked panes are not gone
+  # (known reference and unproven state each named as itself), exact operator-parity XDG restore
+  # (absent means DELETED, never canonical defaults; RUNTIME_DIR stays fixture by design), the
+  # lifecycle pi/claude cell-branch topology, and both smokes consuming the one shared helper.
+  run_ts scripts/check-mux-launcher-fence.ts
+}
+
+check_mux_parent_artifact() {
+  # Deterministic gate for the tracked scrubbed parent-transcript fixture
+  # (scripts/fixtures/mux-parent-transcript.scrubbed.jsonl). The fixture is a version-pinned
+  # SAMPLE OF THE PARENT-SIDE SHAPE — what an entwurf_fresh_call and the sibling's nonce callback
+  # look like in the transcript of the citizen that made the call — so a downstream parser never
+  # has to open a private transcript to learn it. Structure came from a fixture-only real Pi
+  # parent retake and was then scrubbed. Pins: event order (fresh_call toolResult, then the later
+  # callback custom_message), the toolCallId join on the RESULT (measured: pi writes no separate
+  # toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info>
+  # envelope field names, and the absence of any operator path / real garden id / real uuid.
+  # It is NOT placement evidence and the gate says so.
+  run_ts scripts/check-mux-parent-artifact.ts
+}
+
+check_mux_resume_call() {
+  # Deterministic gate for the S1 resume placement composition (mux-resume-call.ts). Same scope
+  # as check-mux-launch/check-mux-fresh-call: no fake tmux, only what is decidable without one.
+  # The cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while
+  # being wrong — a nonexistent `-c` exits 0 and lands the child in $HOME, and `-c` is
+  # FORMAT-EXPANDED so `#{…}` rewrites the path and `#(…)` was observed running a command.
+  # Whitespace measured SAFE, so the refusal set stays at two rules with no escaping layer.
+  # Also pins: `-c` reaches tmux, runtime after `--`, carrier-free argv, no identity in this
+  # module, and the surface seam that keeps the v2 composition from importing mux.
+  run_ts scripts/check-mux-resume-call.ts
+}
+
+check_entwurf_v2_visible_resume() {
+  # Deterministic gate for the S1 visible-resume composition (entwurf-v2-visible-resume.ts).
+  # Every seam is injected, so the whole state machine — including the timeout branch — runs
+  # without tmux, a lock file, a socket or a clock. Pins: lock BEFORE liveness, identity under
+  # the lock and before any window (a citizen with no transcript fails loud and opens nothing),
+  # live/indeterminate/address-conflict refused unlaunched, the observation as a BOUNDED WAIT
+  # (measured: the socket answers ~2–4s after launch, so one immediate probe would report a
+  # successful resume as unobserved), exactly one launch on every path, timeout releasing the
+  # lock and leaving the window open, a failed release throwing, and the two receipts staying
+  # separate in both the type and the rendered text.
+  run_ts scripts/check-entwurf-v2-visible-resume.ts
+}
+
+check_resume_launch_identity() {
+  # Deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity
+  # leaf preserved when the visible-first cut deleted spawn-bg and every caller it had. Identity
+  # authority is fail-closed risk, so the preserved leaf does not ship on its header comment:
+  # a temp meta-store fixture drives gardenId → record.transcriptPath → header-id integrity
+  # (a foreign/stale transcript is refused, never resumed), the #52 ADDRESSABLE read (a garden id
+  # that no longer holds its nativeSessionId alone is refused from either side), and cause
+  # fidelity for every impossible resume — including the F7 pin that a recorded-but-deleted
+  # transcript is reported as MISSING rather than as "no recorded model". No spawn, socket, or
+  # timer: the launch this identity would feed is deliberately out of scope.
+  run_ts scripts/check-resume-launch-identity.ts
+}
+
+check_mux_placement() {
+  # Deterministic gate for the T0-b placement primitives (mux-placement.ts): the argv shapes,
+  # the anchor precondition, the parse, and the close classification — everything decidable
+  # without tmux. It does NOT simulate tmux; no fake tmux exists in this repo on purpose.
+  # Topology is judged by check-mux-placement-tmux against a real private server.
+  run_ts scripts/check-mux-placement.ts
+}
+
+check_mux_placement_tmux() {
+  # REAL tmux acceptance: drives the production placement functions against a private fixture
+  # server (unique -S socket, never the operator's), with TMUX/TMUX_PANE actually INHERITED by
+  # a fixture pane. Proves one session throughout, 1,2 -> 1,2,3 -> 1,2,3,4 -> 1,2, surviving
+  # pane pids and focus, stable @window/%pane handles, the display-message rc=0 trap and its
+  # refusal, and both close paths (closed / already-gone). Skips (97) without tmux or /proc.
+  # Operator-run: kept OUT of pnpm check, and it is not a release-gate MUST at T0.
+  run_ts scripts/check-mux-placement-tmux.ts
 }
 
+check_mux_launch() {
+  # Deterministic gate for the T1-a visible launch (mux-launch.ts): the named preconditions
+  # that run BEFORE any window opens, the PATH resolution rule, the `--` argv shape, and the
+  # docs §11 import boundary. It does NOT simulate tmux. The measured trap it exists for — a
+  # failed exec exits 0, prints a handle, and its window is still listed on an immediate
+  # re-read — is judged against a real server by check-mux-launch-tmux.
+  run_ts scripts/check-mux-launch.ts
+}
+
+check_mux_fresh_call() {
+  # Transition shim (issue #62): this lane is the vitest pilot, so the gate NAME is preserved
+  # while the contracts live in test/*.test.ts. Same scope as before — the per-backend argv
+  # dialects (both measured to fail the other way round), first-turn framing order, named
+  # refusals, per-surface caller identity — PLUS the runtime axes the retired source-text gate
+  # could not see: real bridge boot → tools/list schema/description, Rust-regex-family pattern
+  # validity on every emitted pattern (the #62 escape), and the schema riding the actual
+  # anthropic-messages request body. No fake tmux: the real-window axis is smoke-mux-fresh-call-live.
+  run_vitest test/mux-fresh-call.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts
+}
+
+smoke_mux_fresh_call_live() {
+  # LIVE acceptance for entwurf_fresh_call — OUT of pnpm check, needs LIVE=1, spends two model
+  # turns. The one axis no deterministic gate reaches: a real window, a real runtime, a real first
+  # turn, and a real nonce callback whose SENDER ENVELOPE carries the new sibling's garden id.
+  # Entwurf-owned write axes (XDG, all four meta roots, v2 locks, cwd) are fixture-bound; Pi also
+  # gets fixture HOME so its control socket is isolated. Runtime-owned auth/config stays real and
+  # native transcripts remain as evidence. Private tmux servers plus entry-set/GID residue checks
+  # prove no fixture citizen lands in the operator's real record or control-socket directories.
+  run_ts scripts/smoke-mux-fresh-call-live.ts
+}
+
+smoke_mux_lifecycle_live() {
+  # RELEASE MUST integrated LIVE acceptance for the whole mux lifecycle, through the REAL MCP
+  # surface. Needs LIVE=1; spends model turns on the operator's configured runtimes (two pi
+  # siblings — native provider and recorded-ACP provider — each resumed once, plus one Claude
+  # Code sibling). Enters via tools/call on the shipped bridge launcher and follows one citizen
+  # around: fresh_call launch receipt -> nonce callback SENDER ENVELOPE -> entwurf_v2 control
+  # send landing in the sibling's own transcript -> resume_call REFUSED while live (window count
+  # unchanged) -> stable-handle close proving pane/socket gone with the record preserved ->
+  # dormant delivery refused honestly -> public entwurf_resume_call with its LAUNCH and
+  # OBSERVATION receipts kept apart, same-gid socket alive, no new citizen, no lock residue,
+  # resumed pane_start_path == the RECORD's cwd (separate tmux query, never pane text), and the
+  # transcript byte-identical across the resume itself -> entwurf_v2 recalling the fact from
+  # BEFORE the close, which is what proves the same CONVERSATION returned. Claude Code runs the
+  # callback+mailbox half and its resume is refused as target-not-pi with no window opened and no lock residue.
+  # Fixture-fenced writes (XDG, four meta roots, v2 lock dir, control socket via fixture HOME);
+  # the runtime auth roots stay REAL and sibling transcripts remain in the real pi agent dir as
+  # evidence. Private tmux server per cell, bounded teardown, operator real-root entry sets
+  # proven unchanged.
+  run_ts scripts/smoke-mux-lifecycle-live.ts
+}
+
+check_mux_launch_tmux() {
+  # REAL tmux acceptance for T1-a: drives production launchPi against a private fixture server
+  # (unique -S socket, never the operator's) with TMUX/TMUX_PANE actually INHERITED. Proves the
+  # window lands at {end} of the caller's own session, the pane process IS the runtime (no
+  # shell wrapper), focus and the original panes survive, a precondition refusal opens NO
+  # window, and the failed-exec trap is real. The runtime is a fixture stand-in, never the
+  # operator's pi. Skips (97) without tmux or /proc. Operator-run: kept OUT of pnpm check.
+  run_ts scripts/check-mux-launch-tmux.ts
+}
+
+
 smoke_acp_socket_citizen_live() {
   # S1 acceptance smoke (ACP plugin on v2) — OUT of pnpm check, needs LIVE=1.
   # Spawns a REAL `pi --entwurf-control` resident on an ACP model
@@ -1051,6 +1204,18 @@ smoke_acp_memory_containment_live() {
   run_ts scripts/smoke-acp-memory-containment-live.ts
 }
 
+smoke_acp_long_turn_live() {
+  # 0.13.1 LIVE acceptance for the prompt-lifecycle contract — OUT of pnpm check,
+  # needs LIVE=1. Drives ONE real pi provider turn whose tool work (default
+  # 3 x 240s foreground wait) deliberately outlasts the RETIRED 600s prompt cutoff, and
+  # requires it to finish as ONE turn: the nonce arrives, elapsed > 600000ms, the
+  # persisted transcript shows exactly ONE cold ACP bootstrap (no replay), and no
+  # retry/timeout is reported anywhere. Takes >12 minutes by construction.
+  # Overrides: ENTWURF_ACP_LONG_TURN_{MODEL,SLEEP_SECONDS,ROUNDS,HORIZON_MS}.
+  #   LIVE=1 ./run.sh smoke-acp-long-turn-live
+  run_ts scripts/smoke-acp-long-turn-live.ts
+}
+
 smoke_acp_provider_live() {
   # S2c acceptance smoke (ACP plugin on v2) — OUT of pnpm check, needs LIVE=1.
   # Drives the REAL pi PROVIDER path end to end: a real `pi` loads this
@@ -1181,16 +1346,16 @@ smoke_acp_rgg_live() {
 
 smoke_acp_cortex_live() {
   # On-demand LIVE smoke for the Cortex (Snowflake Cortex Code) ACP backend — the
-  # first NON-claude adapter on the rail (docs/acp-backend-rail.md §6). OUT of
+  # first NON-claude adapter on the rail (docs/acp-backend-rail.md, Cortex audit). OUT of
   # `pnpm check` AND OUTSIDE the claude-only aggregate LIVE floor (capability
   # dignity, invariant #7): a host with no cortex install / no Snowflake auth must
   # not redden a release for a backend it does not run, so this is deliberately
   # absent from release-gate's 11-smoke ACP acceptance floor. That is a WIRING
   # decision, not a lower evidence bar — a cut that SHIPS cortex still owes a
   # deliberate run of this smoke, and the aggregate gate's silence is not a pass
-  # (rail §11-8 tail). Drives one real
+  # (ACP rail Cortex verification boundary). Drives one real
   # cortex ACP turn through the entwurf provider path (outbound entwurf_v2 +
-  # dual-HOME overlay facts + process-group reclaim — CP2, rail §11-8).
+  # dual-HOME overlay facts + process-group reclaim — CP2).
   # HONEST-SKIP (exit 0) when LIVE!=1 OR `cortex` is not on PATH OR no
   # connection is pinned — the live turn needs `cortex` installed with the
   # operator's own web-login auth already present (there is no `cortex auth`
@@ -1202,13 +1367,14 @@ smoke_acp_cortex_live() {
   # operator settings.json where a default would live. PR #40 called this
   # `smoke-cortex`; the canonical family name is smoke-acp-cortex-live.
   #   LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live
+  entwurf_require_step_outcome
   if [ "${LIVE:-}" != "1" ]; then
-    echo "[smoke-acp-cortex-live] skipped — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run."
-    return 0
+    echo "[entwurf:skip] smoke-acp-cortex-live — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run."
+    return "$ENTWURF_STEP_SKIP_EXIT"
   fi
   if ! command -v cortex >/dev/null 2>&1; then
-    echo "[smoke-acp-cortex-live] skipped — cortex not on PATH (install Snowflake Cortex Code and complete its own login flow)."
-    return 0
+    echo "[entwurf:skip] smoke-acp-cortex-live — cortex not on PATH (install Snowflake Cortex Code and complete its own login flow)."
+    return "$ENTWURF_STEP_SKIP_EXIT"
   fi
   run_ts scripts/smoke-acp-cortex-live.ts
 }
@@ -1225,35 +1391,14 @@ smoke_entwurf_v2_matrix_live() {
   # stay deterministic. Honest skip when LIVE!=1 so the release-gate is runnable unattended.
   # Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4).
   #   LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
+  entwurf_require_step_outcome
   if [ "${LIVE:-}" != "1" ]; then
-    echo "[smoke-entwurf-v2-matrix-live] skipped — set LIVE=1 to run (spawns a real pi --entwurf-control + opens a real socket)."
-    return 0
+    echo "[entwurf:skip] smoke-entwurf-v2-matrix-live — set LIVE=1 to run (spawns a real pi --entwurf-control + opens a real socket)."
+    return "$ENTWURF_STEP_SKIP_EXIT"
   fi
   run_ts scripts/smoke-entwurf-v2-matrix-live.ts
 }
 
-smoke_entwurf_v2_spawn_resume_live() {
-  # The 0.11.0 (A) acceptance gate — kept OUT of `pnpm check`. Unlike matrix-live (a
-  # transport/lock sentinel, model-in-loop OUT) and spawn-live (OS-substrate watcher, no real
-  # pi), this drives the FULL production loop: mint a backend=pi meta identity → seed a REAL
-  # dormant pi session (one-shot `pi --mode json -p --no-extensions` into the REAL
-  # ~/.pi/agent/sessions) → runEntwurfV2(intent=owned-outcome) routes the dormant in-domain pi
-  # citizen to spawn-bg resume → a REAL detached `pi --entwurf-control` child stands its socket
-  # up, resumes, and DOES a model turn. Asserts: executed/spawn-bg/socket-alive/released, lock
-  # released exactly once + no lock file, resident pid alive + socket connectable, and the
-  # resume USER + assistant OK nonces appended to the session JSONL (real work, not just
-  # "process up"). This is the evidence v1 deprecation (0.12) is predicated on. Model-in-loop is
-  # IN. Honest skip when LIVE!=1 (skip = CI safety, NOT an acceptance PASS).
-  # Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4);
-  #        ENTWURF_SPAWN_RESUME_ASSISTANT_TIMEOUT_MS (default 180000).
-  #   LIVE=1 ./run.sh smoke-entwurf-v2-spawn-resume-live
-  if [ "${LIVE:-}" != "1" ]; then
-    echo "[smoke-entwurf-v2-spawn-resume-live] skipped — set LIVE=1 to run (spawns a real pi resume child + opens a real socket)."
-    return 0
-  fi
-  run_ts scripts/smoke-entwurf-v2-spawn-resume-live.ts
-}
-
 check_entwurf_facts() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 1): the PURE
   # fact core. Locks the PeerFact shape + R1/R3b liveness invariant before any IO
@@ -1299,6 +1444,17 @@ check_meta_listing() {
   run_ts scripts/check-meta-listing.ts
 }
 
+check_meta_facts() {
+  # Deterministic gate for the #65 owner-normalized store projection. Drives the
+  # REAL scripts/meta-facts.ts as a subprocess against sandboxed fixture stores:
+  # full verbatim v3 records in the join, parse-before-uniqueness (a schema-invalid
+  # rival never quarantines a healthy citizen), no-winner duplicates, drift /
+  # symlink / invalid-UTF-8 defects in-band with exit 0, byte-deterministic JSON,
+  # missing store = readable empty store, unreadable store = exit 3 with NO JSON,
+  # usage = exit 2, plus dispatch + compiled-twin emit reachability.
+  run_ts scripts/check-meta-facts.ts
+}
+
 check_entwurf_fact_provider() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4b): the
   # ASSEMBLY layer listEntwurfFacts. listAllMetaIdentities → scanSocketProbes →
@@ -1416,7 +1572,7 @@ check_package_source_routing() {
 # substrate entwurf used to stand on. C2 removed every entwurf use of that
 # substrate (the record mints the address; pi owns id and name), so the smoke's
 # subject no longer exists. The resident identity axis is covered by
-# smoke-pi-attach (deterministic, in pnpm check) + smoke-resident-garden-guard (LIVE).
+# smoke-pi-attach (deterministic, in pnpm run check:full) + smoke-resident-garden-guard (LIVE).
 
 
 
@@ -1425,7 +1581,7 @@ check_dep_versions() {
   # docs. Concretely the kind of skew that produced commit 21de0f9's "0.11.1
   # leftover" review comment: package.json bumped to 0.12.0 while README
   # and run.sh's setup gate still claimed 0.11.1. Static check, no
-  # subprocess — fast enough to run inside `pnpm check` and pre-commit.
+  # subprocess — fast enough to run inside `pnpm check`.
   # The doc half of that promise was prose only until 0.12.8 — see the
   # BASELINE DOCS block below, which finally makes this comment true.
   (cd "$REPO_DIR" && node --input-type=module <<'EOF'
@@ -1472,12 +1628,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.83+ at the current 0.82.1 pin) whose
+// pi (past the declared ceiling — 0.85+ at the current 0.84.1 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
-// installer re-acquires the drift. Expected
-// shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.82.1 <0.83`).
+// installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
+// install resolves: at `>=0.84.1` an existing 0.83.x host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.1 <0.85`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -1923,9 +2080,13 @@ check_pi_import_surface() {
   # pattern catches static `from`, dynamic `import()`, `require()`,
   # `export … from`, side-effect `import "…"`, and whitespace variants alike.
   # Root import `@earendil-works/pi-coding-agent` (no trailing slash) is allowed.
-  # Scans EVERY tracked .ts/.js/.mjs/.cjs source (git ls-files), not a hardcoded
-  # file list — a new root file (acp-bridge.ts, event-mapper.ts, engraving.ts,
-  # pi-context-augment.ts, protocol.js, …) can never silently escape the gate.
+  # Scans the whole git WORK SURFACE (tracked + untracked-non-ignored), not a
+  # hardcoded or index-only file list. The index-only corpus was the #62 measured
+  # escape: a brand-new test file carrying a forbidden subpath was invisible to the
+  # floor until it happened to be staged, so the gate went green on a candidate CI
+  # then rejected. The denominator is re-proved every run against an EXTERNAL
+  # throwaway git repo (never this worktree — the frozen candidate must not be
+  # written to) holding one tracked-clean and one untracked-forbidden fixture.
   #
   # pi 0.80 EXCEPTION — exactly ONE allowlisted subpath:
   #   @earendil-works/pi-ai/compat
@@ -1938,24 +2099,57 @@ check_pi_import_surface() {
   # the remainder, producing the unresolvable `…/dist/compat.js/providers/
   # anthropic` (verified live: extension load crash — invisible to static
   # typecheck, which resolves against node_modules `exports`). So `/compat` is the
-  # sanctioned extension entrypoint this repo uses for the old global model-catalog API
-  # (lib/acp/models.ts: `getModels`), and the ONLY allowlisted exception. The
+  # sanctioned extension entrypoint, and the ONLY allowlisted exception. It has TWO
+  # consumers: lib/acp/models.ts (`getModels`, the old global model-catalog API) and
+  # test/fresh-call-provider.contract.test.ts (`stream`, the loopback provider-conversion
+  # contract — pi-ai 0.84's package ROOT exports no stream/streamAnthropic at all, and
+  # root `lazyStream(model, setup)` only defers the same private import into `setup`,
+  # so /compat is the only surface that can observe the real anthropic request body). The
   # allow-pattern is closing-quote-anchored (`@earendil-works/pi-ai/compat["'\`]`)
   # so it permits ONLY that exact specifier: `/compat-foo`, `/oauth`, every
   # `/providers/*`, and any deeper path stay FORBIDDEN (we use only `/compat`).
   # Do NOT widen this to a `providers/*` subpath — it typechecks but CANNOT
   # resolve under the extension loader.
-  local hits
-  hits=$(cd "$REPO_DIR" && git ls-files '*.ts' '*.js' '*.mjs' '*.cjs' \
-    | grep -vE '^(node_modules|dist)/' \
-    | xargs -r grep -HnE "[\"'\`]@earendil-works/pi-(ai|coding-agent|tui)/" 2>/dev/null \
-    | grep -vE "[\"'\`]@earendil-works/pi-ai/compat[\"'\`]" 2>/dev/null || true)
+  # ONE corpus, TWO callers. The real scan and the denominator fixture must run the
+  # SAME two lines, or the fixture would prove a command the gate does not use.
+  pi_import_work_surface() {
+    git ls-files -z --cached --others --exclude-standard -- '*.ts' '*.js' '*.mjs' '*.cjs'
+  }
+  pi_import_scan() {
+    pi_import_work_surface \
+      | xargs -0r grep -HnE "[\"'\`]@earendil-works/pi-(ai|coding-agent|tui)/" 2>/dev/null \
+      | grep -vE "[\"'\`]@earendil-works/pi-ai/compat[\"'\`]" 2>/dev/null || true
+  }
+
+  local probe_dir probe_hits hits
+  probe_dir=$(mktemp -d "${TMPDIR:-/tmp}/entwurf-pi-import-denominator.XXXXXX")
+  (
+    cd "$probe_dir" || exit 1
+    git -c init.defaultBranch=main init -q .
+    printf '%s\n' 'import { getModels } from "@earendil-works/pi-ai/compat";' > tracked-allowed.ts
+    git add tracked-allowed.ts
+    printf '%s\n' 'import "@earendil-works/pi-ai/private-probe";' > untracked-forbidden.ts
+  ) || { fail "[check-pi-import-surface] could not build the denominator fixture in $probe_dir"; rm -rf "$probe_dir"; return 1; }
+  probe_hits=$(cd "$probe_dir" && pi_import_scan)
+  rm -rf "$probe_dir"
+  # ONE assertion, ONE claim token: the manifest contract requires the signature to
+  # occur exactly once in this file, so both fixture conditions are folded into a
+  # single failure whose message still names which half broke.
+  local saw_untracked_forbidden="no" saw_tracked_allowed="no"
+  grep -qF 'untracked-forbidden.ts' <<<"$probe_hits" && saw_untracked_forbidden="yes"
+  grep -qF 'tracked-allowed.ts' <<<"$probe_hits" && saw_tracked_allowed="yes"
+  if [ "$saw_untracked_forbidden" != "yes" ] || [ "$saw_tracked_allowed" != "no" ]; then
+    fail "[QK:PIIMPORT-WORK-SURFACE] the denominator fixture disagrees with the corpus — untracked-forbidden reached=$saw_untracked_forbidden (want yes: a brand-new forbidden import must not escape until it is staged), tracked-allowed flagged=$saw_tracked_allowed (want no: the /compat exception must survive)"
+    return 1
+  fi
+
+  hits=$(cd "$REPO_DIR" && pi_import_scan)
   if [ -n "$hits" ]; then
     echo "[check-pi-import-surface] FAIL: pi private subpath reference(s) — import @earendil-works/pi-* by the package ROOT only:"
     echo "$hits"
     exit 1
   fi
-  ok "[check-pi-import-surface] pi references are root-only (no private subpath; all tracked ts/js scanned)"
+  ok "[check-pi-import-surface] pi references are root/compat-only across tracked + untracked-non-ignored ts/js; the untracked denominator is proved on an external fixture repo"
 }
 
 check_env_namespace() {
@@ -2261,22 +2455,21 @@ check_acp_provider_surface() {
 }
 
 check_acp_sdk_surface() {
-  # Deterministic gate for the S2a ACP SDK dependency surface. Pins the three
-  # ACP runtime deps to the current oracle versions (@agentclientprotocol/sdk
-  # 1.3.0 + claude-agent-acp 0.62.0 + @anthropic-ai/sdk 0.100.1), locks the
-  # peer-resolution that keeps claude-agent-sdk satisfiable (0.100.1, not the
-  # stale 0.91.1), asserts the wire SDK still value-exports the symbols the raw
-  # turn needs (silent-rename gate), and forbids any source-level anthropic SDK
-  # import / API-client use (the anthropic dep is a peer-pin ONLY).
+  # Transition shim (issue #62 Phase 3): the gate NAME is preserved while the S2a
+  # ACP SDK dependency-surface contracts live in the vitest lane. Same layers as
+  # the retired scripts gate — exact dep pins, pnpm-lock peer-resolution lock,
+  # runtime resolver probes (anthropic peer / shared wire SDK / MCP peer edge),
+  # wire-SDK value-export surface, and the forbidden anthropic-import sweep. The
+  # per-layer mapping table is in the test file's header.
   section "ACP SDK surface (S2a dep pin + peer-resolution + no-client-use)"
-  run_ts scripts/check-acp-sdk-surface.ts
+  run_vitest test/acp-sdk-surface.contract.test.ts
 }
 
 check_acp_overlay() {
   # Deterministic gate for the S2b Claude config overlay materializer. Drives
   # ensureClaudeConfigOverlay against injected temp realDir/overlayDir (no
   # operator ~/.claude touched) and asserts: settings.json hooks:{} +
-  # defaultMode default + autoMemory off; whitelisted entries symlinked;
+  # defaultMode bypassPermissions (unattended turns never prompt) + autoMemory off; whitelisted entries symlinked;
   # projects/sessions overlay-private real dirs (NOT symlinks); operator
   # personal config (CLAUDE.md/settings.local.json/plugins/agents) never leaks;
   # stale symlinks cleaned; binary-owned files preserved; CLAUDE_CONFIG_DIR
@@ -2308,6 +2501,53 @@ check_acp_event_mapper() {
   run_ts scripts/check-acp-event-mapper.ts
 }
 
+check_acp_stop_reason() {
+  # Deterministic gate for the ACP stop-reason contract. Drives every member of
+  # the closed ACP terminal set (end_turn / max_tokens / max_turn_requests /
+  # refusal / cancelled), plus an unrecognized reason and an ABSENT one, end to
+  # end through streamAcpTurn against a fake connection — asserting the event
+  # kind, the event reason, and the final message's stopReason / rawStopReason /
+  # errorMessage together. Forbids the collapse-to-"stop" default that reported
+  # refusals and exhausted turn budgets as finished answers. Also pins the
+  # "pending" seed on the freshly created stream state.
+  section "ACP stop reason (terminal set → pi verdict)"
+  run_ts scripts/check-acp-stop-reason.ts
+}
+
+check_acp_prompt_lifecycle() {
+  # Deterministic gate for the ACP prompt LIFECYCLE contract. A prompt has no
+  # wall-clock cutoff: it ends when it resolves, when the operator aborts, or
+  # when the child dies / its stdio ends. Drives streamAcpTurn against a fake
+  # ACP child + connection for eight cells — a quiet in-flight turn is not
+  # sealed and later completes on its ORIGINAL prompt; an abort sends ACP
+  # session/cancel first (cancelled→aborted, no signal to a cooperating child);
+  # a wedged agent is torn down after the bounded grace and still returns; a
+  # mid-prompt child death reports exit status + stderr tail on BOTH the new and
+  # the reuse path; a death BETWEEN turns is announced once by the next turn
+  # while a teardown WE performed stays silent — plus pi's own
+  # isRetryableAssistantError as
+  # the oracle that our prompt-phase failure text is not a transient
+  # (cold-replay) error.
+  section "ACP prompt lifecycle (no wall clock; abort/child-death endings)"
+  run_ts scripts/check-acp-prompt-lifecycle.ts
+}
+
+check_acp_stream_hooks() {
+  # Deterministic gate for the pi 0.84 streamSimple hook contract on the ACP rail
+  # (#63; upstream pi-mono #7372 → doc-only #7576). before_provider_request
+  # (onPayload) receives the EXACT ACP session/prompt wire params on new AND
+  # reuse turns and its replacement becomes the wire — fail-closed: a non-null/
+  # non-array-object violation, a changed bootstrapped sessionId, or an emptied
+  # prompt array refuses the turn loudly with zero sends, a hook rejection fails
+  # loud, and an abort raised while the hook is awaited wins before the wire
+  # write on BOTH the new and the reuse path. after_provider_response (onResponse)
+  # is an explicit local non-HTTP exemption: ACP has no truthful {status,
+  # headers} and its terminal result arrives after the body was consumed, so the
+  # gate pins ZERO invocations across success/error/abort turns.
+  section "ACP streamSimple hooks (truthful onPayload; onResponse exemption)"
+  run_ts scripts/check-acp-stream-hooks.ts
+}
+
 check_acp_prompt_builder() {
   # Deterministic gate for the S2d bootstrapPath-scoped ACP prompt builder (핀4).
   # Proves prompt SCOPE follows bootstrapPath: new=full transcript (history
@@ -2383,11 +2623,11 @@ check_acp_carrier_augment() {
 check_acp_cortex() {
   # Deterministic gate for the Cortex (Snowflake Cortex Code) ACP backend — the
   # first non-claude adapter on the rail, landed 0.13.0 on the CP0-measured
-  # contract (docs/acp-backend-rail.md §4/§6/§11-8). The cortex source is one
+  # contract (docs/acp-backend-rail.md, Cortex audit D1–D10). The cortex source is one
   # `cortexAdapter` object (backend-adapter.ts) + its curated surface (models.ts)
   # + the dual-HOME overlay (overlay.ts); the 결합 규칙 requires the gate to land
-  # WITH it, and §6 said EXTEND the check-acp-* family, so cortex's whole
-  # deterministic axis lives here. Locks (each §11-8 D-pinned): the GLG-decided
+  # WITH it, extending the check-acp-* family, so cortex's whole
+  # deterministic axis lives here. Locks (each Cortex-audit D-pinned): the GLG-decided
   # 4-row curation rides real registry bases and the `cortex-` prefix routes to
   # cortexAdapter; launch is `cortex acp serve` with NO -m — the model is
   # enforced per turn via session/set_config_option with the native id (E);
@@ -2505,6 +2745,9 @@ check_pack() {
     # previous-generation store; without this twin the prescription every
     # v3-only rejection names would be dead exactly where it matters.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js"
+    # #65 — the owner-normalized store projection consumers call INSTEAD of
+    # parsing the store; installed hosts are exactly where those consumers live.
+    "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
     # 0.12.5 — the node_modules-safe plugin hook + its lib. install-meta-bridge copies
     # these compiled JS into the assembled plugin when installed (raw .ts can't
     # strip-types under node_modules). meta-session.js is shared with the store-doctor
@@ -2551,7 +2794,7 @@ check_pack() {
     '\.agent-(reports|shell)/'
     'pi/meta-bridge/\.assembled/'
     # Python bytecode residue — `scripts/` ships whole via the files allowlist,
-    # which BYPASSES .gitignore/.npmignore for its contents, so a `pnpm check`
+    # which BYPASSES .gitignore/.npmignore for its contents, so a `pnpm run check:full`
     # run's generated scripts/__pycache__/*.pyc rode into the 0.12.6 tarball. The
     # files-array `!**/__pycache__` / `!**/*.pyc` negations exclude it; this is the
     # tripwire that fails loud if that negation is ever dropped (결합 규칙).
@@ -2639,7 +2882,7 @@ _check_pack_install_impl() {
 
   echo "[check-pack-install] npm pack -> ${tgz_name}"
   # with-dist-lock: same whole-pack serialization as check-pack — this heavy gate
-  # and a background check-pack (via `pnpm check`) both pack, and unserialized they
+  # and a background check-pack (via `pnpm run check:full`) both pack, and unserialized they
   # race the shared dist dir. The stale-dist sentinel planted just above still
   # proves build-bridge's own `rm -rf dist` clean step under the lock.
   (cd "$REPO_DIR" && bash scripts/with-dist-lock.sh npm pack --dry-run=false --pack-destination "$pack_tmp" 2>&1 | tail -1) || {
@@ -2671,8 +2914,8 @@ _check_pack_install_impl() {
   # Required tarball contents. The old 0.11.0 ACP root files (index.ts,
   # acp-bridge.ts, event-mapper.ts, engraving.ts, pi-context-augment.ts,
   # pi-extensions/entwurf.ts) were removed on v2-only and are GONE — keeping them
-  # here made this heavy gate silently RED (publish-blocking) while `pnpm check`
-  # (which runs only check-pack, not check-pack-install) stayed green. The ACP
+  # here made this heavy gate silently RED (publish-blocking) while the deterministic floor
+  # (check:full runs only check-pack, not check-pack-install) stayed green. The ACP
   # plugin re-enters on v2 as the provider entry + lib/acp/* modules below.
   local tar_required=(
     "package.json" "README.md" "LICENSE" "CHANGELOG.md"
@@ -2700,6 +2943,8 @@ _check_pack_install_impl() {
     # The generation verb (see check-pack). The installed-command regression below
     # opens a fresh generation on a 0-record sandbox through the real bin.
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js"
+    # #65 — the owner-normalized store projection (see check-pack).
+    "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
     # hook regression below runs exactly this compiled JS from under node_modules.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
@@ -2776,21 +3021,31 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.82.1`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.84.1`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
   # "pinned pi 0.80.7". The gate would then be verifying an UNVERIFIED runtime — the
   # exact class this cut exists to close. Pin every @earendil-works package that
   # constitutes the pi runtime, not just the ones whose types we touch.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.82.x peers + typebox)"
+  #
+  # The constellation is re-measured at each pi bump, never carried forward. At
+  # 0.84.0 it GREW: pi-coding-agent's @earendil-works caret set went from
+  # {pi-agent-core, pi-ai, pi-tui} at 0.83.0 to {pi-agent-core, pi-ai, pi-client,
+  # pi-protocol, pi-tui}, so pi-client and pi-protocol are pinned here for the
+  # first time. Unpinned they would float exactly like pi-agent-core did in the
+  # 2026-07-21 incident above. (pi-telemetry arrives transitively, not as a
+  # direct caret; the leak assertion below covers it and every other pi package.)
+  echo "[check-pack-install] pnpm add into $tmp (with 0.84.x peers + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.82.1" \
-    "@earendil-works/pi-coding-agent@0.82.1" \
-    "@earendil-works/pi-tui@0.82.1" \
-    "@earendil-works/pi-agent-core@0.82.1" \
+    "@earendil-works/pi-ai@0.84.1" \
+    "@earendil-works/pi-coding-agent@0.84.1" \
+    "@earendil-works/pi-tui@0.84.1" \
+    "@earendil-works/pi-agent-core@0.84.1" \
+    "@earendil-works/pi-client@0.84.1" \
+    "@earendil-works/pi-protocol@0.84.1" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -2800,17 +3055,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.82.1. Anything else means an unpinned caret floated and the
+  # must be the pinned 0.84.1. Anything else means an unpinned caret floated and the
   # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.82.1". Fail loud instead of proving the wrong floor.
+  # printing "pinned pi 0.84.1". Fail loud instead of proving the wrong floor.
   local leaked_pi
-  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.82\.1' || true)
+  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.84\.1' || true)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.82.1):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.1):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.82.1"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.1"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -3200,8 +3455,16 @@ function finish(trimmed) {
   try { msg = JSON.parse(trimmed); }
   catch { console.error('unparseable tools/list:', trimmed.slice(0, 300)); if (stderr.trim()) console.error(stderr.trim()); process.exit(1); }
   const names = (msg?.result?.tools ?? []).map((t) => t?.name).sort();
-  for (const need of ['entwurf_v2', 'entwurf_peers', 'entwurf_self', 'entwurf_inbox_read', 'entwurf_register_native']) {
-    if (!names.includes(need)) { console.error('missing MCP tool from installed boot:', need, '— got', names.join(',')); process.exit(1); }
+  // EXACT set, not a floor. The subset form of this assertion named only the five
+  // pre-0.14 verbs, so an ARTIFACT whose bridge boots and answers but carries an older
+  // emitted surface — no entwurf_fresh_call, no entwurf_resume_call — passed the very
+  // gate that exists to catch "green clone, dead consumer". Equality also catches the
+  // other direction the narrow-surface rule cares about: an extra or duplicated verb
+  // reaching hosts without a decision. Written sorted; `names` is sorted above.
+  const EXPECT_TOOLS = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
+    console.error('installed MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
+    process.exit(1);
   }
   console.log(names.join(','));
   child.kill('SIGTERM');
@@ -3483,6 +3746,21 @@ JSON
     echo "$devgate_out" | tail -6 | sed 's/^/    /' >&2
     return 1
   fi
+  # The migrated fresh-call gate takes a third path: run_vitest. Drive that exact
+  # installed branch and require both the nonzero refusal and its intended cause;
+  # an incidental missing file or raw strip-types crash is not consumer evidence.
+  local vitestgate_out vitestgate_rc=0
+  vitestgate_out=$(HOME="$npmhome" XDG_DATA_HOME="$op_xdg_data" XDG_STATE_HOME="$op_xdg_state" XDG_CACHE_HOME="$op_xdg_cache" PI_CODING_AGENT_DIR="$op_agent" "$installed_entwurf" check-mux-fresh-call 2>&1) || vitestgate_rc=$?
+  if [ "$vitestgate_rc" -eq 0 ]; then
+    fail "[check-pack-install] the Vitest-backed check-mux-fresh-call exited 0 from an installed package — the devDependency runner is absent"
+    return 1
+  fi
+  if ! printf '%s' "$vitestgate_out" | grep -q 'dev-clone-only surface' || ! printf '%s' "$vitestgate_out" | grep -q 'vitest is a devDependency'; then
+    fail "[check-pack-install] installed check-mux-fresh-call did not refuse for run_vitest's intended devDependency/dev-clone-only reason:"
+    echo "$vitestgate_out" | tail -6 | sed 's/^/    /' >&2
+    return 1
+  fi
+
   # Same rule, different mechanism. check-fresh-cut-gate is a SHELL gate, so run_ts
   # never sees it — `scripts/` ships whole and the dispatch would happily run it
   # from under node_modules, where the dev sandbox it builds has no business
@@ -3499,7 +3777,7 @@ JSON
     echo "$shgate_out" | tail -6 | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] dev-only gate refusal pass (installed package refuses check-* legibly via run_ts, and the shell-side check-fresh-cut-gate refuses on its own guard; no raw-.ts fallback, no silent exit 0)"
+  echo "[check-pack-install] dev-only gate refusal pass (installed package refuses run_ts and run_vitest checks for their exact causes; shell-side check-fresh-cut-gate refuses on its own guard; no silent exit 0)"
 
   # 0.12.4 — installed STORE-DOCTOR regression. meta-bridge-doctor.sh's full store
   # scan runs the prebuilt dist JS when it lives under node_modules (strip-types
@@ -3599,7 +3877,7 @@ check_pack_install() {
 # NOT run the legacy ACP/v1 Axis 1 interview gates (session-messaging/sentinel):
 # those call removed surfaces and survive only as fail-loud reference subcommands
 # until rewritten onto entwurf_v2. The release-gate owns the heavier live v2
-# substrate proof (matrix-live + spawn-resume-live).
+# substrate proof (matrix-live).
 
 validate_entwurf_bridge() {
   local bridge_dir="$REPO_DIR/mcp/entwurf-bridge"
@@ -3610,7 +3888,11 @@ validate_entwurf_bridge() {
     return 1
   fi
 
-  log "entwurf-bridge: direct MCP smoke (strip-types launcher, no build step)"
+  # The launcher picks its own mode by LOCATION (dev clone → strip-types source; under
+  # node_modules → prebuilt dist), and this subcommand ships, so an operator running
+  # `entwurf check-bridge` from an npm install reads this line too. Naming only the dev
+  # branch here told that operator the installed bytes were never the subject.
+  log "entwurf-bridge: direct MCP smoke (start.sh as it ships — source under a clone, prebuilt dist under node_modules)"
 
   if ! raw=$(cd "$bridge_dir" && node --input-type=module <<'JS'
 import { spawn } from 'node:child_process';
@@ -3632,12 +3914,16 @@ function finishOk(trimmed) {
     process.exit(1);
   }
   const names = tools.map((t) => t?.name).sort();
-  const expected = ['entwurf_peers', 'entwurf_self', 'entwurf_inbox_read', 'entwurf_register_native', 'entwurf_v2'];
-  for (const name of expected) {
-    if (!names.includes(name)) {
-      console.error(`missing MCP tool: ${name}`);
-      process.exit(1);
-    }
+  // EXACT set, not a floor. This is the assertion behind the operator-facing claim that
+  // `entwurf check-bridge` proves the installed bytes list the seven garden tools — and
+  // under an installed package this launcher IS the dist branch of start.sh, so a subset
+  // check here let an artifact missing entwurf_fresh_call / entwurf_resume_call read as a
+  // green bridge. Equality also refuses an undecided extra verb. Written sorted; `names`
+  // is sorted above.
+  const expected = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  if (names.length !== expected.length || expected.some((n, i) => names[i] !== n)) {
+    console.error(`MCP tool set MISMATCH — want exactly [${expected.join(',')}] got [${names.join(',')}]`);
+    process.exit(1);
   }
   console.log(names.join(','));
   child.kill('SIGTERM');
@@ -3757,7 +4043,7 @@ setup_all() {
   # native-harness meta-bridge, so a relocate/clone needs ONE command — not the
   # install + install-meta-bridge two-pronged split that froze the Claude
   # statusLine on the old path (the 2026-06-23 relocation gap). Detection-gated:
-  # a pi-only host with no native harness skips it cleanly (§10 "있으면 설정,
+  # a pi-only host with no native harness skips it cleanly (rail “Shipped adapters” — "있으면 설정,
   # 없으면 담아준다"); meta-bridge-install.sh is itself idempotent.
   if command -v claude >/dev/null 2>&1; then
     section "meta-bridge install (native harness detected: Claude Code)"
@@ -3788,8 +4074,8 @@ setup_all() {
   # survives while the meta-record is created/attached by conversationId.
   wire_agy_hooks
 
-  # Deterministic preflight lives in `pnpm check`; live substrate acceptance lives
-  # in `LIVE=1 ./run.sh release-gate <scratch>`. Setup is the install path, so it
+  # Deterministic preflight lives in `pnpm run check:full`; live substrate acceptance lives
+  # in `LIVE=1 ./run.sh release-gate <scratch> --cut`. Setup is the install path, so it
   # verifies the installed MCP bridge boundary only and does NOT run the legacy
   # ACP/v1 session-messaging/sentinel gates.
   section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
@@ -3805,7 +4091,7 @@ setup_all() {
     echo "                           ./run.sh doctor-agy-statusline"
     echo "                           ./run.sh doctor-agy-hooks"
   fi
-  echo "Run 'LIVE=1 ./run.sh release-gate <scratch>' for live substrate acceptance."
+  echo "Run 'LIVE=1 ./run.sh release-gate <scratch> --cut' for live substrate acceptance (--cut refuses any MUST SKIP)."
 }
 
 # wire_agy_bridge — detection-gated, NON-FATAL agy (Antigravity) MCP bridge wiring, folded into
@@ -3967,13 +4253,13 @@ expose_dev_bin() {
 }
 
 # release-gate — the single command that, when GREEN, is sufficient to cut
-# release cuts. Runs the full static floor (`pnpm check`) followed by the
+# release cuts. Runs the full static floor (`pnpm run check:full`) followed by the
 # v2-native live gates, then emits one PASS/FAIL/SKIP summary. Everything is
 # invoked through run.sh subcommands — never a script in scripts/ directly.
 #
 # Design invariants (NEXT Step 1e + GPT-5.5 reviews):
 #   - v2-native live floor: the MUST tier is the v2 dispatch substrate
-#     (smoke-entwurf-v2-matrix-live + smoke-entwurf-v2-spawn-resume-live, opt-in
+#     (smoke-entwurf-v2-matrix-live, opt-in
 #     LIVE), the MCP bridge (check-bridge), and the resident citizen guard
 #     (smoke-resident-garden-guard).
 #   - ACP plugin acceptance floor (S0~S2g): the 11 ACP LIVE smokes
@@ -3989,10 +4275,18 @@ expose_dev_bin() {
 #   - Final release authorization is GLG's, not this script's: a green
 #     run is necessary, and the operator closes the decision.
 release_gate() {
+  entwurf_require_step_outcome
   local -a positional=()
   local a
+  # --cut is the EXECUTABLE half of "a CUT needs LIVE=1, SKIP=0" (P1). Without it
+  # this stays the unattended diagnostic it has always been: SKIPs are reported
+  # and the run still exits 0. With it, any MUST SKIP is red — including the
+  # LIVE!=1 case, which needs no separate assertion because every LIVE-gated step
+  # then skips on its own and the skip counter blocks.
+  local cut_mode=0
   for a in "$@"; do
     case "$a" in
+      --cut) cut_mode=1 ;;
       --allow-skip-gemini) ;;  # accepted-but-ignored: gemini removed from the claude-only floor (back-compat for existing scripts)
       *) positional+=("$a") ;;
     esac
@@ -4043,27 +4337,36 @@ release_gate() {
   }
 
   # LIVE-gated MUST step: a release-blocking gate that needs a real backend turn
-  # (auth/model/credit). When LIVE!=1 it is an HONEST SKIP — counted as SKIP, NOT
-  # PASS — so an unattended `./run.sh release-gate` stays runnable without faking
-  # coverage. A release CUT therefore requires `LIVE=1 ./run.sh release-gate
-  # <scratch>` to land MUST PASS with SKIP=0; a green run that still shows SKIP is
-  # CI safety, never live acceptance. (Same rule the v2 substrate sentinels below
-  # spell out inline; this helper applies it to the ACP plugin acceptance floor.)
+  # (auth/model/credit). It is ALWAYS INVOKED and the step itself reports whether
+  # it could run — that is the whole point of P1. The old shape asked `LIVE=1?`
+  # here and skipped without calling, which meant the summary asserted a skip it
+  # had never confirmed, while a step that WAS called could still exit 0 on a
+  # missing prerequisite (Cortex without a connection) and be counted PASS.
+  # Now one protocol decides: exit 0 = PASS, $ENTWURF_STEP_SKIP_EXIT = SKIP,
+  # anything else = FAIL. A SKIP is never rounded up, and `--cut` refuses any.
+  #
+  # `LIVE` is NOT forced here — it rides the operator's environment into the
+  # child, so `LIVE=1 ./run.sh release-gate` runs the step for real and a bare
+  # invocation gets the step's own honest skip.
   run_live_step() {
     local name="$1"; shift
     section "release-gate step: $name"
-    if [ "${LIVE:-}" = "1" ]; then
-      if "$@"; then
+    local rc=0
+    "$@" || rc=$?
+    case "$(entwurf_step_outcome "$rc")" in
+      PASS)
         ok "$name: PASS"
         results+=("PASS  $name"); pass=$((pass + 1))
-      else
-        fail "$name: FAIL"
+        ;;
+      SKIP)
+        warn "$name: SKIP — the step declined a prerequisite it does not have (see its [entwurf:skip] line above). NOT a live acceptance."
+        results+=("SKIP  $name"); skip=$((skip + 1))
+        ;;
+      *)
+        fail "$name: FAIL (exit $rc)"
         results+=("FAIL  $name"); failc=$((failc + 1))
-      fi
-    else
-      warn "$name: LIVE!=1 — skipped (opt-in: needs auth/model — NOT a live acceptance run)"
-      results+=("SKIP  $name (LIVE!=1)"); skip=$((skip + 1))
-    fi
+        ;;
+    esac
   }
 
   # BEHAVIOR lane (0.11.0, GLG+GPT+Opus): a SEPARATE advisory counter for
@@ -4087,29 +4390,56 @@ release_gate() {
   # deterministic/programmatic must-pass gates above (check-entwurf-v2-*,
   # check-bridge) — this lane is autonomous-tool-selection *behavior*, not
   # *function*. Residual bypass → 0.11.x usability lane.
-  local behavior_pass=0 behavior_failc=0
+  # The lane speaks the same STEP OUTCOME protocol (P1) so a missing prerequisite
+  # here is a BEHAVIOR-SKIP, not a fabricated BEHAVIOR-PASS or a misread
+  # BEHAVIOR-FAIL. Advisory semantics are untouched: none of these counters ever
+  # reaches `failc`, and `--cut` reads the MUST skip counter only.
+  local behavior_pass=0 behavior_failc=0 behavior_skip=0
   local -a behavior_results=()
 
   run_behavior_step() {
     local name="$1"; shift
     section "release-gate BEHAVIOR step (advisory, non-blocking): $name"
-    if "$@"; then
-      ok "$name: BEHAVIOR-PASS"
-      behavior_results+=("BEHAVIOR-PASS  $name"); behavior_pass=$((behavior_pass + 1))
-    else
-      warn "$name: BEHAVIOR-FAIL (advisory — model-in-loop signal; S7=Bash-bypass stays hard-fail here; NOT a cut blocker)"
-      behavior_results+=("BEHAVIOR-FAIL  $name"); behavior_failc=$((behavior_failc + 1))
-    fi
+    local rc=0
+    "$@" || rc=$?
+    case "$(entwurf_step_outcome "$rc")" in
+      PASS)
+        ok "$name: BEHAVIOR-PASS"
+        behavior_results+=("BEHAVIOR-PASS  $name"); behavior_pass=$((behavior_pass + 1))
+        ;;
+      SKIP)
+        warn "$name: BEHAVIOR-SKIP — prerequisite absent (advisory lane; not a signal either way)"
+        behavior_results+=("BEHAVIOR-SKIP  $name"); behavior_skip=$((behavior_skip + 1))
+        ;;
+      *)
+        warn "$name: BEHAVIOR-FAIL (advisory — model-in-loop signal; S7=Bash-bypass stays hard-fail here; NOT a cut blocker)"
+        behavior_results+=("BEHAVIOR-FAIL  $name"); behavior_failc=$((behavior_failc + 1))
+        ;;
+    esac
   }
 
-  # 1. Static floor (deterministic; includes the two folded gates).
-  section "release-gate step: static (pnpm check)"
-  if (cd "$REPO_DIR" && pnpm check); then
-    ok "static (pnpm check): PASS"
-    results+=("PASS  static (pnpm check)"); pass=$((pass + 1))
+  # 1. Static floor (deterministic; the FULL tier — core plus hermetic/package —
+  #    never the ≤60s everyday core alone).
+  section "release-gate step: static (pnpm run check:full)"
+  if (cd "$REPO_DIR" && pnpm run check:full); then
+    ok "static (pnpm run check:full): PASS"
+    results+=("PASS  static (pnpm run check:full)"); pass=$((pass + 1))
   else
-    fail "static (pnpm check): FAIL"
-    results+=("FAIL  static (pnpm check)"); failc=$((failc + 1))
+    fail "static (pnpm run check:full): FAIL"
+    results+=("FAIL  static (pnpm run check:full)"); failc=$((failc + 1))
+  fi
+
+  # 1b. Discriminating power of that floor. check-gate-qualification left the
+  # default check chains (operator inner-loop cost), so release acceptance
+  # carries it explicitly as its own MUST step: a cut must re-prove the gates
+  # still kill what they claim to kill.
+  section "release-gate step: check-gate-qualification"
+  if (cd "$REPO_DIR" && bash "$self" check-gate-qualification); then
+    ok "check-gate-qualification: PASS"
+    results+=("PASS  check-gate-qualification"); pass=$((pass + 1))
+  else
+    fail "check-gate-qualification: FAIL"
+    results+=("FAIL  check-gate-qualification"); failc=$((failc + 1))
   fi
 
   # 2. (gemini-availability step removed — claude-only floor; gemini CLI is
@@ -4125,7 +4455,7 @@ release_gate() {
   #    the identity foundation is broken, every Entwurf live gate below is
   #    meaningless, so fail fast here. (The old smoke-session-id-name substrate
   #    proof is gone with the substrate itself — #50 C3; smoke-pi-attach carries
-  #    the deterministic half inside pnpm check.)
+  #    the deterministic half inside pnpm run check:full.)
   # RGG split: the 0-token half (BIRTH: record + record-keyed socket / ATTACH:
   # re-open keeps the address / REPLACEMENT: in-process /new is pi's again) is
   # release-blocking and stays here as a must-pass with SMOKE_RGG_POSITIVE=0. The
@@ -4137,41 +4467,16 @@ release_gate() {
   # production runEntwurfV2 deps + real pi control-socket RPC + real mailbox enqueue + v2 lock, not
   # per-backend model behavior). Placed right after check-bridge: the MCP/protocol substrate must be
   # green first so a matrix-live failure reads as "v2 transport/lock/enqueue", not bridge basics.
-  # Opt-in LIVE: it spawns a real `pi --entwurf-control` (needs auth/model), so LIVE!=1 is an HONEST
-  # SKIP (not a PASS) — an unattended release-gate stays runnable without faking coverage. Independent
-  # of --allow-skip-gemini (now a no-op back-compat flag on the claude-only floor; this gates substrate auth).
-  section "release-gate step: smoke-entwurf-v2-matrix-live"
-  if [ "${LIVE:-}" = "1" ]; then
-    if gate env LIVE=1 bash "$self" smoke-entwurf-v2-matrix-live; then
-      ok "smoke-entwurf-v2-matrix-live: PASS"
-      results+=("PASS  smoke-entwurf-v2-matrix-live"); pass=$((pass + 1))
-    else
-      fail "smoke-entwurf-v2-matrix-live: FAIL"
-      results+=("FAIL  smoke-entwurf-v2-matrix-live"); failc=$((failc + 1))
-    fi
-  else
-    warn "smoke-entwurf-v2-matrix-live: LIVE!=1 — skipped (v2 substrate sentinel, opt-in: needs auth/model)"
-    results+=("SKIP  smoke-entwurf-v2-matrix-live (LIVE!=1)"); skip=$((skip + 1))
-  fi
-  # 0.11.0 (A) acceptance: the FULL spawn-bg resident lifecycle — a real `pi` resume child stands
-  # its control socket up, does a model turn, lock released ×1. Placed right after matrix-live (the
-  # transport sentinel): a spawn-resume failure then reads as "resume/resident lifecycle", not
-  # transport basics. Same opt-in LIVE rule — LIVE!=1 is an HONEST SKIP (model-in-loop, needs
-  # auth/model). NOTE: a 0.11.0 tag REQUIRES `LIVE=1 ./run.sh release-gate` (or this step direct)
-  # to PASS — the SKIP is CI safety, never acceptance.
-  section "release-gate step: smoke-entwurf-v2-spawn-resume-live"
-  if [ "${LIVE:-}" = "1" ]; then
-    if gate env LIVE=1 bash "$self" smoke-entwurf-v2-spawn-resume-live; then
-      ok "smoke-entwurf-v2-spawn-resume-live: PASS"
-      results+=("PASS  smoke-entwurf-v2-spawn-resume-live"); pass=$((pass + 1))
-    else
-      fail "smoke-entwurf-v2-spawn-resume-live: FAIL"
-      results+=("FAIL  smoke-entwurf-v2-spawn-resume-live"); failc=$((failc + 1))
-    fi
-  else
-    warn "smoke-entwurf-v2-spawn-resume-live: LIVE!=1 — skipped (0.11.0 A acceptance, opt-in: needs auth/model)"
-    results+=("SKIP  smoke-entwurf-v2-spawn-resume-live (LIVE!=1)"); skip=$((skip + 1))
-  fi
+  # Opt-in LIVE: it spawns a real `pi --entwurf-control` (needs auth/model), so a missing
+  # prerequisite is an HONEST SKIP (not a PASS) — an unattended release-gate stays runnable without
+  # faking coverage. Independent of --allow-skip-gemini (now a no-op back-compat flag on the
+  # claude-only floor; this gates substrate auth). It used to carry its own inline copy of the
+  # PASS/FAIL/SKIP branch; P1 folded it onto `run_live_step` so there is exactly ONE classifier —
+  # a second copy is how a lane silently keeps counting a skip as a pass.
+  run_live_step "smoke-entwurf-v2-matrix-live (D4-c: v2 dispatch substrate sentinel)" gate bash "$self" smoke-entwurf-v2-matrix-live
+  # The spawn-bg resident-lifecycle acceptance that used to sit here left with the transport in the
+  # visible-first cut. A same-id resume lane will need its own acceptance step; it does not inherit
+  # this one, because what that step proved was a HIDDEN child standing its socket up.
 
   # 3b. ACP plugin acceptance floor (S0~S2f live). These prove the ACP plugin's
   #     programmatic transport/provider/backend invariants on the v2 core — NOT
@@ -4186,18 +4491,35 @@ release_gate() {
   #     → first-user augment delivery + empty-carrier billing-clean (핀1) →
   #     ACP-target garden guard (deterministic half). Opt-in LIVE: LIVE!=1 is an
   #     HONEST SKIP via run_live_step (see its note) — a CUT needs LIVE=1, SKIP=0.
-  run_live_step "smoke-acp-socket-citizen-live (S1: turn-free socket citizenship)"        gate env LIVE=1 bash "$self" smoke-acp-socket-citizen-live
-  run_live_step "smoke-acp-raw-turn-live (S2a: pinned ACP pipe + local auth)"             gate env LIVE=1 bash "$self" smoke-acp-raw-turn-live
-  run_live_step "smoke-acp-overlay-live (S2b: config overlay + hooks:{} + tool meta)"     gate env LIVE=1 bash "$self" smoke-acp-overlay-live
-  run_live_step "smoke-acp-provider-live (S2c/S2f: real pi provider path + progress/L3)"  gate env LIVE=1 bash "$self" smoke-acp-provider-live
-  run_live_step "smoke-acp-session-reuse-live (S2d: process-scoped reuse + recall)"       gate env LIVE=1 bash "$self" smoke-acp-session-reuse-live
-  run_live_step "smoke-acp-carrier-augment-live (S2e-1: augment delivery + 핀1 billing)"  gate env LIVE=1 bash "$self" smoke-acp-carrier-augment-live
-  run_live_step "smoke-acp-memory-containment-live (Gate D: no overlay memory leak)"      gate env LIVE=1 bash "$self" smoke-acp-memory-containment-live
-  run_live_step "smoke-acp-rgg-live (S2e-2: ACP-target garden guard, deterministic half)" gate env LIVE=1 bash "$self" smoke-acp-rgg-live
-  run_live_step "smoke-acp-mcp-live (S2g: operator mcpServers reach the live ACP session)"  gate env LIVE=1 bash "$self" smoke-acp-mcp-live
-  run_live_step "smoke-acp-skill-live (S2g: operator skillPlugins reach the live ACP session)" gate env LIVE=1 bash "$self" smoke-acp-skill-live
-  run_live_step "smoke-acp-bundled-mcp-live (S2g axis 3: bundled entwurf-bridge via 0.11.0 resident/RPC circuit)" gate env LIVE=1 bash "$self" smoke-acp-bundled-mcp-live
-  run_live_step "smoke-acp-v2-send-live (S2g axis 4: an ACP model SENDS via entwurf_v2, landing as itself)" gate env LIVE=1 bash "$self" smoke-acp-v2-send-live
+  run_live_step "smoke-acp-socket-citizen-live (S1: turn-free socket citizenship)"        gate bash "$self" smoke-acp-socket-citizen-live
+  run_live_step "smoke-acp-raw-turn-live (S2a: pinned ACP pipe + local auth)"             gate bash "$self" smoke-acp-raw-turn-live
+  run_live_step "smoke-acp-overlay-live (S2b: config overlay + hooks:{} + tool meta)"     gate bash "$self" smoke-acp-overlay-live
+  run_live_step "smoke-acp-provider-live (S2c/S2f: real pi provider path + progress/L3)"  gate bash "$self" smoke-acp-provider-live
+  run_live_step "smoke-acp-session-reuse-live (S2d: process-scoped reuse + recall)"       gate bash "$self" smoke-acp-session-reuse-live
+  run_live_step "smoke-acp-carrier-augment-live (S2e-1: augment delivery + 핀1 billing)"  gate bash "$self" smoke-acp-carrier-augment-live
+  run_live_step "smoke-acp-memory-containment-live (Gate D: no overlay memory leak)"      gate bash "$self" smoke-acp-memory-containment-live
+  run_live_step "smoke-acp-rgg-live (S2e-2: ACP-target garden guard, deterministic half)" gate bash "$self" smoke-acp-rgg-live
+  run_live_step "smoke-acp-mcp-live (S2g: operator mcpServers reach the live ACP session)"  gate bash "$self" smoke-acp-mcp-live
+  run_live_step "smoke-acp-skill-live (S2g: operator skillPlugins reach the live ACP session)" gate bash "$self" smoke-acp-skill-live
+  run_live_step "smoke-acp-bundled-mcp-live (S2g axis 3: bundled entwurf-bridge via 0.11.0 resident/RPC circuit)" gate bash "$self" smoke-acp-bundled-mcp-live
+  run_live_step "smoke-acp-v2-send-live (S2g axis 4: an ACP model SENDS via entwurf_v2, landing as itself)" gate bash "$self" smoke-acp-v2-send-live
+
+  # 3c. The axes the aggregate used to leave out with no stated reason (P2,
+  #     2026-07-31). Three LIVE smokes existed and were simply never wired, so a
+  #     green cut said nothing about them. Under the P1 outcome protocol wiring
+  #     them costs nothing on a host that cannot run them — they SKIP honestly and
+  #     `--cut` names the missing prerequisite — while a host that CAN run them now
+  #     must. Cortex is deliberately NOT here: its rail needs an external Snowflake
+  #     connection the HOST owns, so wiring it would block every cut taken without
+  #     that account; it stays a required DIRECT call for a Cortex-rail cut instead
+  #     (VERIFY 「Cortex is an on-demand axis」). Same for `smoke-acp-long-turn-live`,
+  #     `smoke-agy-native-push-live` and `smoke-acp-ordering-probe-live`: >12min by
+  #     construction, no aggregate-owned agy conversation id, and an opt-in instrument
+  #     rather than acceptance. check-release-gate-outcomes pins that every LIVE smoke
+  #     is either wired here or excluded by a reason the docs still carry.
+  run_live_step "smoke-claude-native-resume-live (native Claude Code resume + meta-bridge neutrality)" gate bash "$self" smoke-claude-native-resume-live
+  run_live_step "smoke-entwurf-chain-live (P3: Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox, identity + receipt)" gate bash "$self" smoke-entwurf-chain-live
+  run_live_step "smoke-mux-lifecycle-live (mux public-harness lifecycle: fresh -> send -> dormant -> same-id visible resume -> recall)" gate bash "$self" smoke-mux-lifecycle-live
 
   # 4. BEHAVIOR lane (advisory, non-blocking). Model-in-loop gates that probe
   #     whether the model AUTONOMOUSLY drives the MCP entwurf surface. These never
@@ -4227,21 +4549,44 @@ release_gate() {
   if [ "${#behavior_results[@]}" -gt 0 ]; then
     printf '    %s\n' "${behavior_results[@]}"
   fi
-  echo "    BEHAVIOR: PASS=$behavior_pass  FAIL=$behavior_failc"
+  echo "    BEHAVIOR: PASS=$behavior_pass  FAIL=$behavior_failc  SKIP=$behavior_skip"
   echo "  (per-step artifact paths are printed in each step's output above)"
   if [ "$behavior_failc" -gt 0 ]; then
     echo ""
     warn "BEHAVIOR FAIL present ($behavior_failc) — advisory model-in-loop signal (e.g. S7 Bash-bypass / entwurf_self not autonomously called). Tracked, NOT a cut blocker; see the 0.11.x usability lane."
   fi
-  # Exit authority = MUST `failc` ONLY. A BEHAVIOR fail never blocks the cut.
-  if [ "$failc" -gt 0 ]; then
+  echo ""
+  if [ "$cut_mode" = "1" ]; then
+    echo "  mode: --cut (a MUST SKIP is a BLOCKER — this run is being read as release acceptance)"
+  else
+    echo "  mode: diagnostic (MUST SKIPs are reported, not blocking — re-run with --cut to read this as acceptance)"
+  fi
+  # The verdict as one greppable token, so release evidence can distinguish a
+  # step that RAN AND BROKE from one that NEVER RAN without reading prose. The
+  # counters above stay literal — a policy block is `FAIL=0 SKIP=n` plus
+  # `BLOCKED (MUST SKIP)`, never a synthesized failure.
+  echo "  $(entwurf_release_verdict "$failc" "$skip" "$cut_mode")"
+
+  # Exit authority — MUST tier only, BEHAVIOR never blocks. The releasable
+  # decision lives in scripts/lib/step-outcome.sh so it is one testable function
+  # rather than a branch re-derived here (and re-derived wrong: the pre-P1 branch
+  # read `failc` alone, so a run with 14 SKIPs still printed "all green").
+  if ! entwurf_release_releasable "$failc" "$skip" "$cut_mode"; then
     echo ""
-    fail "release-gate MUST NOT green — $failc release-blocking step(s) failed. Current release is NOT releasable."
+    if [ "$failc" -gt 0 ]; then
+      fail "release-gate MUST NOT green — $failc release-blocking step(s) failed. Current release is NOT releasable."
+    else
+      fail "release-gate --cut REFUSED — $skip release-blocking step(s) SKIPPED, so this run does not prove they were called."
+      echo "  A skipped step is not acceptance. Supply each missing prerequisite (usually LIVE=1 plus the"
+      echo "  per-step env the [entwurf:skip] lines above name) and re-run, or drop --cut to keep this a diagnostic."
+    fi
     echo "  A green MUST gate is necessary but not sufficient; GLG closes the call."
     return 1
   fi
-  if [ "$behavior_failc" -gt 0 ]; then
-    ok "release-gate MUST PASS (all release-blocking steps green); BEHAVIOR FAIL present (advisory). Necessary condition met — GLG authorizes the cut."
+  if [ "$skip" -gt 0 ]; then
+    warn "release-gate MUST has no failures, but $skip step(s) SKIPPED — this is a DIAGNOSTIC run, not live acceptance. A cut needs \`LIVE=1 ./run.sh release-gate <scratch> --cut\` with SKIP=0."
+  elif [ "$behavior_failc" -gt 0 ]; then
+    ok "release-gate MUST PASS (all release-blocking steps ran and are green); BEHAVIOR FAIL present (advisory). Necessary condition met — GLG authorizes the cut."
   else
     ok "release-gate MUST PASS + BEHAVIOR PASS — all green. Necessary condition met — GLG authorizes the cut."
   fi
@@ -4363,20 +4708,44 @@ case "$cmd" in
   check-entwurf-bridge-pi-free)
     check_entwurf_bridge_pi_free
     ;;
-  check-entwurf-v2-spawn)
-    check_entwurf_v2_spawn
-    ;;
   check-entwurf-resume-args)
     check_entwurf_resume_args
     ;;
-  check-entwurf-v2-spawn-production)
-    check_entwurf_v2_spawn_production
+  check-resume-launch-identity)
+    check_resume_launch_identity
+    ;;
+  check-mux-placement)
+    check_mux_placement
+    ;;
+  check-mux-placement-tmux)
+    check_mux_placement_tmux
+    ;;
+  check-mux-launch)
+    check_mux_launch
     ;;
-  smoke-entwurf-v2-spawn-live)
-    smoke_entwurf_v2_spawn_live
+  check-mux-fresh-call)
+    check_mux_fresh_call
     ;;
-  smoke-entwurf-v2-spawn-resume-live)
-    smoke_entwurf_v2_spawn_resume_live
+  check-mux-resume-call)
+    check_mux_resume_call
+    ;;
+  check-mux-parent-artifact)
+    check_mux_parent_artifact
+    ;;
+  check-mux-launcher-fence)
+    check_mux_launcher_fence
+    ;;
+  check-entwurf-v2-visible-resume)
+    check_entwurf_v2_visible_resume
+    ;;
+  smoke-mux-fresh-call-live)
+    smoke_mux_fresh_call_live
+    ;;
+  smoke-mux-lifecycle-live)
+    smoke_mux_lifecycle_live
+    ;;
+  check-mux-launch-tmux)
+    check_mux_launch_tmux
     ;;
   smoke-entwurf-v2-matrix-live)
     smoke_entwurf_v2_matrix_live
@@ -4393,6 +4762,9 @@ case "$cmd" in
   smoke-acp-provider-live)
     smoke_acp_provider_live
     ;;
+  smoke-acp-long-turn-live)
+    smoke_acp_long_turn_live
+    ;;
   smoke-acp-session-reuse-live)
     smoke_acp_session_reuse_live
     ;;
@@ -4405,6 +4777,15 @@ case "$cmd" in
   smoke-acp-bundled-mcp-live)
     smoke_acp_bundled_mcp_live
     ;;
+  smoke-entwurf-chain-live)
+    # P3 — the cross-harness delivery CHAIN on real authenticated rails:
+    # native Claude Code -> pi GPT -> pi ACP Claude Sonnet -> mailbox terminus,
+    # with sender identity at every hop and a read receipt at the end. Needs
+    # `claude` on PATH plus pi credentials for both pi backends; each missing
+    # prerequisite is an honest protocol SKIP, never a pass.
+    #   LIVE=1 ./run.sh smoke-entwurf-chain-live
+    run_ts scripts/smoke-entwurf-chain-live.ts
+    ;;
   smoke-acp-v2-send-live)
     smoke_acp_v2_send_live
     ;;
@@ -4432,6 +4813,9 @@ case "$cmd" in
   check-meta-listing)
     check_meta_listing
     ;;
+  check-meta-facts)
+    check_meta_facts
+    ;;
   check-entwurf-fact-provider)
     check_entwurf_fact_provider
     ;;
@@ -4608,7 +4992,7 @@ case "$cmd" in
     # 봉인 8 LIVE acceptance gate for the native-push (agy) delivery rail. Drives the REAL
     # antigravity adapter + register core + runEntwurfV2 (production deps) against a live agy
     # conversation (AGY_CONVERSATION_ID): probe route, register create/attach idempotency,
-    # fire→native-push delivered, owned-outcome reject, bogus-conv probe-indeterminate reject.
+    # fire→native-push delivered, bogus-conv probe-indeterminate reject.
     # Meta-store is isolated to a temp dir (only the agy round-trip is real); honest SKIP when
     # LIVE!=1. doctor-static preflight FAILs before the agy bridge is wired (③).
     run_ts scripts/smoke-agy-native-push-live.ts
@@ -4775,6 +5159,16 @@ case "$cmd" in
     shift || true
     run_ts scripts/meta-bridge-prune.ts "$@"
     ;;
+  meta-facts)
+    # #65 owner-normalized READ-ONLY projection of the meta-record store: the
+    # (gardenId, nativeSessionId, transcriptPath) join as deterministic JSON,
+    # emitted by THE listing contract (listAllMetaIdentities) so consumers stop
+    # carrying a decaying copy of the certification. Defects ride in-band with
+    # exit 0; an unreadable store is exit 3 and never looks empty. No liveness,
+    # no socket paths, no transcript contents, no state.
+    shift || true
+    run_ts scripts/meta-facts.ts "$@"
+    ;;
   meta-bridge-managed-keys)
     # 0.10.0 meta-bridge: emit the SSOT of settings.json/~/.claude.json keys that
     # entwurf's install OWNS. Consumers (agent-config fragment, future
@@ -4834,6 +5228,15 @@ case "$cmd" in
   check-acp-event-mapper)
     check_acp_event_mapper
     ;;
+  check-acp-stop-reason)
+    check_acp_stop_reason
+    ;;
+  check-acp-prompt-lifecycle)
+    check_acp_prompt_lifecycle
+    ;;
+  check-acp-stream-hooks)
+    check_acp_stream_hooks
+    ;;
   check-acp-prompt-builder)
     check_acp_prompt_builder
     ;;
@@ -4849,6 +5252,9 @@ case "$cmd" in
   check-acp-session-reuse)
     check_acp_session_reuse
     ;;
+  check-release-gate-outcomes)
+    run_ts scripts/check-release-gate-outcomes.ts
+    ;;
   check-acp-carrier-augment)
     check_acp_carrier_augment
     ;;