@junghanacs/entwurf 0.14.2 → 0.15.1

package/run.sh

@@ -119,7 +119,7 @@ run_vitest() {
 usage() {
   cat <<'EOF'
 Usage:
-  ./run.sh setup [project-dir]        # ONE confident install: pnpm install + install + meta-bridge (if native harness) + v2 install smoke (LIVE substrate = release-gate)
+  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
@@ -130,6 +130,10 @@ Usage:
   ./run.sh check-meta-session          # deterministic gate (#30 step 2, V3-only): fs store — idempotent decideUpsert/upsertMetaSession + mailbox enqueue/read + receipt state, no API
   ./run.sh check-meta-v3-record        # deterministic gate: the ONE live record schema (v3) — canonical serialize/round-trip/mint, foreign-generation rejections name fresh-cut with the actual version value, strict keyset, no API
   ./run.sh check-mailbox-receipt-state # deterministic gate (0.11 Stage 0 step 3B): mailbox receipt state schema + store (stamp→persist→read-back) in a temp mailbox, strict keyset, no API
+  ./run.sh check-copilot-birth-hook   # #82 gate: drives the real Copilot assembler into a temp dir, fires the baked launcher with NO ARGV (the way Copilot's `exec`-string schema forces), and requires a backend:"copilot" v3 record + attach + peer row + a SENDER marker the resolver joins back to that record, and still zero mailbox/receiver marker (who-sent needs a shared parent; a receiver needs a doorbell this backend has not got). Hermetic; no Copilot, no model turn
+  ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
+  ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
+  ./run.sh check-copilot-statusline   # #82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
@@ -177,7 +181,8 @@ Usage:
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
   ./run.sh check-meta-doctor-oracle   # 0.12.8 (#51): detection power of the release ORACLE — healthy fixture must reach `doctor: PASS`, then 21 planted defects (retired shell form, partial hand-patch, launcher bypass/repoint/provenance loss, malformed exec args, owner type drift, extra leaf/group, doorbell asyncRewake/path/timeout, no live bridge, stale receiver, ambiguous/missing cache, missing hook log/writer, failing CLI probes) must each turn it FAIL naming their own cause, plus a positive case pinning that a long-writing CLI is NOT a false negative. Offline/deterministic (deps: bash+node+python3)
-  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
+  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, truthful setup outcomes. Offline/deterministic
+  ./run.sh smoke-setup-verdict        # #86 C1+C3b aggregate setup verdict fixture: all-absent SKIP/green, pi presence+floor, detected-FAIL nonzero, copilot four-unit composition (present=independent PASS/FAIL rows, absent=zero-state SKIP), installed-mode named branch, credential store untouched. Offline/deterministic
   ./run.sh check-agy-permission-matrix # AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
@@ -185,8 +190,10 @@ Usage:
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
+  ./run.sh smoke-copilot-statusline-state # Copilot custom-footer install/doctor/inverse regression. Offline/deterministic
+  ./run.sh smoke-copilot-mcp-state       # Copilot MCP install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
-  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry). Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
@@ -195,6 +202,19 @@ Usage:
   ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is not yet verified/certified and stays nonzero for this cut (future validation may reopen it). Detection power is held by check-meta-doctor-oracle
+  ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
+  ./run.sh install-copilot-bridge     # #82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)
+  ./run.sh uninstall-copilot-bridge   # #86 C3a: honest inverse of install-copilot-bridge from the package-owned install-state (exact qualified id + exact marketplace name/path + recorded assembly only; state deleted LAST; a failing vendor list is UNKNOWN and refuses; never --force, never the stale Claude unit)
+  ./run.sh doctor-copilot-bridge      # #82/#86: fail-loud surface for that unit — runtime axis (red = a hook that RAN and failed, or a broken/unbaked artifact; "installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens, measured) + ownership axis (install-state shape/binding, marketplace path drift, UNKNOWN vendor lists; legacy no-state install = named non-green, repair = install-copilot-bridge adoption). Either axis red = red
+  ./run.sh install-copilot-statusline # own Copilot statusLine + footer.showCustom with an install-state preimage
+  ./run.sh uninstall-copilot-statusline # honest inverse of install-copilot-statusline
+  ./run.sh doctor-copilot-statusline  # static ownership/config/bin doctor; never claims a render receipt
+  ./run.sh install-copilot-mcp        # #82 RAIL 5: register ONE entwurf-bridge server in ~/.copilot/mcp-config.json (adopt / create / REFUSE symlink), type:local, install-state under $XDG_DATA_HOME/entwurf/copilot-mcp/
+  ./run.sh uninstall-copilot-mcp      # honest inverse of install-copilot-mcp from install-state
+  ./run.sh doctor-copilot-mcp         # static ownership/config/boot doctor; RED only when install-state exists
+  ./run.sh install-copilot-receive    # #82 RAIL 5: install the RECEIVER extension (user scope ~/.copilot/extensions/entwurf-receive). Owns the artifact and CHECKS the launch flag; it never sets one (a launch does — see `./run.sh copilot`). Arms per session after birth
+  ./run.sh uninstall-copilot-receive  # honest inverse from install-state; never removes a unit it did not install
+  ./run.sh doctor-copilot-receive     # artifact + digest, COPILOT_CLI_ENABLED_FEATURE_FLAGS on the LIVE copilot processes (the silent failure), live receiver markers via the production reader, receiver log. RED only when install-state exists
   ./run.sh install-agy-bridge         # 봉인 7: agy MCP install adapter — register ONE entwurf-bridge server in the agy mcp_config (adopt file / create / REFUSE symlink), stable bin command, install-state under $XDG_DATA_HOME/entwurf/agy-bridge/
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
   ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
@@ -213,13 +233,15 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.30 must leak, @0.84.3 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
-  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (0.82.x) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
+  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
-  ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
   ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
-  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project)
+  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
+  ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
+  ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
 
 Notes:
   - project-dir defaults to current directory
@@ -249,44 +271,12 @@ print(os.path.abspath(os.path.expanduser(sys.argv[1])))
 PY
 }
 
-sync_auth() {
-  local auth_path="$HOME/.pi/agent/auth.json"
-  python3 - "$auth_path" "$PROVIDER_ID" <<'PY'
-import json, os, sys
-from pathlib import Path
-
-auth_path = Path(sys.argv[1]).expanduser()
-provider_id = sys.argv[2]
-auth_path.parent.mkdir(parents=True, exist_ok=True)
-
-if auth_path.exists():
-    data = json.loads(auth_path.read_text())
-    if not isinstance(data, dict):
-        raise SystemExit("auth.json is not an object")
-else:
-    data = {}
-
-anthropic = data.get("anthropic")
-if not isinstance(anthropic, dict):
-    print("sync-auth: skipped (no anthropic OAuth credentials in ~/.pi/agent/auth.json)")
-    raise SystemExit(0)
-
-before = json.dumps(data.get(provider_id), sort_keys=True)
-after = json.dumps(anthropic, sort_keys=True)
-if before == after:
-    print(f"sync-auth: already synced ({provider_id})")
-    raise SystemExit(0)
-
-data[provider_id] = anthropic
-backup = auth_path.with_suffix(auth_path.suffix + ".bak")
-if auth_path.exists():
-    backup.write_text(auth_path.read_text())
-auth_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"sync-auth: wrote {provider_id} alias to {auth_path}")
-if backup.exists():
-    print(f"sync-auth: backup -> {backup}")
-PY
-}
+# The old `sync_auth` credential mutation is GONE (#86 A5): setup composes what
+# the operator already installed and NEVER reads, copies, aliases or backs up a
+# harness credential store — the `entwurf` alias it wrote had no in-repo reader
+# (the ACP provider passes pi's auth check with the no-auth sentinel), and the
+# `auth.json.bak` it left is documented manual-operator-cleanup ONLY. Do not
+# reintroduce credential copying as a convenience helper in any install path.
 
 # Repo dependency integrity is a HARD requirement for install — NOT gated on
 # backend (Claude/ACP) auth. A cloned-but-not-installed or a moved/renamed repo
@@ -495,6 +485,14 @@ PY
 }
 
 install_local_package() {
+  # Named interpreter prerequisite BEFORE any preflight/write (#86 E5): the
+  # packages[]/provider writers below are python3-backed and `entwurf install`
+  # dispatches here directly, so a python3-less host gets this verdict instead
+  # of an accidental mid-write failure.
+  command -v python3 >/dev/null 2>&1 || {
+    echo "[install] entwurf install requires python3 on PATH (settings writers are python3-backed); nothing was written." >&2
+    exit 1
+  }
   local project_dir agent_dir
   project_dir=$(normalize_project_dir "$1")
   agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
@@ -534,19 +532,79 @@ install_local_package() {
 # launchers and the npm consumer's "installs → just works" both need the entry
 # in ~/.pi/agent/settings.json's packages[]. This is the wiring that dropped when
 # `pi install` was removed from setup (2026-07-03: `--entwurf-control` unknown in
-# a foreign cwd). Idempotent: absent → append, present → no-op; a stale entwurf
-# entry at a different path is normalized to REPO_DIR. Every other package and key
-# in the operator's user settings is preserved untouched.
+# a foreign cwd). Idempotent for THIS root: absent → append + owner state, present
+# same-root → no-op. #86 C2 retires the silent normalization of other roots'
+# entries: a different owner (live or missing) is a zero-write refusal that names
+# takeover-user-scope. Every other package and key is preserved untouched.
+_pi_package_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-package/install-state.json"; }
+_pi_provider_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"; }
+
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR"
+  # #86 C2: user scope carries a recorded OWNER (packageRoot in the pi-package
+  # install-state). Another owner — live or missing — makes this a zero-write
+  # ownership refusal (exit 6) that propagates: install fails, setup records the
+  # pi component FAIL. The only writer over another owner is takeover-user-scope.
+  #
+  # ATOMIC (#86 C2 amendment): BOTH ownership halves are decided READ-ONLY before
+  # either writer runs — a provider-side refusal must leave the package side
+  # byte-identical (and vice versa), never a half-installed user scope.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)"
   # #46 Task 2: own entwurfProvider.mcpServers.entwurf-bridge as the bare stable bin at USER scope
   # (GLOBAL/durable →파급s to every cwd), so its inverse needs an install-state honest inverse
   # under $XDG_DATA_HOME/entwurf/pi-provider/ (Task 0/1 discipline). project scope is checkout-
   # local and covered by `run.sh remove` (no state) — deliberate, reasoned asymmetry.
-  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+  # #86 C2: the provider state records installerRoot, so the same foreign-owner refusal
+  # holds here — and the package refusal above fires FIRST, before any provider write.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)"
+}
+
+# takeover-user-scope — the operator-explicit ownership move (#86 C2). The ONLY
+# writer that replaces another root's user-scope registration: normal install/
+# setup/remove refuse instead. Reports old→new for both the packages[] entry
+# (packageRoot) and the provider key (installerRoot). No --force variant exists.
+takeover_user_scope() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}" pp_out
+  command -v python3 >/dev/null 2>&1 || { echo "[takeover] requires python3 on PATH; nothing was written." >&2; exit 1; }
+  section "takeover-user-scope: move the shared user-scope registration to this root"
+  # ATOMIC (#86 C2 amendment): both halves decided READ-ONLY first — an exact-entry
+  # mismatch on the package side or a refusal on the provider side leaves the other
+  # half byte-identical.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --takeover --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --takeover --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --takeover
+  pp_out=$(python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --takeover)
+  printf '%s\n' "$pp_out"
+  # Split verdict (#86 C2 amendment): a user-override provider key is preserved and
+  # stays UNOWNED — say exactly which half moved instead of a false "both owned".
+  if printf '%s' "$pp_out" | grep -q 'provider override preserved'; then
+    ok "takeover-user-scope: package owner moved to this root ($REPO_DIR); provider key preserved as the operator's override (unowned — doctor-pi-provider reports it as such)"
+  else
+    ok "takeover-user-scope: this root now owns the user-scope registration ($REPO_DIR)"
+  fi
+}
+
+# doctor-pi-package — package-side ownership verdict only (#86 C2): unregistered /
+# owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner.
+# Deliberately NOT mixed into doctor-pi-provider (provider runtime verdicts stay there).
+doctor_pi_package() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  command -v python3 >/dev/null 2>&1 || { echo "[doctor-pi-package] requires python3 on PATH." >&2; exit 1; }
+  # #86 C2 amendment: the provider state rides along for the OWNERSHIP coupling
+  # verdict only (installerRoot vs packageRoot mismatch = FAIL); provider RUNTIME
+  # verdicts stay with doctor-pi-provider.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --provider-state "$(_pi_provider_state)" --doctor
 }
 
 # The honest inverse of register_user_scope_citizen: drop entwurf from the GLOBAL
@@ -562,11 +620,54 @@ register_user_scope_citizen() {
 # reported rather than deleted — install never writes that form (#53 B).
 remove_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" --remove
+  local pkg_state pp_state orphan_args=()
+  pkg_state="$(_pi_package_state)"; pp_state="$(_pi_provider_state)"
+  # #86 C2 aligned orphan path: --orphan-cleanup is passed ONLY when the package
+  # entry, the package state's packageRoot and the provider state's installerRoot
+  # all name the SAME root and that root is MISSING on disk. Any live foreign
+  # owner, or any mismatch between the three, refuses inside the SSOTs instead.
+  if python3 - "$agent_dir/settings.json" "$pkg_state" "$pp_state" <<'PY'
+import json, os, sys
+settings_path, pkg_state_path, pp_state_path = sys.argv[1:4]
+def load(p):
+    try:
+        with open(p) as fh: return json.load(fh)
+    except (OSError, json.JSONDecodeError): return None
+pkg = load(pkg_state_path)
+if not isinstance(pkg, dict) or not isinstance(pkg.get("packageRoot"), str): sys.exit(1)
+owner = pkg["packageRoot"]
+if os.path.isdir(owner): sys.exit(1)                      # live owner: never orphan
+# Alignment REQUIRES the provider state to exist AND to be bound to the same
+# missing root (#86 C2 amendment): an absent, legacy (no installerRoot) or
+# elsewhere-bound provider state is NOT alignment — both sides refuse instead.
+pp = load(pp_state_path)
+if not isinstance(pp, dict): sys.exit(1)
+if pp.get("installerRoot") != owner: sys.exit(1)
+settings = load(settings_path)
+pkgs = settings.get("packages") if isinstance(settings, dict) else None
+if not isinstance(pkgs, list): sys.exit(1)
+def src(x): return x.get("source") if isinstance(x, dict) else x
+if not any(isinstance(src(x), str) and src(x).rstrip("/") == owner for x in pkgs): sys.exit(1)
+sys.exit(0)
+PY
+  then
+    orphan_args=(--orphan-cleanup)
+    log "remove-user-scope: package entry + package state + provider installerRoot align on a MISSING owner — reported orphan cleanup"
+  fi
+  # ATOMIC (#86 C2 amendment): both removal halves are decided READ-ONLY first, so
+  # a provider-side refusal (live-other, legacy, mismatch) leaves the package
+  # entry/state byte-identical instead of a half-removed user scope.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pkg_state" --remove ${orphan_args[@]+"${orphan_args[@]}"} --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pp_state" ${orphan_args[@]+"${orphan_args[@]}"} --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pkg_state" --remove ${orphan_args[@]+"${orphan_args[@]}"}
   # #46 Task 2: honest inverse of the user-scope entwurfProvider ownership — the install-state
   # drives it (absent/managed-* → remove OUR key; a user-override we never owned is untouched).
-  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+  # #86 C2: installerRoot makes this same-owner-only; the aligned orphan flag rides along.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pp_state" ${orphan_args[@]+"${orphan_args[@]}"}
 }
 
 # The ~/.pi/agent/entwurf-targets.json symlink machinery (ensure_agent_dir_symlinks
@@ -738,6 +839,41 @@ check_meta_receiver_marker() {
   run_ts scripts/check-meta-receiver-marker.ts
 }
 
+check_copilot_birth_hook() {
+  # #82 gate: the Copilot BIRTH path, proven without Copilot. Drives the REAL
+  # assembler (--assemble-only, into a temp dir), then fires the baked launcher the
+  # way Copilot fires it — NO ARGV, envelope on stdin — and requires a v3 record with
+  # backend "copilot", an attach on the second event of the same prompt, no
+  # mailbox/marker of any kind, and a peer row with liveness `unsupported`. Refusals
+  # (disagreeing ids, missing cwd, no id, malformed) must refuse rather than guess.
+  # It proves the MECHANISM, never the admission: §6 acceptance is a record minted by
+  # a real Copilot session, which costs a model turn.
+  run_ts scripts/check-copilot-birth-hook.ts
+}
+
+check_copilot_statusline() {
+  # #82 Copilot custom-footer renderer. Drives scripts/copilot-statusline.sh with
+  # session_id on stdin in an isolated store. ready / ? / exact gid; exit 0.
+  run_ts scripts/check-copilot-statusline.ts
+}
+
+check_copilot_launch() {
+  # #82 RAIL 7. The subject is a process REPLACEMENT, so the oracle is a fake vendor
+  # executable on a sandboxed PATH that reports the argv/env/pid/cwd it was handed —
+  # never a reading of the launcher's source. HOME/XDG/PATH are all redirected, so the
+  # install-state, the extensions root and the resolved binary are the fixture's.
+  run_ts scripts/check-copilot-launch.ts
+}
+
+check_copilot_receive_arm() {
+  # #82 RAIL 5 gate: drives the REAL receiver installer into a temp extensions dir, then
+  # forks the REAL extension.mjs with the SDK specifier resolved by a loader hook (the
+  # vendor's own mechanism). Binds arm-after-birth, watcher-owned marker, the self-fetch
+  # dispatch answer, a doorbell that carries the id and not the body, and every refusal.
+  # Needs the compiled bridge closure; hermetic otherwise (no Copilot, no model turn).
+  run_ts scripts/check-copilot-receive-arm.ts
+}
+
 check_hook_launch_topology() {
   # #51 gate 1, deliberately built only AFTER the B/B2 verdict. Binds the SHIPPED
   # hooks.json to real child topology: every leaf is exec form through the shipped
@@ -1099,7 +1235,10 @@ check_mux_fresh_call() {
   # could not see: real bridge boot → tools/list schema/description, Rust-regex-family pattern
   # validity on every emitted pattern (the #62 escape), and the schema riding the actual
   # anthropic-messages request body. No fake tmux: the real-window axis is smoke-mux-fresh-call-live.
-  run_vitest test/mux-fresh-call.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts
+  # copilot-fresh-preflight rides here rather than in its own gate: it exists only as
+  # freshCall's pre-mutation branch (#82 RAIL 9), and splitting it would let the two halves
+  # of one refusal be certified in different runs.
+  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -1629,13 +1768,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.85+ at the current 0.84.2 pin) whose
+// pi (past the declared ceiling — 0.85+ at the current 0.84.3 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.84.2` an existing 0.83.x host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.2 <0.85`).
+// install resolves: at `>=0.84.3` an existing 0.83.x host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.3 <0.85`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2757,6 +2896,9 @@ check_pack() {
     # strip-types under node_modules). meta-session.js is shared with the store-doctor
     # above; listed here too so the hook axis fails loud if the emit graph drops it.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    # #82 — the Copilot birth entry's compiled closure, for the same node_modules
+    # strip-types refusal that forces the Claude one.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
@@ -2769,6 +2911,25 @@ check_pack() {
     # It rides a per-FILE entry in the files array (not a whole directory), so one
     # deleted line drops it from the tarball while every other gate stays green.
     "pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh"
+    # #82 — the Copilot BIRTH unit. It is a SECOND marketplace root, not a second
+    # plugin inside the Claude one: the Claude installer assembles one root and copies
+    # one plugin out of it, so a shared marketplace.json would publish a `source` the
+    # assembly does not contain. Same per-FILE listing discipline as the Claude unit.
+    "pi/meta-bridge-copilot/.claude-plugin/marketplace.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
+    "pi-extensions/meta-bridge-hook-copilot.ts"
+    "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-uninstall.sh"
+    "scripts/copilot-bridge-oracle.sh"
+    "scripts/copilot-bridge-doctor.sh"
+    # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
+    # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
+    # extensions dir. `extension.mjs` is the vendor's required entry NAME: a rename in
+    # the tarball is not a degraded path, it is a unit Copilot never discovers.
+    "pi/copilot-receive/entwurf-receive/extension.mjs"
+    "scripts/copilot-receive-bridge.sh"
     "pi-extensions/meta-bridge-hook.ts"
     "pi-extensions/lib/meta-session.ts"
     "pi-extensions/lib/session-id.js"
@@ -2836,7 +2997,41 @@ check_pack() {
   return 1
 }
 
+# The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
+# self-test below. The version BOUNDARY is load-bearing: a pnpm .pnpm entry is
+# `<name>@<version>` followed by either `_<peer-hash>` or end-of-name (measured pnpm 11.20.0
+# on this tree), so an unbounded substring match would bless a lookalike such as `@0.84.30`
+# while announcing the pinned floor — a false-green oracle (found by independent review,
+# 2026-08-25).
+pack_install_leaked_pi() {
+  grep '^@earendil-works+pi-' | grep -Ev '@0\.84\.3(_|$)' || true
+}
+
+# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise the
+# false-green shape (it contains no 0.84.30), so the oracle is proven against a fixture
+# listing. Expected: the two lookalikes leak, the pinned version passes bare and with a
+# peer-hash suffix. Exposed as its own snapshot-safe subcommand because the heavy
+# check-pack-install cannot run inside the qualification snapshot (no install environment),
+# and a kill-proof needs a control-green gate there; check-pack-install still runs this
+# first so the heavy gate cannot proceed on a broken oracle.
+check_pack_pin_matcher() {
+  local matcher_probe
+  matcher_probe=$(printf '%s\n' \
+    '@earendil-works+pi-ai@0.84.3' \
+    '@earendil-works+pi-ai@0.84.3_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.84.30' \
+    '@earendil-works+pi-agent-core@0.84.2' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.84.30
+@earendil-works+pi-agent-core@0.84.2' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.84.30/0.84.2 lookalikes and pass 0.84.3 bare or with a peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    return 1
+  fi
+  echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with a peer-hash)"
+}
+
 _check_pack_install_impl() {
+  check_pack_pin_matcher || return 1
+
   # Heavy publish gate. Runs the remaining three checks in #13's
   # publish checklist that check_pack (dry-run only) does not cover:
   #
@@ -2954,6 +3149,9 @@ _check_pack_install_impl() {
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
     # hook regression below runs exactly this compiled JS from under node_modules.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
+    # #82 — the Copilot birth entry's compiled closure, for the same node_modules
+    # strip-types refusal that forces the Claude one.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
@@ -2965,6 +3163,25 @@ _check_pack_install_impl() {
     # both callers source. The install smoke below asserts the ASSEMBLED launcher is
     # executable; this asserts the artifact it is assembled FROM actually shipped.
     "pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh"
+    # #82 — the Copilot BIRTH unit. It is a SECOND marketplace root, not a second
+    # plugin inside the Claude one: the Claude installer assembles one root and copies
+    # one plugin out of it, so a shared marketplace.json would publish a `source` the
+    # assembly does not contain. Same per-FILE listing discipline as the Claude unit.
+    "pi/meta-bridge-copilot/.claude-plugin/marketplace.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json"
+    "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
+    "pi-extensions/meta-bridge-hook-copilot.ts"
+    "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-uninstall.sh"
+    "scripts/copilot-bridge-oracle.sh"
+    "scripts/copilot-bridge-doctor.sh"
+    # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
+    # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
+    # extensions dir. `extension.mjs` is the vendor's required entry NAME: a rename in
+    # the tarball is not a degraded path, it is a unit Copilot never discovers.
+    "pi/copilot-receive/entwurf-receive/extension.mjs"
+    "scripts/copilot-receive-bridge.sh"
     "pi-extensions/meta-bridge-hook.ts"
     "pi-extensions/lib/meta-session.ts"
     "pi-extensions/lib/session-id.js"
@@ -3013,9 +3230,9 @@ _check_pack_install_impl() {
   # to our pnpm-workspace.yaml; --ignore-scripts blocks the husky
   # prepare hook (and any future install scripts) from running inside
   # the consumer project. Peer deps are pinned to the CURRENT pi release
-  # baseline (0.82.x — the pins below are what check-dep-versions binds to
-  # the package.json devDep) so the smoke matches the same shape an external
-  # pi user would have after `pi install`.
+  # baseline (the package.json devDep pin — the pins below are what
+  # check-dep-versions binds to that devDep) so the smoke matches the same
+  # shape an external pi user would have after `pi install`.
   local tmp npm_tmp
   tmp=$(mktemp -d -t entwurf-install-smoke.XXXXXX)
   # Separate tree for the npm-managed regression below: npm install must NOT be
@@ -3027,7 +3244,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.84.2`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.84.3`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3046,12 +3263,12 @@ _check_pack_install_impl() {
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.84.2" \
-    "@earendil-works/pi-coding-agent@0.84.2" \
-    "@earendil-works/pi-tui@0.84.2" \
-    "@earendil-works/pi-agent-core@0.84.2" \
-    "@earendil-works/pi-client@0.84.2" \
-    "@earendil-works/pi-protocol@0.84.2" \
+    "@earendil-works/pi-ai@0.84.3" \
+    "@earendil-works/pi-coding-agent@0.84.3" \
+    "@earendil-works/pi-tui@0.84.3" \
+    "@earendil-works/pi-agent-core@0.84.3" \
+    "@earendil-works/pi-client@0.84.3" \
+    "@earendil-works/pi-protocol@0.84.3" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3061,17 +3278,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.84.2. Anything else means an unpinned caret floated and the
+  # must be the pinned 0.84.3. Anything else means an unpinned caret floated and the
   # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.84.2". Fail loud instead of proving the wrong floor.
+  # printing "pinned pi 0.84.3". Fail loud instead of proving the wrong floor.
   local leaked_pi
-  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.84\.2' || true)
+  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.2):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.3):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.2"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.3"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -3224,6 +3441,11 @@ _check_pack_install_impl() {
     ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
     return 1
   fi
+  if [ ! -x "$npmroot/node_modules/.bin/entwurf-copilot-statusline" ]; then
+    fail "[check-pack-install] npm-managed neutral install missing package bin entwurf-copilot-statusline"
+    ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
+    return 1
+  fi
   wire_log=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
     fail "[check-pack-install] npm-managed run.sh install failed (preflight rejected hoisted deps?):"
     echo "$wire_log" | tail -15 | sed 's/^/    /' >&2
@@ -3278,6 +3500,230 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
   fi
   echo "[check-pack-install] user-scope citizen regression pass (npm consumer: --entwurf-control loads from a foreign cwd)"
 
+  # Two-root ownership row (#86 C2, L1b extension): a SECOND npm root under the
+  # SAME consumer HOME must not silently steal the user-scope registration the
+  # first root owns — normal install refuses (naming takeover-user-scope) and the
+  # operator-explicit takeover is what moves the shared entry, old→new reported.
+  local npmroot2="$npm_tmp/npmroot2" npmproj2="$npm_tmp/npmproj2" npm2_log two_root_out two_root_rc npm2_pkg
+  mkdir -p "$npmroot2" "$npmproj2"
+  npm2_log=$(cd "$npmroot2" && npm install "$tgz_path" --no-audit --no-fund 2>&1) || {
+    fail "[check-pack-install] second npm root install failed:"
+    echo "$npm2_log" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  }
+  npm2_pkg="$npmroot2/node_modules/@junghanacs/entwurf"
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" install "$npmproj2" 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -eq 0 ] || ! grep -q "takeover-user-scope" <<<"$two_root_out"; then
+    fail "[check-pack-install] a second npm root's normal install must REFUSE the owned user-scope registration and name takeover-user-scope (rc=$two_root_rc):"
+    echo "$two_root_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+ok_a=any(isinstance(s,str) and s.rstrip('/')== '$npm_pkg' for s in srcs)
+bad_b=any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs)
+sys.exit(0 if ok_a and not bad_b else 1)
+"; then
+    fail "[check-pack-install] the refused second-root install still altered the user-scope packages[] entry:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" takeover-user-scope 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -ne 0 ] || ! grep -q "takeover: user-scope entwurf registration moved" <<<"$two_root_out"; then
+    fail "[check-pack-install] explicit takeover-user-scope from the second root failed (rc=$two_root_rc):"
+    echo "$two_root_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+ok_b=any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs)
+bad_a=any(isinstance(s,str) and s.rstrip('/')== '$npm_pkg' for s in srcs)
+sys.exit(0 if ok_b and not bad_a else 1)
+"; then
+    fail "[check-pack-install] takeover did not move the user-scope entry old→new:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  # #86 C2 amendment: BOTH ownership halves moved — the provider installerRoot must
+  # now name the new root, and the OLD root's inverse must refuse (live foreign owner).
+  if ! python3 -c "
+import json,sys
+st=json.load(open('$npmhome/.local/share/entwurf/pi-provider/install-state.json'))
+sys.exit(0 if st.get('installerRoot','').rstrip('/')== '$npm2_pkg' else 1)
+"; then
+    fail "[check-pack-install] takeover did not rebind the provider installerRoot to the new root:"
+    sed 's/^/    /' "$npmhome/.local/share/entwurf/pi-provider/install-state.json" >&2
+    return 1
+  fi
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" remove-user-scope 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -eq 0 ] || ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs) else 1)
+"; then
+    fail "[check-pack-install] the OLD root's remove-user-scope must refuse after takeover (rc=$two_root_rc) and leave the new owner's entry intact:"
+    echo "$two_root_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] two-root ownership row pass (second root: normal install refused naming takeover-user-scope; explicit takeover moved entry + provider installerRoot old->new; old root's inverse refused)"
+
+  # Installed-package aggregate `setup` row (#86 C1, review blocker 2026-08-26):
+  # the composed public command itself, driven through the consumer bin from the
+  # SAME installed candidate, on a FRESH sandbox home with every harness absent.
+  # This is the first living consumer of package-installed `entwurf setup`:
+  # mode=installed decided by name before anything else, NO pnpm bootstrap inside
+  # node_modules, pi/claude/agy explicit zero-state SKIPs, stable bins PASS as
+  # npm-provided, core bridge boundary PASS, computed green, zero harness/auth
+  # writes. Harness probes are pinned absent via the PI_BIN/CLAUDE_BIN/AGY_BIN/
+  # COPILOT_BIN seams so the gate host's real harnesses never leak in.
+  local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
+  mkdir -p "$setup_home/.pi/agent" "$setup_proj"
+  setup_auth="$setup_home/.pi/agent/auth.json"
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "consumer-oauth-token"\n  }\n}\n' > "$setup_auth"
+  local setup_auth_before
+  setup_auth_before="$(sha256sum "$setup_auth" | cut -d' ' -f1)"
+  set +e
+  setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
+    XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
+    PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" \
+    "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
+  setup_rc=$?
+  set -e
+  if [ "$setup_rc" -ne 0 ]; then
+    fail "[check-pack-install] installed all-absent setup exited $setup_rc — core must stay green with every harness absent, and an installed package must never re-enter the source pnpm bootstrap:"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! head -n 1 <<<"$setup_out" | grep -q "mode: installed package"; then
+    fail "[check-pack-install] installed setup did not name its mode FIRST:"
+    echo "$setup_out" | head -5 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if grep -Eqi "pnpm install|Lockfile is up to date|Progress: resolved" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup reached the source pnpm bootstrap inside node_modules:"
+    echo "$setup_out" | grep -Ei "pnpm|Lockfile|Progress" | sed 's/^/    /' >&2
+    return 1
+  fi
+  local skip_probe
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP"; do
+    if ! grep -q "$skip_probe" <<<"$setup_out"; then
+      fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
+      echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if ! grep -q "bins: PASS — provided by npm bin linking" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup must report stable bins PASS as npm-provided (capability present, not absent):"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! grep -q "core: PASS" <<<"$setup_out" || ! grep -q "result: green (computed from the component outcomes above)" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup core/computed-green missing:"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ]; then
+    fail "[check-pack-install] installed all-absent setup wrote harness state (must be zero-write)"
+    return 1
+  fi
+  if [ "$(sha256sum "$setup_auth" | cut -d' ' -f1)" != "$setup_auth_before" ] || [ -e "$setup_auth.bak" ]; then
+    fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
+    return 1
+  fi
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 4x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+
+  # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
+  # bin on a fresh sandbox home, with the shared fake vendor
+  # (scripts/fake-copilot-vendor.sh) on PATH. The presence-driven composition
+  # must run all FOUR Copilot units from the installed package: birth assembles
+  # the COMPILED hook (no raw .ts under node_modules) and drives the real
+  # marketplace-add→plugin-install sequence, MCP + receiver + footer land their
+  # configs/units in the sandbox, each unit keeps its package-owned
+  # install-state (its inverse authority), and the verdict is computed green.
+  local cop_setup_home="$npm_tmp/copsetuphome" cop_setup_proj="$npm_tmp/copsetupproj" cop_fake="$npm_tmp/fake-copilot-vendor"
+  mkdir -p "$cop_setup_home/.pi/agent" "$cop_setup_proj"
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "consumer-oauth-token"\n  }\n}\n' > "$cop_setup_home/.pi/agent/auth.json"
+  local cop_auth_before
+  cop_auth_before="$(sha256sum "$cop_setup_home/.pi/agent/auth.json" | cut -d' ' -f1)"
+  # EXECUTED, never sourced: this impl holds a `trap … RETURN`, and bash fires a
+  # RETURN trap when a sourced script finishes — a `. factory` here deleted the
+  # whole npm sandbox mid-gate (measured 2026-08-27, C3b review).
+  bash "$REPO_DIR/scripts/fake-copilot-vendor.sh" "$cop_fake" "$npm_pkg/pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json" || {
+    fail "[check-pack-install] could not build the fake copilot vendor from the PACKED plugin.json (is pi/meta-bridge-copilot missing from the tarball?)"
+    return 1
+  }
+  set +e
+  setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
+    XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
+    PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
+    "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
+  setup_rc=$?
+  set -e
+  if [ "$setup_rc" -ne 0 ]; then
+    fail "[check-pack-install] installed copilot-present setup exited $setup_rc — the four-unit composition must be green against the fake vendor:"
+    echo "$setup_out" | tail -30 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_row
+  for cop_row in "copilot-birth: PASS" "copilot-mcp: PASS" "copilot-receive: PASS" "copilot-statusline: PASS"; do
+    if ! grep -q "$cop_row" <<<"$setup_out"; then
+      fail "[check-pack-install] installed copilot-present setup missing unit verdict '$cop_row':"
+      echo "$setup_out" | tail -30 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if ! grep -q "result: green (computed from the component outcomes above)" <<<"$setup_out"; then
+    fail "[check-pack-install] installed copilot-present setup did not compute green:"
+    echo "$setup_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_setup_asm="$cop_setup_home/.local/share/entwurf/meta-bridge-copilot/.assembled/entwurf-meta-receive-copilot"
+  if [ ! -f "$cop_setup_asm/meta-bridge-hook-copilot.js" ] || [ -f "$cop_setup_asm/meta-bridge-hook-copilot.ts" ]; then
+    fail "[check-pack-install] installed copilot-present setup did not assemble the compiled birth hook (want meta-bridge-hook-copilot.js, no raw .ts) in $cop_setup_asm"
+    return 1
+  fi
+  if ! grep -q "^plugin marketplace add " "$cop_fake/calls.log" || ! grep -q "^plugin install entwurf-meta-receive-copilot@meta-bridge-copilot-local$" "$cop_fake/calls.log"; then
+    fail "[check-pack-install] installed copilot-present setup did not drive the vendor sequence (marketplace add + plugin install) — calls:"
+    sed 's/^/    /' "$cop_fake/calls.log" >&2
+    return 1
+  fi
+  if [ ! -f "$cop_setup_home/.copilot/extensions/entwurf-receive/extension.mjs" ] || [ ! -f "$cop_setup_home/.copilot/extensions/entwurf-receive/lib/meta-session.js" ]; then
+    fail "[check-pack-install] installed copilot-present setup did not deploy the receiver unit from the shipped dist closure"
+    return 1
+  fi
+  if ! grep -q "entwurf-bridge" "$cop_setup_home/.copilot/mcp-config.json" || ! grep -q "entwurf-copilot-statusline" "$cop_setup_home/.copilot/settings.json"; then
+    fail "[check-pack-install] installed copilot-present setup did not land the MCP config / footer settings in the sandbox home"
+    return 1
+  fi
+  local cop_state
+  for cop_state in copilot-bridge copilot-mcp copilot-receive copilot-statusline; do
+    if [ ! -f "$cop_setup_home/.local/share/entwurf/$cop_state/install-state.json" ]; then
+      fail "[check-pack-install] installed copilot-present setup left no package-owned install-state for $cop_state (its inverse authority)"
+      return 1
+    fi
+  done
+  if [ "$(sha256sum "$cop_setup_home/.pi/agent/auth.json" | cut -d' ' -f1)" != "$cop_auth_before" ] || [ -e "$cop_setup_home/.pi/agent/auth.json.bak" ]; then
+    fail "[check-pack-install] installed copilot-present setup touched the credential store (byte drift or .bak)"
+    return 1
+  fi
+  echo "[check-pack-install] installed copilot-present setup pass (four units PASS with install-states, compiled birth hook, vendor sequence driven, computed green, credentials untouched)"
+
   # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
   # bake versioned pnpm-store paths into Claude settings. MCP already uses the
   # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
@@ -3394,6 +3840,48 @@ SH
   fi
   rm -rf "$nm_probe"
   echo "[check-pack-install] installed hook is node_modules-safe compiled JS (hooks.json points at .js; runs under node_modules with plain node; raw .ts refused there by the strip-types fence)"
+
+  # --- #82: the Copilot birth unit's INSTALLED-PACKAGE branch ------------------
+  # check-copilot-birth-hook drives the installer from a DEV CLONE, so it only ever
+  # exercises the `.ts` branch. The installed-package branch — compiled
+  # meta-bridge-hook-copilot.js, its rewritten `./lib/meta-session.js` import, the
+  # registry copied to the plugin root — was covered by pack LISTS and by nothing that
+  # RUNS it, which is the shape Hard Rule 11 exists to refuse (cross-review, terra +
+  # glm independently, 2026-08-21).
+  #
+  # `--assemble-only` stops before the Copilot CLI, so this needs no Copilot and no fake
+  # of one. A fake Copilot CLI would only prove our script calls our fake the way we
+  # wrote it — the vendor contract is unmeasured, and the first real execution is the
+  # §6 admission itself. This asserts the CITIZEN, not merely that a node process ran.
+  local cop_asm="$npm_tmp/copilot-asm" cop_store cop_log
+  cop_store="$(mktemp -d)"
+  if ! cop_log=$(HOME="$mb_home" XDG_DATA_HOME="$mb_home/.local/share" ENTWURF_COPILOT_ASM="$cop_asm" PATH="$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-copilot-bridge --assemble-only 2>&1); then
+    fail "[check-pack-install] installed install-copilot-bridge --assemble-only failed:"
+    echo "$cop_log" | tail -20 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_unit="$cop_asm/entwurf-meta-receive-copilot"
+  # Branch SELECTION, pinned: an installed package must assemble the compiled entry and
+  # no raw .ts. Without this the fire below could pass on a layout that silently chose
+  # the dev-clone branch.
+  if [ ! -f "$cop_unit/meta-bridge-hook-copilot.js" ] || [ -f "$cop_unit/meta-bridge-hook-copilot.ts" ]; then
+    fail "[check-pack-install] installed install-copilot-bridge did not select the compiled branch (want meta-bridge-hook-copilot.js, no raw .ts) in $cop_unit"
+    return 1
+  fi
+  local cop_out
+  # Fired the way Copilot fires it: NO ARGV, envelope on stdin.
+  if ! cop_out="$(printf '%s' '{"sessionId":"pack-copilot-probe","cwd":"/tmp","source":"new"}' | env PI_CODING_AGENT_DIR="$cop_store" "$cop_unit/scripts/copilot-hook-launch.sh" 2>&1)"; then
+    fail "[check-pack-install] the installed Copilot launcher failed: $(printf '%s' "$cop_out" | tr '\n' ' ' | cut -c1-200)"
+    return 1
+  fi
+  local cop_records
+  cop_records="$(grep -l '"backend": "copilot"' "$cop_store"/meta-sessions/*.meta.json 2>/dev/null | wc -l | tr -d ' ')"
+  if [ "$cop_records" != "1" ]; then
+    fail "[check-pack-install] the installed Copilot unit did not mint exactly one copilot citizen (found ${cop_records:-0}); log: $(tail -1 "$cop_store/meta-bridge-hook.log" 2>/dev/null)"
+    return 1
+  fi
+  rm -rf "$cop_store"
+  echo "[check-pack-install] installed Copilot birth unit assembles its compiled branch and mints a citizen from a no-argv launch"
   python3 - "$mb_cfg/settings.json" "$mb_home/.claude.json" "$stable_asm" <<'PY'
 import json, sys
 settings = json.load(open(sys.argv[1]))
@@ -3596,6 +4084,60 @@ JS
     return 1
   fi
 
+  # #82 RAIL 7 — the managed launch, from the INSTALLED package. Hard Rule 11: a green
+  # clone is not a green tarball. `entwurf copilot` is a bash leaf, so its risk here is
+  # not the strip-types fence but PACKAGING — `scripts/copilot-launch.sh` has to be in
+  # the tarball and reachable from the installed `run.sh`, and a file-list assertion
+  # cannot tell a shipped script from a shipped script that resolves its siblings wrongly
+  # once it lives under node_modules. So the cell RUNS it, against a fake vendor on a
+  # sandbox PATH and a fake receiver install-state, and reads what the vendor was handed.
+  local cop_launch_home="$npm_tmp/cop-launch-home" cop_launch_xdg="$npm_tmp/cop-launch-xdg" cop_launch_bin="$npm_tmp/cop-launch-bin"
+  local cop_unit_dir="$cop_launch_home/.copilot/extensions/entwurf-receive"
+  local cop_state_dir="$cop_launch_xdg/entwurf/copilot-receive"
+  mkdir -p "$cop_unit_dir" "$cop_state_dir" "$cop_launch_bin"
+  printf '// fixture\n' > "$cop_unit_dir/extension.mjs"
+  printf '{"schemaVersion":1,"unit":"entwurf-receive","path":"%s"}\n' "$cop_unit_dir" > "$cop_state_dir/install-state.json"
+  # The stand-in is installed under the REAL name on a sandbox PATH: the launcher resolves
+  # `copilot` and nothing else, so there is no env switch here to prove the wrong contract with.
+  {
+    printf '#!/usr/bin/env bash\n'
+    printf 'echo "FLAG=[${COPILOT_CLI_ENABLED_FEATURE_FLAGS-<unset>}]"\n'
+    printf 'for a in "$@"; do printf "ARG<%%s>\\n" "$a"; done\n'
+  } > "$cop_launch_bin/copilot"
+  chmod +x "$cop_launch_bin/copilot"
+  # `env -u` for BOTH carriers, not just a reassignment: an operator running this gate with
+  # their own COPILOT_CLI_ENABLED_FEATURE_FLAGS exported would otherwise inherit those tokens
+  # into the oracle below and read a FALSE RED, and an inherited launch sentinel would trip
+  # the recursion fence before the vendor was ever reached. The cell must measure the
+  # installed launcher, not the shell that happened to start it.
+  if ! op_out=$(env -u COPILOT_CLI_ENABLED_FEATURE_FLAGS -u ENTWURF_COPILOT_LAUNCH_ACTIVE \
+      HOME="$cop_launch_home" XDG_DATA_HOME="$cop_launch_xdg" PATH="$cop_launch_bin:$PATH" \
+      "$installed_entwurf" copilot -p hi 2>&1); then
+    fail "[check-pack-install] installed 'entwurf copilot' FAILED to reach the vendor:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  # Assert MEANING: the scan flag this whole surface exists to set, the managed defaults,
+  # and the operator's own argument, all arriving at the vendor from the installed tree.
+  if ! printf '%s' "$op_out" | grep -q 'FLAG=\[EXTENSIONS\]'; then
+    fail "[check-pack-install] installed 'entwurf copilot' did not hand the vendor COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  for want in 'ARG<-p>' 'ARG<hi>' 'ARG<--model>' 'ARG<auto>' 'ARG<--yolo>'; do
+    if ! printf '%s' "$op_out" | grep -qF "$want"; then
+      fail "[check-pack-install] installed 'entwurf copilot' did not forward the managed argv (missing $want):"
+      echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if printf '%s' "$op_out" | grep -qF 'ARG<copilot>'; then
+    fail "[check-pack-install] installed 'entwurf copilot' leaked the dispatcher verb into the vendor's argv:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed 'entwurf copilot' reached the vendor with the scan flag and the managed argv"
+
   # The generation verb must reach its verdict from under node_modules. On the
   # sandbox 0-record agent dir it archives nothing and opens a fresh generation.
   # The exit code alone can't tell a verdict from a fence crash, so read the line.
@@ -3994,24 +4536,109 @@ check_bridge() {
 }
 
 
-# setup_all — full entwurf v2 install.
+# ── setup verdict engine (#86 C1) ────────────────────────────────────────────
+# setup composes harnesses the operator ALREADY installed. Per component the
+# verdict is PASS (detected + completed), SKIP (truly absent — zero state
+# written), or FAIL (detected but incomplete/below-floor/refused). The final
+# summary and exit status are COMPUTED from these outcomes: core survival never
+# relabels a detected harness failure as green, and a FAIL owns a nonzero setup
+# result while every valid earlier write stays installed (re-running setup is
+# the documented repair action).
+SETUP_RESULTS=()
+setup_result() {  # $1=component $2=PASS|SKIP|FAIL $3=detail
+  SETUP_RESULTS+=("$1|$2|$3")
+  case "$2" in
+    PASS) ok "$1: PASS — $3" ;;
+    SKIP) log "$1: SKIP — $3" ;;
+    *)    fail "$1: FAIL — $3" ;;
+  esac
+}
+
+# Installed-vs-source is decided by PACKAGE LOCATION — the same `*/node_modules/*`
+# seam run_ts and the bridge launcher already branch on — never by which of
+# pnpm/pi happens to be missing (an accidental failure is not a mode gate).
+setup_mode() {
+  case "$REPO_DIR" in
+    */node_modules/*) echo installed ;;
+    *) echo source ;;
+  esac
+}
+
+# Supported pi range, derived at runtime from the package.json devDependencies
+# pin (the SSOT check-dep-versions binds: peer range == `>=<pin> <0.<minor+1>`).
+# Never retyped here as a second literal.
+pi_supported_range() {
+  node -e '
+    const pkg = require(process.argv[1]);
+    const pin = pkg.devDependencies?.["@earendil-works/pi-coding-agent"];
+    if (!/^0\.\d+\.\d+$/.test(pin ?? "")) { console.error(`unparseable pi pin: ${pin}`); process.exit(1); }
+    const [, min] = pin.split(".").map(Number);
+    console.log(`>=${pin} <0.${min + 1}`);
+  ' "$REPO_DIR/package.json"
+}
+
+pi_version_in_range() {  # $1=detected version  $2=range ">=a.b.c <x.y"; exit 0 in-range
+  node -e '
+    const [ver, range] = process.argv.slice(1);
+    const m = range.match(/^>=(\d+)\.(\d+)\.(\d+) <(\d+)\.(\d+)$/);
+    const v = ver.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!m || !v) process.exit(2);
+    const [maj, min, pat] = v.slice(1).map(Number);
+    const lo = m.slice(1, 4).map(Number);
+    const hi = m.slice(4, 6).map(Number);
+    const geFloor = maj > lo[0] || (maj === lo[0] && (min > lo[1] || (min === lo[1] && pat >= lo[2])));
+    const ltCeil = maj < hi[0] || (maj === hi[0] && min < hi[1]);
+    process.exit(geFloor && ltCeil ? 0 : 1);
+  ' "$1" "$2"
+}
+
+# setup_all — one-command presence-driven composition (#86).
 #
-# Installs the v2 dispatch substrate + MCP entwurf-bridge into a target project
-# and verifies the installed bridge boundary. ACP/v1 backend interview gates are
-# deliberately not part of setup on v2-only; the heavier live v2 substrate proof
-# is release-gate's job.
+# Entwurf installs itself only: this command completes the integration of each
+# harness the operator already installed and NEVER installs a harness binary,
+# subscription, credential or login — `pi` has no privileged exception. It
+# verifies the installed bridge boundary; ACP/v1 backend interview gates are
+# deliberately not part of setup on v2-only (the heavier live v2 substrate
+# proof is release-gate's job). Copilot's four native units (birth / MCP /
+# receiver / visible footer) compose presence-driven since the birth inverse
+# landed (#86 C3a→C3b); the explicit install-copilot-* / uninstall-copilot-*
+# surfaces remain the operator-selected repair and inverse path.
 #
 # An external harness that consumes entwurf (e.g. agent-config as a
 # pi package + skills set) may still have its own install/setup for its
 # own concerns; those are outside the scope of this script.
 setup_all() {
+  # MODE FIRST (#86 C1): the installed-vs-source branch is a NAMED decision
+  # ahead of every prerequisite check and write, so an installed consumer is
+  # never mode-gated by an accidental missing `pnpm`/`pi`.
+  local mode
+  mode=$(setup_mode)
+  case "$mode" in
+    installed)
+      echo "[setup] mode: installed package — composition only (no source bootstrap; setup never runs npm/pnpm inside node_modules)" ;;
+    *)
+      echo "[setup] mode: source checkout — repo dev bootstrap, then the same composition semantics" ;;
+  esac
+
+  # Named interpreter prerequisite, decided BEFORE any write (#86 C1/E5):
+  # setup's project-path normalization and every pi/agy wiring writer are
+  # python3-backed today. `entwurf --help` / `entwurf check-bridge` stay
+  # python3-free; only the commands that invoke those writers declare it.
+  command -v python3 >/dev/null 2>&1 || {
+    echo "[setup] entwurf setup requires python3 on PATH (project-path normalization + wiring writers)." >&2
+    echo "[setup] Install python3, or use python3-free surfaces (--help, check-bridge)." >&2
+    exit 1
+  }
+  require_cmd node
+
   local project_dir
   project_dir=$(normalize_project_dir "$1")
 
-  require_cmd pnpm
-  require_cmd python3
-  require_cmd pi
-  require_cmd node
+  if [ "$mode" = "source" ]; then
+    # Source-only dev fixtures: the pinned repo dependencies are build/test
+    # fixtures, never a product promise that consumers receive them (#86 A4).
+    require_cmd pnpm
+  fi
 
   # Node 24+ is the SINGLE supported axis (GLG, 2026-07-21). The floor is not
   # derived from a feature gate: type-stripping alone would only demand 23.6.
@@ -4032,81 +4659,217 @@ setup_all() {
   echo "[setup] scope:   entwurf v2 package + detected native-harness bridges + pi adapter"
   echo "[setup] verification: v2 install smoke (entwurf-bridge; LIVE substrate = release-gate)"
 
-  # Store gate FIRST — ahead of pnpm install, sync_auth (which creates and
-  # rewrites ~/.pi/agent/auth.json) and every settings writer below. On an
-  # existing development host this is the only step standing between a `git pull`
-  # and a V3-only activation over a store the live schema cannot read; putting
-  # it inside install_local_package would already be one auth.json write too
-  # late. The store-doctor imports repo-local libs and node builtins only, so it
-  # runs before dependencies exist.
+  # Store gate FIRST — ahead of the source bootstrap and every settings writer
+  # below. On an existing development host this is the only step standing
+  # between a `git pull` and a V3-only activation over a store the live schema
+  # cannot read; putting it inside install_local_package would already be one
+  # write too late. The store-doctor imports repo-local libs and node builtins
+  # only, so it runs before dependencies exist.
   preflight_v3_store setup
 
-  (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
-  sync_auth
-  install_local_package "$project_dir"
-
-  # Single confident install command (GLG 2026-06-23): setup ALSO wires the
-  # native-harness meta-bridge, so a relocate/clone needs ONE command — not the
-  # install + install-meta-bridge two-pronged split that froze the Claude
-  # statusLine on the old path (the 2026-06-23 relocation gap). Detection-gated:
-  # a pi-only host with no native harness skips it cleanly (rail “Shipped adapters” — "있으면 설정,
-  # 없으면 담아준다"); meta-bridge-install.sh is itself idempotent.
-  if command -v claude >/dev/null 2>&1; then
+  SETUP_RESULTS=()
+
+  if [ "$mode" = "source" ]; then
+    # Source bootstrap is the ONLY install-mode difference (#86): the pinned
+    # repo dev dependencies are fixtures this checkout builds/tests with. A
+    # broken bootstrap is a broken checkout — crash, don't degrade.
+    (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
+  fi
+
+  # ── pi (presence + floor, #86 C1/C9) ── pi is OPTIONAL-BY-PRESENCE: absent is
+  # an explicit zero-state SKIP (setup never installs pi and writes no Pi
+  # wiring), below-floor/unreadable is detected-incomplete FAIL — never a SKIP,
+  # so a stale pi is told the truth instead of being silently skipped. PI_BIN
+  # pins the probe for the hermetic smoke (same seam as AGY_BIN); production
+  # leaves it unset.
+  local pi_bin="${PI_BIN:-pi}" pi_range pi_ver
+  if ! command -v "$pi_bin" >/dev/null 2>&1; then
+    setup_result pi SKIP "pi not on PATH — zero Pi wiring written (the operator installs pi; setup never does)"
+  else
+    pi_range=$(pi_supported_range)
+    # Bounded capture: a resolvable pi whose --version crashes or prints garbage
+    # must land in the computed FAIL verdict below, never abort setup via set -e
+    # before the summary (review defect, 2026-08-26).
+    pi_ver="$("$pi_bin" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')" || pi_ver=""
+    if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
+      setup_result pi FAIL "detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup"
+    elif (install_local_package "$project_dir"); then
+      setup_result pi PASS "project + user-scope wiring complete (pi $pi_ver in $pi_range) — verify: ./run.sh doctor-pi-provider"
+    else
+      setup_result pi FAIL "pi wiring did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── claude (meta-bridge) ── single confident install command (GLG 2026-06-23):
+  # setup ALSO wires the native-harness meta-bridge so a relocate/clone needs ONE
+  # command. Detection-gated ("있으면 설정, 없으면 담아준다");
+  # meta-bridge-install.sh is idempotent and enforces the Claude floor + its own
+  # named prerequisites itself, so a below-floor or refused host lands here as a
+  # detected FAIL, never a cosmetic green. CLAUDE_BIN pins the probe for the
+  # hermetic smoke; production leaves it unset.
+  local claude_bin="${CLAUDE_BIN:-claude}"
+  if ! command -v "$claude_bin" >/dev/null 2>&1; then
+    setup_result claude SKIP "claude not on PATH — zero meta-bridge wiring written"
+  else
     section "meta-bridge install (native harness detected: Claude Code)"
-    (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh)
+    if (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh); then
+      setup_result claude PASS "meta-bridge wired — verify: ./run.sh doctor-meta-bridge"
+    else
+      setup_result claude FAIL "detected Claude Code, but the meta-bridge integration did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── stable command exposure ── source mode exposes entwurf's STABLE bins on
+  # PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the operator command
+  # `entwurf` that Copilot fresh resolves as its managed runtime, plus the bare
+  # bridge/statusline/imprint names native-harness configs record. An installed
+  # consumer already has the same commands from npm bin linking — nothing to
+  # expose there. The core operator stays fail-loud; helper units are attempted
+  # independently and a refused helper is a named FAIL, not a cosmetic green.
+  local bins_rc
+  if [ "$mode" = "installed" ]; then
+    # PASS, not SKIP (review, 2026-08-26): the capability IS present — npm bin
+    # linking provides the same stable commands the source lane must expose.
+    # SKIP stays reserved for a truly absent capability with zero state.
+    setup_result bins PASS "provided by npm bin linking (installed package needs no source exposure)"
   else
-    echo "[setup] no native harness (claude) on PATH — skipping meta-bridge wiring (pi-only host)"
-  fi
-
-  # Expose entwurf's STABLE bins on PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the
-  # agy mcp_config, settings.statusLine, and hooks.json record the bare names `entwurf-bridge` /
-  # `entwurf-agy-statusline` / `entwurf-agy-imprint`, so they must resolve for the agy doctors
-  # to pass. NON-FATAL — a foreign bin already on PATH is left as-is.
-  expose_dev_bin
-
-  # Fold agy (Antigravity) MCP bridge wiring into setup (막힘 ①, GLG 2026-07-04: install
-  # ownership moves to entwurf). Same detection-gated, idempotent, NON-FATAL posture as the
-  # meta-bridge block above — agy is an OPTIONAL harness, so a refused/corrupt agy config warns
-  # but never bricks a pi/Claude setup. The hard gate stays doctor-agy-bridge.
-  wire_agy_bridge
-
-  # Fold agy statusLine wiring into setup (#46 Task 1: own the ambient status area so it shows
-  # driver + garden id, the claude meta-bridge symmetry). Same detection-gated NON-FATAL posture
-  # — an explicit install-agy-statusline is fail-loud, but the setup wrapper WARNs + continues.
-  wire_agy_statusline
-
-  # Fold agy PreInvocation birth imprint wiring into setup (#46 close criterion: manual register 0).
-  # The hook runs the thin `entwurf-agy-imprint` bin and returns {"injectSteps":[]} so agy's loop
-  # survives while the meta-record is created/attached by conversationId.
-  wire_agy_hooks
-
-  # Deterministic preflight lives in `pnpm run check:full`; live substrate acceptance lives
-  # in `LIVE=1 ./run.sh release-gate <scratch> --cut`. Setup is the install path, so it
-  # verifies the installed MCP bridge boundary only and does NOT run the legacy
-  # ACP/v1 session-messaging/sentinel gates.
-  section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
-  validate_entwurf_bridge
+    bins_rc=0; expose_dev_bin || bins_rc=$?
+    if [ "$bins_rc" -eq 0 ]; then
+      setup_result bins PASS "source operator + helper bins exposed and certified (PATH winner: this checkout)"
+    elif [ "$bins_rc" -eq 3 ]; then
+      setup_result bins FAIL "foreign helper bin(s) refused (named above; every unit was attempted) — repair them, then re-run setup"
+    else
+      setup_result bins FAIL "source operator command not certified (see above) — repair PATH/link, then re-run setup"
+    fi
+  fi
 
-  echo ""
-  echo "DONE: entwurf setup (pi adapter + detected native bridges + v2 install smoke) green."
-  if command -v claude >/dev/null 2>&1; then
-    echo "Verify Claude wiring with: ./run.sh doctor-meta-bridge"
+  # ── agy (Antigravity) ── detection-gated (막힘 ①, GLG 2026-07-04: install
+  # ownership moves to entwurf); AGY_BIN pins the probe for the hermetic smoke.
+  # agy absent is one zero-state SKIP. agy PRESENT runs all three leaves
+  # (bridge / statusLine / PreInvocation imprint) independently; a refused or
+  # corrupt config is a named component FAIL that keeps the rest of setup alive
+  # but owns a nonzero final result — the old WARN-then-green posture is retired
+  # (#86 C6/C7). Hard per-leaf verdicts stay with the doctor commands.
+  local agy_rc
+  if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
+    setup_result agy SKIP "agy not on PATH — zero agy wiring written"
+  else
+    agy_rc=0; wire_agy_bridge || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-bridge PASS "MCP bridge wired — verify: ./run.sh doctor-agy-bridge"
+    else
+      setup_result agy-bridge FAIL "detected agy, but the MCP bridge integration did not complete (reason above) — repair, then re-run setup"
+    fi
+    agy_rc=0; wire_agy_statusline || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-statusline PASS "statusLine wired — verify: ./run.sh doctor-agy-statusline"
+    else
+      setup_result agy-statusline FAIL "detected agy, but the statusLine integration did not complete (reason above) — repair, then re-run setup"
+    fi
+    agy_rc=0; wire_agy_hooks || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-hooks PASS "birth imprint wired — verify: ./run.sh doctor-agy-hooks"
+    else
+      setup_result agy-hooks FAIL "detected agy, but the birth-imprint integration did not complete (reason above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── copilot (GitHub Copilot CLI) ── presence-driven composition (#86 C3b):
+  # the operator's copilot on PATH is the ONLY trigger; absent is one zero-state
+  # SKIP (setup never installs a harness). Present runs all FOUR units the
+  # fresh-call preflight requires — birth → MCP → receiver → visible footer —
+  # INDEPENDENTLY: a failed unit is a named component FAIL that keeps the other
+  # units and the rest of setup alive but owns a nonzero final result. Every
+  # unit is an operator-selectable install with a package-owned inverse (#86
+  # C3a closed the birth inverse), so setup composes only lifecycles it can
+  # also undo. COPILOT_BIN pins the PROBE for the hermetic gates (same seam
+  # spirit as PI_BIN/CLAUDE_BIN/AGY_BIN); the unit scripts address the vendor
+  # as `copilot` on PATH, so production leaves it unset and the two agree.
+  local copilot_rc
+  if ! command -v "${COPILOT_BIN:-copilot}" >/dev/null 2>&1; then
+    setup_result copilot SKIP "copilot not on PATH — zero Copilot wiring written"
+  else
+    section "copilot units (native harness detected: GitHub Copilot CLI)"
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-birth PASS "birth plugin installed — verify: ./run.sh doctor-copilot-bridge"
+    else
+      setup_result copilot-birth FAIL "detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup"
+    fi
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh install) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-mcp PASS "MCP server registered — verify: ./run.sh doctor-copilot-mcp"
+    else
+      setup_result copilot-mcp FAIL "detected copilot, but the MCP registration did not complete (see above) — repair, then re-run setup"
+    fi
+    # The receiver deploys the COMPILED dist closure on every install shape
+    # (Copilot's extension runtime cannot strip-types). The tarball ships dist;
+    # a source checkout may not have built it yet, and those bytes are
+    # entwurf's OWN artifact (Hard Rule 17: the source bootstrap supplies
+    # entwurf's own bytes), so the source lane builds it here once when absent.
+    copilot_rc=0
+    if [ "$mode" = "source" ] && [ ! -f "$REPO_DIR/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js" ]; then
+      (cd "$REPO_DIR" && pnpm run build-bridge) || copilot_rc=$?
+    fi
+    if [ "$copilot_rc" -ne 0 ]; then
+      setup_result copilot-receive FAIL "detected copilot, but the receiver's compiled dist closure failed to build (see above) — repair, then re-run setup"
+    else
+      copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh install) || copilot_rc=$?
+      if [ "$copilot_rc" -eq 0 ]; then
+        setup_result copilot-receive PASS "receiver extension installed — verify: ./run.sh doctor-copilot-receive"
+      else
+        setup_result copilot-receive FAIL "detected copilot, but the receiver extension install did not complete (see above) — repair, then re-run setup"
+      fi
+    fi
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh install) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-statusline PASS "visible footer wired — verify: ./run.sh doctor-copilot-statusline"
+    else
+      setup_result copilot-statusline FAIL "detected copilot, but the visible-footer integration did not complete (see above) — repair, then re-run setup"
+    fi
   fi
-  if command -v agy >/dev/null 2>&1; then
-    echo "Verify agy wiring with:    ./run.sh doctor-agy-bridge"
-    echo "                           ./run.sh doctor-agy-statusline"
-    echo "                           ./run.sh doctor-agy-hooks"
+
+  # ── core bridge boundary ── deterministic preflight lives in `pnpm run
+  # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
+  # release-gate <scratch> --cut`. Setup is the install path, so it verifies the
+  # installed MCP bridge boundary only and does NOT run the legacy ACP/v1
+  # session-messaging/sentinel gates.
+  section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
+  if (validate_entwurf_bridge); then
+    setup_result core PASS "installed bridge boots and lists the exact v2 tool set"
+  else
+    setup_result core FAIL "installed bridge boundary did not validate (see above)"
+  fi
+
+  # ── computed summary (#86 C7/C8) ── the final verdict is DERIVED from the
+  # component outcomes above, never printed independently of them. A detected
+  # integration FAIL owns a nonzero exit while valid components stay installed;
+  # re-running the same setup is the documented repair action (idempotent).
+  section "setup summary (computed from component outcomes)"
+  local entry rest s_name s_verdict s_fails=""
+  for entry in "${SETUP_RESULTS[@]}"; do
+    s_name="${entry%%|*}"; rest="${entry#*|}"; s_verdict="${rest%%|*}"
+    printf '  %-14s %-4s %s\n' "$s_name" "$s_verdict" "${rest#*|}"
+    if [ "$s_verdict" = "FAIL" ]; then s_fails="$s_fails $s_name"; fi
+  done
+  echo ""
+  if [ -n "$s_fails" ]; then
+    echo "DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup."
+    return 1
   fi
+  echo "DONE: entwurf setup — result: green (computed from the component outcomes above)."
   echo "Run 'LIVE=1 ./run.sh release-gate <scratch> --cut' for live substrate acceptance (--cut refuses any MUST SKIP)."
 }
 
-# wire_agy_bridge — detection-gated, NON-FATAL agy (Antigravity) MCP bridge wiring, folded into
+# wire_agy_bridge — detection-gated agy (Antigravity) MCP bridge wiring, folded into
 # setup so a relocate/clone needs ONE idempotent command (막힘 ①). Mirrors the meta-bridge
 # block: agy on PATH → idempotent install-agy-bridge; no agy → honest skip, NO state ("있으면
-# 설정, 없으면 담아준다"). NON-FATAL by contract: agy is an OPTIONAL harness, so a refused/corrupt
-# agy config must NOT brick a pi/Claude setup — the hard gate is doctor-agy-bridge (issue #45:
-# the '?' surfaces in doctor, not by killing setup). WARNs are reason-specific so a transitional
-# symlink (someone else's SSOT) and a corrupt config (invalid JSON) are never conflated.
+# 설정, 없으면 담아준다"). A refused/corrupt agy config still never bricks the rest of setup —
+# later components are attempted — but it RETURNS 1 so the aggregate verdict records a named
+# component FAIL and setup exits non-green (#86 C6/C7: the old WARN-then-exit-0 posture was the
+# false-success shape). The hard per-leaf gate stays doctor-agy-bridge (issue #45). WARNs are
+# reason-specific so a transitional symlink (someone else's SSOT) and a corrupt config
+# (invalid JSON) are never conflated.
 wire_agy_bridge() {
   # Detection = the agy binary on PATH. AGY_BIN pins the target (default `agy`) so the
   # hermetic smoke can point at a fake agy or a definitely-absent path without depending on
@@ -4127,7 +4890,8 @@ wire_agy_bridge() {
     echo "[setup] agy bridge wired (idempotent). Verify with: ./run.sh doctor-agy-bridge"
     return 0
   fi
-  # NON-FATAL: keep setup alive, surface the reason honestly (never a silent pass).
+  # Keep setup alive for the remaining components, surface the reason honestly, and return 1
+  # so the aggregate verdict records this component as FAIL (never a silent pass).
   # ORDER MATTERS: the permission failures carry the same words as the mcp_config ones ("refused
   # (symlink)", "invalid JSON") and MUST be matched first — otherwise a settings.json problem gets
   # reported as an mcp_config problem and sends the operator to repair the wrong file.
@@ -4156,14 +4920,14 @@ wire_agy_bridge() {
       echo "[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# wire_agy_statusline — detection-gated, NON-FATAL agy statusLine wiring, folded into setup (#46
+# wire_agy_statusline — detection-gated agy statusLine wiring, folded into setup (#46
 # Task 1). Mirrors wire_agy_bridge: agy on PATH → idempotent install-agy-statusline; no agy →
-# honest skip, NO state. NON-FATAL by contract (agy is OPTIONAL — a refused/corrupt settings must
-# not brick a pi/Claude setup); the hard gate is doctor-agy-statusline. The renderer is the
-# stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
+# honest skip, NO state; a refused/corrupt settings keeps the rest of setup alive but returns 1
+# for a named component FAIL (#86 C6/C7). The hard gate is doctor-agy-statusline. The renderer
+# is the stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
 wire_agy_statusline() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
     echo "[setup] no agy on PATH — skipping agy statusLine wiring (no state; this host runs no Antigravity)"
@@ -4196,12 +4960,13 @@ wire_agy_statusline() {
       echo "[setup]       statusLine NOT wired; verify with ./run.sh doctor-agy-statusline. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# wire_agy_hooks — detection-gated, NON-FATAL agy PreInvocation imprint wiring. Same setup posture
-# as the MCP/statusLine adapters, but this one is the birth writer that turns statusLine '?' into a
-# garden id after the first invocation.
+# wire_agy_hooks — detection-gated agy PreInvocation imprint wiring. Same setup posture
+# as the MCP/statusLine adapters (skip on absence, named FAIL on detected incompleteness), but
+# this one is the birth writer that turns statusLine '?' into a garden id after the first
+# invocation.
 wire_agy_hooks() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
     echo "[setup] no agy on PATH — skipping agy hooks wiring (no state; this host runs no Antigravity)"
@@ -4232,30 +4997,39 @@ wire_agy_hooks() {
       echo "[setup]       Birth imprint NOT wired; verify with ./run.sh doctor-agy-hooks. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# expose_dev_bin — make the `entwurf-bridge` STABLE bin resolve for a DEV checkout (막힘 ②).
-# setup IS the dev install command (consumers get the bin from npm bin-linking), so setup owns a
-# managed ~/.local/bin/entwurf-bridge symlink into this checkout via scripts/dev-bin.sh, recorded
-# for an honest inverse (remove-dev-bin). NON-FATAL like wire_agy_bridge: a foreign bin already on
-# PATH (a real npm install) is REFUSED not clobbered, and a BIN_DIR off PATH only WARNs — neither
-# bricks setup. The hard gate stays doctor-agy-bridge (a missing/dangling bin FAILs there).
+# expose_dev_bin — make the package's stable commands resolve for a DEV checkout (막힘 ②).
+# setup IS the dev install command (consumers get these names from npm bin-linking), so setup owns
+# managed ~/.local/bin symlinks into this checkout via scripts/dev-bin.sh, each recorded for an
+# honest inverse. The set starts with `entwurf` → run.sh: Copilot fresh deliberately launches the
+# managed `entwurf copilot`, never the raw vendor. That operator command is CORE and is certified
+# after exposure by dev-bin.sh's own target authority: our symlink, our target, and the exact PATH
+# winner. A foreign/off-PATH/shadowed operator therefore fails setup (return 1). Helper units are
+# attempted INDEPENDENTLY by dev-bin.sh (#86 C10) and any refusal propagates as return 3 — the
+# aggregate verdict records it as a named FAIL instead of the old WARN-then-green; the refused
+# names are already printed truthfully by dev-bin's attempted/ok/refused summary.
 expose_dev_bin() {
-  section "dev bin: expose entwurf-bridge on PATH (dev checkout)"
+  section "dev bins: expose stable package commands on PATH (dev checkout)"
   local rc
   set +e
   bash "$REPO_DIR/scripts/dev-bin.sh" expose
   rc=$?
   set -e
+
+  if ! bash "$REPO_DIR/scripts/dev-bin.sh" verify entwurf; then
+    return 1
+  fi
+
   [ "$rc" -eq 0 ] && return 0
   if [ "$rc" -eq 3 ]; then
-    echo "[setup] WARN: entwurf-bridge is already on PATH as someone else's bin (not ours) — left as-is." >&2
-    echo "[setup]       If that is a stale/foreign bin, remove it and re-run setup. setup continues." >&2
+    echo "[setup] dev-bin: foreign helper bin path(s) refused, never clobbered — the refused names are in the summary above." >&2
+    echo "[setup]       Every unit was attempted independently; the source operator itself is certified." >&2
   else
-    echo "[setup] WARN: dev bin exposure did not complete (rc=$rc; see above). setup continues." >&2
+    echo "[setup] dev-bin: helper exposure did not complete (rc=$rc; see above)." >&2
   fi
-  return 0
+  return "$rc"
 }
 
 # release-gate — the single command that, when GREEN, is sufficient to cut
@@ -4677,6 +5451,18 @@ case "$cmd" in
   check-hook-launch-topology)
     check_hook_launch_topology
     ;;
+  check-copilot-birth-hook)
+    check_copilot_birth_hook
+    ;;
+  check-copilot-statusline)
+    check_copilot_statusline
+    ;;
+  check-copilot-launch)
+    check_copilot_launch
+    ;;
+  check-copilot-receive-arm)
+    check_copilot_receive_arm
+    ;;
   check-meta-capability-source)
     check_meta_capability_source
     ;;
@@ -4937,6 +5723,16 @@ case "$cmd" in
     # Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-install-state.sh)
     ;;
+  smoke-setup-verdict)
+    # #86 C1 aggregate setup verdict fixture — the first automated consumer of
+    # `entwurf setup` itself: all-absent SKIP/green, pi below-floor detected FAIL
+    # (never SKIP), pi-present wiring PASS, agy detected+corrupt named FAIL with
+    # NON-GREEN nonzero exit, installed-mode named branch before the bootstrap,
+    # and the credential store byte-identical in every cell. Sandboxed HOME/XDG/
+    # agent/dev-bin roots; presence pinned via PI_BIN/CLAUDE_BIN/AGY_BIN.
+    # Offline + deterministic (deps: bash+node+python3+pnpm).
+    (cd "$REPO_DIR" && bash scripts/smoke-setup-verdict.sh)
+    ;;
   check-agy-permission-matrix)
     # The agy permission engine's CONTRACT SPACE as a literal table (55 cells + stated
     # exclusions R2/R4-R7): parser-state × operation × settings × ownership × precedence.
@@ -4993,8 +5789,8 @@ case "$cmd" in
     # own the statusLine subtree WHOLE (preserve unrelated keys) + state (stable command, prior
     # subtree as preimage), doctor static-clean/live-SKIP (+live-consistent with a fake agy) /
     # drift-FAIL / dangling-command-FAIL / not-ours note, honest-inverse uninstall, symlink +
-    # dangling-symlink refuse, create-new inverse, the NON-FATAL wire wrapper, and checkout
-    # impurity 0. Offline + deterministic (deps: bash+python3).
+    # dangling-symlink refuse, create-new inverse, the truthful wire wrapper (detected refusal
+    # → nonzero, #86 C6/C7), and checkout impurity 0. Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-statusline-state.sh)
     ;;
   smoke-agy-hooks-state)
@@ -5024,8 +5820,10 @@ case "$cmd" in
     # 0.12.6 install-boundary gate: register-pi-package.py is the shared
     # packages[] SSOT for project/user install and remove; user scope makes
     # --entwurf-control load from any cwd. Idempotent, preserves unrelated
-    # packages/keys, normalizes stale entries, remove is symmetric, and corrupt
-    # settings fail loud. The tripwire the 2026-07-03 `pi install` removal lacked.
+    # packages/keys, remove is symmetric, corrupt settings fail loud; project
+    # scope normalizes ITS OWN stale entries while user scope carries the #86 C2
+    # explicit ownership contract (other owners refuse; takeover-user-scope moves).
+    # The tripwire the 2026-07-03 `pi install` removal lacked.
     (cd "$REPO_DIR" && bash scripts/smoke-user-scope-citizen.sh)
     ;;
   smoke-claude-native-resume-live)
@@ -5061,6 +5859,86 @@ case "$cmd" in
     # zero claude-code meta-records is a SILENT MISS -> non-zero exit.
     (cd "$REPO_DIR" && bash scripts/meta-bridge-doctor.sh "$@")
     ;;
+  install-copilot-bridge)
+    # #82: the Copilot BIRTH install. Deliberately not a mode of install-meta-bridge —
+    # it assembles its OWN marketplace root (the Claude assembler copies one plugin out
+    # of one root, so a shared marketplace.json would publish a missing `source`), it
+    # bakes node+entry into the launcher rather than into the manifest (Copilot's exec
+    # form is a single string with no argv beside it), and it wires NO MCP: a drain tool
+    # for a mailbox nothing rings would advertise delivery this backend does not have.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh "$@")
+    ;;
+  uninstall-copilot-bridge)
+    # #86 C3a: the package-owned inverse of install-copilot-bridge. The ownership state
+    # is the sole removal authority (exact qualified id, exact marketplace name+path,
+    # recorded assembly only); a failing vendor list is UNKNOWN and refuses; state is
+    # deleted LAST so any partial failure keeps a rerun-repair authority. Never touches
+    # the stale Claude unit and never uses --force.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-uninstall.sh "$@")
+    ;;
+  doctor-copilot-bridge)
+    # #82: the fail-loud surface for the Copilot unit. Its red conditions differ from
+    # the Claude doctor's on purpose: a Copilot session mints on its FIRST PROMPT, not
+    # at session open, so "installed with zero records" is reported as NOT-YET rather
+    # than as a silent miss. Red is a hook that RAN and failed.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-doctor.sh "$@")
+    ;;
+  install-copilot-statusline)
+    (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh install "$@")
+    ;;
+  uninstall-copilot-statusline)
+    (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh uninstall "$@")
+    ;;
+  doctor-copilot-statusline)
+    (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh doctor "$@")
+    ;;
+  smoke-copilot-statusline-state)
+    (cd "$REPO_DIR" && bash scripts/smoke-copilot-statusline-state.sh)
+    ;;
+  install-copilot-mcp)
+    (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh install "$@")
+    ;;
+  uninstall-copilot-mcp)
+    (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh uninstall "$@")
+    ;;
+  doctor-copilot-mcp)
+    (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh doctor "$@")
+    ;;
+  smoke-copilot-mcp-state)
+    (cd "$REPO_DIR" && bash scripts/smoke-copilot-mcp-state.sh)
+    ;;
+  copilot)
+    # #82 RAIL 7: the managed launch. `exec` and NO subshell/cd on purpose — the vendor
+    # must inherit this terminal exactly: the caller's cwd, this pid, this tty, and its own
+    # exit status. The sibling install/doctor verbs wrap themselves in `(cd "$REPO_DIR" && …)`
+    # because they operate on the repo; this one operates on the operator's session, and a
+    # subshell would make run.sh a parent that outlives nothing and owns nothing.
+    #
+    # `shift` is load-bearing here, not cosmetic: this dispatcher keeps the verb in "$@"
+    # and each branch drops it for itself. The neighbouring install/doctor verbs get away
+    # without one because their bridge scripts take a leading subcommand and ignore the
+    # trailing noise; this branch forwards straight into the VENDOR's argv, where a stray
+    # "copilot" would arrive as a prompt argument.
+    shift || true
+    exec bash "$REPO_DIR/scripts/copilot-launch.sh" "$@"
+    ;;
+  install-copilot-receive)
+    # #82 RAIL 5: install the RECEIVER extension into the Copilot USER extensions dir.
+    # Artifact ownership only — it sets no launch flag (`run.sh copilot` owns one
+    # invocation's environment; this owns the unit on disk), and it arms
+    # nothing by itself: a session arms after birth, on a CLI launched with
+    # COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS.
+    (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh install "$@")
+    ;;
+  uninstall-copilot-receive)
+    (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh uninstall "$@")
+    ;;
+  doctor-copilot-receive)
+    (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh doctor "$@")
+    ;;
   install-agy-bridge)
     # 봉인 7: the agy (Antigravity) MCP install ADAPTER (SEPARATE from the Claude
     # marketplace install — only runner/reporting is shared). Registers ONE entwurf-bridge
@@ -5085,11 +5963,12 @@ case "$cmd" in
     (cd "$REPO_DIR" && bash scripts/agy-bridge.sh doctor "$@")
     ;;
   wire-agy-bridge)
-    # 막힘 ①: the detection-gated, NON-FATAL setup wrapper around install-agy-bridge (agy on
-    # PATH → idempotent install; no agy → honest skip, no state). HIDDEN/internal — setup calls
-    # this; it is exposed as a subcommand only so smoke-agy-install-state can drive it
-    # deterministically. The hard gate stays doctor-agy-bridge (issue #45: the '?' is a doctor
-    # signal, not a setup-killer).
+    # 막힘 ①: the detection-gated, truthful setup wrapper around install-agy-bridge (agy on
+    # PATH → idempotent install; no agy → honest skip, no state; detected refusal/corrupt →
+    # reason-specific WARN + nonzero so the aggregate records a named component FAIL while later
+    # components stay attempted, #86 C6/C7). HIDDEN/internal — setup calls this; it is exposed
+    # as a subcommand only so smoke-agy-install-state can drive it deterministically. The hard
+    # per-leaf gate stays doctor-agy-bridge (issue #45).
     wire_agy_bridge
     ;;
   install-agy-statusline)
@@ -5157,9 +6036,10 @@ case "$cmd" in
     run_ts scripts/doctor-pi-provider.ts "$@"
     ;;
   wire-agy-statusline)
-    # #46 Task 1: the detection-gated, NON-FATAL setup wrapper around install-agy-statusline.
-    # HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can drive it
-    # deterministically. The hard gate stays doctor-agy-statusline.
+    # #46 Task 1: the detection-gated, truthful setup wrapper around install-agy-statusline
+    # (detected refusal/corrupt → WARN + nonzero, named component FAIL in the aggregate, #86
+    # C6/C7). HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can
+    # drive it deterministically. The hard per-leaf gate stays doctor-agy-statusline.
     wire_agy_statusline
     ;;
   wire-agy-hooks)
@@ -5167,14 +6047,16 @@ case "$cmd" in
     wire_agy_hooks
     ;;
   expose-dev-bin)
-    # 막힘 ②: expose the entwurf-bridge STABLE bin on PATH for a DEV checkout (a managed symlink
-    # into this checkout, recorded for an honest inverse). HIDDEN/internal — setup calls the
-    # NON-FATAL expose_dev_bin wrapper; exposed here so smoke-agy-install-state can drive the
-    # foreign-refuse WARN path. The exposure logic lives in scripts/dev-bin.sh.
+    # 막힘 ②: expose the stable package commands on PATH for a DEV checkout, including the
+    # `entwurf` operator command Copilot fresh resolves. HIDDEN/internal — setup requires the
+    # core operator certification and attempts every helper unit independently; a foreign helper
+    # propagates rc=3 as a named bins FAIL (#86 C10). Exposed here so the install smoke can
+    # drive ownership/refusal.
+    # The exposure logic lives in scripts/dev-bin.sh.
     expose_dev_bin
     ;;
   remove-dev-bin)
-    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed link + state (REFUSE if
+    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed links + states (REFUSE if
     # it became foreign). The raw script (no wrapper) so an operator sees a loud failure.
     shift || true
     (cd "$REPO_DIR" && bash scripts/dev-bin.sh remove "$@")
@@ -5316,6 +6198,9 @@ case "$cmd" in
   check-pack)
     check_pack
     ;;
+  check-pack-pin-matcher)
+    check_pack_pin_matcher
+    ;;
   check-pack-install)
     check_pack_install
     ;;
@@ -5329,9 +6214,6 @@ case "$cmd" in
     # from under node_modules rather than re-packing the installed copy.
     (cd "$REPO_DIR" && bash scripts/check-install-container.sh "$@")
     ;;
-  sync-auth)
-    sync_auth
-    ;;
   install)
     install_local_package "$TARGET_PROJECT_DIR"
     ;;
@@ -5341,6 +6223,17 @@ case "$cmd" in
   remove-user-scope)
     remove_user_scope_citizen
     ;;
+  takeover-user-scope)
+    # #86 C2: operator-explicit ownership move — the ONLY writer allowed to replace
+    # another root's user-scope registration (normal install/setup/remove refuse).
+    takeover_user_scope
+    ;;
+  doctor-pi-package)
+    # #86 C2: package-side ownership verdict (unregistered/owned/owned-by-other/
+    # legacy-no-state/mismatch/missing-owner). Provider runtime stays with
+    # doctor-pi-provider — the two doctors are deliberately not mixed.
+    doctor_pi_package
+    ;;
   -h|--help|help|"")
     usage
     ;;