@junghanacs/entwurf 0.15.0 → 0.15.1

package/run.sh

@@ -119,7 +119,7 @@ run_vitest() {
 usage() {
   cat <<'EOF'
 Usage:
-  ./run.sh setup [project-dir]        # ONE confident install: pnpm install + install + meta-bridge (if native harness) + v2 install smoke (LIVE substrate = release-gate)
+  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
@@ -181,7 +181,8 @@ Usage:
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
   ./run.sh check-meta-doctor-oracle   # 0.12.8 (#51): detection power of the release ORACLE — healthy fixture must reach `doctor: PASS`, then 21 planted defects (retired shell form, partial hand-patch, launcher bypass/repoint/provenance loss, malformed exec args, owner type drift, extra leaf/group, doorbell asyncRewake/path/timeout, no live bridge, stale receiver, ambiguous/missing cache, missing hook log/writer, failing CLI probes) must each turn it FAIL naming their own cause, plus a positive case pinning that a long-writing CLI is NOT a false negative. Offline/deterministic (deps: bash+node+python3)
-  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
+  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, truthful setup outcomes. Offline/deterministic
+  ./run.sh smoke-setup-verdict        # #86 C1+C3b aggregate setup verdict fixture: all-absent SKIP/green, pi presence+floor, detected-FAIL nonzero, copilot four-unit composition (present=independent PASS/FAIL rows, absent=zero-state SKIP), installed-mode named branch, credential store untouched. Offline/deterministic
   ./run.sh check-agy-permission-matrix # AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
@@ -192,7 +193,7 @@ Usage:
   ./run.sh smoke-copilot-statusline-state # Copilot custom-footer install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-copilot-mcp-state       # Copilot MCP install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
-  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry). Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
@@ -203,7 +204,8 @@ Usage:
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is not yet verified/certified and stays nonzero for this cut (future validation may reopen it). Detection power is held by check-meta-doctor-oracle
   ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
   ./run.sh install-copilot-bridge     # #82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)
-  ./run.sh doctor-copilot-bridge      # #82: fail-loud surface for that unit. Red = a hook that RAN and failed, or a broken/unbaked artifact. "Installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens (measured)
+  ./run.sh uninstall-copilot-bridge   # #86 C3a: honest inverse of install-copilot-bridge from the package-owned install-state (exact qualified id + exact marketplace name/path + recorded assembly only; state deleted LAST; a failing vendor list is UNKNOWN and refuses; never --force, never the stale Claude unit)
+  ./run.sh doctor-copilot-bridge      # #82/#86: fail-loud surface for that unit — runtime axis (red = a hook that RAN and failed, or a broken/unbaked artifact; "installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens, measured) + ownership axis (install-state shape/binding, marketplace path drift, UNKNOWN vendor lists; legacy no-state install = named non-green, repair = install-copilot-bridge adoption). Either axis red = red
   ./run.sh install-copilot-statusline # own Copilot statusLine + footer.showCustom with an install-state preimage
   ./run.sh uninstall-copilot-statusline # honest inverse of install-copilot-statusline
   ./run.sh doctor-copilot-statusline  # static ownership/config/bin doctor; never claims a render receipt
@@ -233,12 +235,13 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.30 must leak, @0.84.3 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
-  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (0.82.x) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
+  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
-  ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
   ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
-  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project)
+  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
+  ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
+  ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
 
 Notes:
   - project-dir defaults to current directory
@@ -268,44 +271,12 @@ print(os.path.abspath(os.path.expanduser(sys.argv[1])))
 PY
 }
 
-sync_auth() {
-  local auth_path="$HOME/.pi/agent/auth.json"
-  python3 - "$auth_path" "$PROVIDER_ID" <<'PY'
-import json, os, sys
-from pathlib import Path
-
-auth_path = Path(sys.argv[1]).expanduser()
-provider_id = sys.argv[2]
-auth_path.parent.mkdir(parents=True, exist_ok=True)
-
-if auth_path.exists():
-    data = json.loads(auth_path.read_text())
-    if not isinstance(data, dict):
-        raise SystemExit("auth.json is not an object")
-else:
-    data = {}
-
-anthropic = data.get("anthropic")
-if not isinstance(anthropic, dict):
-    print("sync-auth: skipped (no anthropic OAuth credentials in ~/.pi/agent/auth.json)")
-    raise SystemExit(0)
-
-before = json.dumps(data.get(provider_id), sort_keys=True)
-after = json.dumps(anthropic, sort_keys=True)
-if before == after:
-    print(f"sync-auth: already synced ({provider_id})")
-    raise SystemExit(0)
-
-data[provider_id] = anthropic
-backup = auth_path.with_suffix(auth_path.suffix + ".bak")
-if auth_path.exists():
-    backup.write_text(auth_path.read_text())
-auth_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"sync-auth: wrote {provider_id} alias to {auth_path}")
-if backup.exists():
-    print(f"sync-auth: backup -> {backup}")
-PY
-}
+# The old `sync_auth` credential mutation is GONE (#86 A5): setup composes what
+# the operator already installed and NEVER reads, copies, aliases or backs up a
+# harness credential store — the `entwurf` alias it wrote had no in-repo reader
+# (the ACP provider passes pi's auth check with the no-auth sentinel), and the
+# `auth.json.bak` it left is documented manual-operator-cleanup ONLY. Do not
+# reintroduce credential copying as a convenience helper in any install path.
 
 # Repo dependency integrity is a HARD requirement for install — NOT gated on
 # backend (Claude/ACP) auth. A cloned-but-not-installed or a moved/renamed repo
@@ -514,6 +485,14 @@ PY
 }
 
 install_local_package() {
+  # Named interpreter prerequisite BEFORE any preflight/write (#86 E5): the
+  # packages[]/provider writers below are python3-backed and `entwurf install`
+  # dispatches here directly, so a python3-less host gets this verdict instead
+  # of an accidental mid-write failure.
+  command -v python3 >/dev/null 2>&1 || {
+    echo "[install] entwurf install requires python3 on PATH (settings writers are python3-backed); nothing was written." >&2
+    exit 1
+  }
   local project_dir agent_dir
   project_dir=$(normalize_project_dir "$1")
   agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
@@ -553,19 +532,79 @@ install_local_package() {
 # launchers and the npm consumer's "installs → just works" both need the entry
 # in ~/.pi/agent/settings.json's packages[]. This is the wiring that dropped when
 # `pi install` was removed from setup (2026-07-03: `--entwurf-control` unknown in
-# a foreign cwd). Idempotent: absent → append, present → no-op; a stale entwurf
-# entry at a different path is normalized to REPO_DIR. Every other package and key
-# in the operator's user settings is preserved untouched.
+# a foreign cwd). Idempotent for THIS root: absent → append + owner state, present
+# same-root → no-op. #86 C2 retires the silent normalization of other roots'
+# entries: a different owner (live or missing) is a zero-write refusal that names
+# takeover-user-scope. Every other package and key is preserved untouched.
+_pi_package_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-package/install-state.json"; }
+_pi_provider_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"; }
+
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR"
+  # #86 C2: user scope carries a recorded OWNER (packageRoot in the pi-package
+  # install-state). Another owner — live or missing — makes this a zero-write
+  # ownership refusal (exit 6) that propagates: install fails, setup records the
+  # pi component FAIL. The only writer over another owner is takeover-user-scope.
+  #
+  # ATOMIC (#86 C2 amendment): BOTH ownership halves are decided READ-ONLY before
+  # either writer runs — a provider-side refusal must leave the package side
+  # byte-identical (and vice versa), never a half-installed user scope.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)"
   # #46 Task 2: own entwurfProvider.mcpServers.entwurf-bridge as the bare stable bin at USER scope
   # (GLOBAL/durable →파급s to every cwd), so its inverse needs an install-state honest inverse
   # under $XDG_DATA_HOME/entwurf/pi-provider/ (Task 0/1 discipline). project scope is checkout-
   # local and covered by `run.sh remove` (no state) — deliberate, reasoned asymmetry.
-  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+  # #86 C2: the provider state records installerRoot, so the same foreign-owner refusal
+  # holds here — and the package refusal above fires FIRST, before any provider write.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)"
+}
+
+# takeover-user-scope — the operator-explicit ownership move (#86 C2). The ONLY
+# writer that replaces another root's user-scope registration: normal install/
+# setup/remove refuse instead. Reports old→new for both the packages[] entry
+# (packageRoot) and the provider key (installerRoot). No --force variant exists.
+takeover_user_scope() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}" pp_out
+  command -v python3 >/dev/null 2>&1 || { echo "[takeover] requires python3 on PATH; nothing was written." >&2; exit 1; }
+  section "takeover-user-scope: move the shared user-scope registration to this root"
+  # ATOMIC (#86 C2 amendment): both halves decided READ-ONLY first — an exact-entry
+  # mismatch on the package side or a refusal on the provider side leaves the other
+  # half byte-identical.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --takeover --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --takeover --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --takeover
+  pp_out=$(python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --takeover)
+  printf '%s\n' "$pp_out"
+  # Split verdict (#86 C2 amendment): a user-override provider key is preserved and
+  # stays UNOWNED — say exactly which half moved instead of a false "both owned".
+  if printf '%s' "$pp_out" | grep -q 'provider override preserved'; then
+    ok "takeover-user-scope: package owner moved to this root ($REPO_DIR); provider key preserved as the operator's override (unowned — doctor-pi-provider reports it as such)"
+  else
+    ok "takeover-user-scope: this root now owns the user-scope registration ($REPO_DIR)"
+  fi
+}
+
+# doctor-pi-package — package-side ownership verdict only (#86 C2): unregistered /
+# owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner.
+# Deliberately NOT mixed into doctor-pi-provider (provider runtime verdicts stay there).
+doctor_pi_package() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  command -v python3 >/dev/null 2>&1 || { echo "[doctor-pi-package] requires python3 on PATH." >&2; exit 1; }
+  # #86 C2 amendment: the provider state rides along for the OWNERSHIP coupling
+  # verdict only (installerRoot vs packageRoot mismatch = FAIL); provider RUNTIME
+  # verdicts stay with doctor-pi-provider.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --provider-state "$(_pi_provider_state)" --doctor
 }
 
 # The honest inverse of register_user_scope_citizen: drop entwurf from the GLOBAL
@@ -581,11 +620,54 @@ register_user_scope_citizen() {
 # reported rather than deleted — install never writes that form (#53 B).
 remove_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" --remove
+  local pkg_state pp_state orphan_args=()
+  pkg_state="$(_pi_package_state)"; pp_state="$(_pi_provider_state)"
+  # #86 C2 aligned orphan path: --orphan-cleanup is passed ONLY when the package
+  # entry, the package state's packageRoot and the provider state's installerRoot
+  # all name the SAME root and that root is MISSING on disk. Any live foreign
+  # owner, or any mismatch between the three, refuses inside the SSOTs instead.
+  if python3 - "$agent_dir/settings.json" "$pkg_state" "$pp_state" <<'PY'
+import json, os, sys
+settings_path, pkg_state_path, pp_state_path = sys.argv[1:4]
+def load(p):
+    try:
+        with open(p) as fh: return json.load(fh)
+    except (OSError, json.JSONDecodeError): return None
+pkg = load(pkg_state_path)
+if not isinstance(pkg, dict) or not isinstance(pkg.get("packageRoot"), str): sys.exit(1)
+owner = pkg["packageRoot"]
+if os.path.isdir(owner): sys.exit(1)                      # live owner: never orphan
+# Alignment REQUIRES the provider state to exist AND to be bound to the same
+# missing root (#86 C2 amendment): an absent, legacy (no installerRoot) or
+# elsewhere-bound provider state is NOT alignment — both sides refuse instead.
+pp = load(pp_state_path)
+if not isinstance(pp, dict): sys.exit(1)
+if pp.get("installerRoot") != owner: sys.exit(1)
+settings = load(settings_path)
+pkgs = settings.get("packages") if isinstance(settings, dict) else None
+if not isinstance(pkgs, list): sys.exit(1)
+def src(x): return x.get("source") if isinstance(x, dict) else x
+if not any(isinstance(src(x), str) and src(x).rstrip("/") == owner for x in pkgs): sys.exit(1)
+sys.exit(0)
+PY
+  then
+    orphan_args=(--orphan-cleanup)
+    log "remove-user-scope: package entry + package state + provider installerRoot align on a MISSING owner — reported orphan cleanup"
+  fi
+  # ATOMIC (#86 C2 amendment): both removal halves are decided READ-ONLY first, so
+  # a provider-side refusal (live-other, legacy, mismatch) leaves the package
+  # entry/state byte-identical instead of a half-removed user scope.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pkg_state" --remove ${orphan_args[@]+"${orphan_args[@]}"} --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pp_state" ${orphan_args[@]+"${orphan_args[@]}"} --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pkg_state" --remove ${orphan_args[@]+"${orphan_args[@]}"}
   # #46 Task 2: honest inverse of the user-scope entwurfProvider ownership — the install-state
   # drives it (absent/managed-* → remove OUR key; a user-override we never owned is untouched).
-  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+  # #86 C2: installerRoot makes this same-owner-only; the aligned orphan flag rides along.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pp_state" ${orphan_args[@]+"${orphan_args[@]}"}
 }
 
 # The ~/.pi/agent/entwurf-targets.json symlink machinery (ensure_agent_dir_symlinks
@@ -2839,6 +2921,8 @@ check_pack() {
     "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
     "pi-extensions/meta-bridge-hook-copilot.ts"
     "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-uninstall.sh"
+    "scripts/copilot-bridge-oracle.sh"
     "scripts/copilot-bridge-doctor.sh"
     # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
     # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
@@ -3089,6 +3173,8 @@ _check_pack_install_impl() {
     "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
     "pi-extensions/meta-bridge-hook-copilot.ts"
     "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-uninstall.sh"
+    "scripts/copilot-bridge-oracle.sh"
     "scripts/copilot-bridge-doctor.sh"
     # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
     # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
@@ -3144,9 +3230,9 @@ _check_pack_install_impl() {
   # to our pnpm-workspace.yaml; --ignore-scripts blocks the husky
   # prepare hook (and any future install scripts) from running inside
   # the consumer project. Peer deps are pinned to the CURRENT pi release
-  # baseline (0.82.x — the pins below are what check-dep-versions binds to
-  # the package.json devDep) so the smoke matches the same shape an external
-  # pi user would have after `pi install`.
+  # baseline (the package.json devDep pin — the pins below are what
+  # check-dep-versions binds to that devDep) so the smoke matches the same
+  # shape an external pi user would have after `pi install`.
   local tmp npm_tmp
   tmp=$(mktemp -d -t entwurf-install-smoke.XXXXXX)
   # Separate tree for the npm-managed regression below: npm install must NOT be
@@ -3414,6 +3500,230 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
   fi
   echo "[check-pack-install] user-scope citizen regression pass (npm consumer: --entwurf-control loads from a foreign cwd)"
 
+  # Two-root ownership row (#86 C2, L1b extension): a SECOND npm root under the
+  # SAME consumer HOME must not silently steal the user-scope registration the
+  # first root owns — normal install refuses (naming takeover-user-scope) and the
+  # operator-explicit takeover is what moves the shared entry, old→new reported.
+  local npmroot2="$npm_tmp/npmroot2" npmproj2="$npm_tmp/npmproj2" npm2_log two_root_out two_root_rc npm2_pkg
+  mkdir -p "$npmroot2" "$npmproj2"
+  npm2_log=$(cd "$npmroot2" && npm install "$tgz_path" --no-audit --no-fund 2>&1) || {
+    fail "[check-pack-install] second npm root install failed:"
+    echo "$npm2_log" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  }
+  npm2_pkg="$npmroot2/node_modules/@junghanacs/entwurf"
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" install "$npmproj2" 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -eq 0 ] || ! grep -q "takeover-user-scope" <<<"$two_root_out"; then
+    fail "[check-pack-install] a second npm root's normal install must REFUSE the owned user-scope registration and name takeover-user-scope (rc=$two_root_rc):"
+    echo "$two_root_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+ok_a=any(isinstance(s,str) and s.rstrip('/')== '$npm_pkg' for s in srcs)
+bad_b=any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs)
+sys.exit(0 if ok_a and not bad_b else 1)
+"; then
+    fail "[check-pack-install] the refused second-root install still altered the user-scope packages[] entry:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" takeover-user-scope 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -ne 0 ] || ! grep -q "takeover: user-scope entwurf registration moved" <<<"$two_root_out"; then
+    fail "[check-pack-install] explicit takeover-user-scope from the second root failed (rc=$two_root_rc):"
+    echo "$two_root_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+ok_b=any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs)
+bad_a=any(isinstance(s,str) and s.rstrip('/')== '$npm_pkg' for s in srcs)
+sys.exit(0 if ok_b and not bad_a else 1)
+"; then
+    fail "[check-pack-install] takeover did not move the user-scope entry old→new:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  # #86 C2 amendment: BOTH ownership halves moved — the provider installerRoot must
+  # now name the new root, and the OLD root's inverse must refuse (live foreign owner).
+  if ! python3 -c "
+import json,sys
+st=json.load(open('$npmhome/.local/share/entwurf/pi-provider/install-state.json'))
+sys.exit(0 if st.get('installerRoot','').rstrip('/')== '$npm2_pkg' else 1)
+"; then
+    fail "[check-pack-install] takeover did not rebind the provider installerRoot to the new root:"
+    sed 's/^/    /' "$npmhome/.local/share/entwurf/pi-provider/install-state.json" >&2
+    return 1
+  fi
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" remove-user-scope 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -eq 0 ] || ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs) else 1)
+"; then
+    fail "[check-pack-install] the OLD root's remove-user-scope must refuse after takeover (rc=$two_root_rc) and leave the new owner's entry intact:"
+    echo "$two_root_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] two-root ownership row pass (second root: normal install refused naming takeover-user-scope; explicit takeover moved entry + provider installerRoot old->new; old root's inverse refused)"
+
+  # Installed-package aggregate `setup` row (#86 C1, review blocker 2026-08-26):
+  # the composed public command itself, driven through the consumer bin from the
+  # SAME installed candidate, on a FRESH sandbox home with every harness absent.
+  # This is the first living consumer of package-installed `entwurf setup`:
+  # mode=installed decided by name before anything else, NO pnpm bootstrap inside
+  # node_modules, pi/claude/agy explicit zero-state SKIPs, stable bins PASS as
+  # npm-provided, core bridge boundary PASS, computed green, zero harness/auth
+  # writes. Harness probes are pinned absent via the PI_BIN/CLAUDE_BIN/AGY_BIN/
+  # COPILOT_BIN seams so the gate host's real harnesses never leak in.
+  local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
+  mkdir -p "$setup_home/.pi/agent" "$setup_proj"
+  setup_auth="$setup_home/.pi/agent/auth.json"
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "consumer-oauth-token"\n  }\n}\n' > "$setup_auth"
+  local setup_auth_before
+  setup_auth_before="$(sha256sum "$setup_auth" | cut -d' ' -f1)"
+  set +e
+  setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
+    XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
+    PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" \
+    "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
+  setup_rc=$?
+  set -e
+  if [ "$setup_rc" -ne 0 ]; then
+    fail "[check-pack-install] installed all-absent setup exited $setup_rc — core must stay green with every harness absent, and an installed package must never re-enter the source pnpm bootstrap:"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! head -n 1 <<<"$setup_out" | grep -q "mode: installed package"; then
+    fail "[check-pack-install] installed setup did not name its mode FIRST:"
+    echo "$setup_out" | head -5 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if grep -Eqi "pnpm install|Lockfile is up to date|Progress: resolved" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup reached the source pnpm bootstrap inside node_modules:"
+    echo "$setup_out" | grep -Ei "pnpm|Lockfile|Progress" | sed 's/^/    /' >&2
+    return 1
+  fi
+  local skip_probe
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP"; do
+    if ! grep -q "$skip_probe" <<<"$setup_out"; then
+      fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
+      echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if ! grep -q "bins: PASS — provided by npm bin linking" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup must report stable bins PASS as npm-provided (capability present, not absent):"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! grep -q "core: PASS" <<<"$setup_out" || ! grep -q "result: green (computed from the component outcomes above)" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup core/computed-green missing:"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ]; then
+    fail "[check-pack-install] installed all-absent setup wrote harness state (must be zero-write)"
+    return 1
+  fi
+  if [ "$(sha256sum "$setup_auth" | cut -d' ' -f1)" != "$setup_auth_before" ] || [ -e "$setup_auth.bak" ]; then
+    fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
+    return 1
+  fi
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 4x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+
+  # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
+  # bin on a fresh sandbox home, with the shared fake vendor
+  # (scripts/fake-copilot-vendor.sh) on PATH. The presence-driven composition
+  # must run all FOUR Copilot units from the installed package: birth assembles
+  # the COMPILED hook (no raw .ts under node_modules) and drives the real
+  # marketplace-add→plugin-install sequence, MCP + receiver + footer land their
+  # configs/units in the sandbox, each unit keeps its package-owned
+  # install-state (its inverse authority), and the verdict is computed green.
+  local cop_setup_home="$npm_tmp/copsetuphome" cop_setup_proj="$npm_tmp/copsetupproj" cop_fake="$npm_tmp/fake-copilot-vendor"
+  mkdir -p "$cop_setup_home/.pi/agent" "$cop_setup_proj"
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "consumer-oauth-token"\n  }\n}\n' > "$cop_setup_home/.pi/agent/auth.json"
+  local cop_auth_before
+  cop_auth_before="$(sha256sum "$cop_setup_home/.pi/agent/auth.json" | cut -d' ' -f1)"
+  # EXECUTED, never sourced: this impl holds a `trap … RETURN`, and bash fires a
+  # RETURN trap when a sourced script finishes — a `. factory` here deleted the
+  # whole npm sandbox mid-gate (measured 2026-08-27, C3b review).
+  bash "$REPO_DIR/scripts/fake-copilot-vendor.sh" "$cop_fake" "$npm_pkg/pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json" || {
+    fail "[check-pack-install] could not build the fake copilot vendor from the PACKED plugin.json (is pi/meta-bridge-copilot missing from the tarball?)"
+    return 1
+  }
+  set +e
+  setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
+    XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
+    PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
+    "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
+  setup_rc=$?
+  set -e
+  if [ "$setup_rc" -ne 0 ]; then
+    fail "[check-pack-install] installed copilot-present setup exited $setup_rc — the four-unit composition must be green against the fake vendor:"
+    echo "$setup_out" | tail -30 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_row
+  for cop_row in "copilot-birth: PASS" "copilot-mcp: PASS" "copilot-receive: PASS" "copilot-statusline: PASS"; do
+    if ! grep -q "$cop_row" <<<"$setup_out"; then
+      fail "[check-pack-install] installed copilot-present setup missing unit verdict '$cop_row':"
+      echo "$setup_out" | tail -30 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if ! grep -q "result: green (computed from the component outcomes above)" <<<"$setup_out"; then
+    fail "[check-pack-install] installed copilot-present setup did not compute green:"
+    echo "$setup_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_setup_asm="$cop_setup_home/.local/share/entwurf/meta-bridge-copilot/.assembled/entwurf-meta-receive-copilot"
+  if [ ! -f "$cop_setup_asm/meta-bridge-hook-copilot.js" ] || [ -f "$cop_setup_asm/meta-bridge-hook-copilot.ts" ]; then
+    fail "[check-pack-install] installed copilot-present setup did not assemble the compiled birth hook (want meta-bridge-hook-copilot.js, no raw .ts) in $cop_setup_asm"
+    return 1
+  fi
+  if ! grep -q "^plugin marketplace add " "$cop_fake/calls.log" || ! grep -q "^plugin install entwurf-meta-receive-copilot@meta-bridge-copilot-local$" "$cop_fake/calls.log"; then
+    fail "[check-pack-install] installed copilot-present setup did not drive the vendor sequence (marketplace add + plugin install) — calls:"
+    sed 's/^/    /' "$cop_fake/calls.log" >&2
+    return 1
+  fi
+  if [ ! -f "$cop_setup_home/.copilot/extensions/entwurf-receive/extension.mjs" ] || [ ! -f "$cop_setup_home/.copilot/extensions/entwurf-receive/lib/meta-session.js" ]; then
+    fail "[check-pack-install] installed copilot-present setup did not deploy the receiver unit from the shipped dist closure"
+    return 1
+  fi
+  if ! grep -q "entwurf-bridge" "$cop_setup_home/.copilot/mcp-config.json" || ! grep -q "entwurf-copilot-statusline" "$cop_setup_home/.copilot/settings.json"; then
+    fail "[check-pack-install] installed copilot-present setup did not land the MCP config / footer settings in the sandbox home"
+    return 1
+  fi
+  local cop_state
+  for cop_state in copilot-bridge copilot-mcp copilot-receive copilot-statusline; do
+    if [ ! -f "$cop_setup_home/.local/share/entwurf/$cop_state/install-state.json" ]; then
+      fail "[check-pack-install] installed copilot-present setup left no package-owned install-state for $cop_state (its inverse authority)"
+      return 1
+    fi
+  done
+  if [ "$(sha256sum "$cop_setup_home/.pi/agent/auth.json" | cut -d' ' -f1)" != "$cop_auth_before" ] || [ -e "$cop_setup_home/.pi/agent/auth.json.bak" ]; then
+    fail "[check-pack-install] installed copilot-present setup touched the credential store (byte drift or .bak)"
+    return 1
+  fi
+  echo "[check-pack-install] installed copilot-present setup pass (four units PASS with install-states, compiled birth hook, vendor sequence driven, computed green, credentials untouched)"
+
   # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
   # bake versioned pnpm-store paths into Claude settings. MCP already uses the
   # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
@@ -4226,24 +4536,109 @@ check_bridge() {
 }
 
 
-# setup_all — full entwurf v2 install.
+# ── setup verdict engine (#86 C1) ────────────────────────────────────────────
+# setup composes harnesses the operator ALREADY installed. Per component the
+# verdict is PASS (detected + completed), SKIP (truly absent — zero state
+# written), or FAIL (detected but incomplete/below-floor/refused). The final
+# summary and exit status are COMPUTED from these outcomes: core survival never
+# relabels a detected harness failure as green, and a FAIL owns a nonzero setup
+# result while every valid earlier write stays installed (re-running setup is
+# the documented repair action).
+SETUP_RESULTS=()
+setup_result() {  # $1=component $2=PASS|SKIP|FAIL $3=detail
+  SETUP_RESULTS+=("$1|$2|$3")
+  case "$2" in
+    PASS) ok "$1: PASS — $3" ;;
+    SKIP) log "$1: SKIP — $3" ;;
+    *)    fail "$1: FAIL — $3" ;;
+  esac
+}
+
+# Installed-vs-source is decided by PACKAGE LOCATION — the same `*/node_modules/*`
+# seam run_ts and the bridge launcher already branch on — never by which of
+# pnpm/pi happens to be missing (an accidental failure is not a mode gate).
+setup_mode() {
+  case "$REPO_DIR" in
+    */node_modules/*) echo installed ;;
+    *) echo source ;;
+  esac
+}
+
+# Supported pi range, derived at runtime from the package.json devDependencies
+# pin (the SSOT check-dep-versions binds: peer range == `>=<pin> <0.<minor+1>`).
+# Never retyped here as a second literal.
+pi_supported_range() {
+  node -e '
+    const pkg = require(process.argv[1]);
+    const pin = pkg.devDependencies?.["@earendil-works/pi-coding-agent"];
+    if (!/^0\.\d+\.\d+$/.test(pin ?? "")) { console.error(`unparseable pi pin: ${pin}`); process.exit(1); }
+    const [, min] = pin.split(".").map(Number);
+    console.log(`>=${pin} <0.${min + 1}`);
+  ' "$REPO_DIR/package.json"
+}
+
+pi_version_in_range() {  # $1=detected version  $2=range ">=a.b.c <x.y"; exit 0 in-range
+  node -e '
+    const [ver, range] = process.argv.slice(1);
+    const m = range.match(/^>=(\d+)\.(\d+)\.(\d+) <(\d+)\.(\d+)$/);
+    const v = ver.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!m || !v) process.exit(2);
+    const [maj, min, pat] = v.slice(1).map(Number);
+    const lo = m.slice(1, 4).map(Number);
+    const hi = m.slice(4, 6).map(Number);
+    const geFloor = maj > lo[0] || (maj === lo[0] && (min > lo[1] || (min === lo[1] && pat >= lo[2])));
+    const ltCeil = maj < hi[0] || (maj === hi[0] && min < hi[1]);
+    process.exit(geFloor && ltCeil ? 0 : 1);
+  ' "$1" "$2"
+}
+
+# setup_all — one-command presence-driven composition (#86).
 #
-# Installs the v2 dispatch substrate + MCP entwurf-bridge into a target project
-# and verifies the installed bridge boundary. ACP/v1 backend interview gates are
-# deliberately not part of setup on v2-only; the heavier live v2 substrate proof
-# is release-gate's job.
+# Entwurf installs itself only: this command completes the integration of each
+# harness the operator already installed and NEVER installs a harness binary,
+# subscription, credential or login — `pi` has no privileged exception. It
+# verifies the installed bridge boundary; ACP/v1 backend interview gates are
+# deliberately not part of setup on v2-only (the heavier live v2 substrate
+# proof is release-gate's job). Copilot's four native units (birth / MCP /
+# receiver / visible footer) compose presence-driven since the birth inverse
+# landed (#86 C3a→C3b); the explicit install-copilot-* / uninstall-copilot-*
+# surfaces remain the operator-selected repair and inverse path.
 #
 # An external harness that consumes entwurf (e.g. agent-config as a
 # pi package + skills set) may still have its own install/setup for its
 # own concerns; those are outside the scope of this script.
 setup_all() {
+  # MODE FIRST (#86 C1): the installed-vs-source branch is a NAMED decision
+  # ahead of every prerequisite check and write, so an installed consumer is
+  # never mode-gated by an accidental missing `pnpm`/`pi`.
+  local mode
+  mode=$(setup_mode)
+  case "$mode" in
+    installed)
+      echo "[setup] mode: installed package — composition only (no source bootstrap; setup never runs npm/pnpm inside node_modules)" ;;
+    *)
+      echo "[setup] mode: source checkout — repo dev bootstrap, then the same composition semantics" ;;
+  esac
+
+  # Named interpreter prerequisite, decided BEFORE any write (#86 C1/E5):
+  # setup's project-path normalization and every pi/agy wiring writer are
+  # python3-backed today. `entwurf --help` / `entwurf check-bridge` stay
+  # python3-free; only the commands that invoke those writers declare it.
+  command -v python3 >/dev/null 2>&1 || {
+    echo "[setup] entwurf setup requires python3 on PATH (project-path normalization + wiring writers)." >&2
+    echo "[setup] Install python3, or use python3-free surfaces (--help, check-bridge)." >&2
+    exit 1
+  }
+  require_cmd node
+
   local project_dir
   project_dir=$(normalize_project_dir "$1")
 
-  require_cmd pnpm
-  require_cmd python3
-  require_cmd pi
-  require_cmd node
+  if [ "$mode" = "source" ]; then
+    # Source-only dev fixtures: the pinned repo dependencies are build/test
+    # fixtures, never a product promise that consumers receive them (#86 A4).
+    require_cmd pnpm
+  fi
 
   # Node 24+ is the SINGLE supported axis (GLG, 2026-07-21). The floor is not
   # derived from a feature gate: type-stripping alone would only demand 23.6.
@@ -4264,81 +4659,217 @@ setup_all() {
   echo "[setup] scope:   entwurf v2 package + detected native-harness bridges + pi adapter"
   echo "[setup] verification: v2 install smoke (entwurf-bridge; LIVE substrate = release-gate)"
 
-  # Store gate FIRST — ahead of pnpm install, sync_auth (which creates and
-  # rewrites ~/.pi/agent/auth.json) and every settings writer below. On an
-  # existing development host this is the only step standing between a `git pull`
-  # and a V3-only activation over a store the live schema cannot read; putting
-  # it inside install_local_package would already be one auth.json write too
-  # late. The store-doctor imports repo-local libs and node builtins only, so it
-  # runs before dependencies exist.
+  # Store gate FIRST — ahead of the source bootstrap and every settings writer
+  # below. On an existing development host this is the only step standing
+  # between a `git pull` and a V3-only activation over a store the live schema
+  # cannot read; putting it inside install_local_package would already be one
+  # write too late. The store-doctor imports repo-local libs and node builtins
+  # only, so it runs before dependencies exist.
   preflight_v3_store setup
 
-  (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
-  sync_auth
-  install_local_package "$project_dir"
-
-  # Single confident install command (GLG 2026-06-23): setup ALSO wires the
-  # native-harness meta-bridge, so a relocate/clone needs ONE command — not the
-  # install + install-meta-bridge two-pronged split that froze the Claude
-  # statusLine on the old path (the 2026-06-23 relocation gap). Detection-gated:
-  # a pi-only host with no native harness skips it cleanly (rail “Shipped adapters” — "있으면 설정,
-  # 없으면 담아준다"); meta-bridge-install.sh is itself idempotent.
-  if command -v claude >/dev/null 2>&1; then
+  SETUP_RESULTS=()
+
+  if [ "$mode" = "source" ]; then
+    # Source bootstrap is the ONLY install-mode difference (#86): the pinned
+    # repo dev dependencies are fixtures this checkout builds/tests with. A
+    # broken bootstrap is a broken checkout — crash, don't degrade.
+    (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
+  fi
+
+  # ── pi (presence + floor, #86 C1/C9) ── pi is OPTIONAL-BY-PRESENCE: absent is
+  # an explicit zero-state SKIP (setup never installs pi and writes no Pi
+  # wiring), below-floor/unreadable is detected-incomplete FAIL — never a SKIP,
+  # so a stale pi is told the truth instead of being silently skipped. PI_BIN
+  # pins the probe for the hermetic smoke (same seam as AGY_BIN); production
+  # leaves it unset.
+  local pi_bin="${PI_BIN:-pi}" pi_range pi_ver
+  if ! command -v "$pi_bin" >/dev/null 2>&1; then
+    setup_result pi SKIP "pi not on PATH — zero Pi wiring written (the operator installs pi; setup never does)"
+  else
+    pi_range=$(pi_supported_range)
+    # Bounded capture: a resolvable pi whose --version crashes or prints garbage
+    # must land in the computed FAIL verdict below, never abort setup via set -e
+    # before the summary (review defect, 2026-08-26).
+    pi_ver="$("$pi_bin" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')" || pi_ver=""
+    if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
+      setup_result pi FAIL "detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup"
+    elif (install_local_package "$project_dir"); then
+      setup_result pi PASS "project + user-scope wiring complete (pi $pi_ver in $pi_range) — verify: ./run.sh doctor-pi-provider"
+    else
+      setup_result pi FAIL "pi wiring did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── claude (meta-bridge) ── single confident install command (GLG 2026-06-23):
+  # setup ALSO wires the native-harness meta-bridge so a relocate/clone needs ONE
+  # command. Detection-gated ("있으면 설정, 없으면 담아준다");
+  # meta-bridge-install.sh is idempotent and enforces the Claude floor + its own
+  # named prerequisites itself, so a below-floor or refused host lands here as a
+  # detected FAIL, never a cosmetic green. CLAUDE_BIN pins the probe for the
+  # hermetic smoke; production leaves it unset.
+  local claude_bin="${CLAUDE_BIN:-claude}"
+  if ! command -v "$claude_bin" >/dev/null 2>&1; then
+    setup_result claude SKIP "claude not on PATH — zero meta-bridge wiring written"
+  else
     section "meta-bridge install (native harness detected: Claude Code)"
-    (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh)
+    if (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh); then
+      setup_result claude PASS "meta-bridge wired — verify: ./run.sh doctor-meta-bridge"
+    else
+      setup_result claude FAIL "detected Claude Code, but the meta-bridge integration did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── stable command exposure ── source mode exposes entwurf's STABLE bins on
+  # PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the operator command
+  # `entwurf` that Copilot fresh resolves as its managed runtime, plus the bare
+  # bridge/statusline/imprint names native-harness configs record. An installed
+  # consumer already has the same commands from npm bin linking — nothing to
+  # expose there. The core operator stays fail-loud; helper units are attempted
+  # independently and a refused helper is a named FAIL, not a cosmetic green.
+  local bins_rc
+  if [ "$mode" = "installed" ]; then
+    # PASS, not SKIP (review, 2026-08-26): the capability IS present — npm bin
+    # linking provides the same stable commands the source lane must expose.
+    # SKIP stays reserved for a truly absent capability with zero state.
+    setup_result bins PASS "provided by npm bin linking (installed package needs no source exposure)"
   else
-    echo "[setup] no native harness (claude) on PATH — skipping meta-bridge wiring (pi-only host)"
-  fi
-
-  # Expose entwurf's STABLE bins on PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the
-  # agy mcp_config, settings.statusLine, and hooks.json record the bare names `entwurf-bridge` /
-  # `entwurf-agy-statusline` / `entwurf-agy-imprint`, so they must resolve for the agy doctors
-  # to pass. NON-FATAL — a foreign bin already on PATH is left as-is.
-  expose_dev_bin
-
-  # Fold agy (Antigravity) MCP bridge wiring into setup (막힘 ①, GLG 2026-07-04: install
-  # ownership moves to entwurf). Same detection-gated, idempotent, NON-FATAL posture as the
-  # meta-bridge block above — agy is an OPTIONAL harness, so a refused/corrupt agy config warns
-  # but never bricks a pi/Claude setup. The hard gate stays doctor-agy-bridge.
-  wire_agy_bridge
-
-  # Fold agy statusLine wiring into setup (#46 Task 1: own the ambient status area so it shows
-  # driver + garden id, the claude meta-bridge symmetry). Same detection-gated NON-FATAL posture
-  # — an explicit install-agy-statusline is fail-loud, but the setup wrapper WARNs + continues.
-  wire_agy_statusline
-
-  # Fold agy PreInvocation birth imprint wiring into setup (#46 close criterion: manual register 0).
-  # The hook runs the thin `entwurf-agy-imprint` bin and returns {"injectSteps":[]} so agy's loop
-  # survives while the meta-record is created/attached by conversationId.
-  wire_agy_hooks
-
-  # Deterministic preflight lives in `pnpm run check:full`; live substrate acceptance lives
-  # in `LIVE=1 ./run.sh release-gate <scratch> --cut`. Setup is the install path, so it
-  # verifies the installed MCP bridge boundary only and does NOT run the legacy
-  # ACP/v1 session-messaging/sentinel gates.
-  section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
-  validate_entwurf_bridge
+    bins_rc=0; expose_dev_bin || bins_rc=$?
+    if [ "$bins_rc" -eq 0 ]; then
+      setup_result bins PASS "source operator + helper bins exposed and certified (PATH winner: this checkout)"
+    elif [ "$bins_rc" -eq 3 ]; then
+      setup_result bins FAIL "foreign helper bin(s) refused (named above; every unit was attempted) — repair them, then re-run setup"
+    else
+      setup_result bins FAIL "source operator command not certified (see above) — repair PATH/link, then re-run setup"
+    fi
+  fi
 
-  echo ""
-  echo "DONE: entwurf setup (pi adapter + detected native bridges + v2 install smoke) green."
-  if command -v claude >/dev/null 2>&1; then
-    echo "Verify Claude wiring with: ./run.sh doctor-meta-bridge"
+  # ── agy (Antigravity) ── detection-gated (막힘 ①, GLG 2026-07-04: install
+  # ownership moves to entwurf); AGY_BIN pins the probe for the hermetic smoke.
+  # agy absent is one zero-state SKIP. agy PRESENT runs all three leaves
+  # (bridge / statusLine / PreInvocation imprint) independently; a refused or
+  # corrupt config is a named component FAIL that keeps the rest of setup alive
+  # but owns a nonzero final result — the old WARN-then-green posture is retired
+  # (#86 C6/C7). Hard per-leaf verdicts stay with the doctor commands.
+  local agy_rc
+  if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
+    setup_result agy SKIP "agy not on PATH — zero agy wiring written"
+  else
+    agy_rc=0; wire_agy_bridge || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-bridge PASS "MCP bridge wired — verify: ./run.sh doctor-agy-bridge"
+    else
+      setup_result agy-bridge FAIL "detected agy, but the MCP bridge integration did not complete (reason above) — repair, then re-run setup"
+    fi
+    agy_rc=0; wire_agy_statusline || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-statusline PASS "statusLine wired — verify: ./run.sh doctor-agy-statusline"
+    else
+      setup_result agy-statusline FAIL "detected agy, but the statusLine integration did not complete (reason above) — repair, then re-run setup"
+    fi
+    agy_rc=0; wire_agy_hooks || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-hooks PASS "birth imprint wired — verify: ./run.sh doctor-agy-hooks"
+    else
+      setup_result agy-hooks FAIL "detected agy, but the birth-imprint integration did not complete (reason above) — repair, then re-run setup"
+    fi
   fi
-  if command -v agy >/dev/null 2>&1; then
-    echo "Verify agy wiring with:    ./run.sh doctor-agy-bridge"
-    echo "                           ./run.sh doctor-agy-statusline"
-    echo "                           ./run.sh doctor-agy-hooks"
+
+  # ── copilot (GitHub Copilot CLI) ── presence-driven composition (#86 C3b):
+  # the operator's copilot on PATH is the ONLY trigger; absent is one zero-state
+  # SKIP (setup never installs a harness). Present runs all FOUR units the
+  # fresh-call preflight requires — birth → MCP → receiver → visible footer —
+  # INDEPENDENTLY: a failed unit is a named component FAIL that keeps the other
+  # units and the rest of setup alive but owns a nonzero final result. Every
+  # unit is an operator-selectable install with a package-owned inverse (#86
+  # C3a closed the birth inverse), so setup composes only lifecycles it can
+  # also undo. COPILOT_BIN pins the PROBE for the hermetic gates (same seam
+  # spirit as PI_BIN/CLAUDE_BIN/AGY_BIN); the unit scripts address the vendor
+  # as `copilot` on PATH, so production leaves it unset and the two agree.
+  local copilot_rc
+  if ! command -v "${COPILOT_BIN:-copilot}" >/dev/null 2>&1; then
+    setup_result copilot SKIP "copilot not on PATH — zero Copilot wiring written"
+  else
+    section "copilot units (native harness detected: GitHub Copilot CLI)"
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-birth PASS "birth plugin installed — verify: ./run.sh doctor-copilot-bridge"
+    else
+      setup_result copilot-birth FAIL "detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup"
+    fi
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh install) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-mcp PASS "MCP server registered — verify: ./run.sh doctor-copilot-mcp"
+    else
+      setup_result copilot-mcp FAIL "detected copilot, but the MCP registration did not complete (see above) — repair, then re-run setup"
+    fi
+    # The receiver deploys the COMPILED dist closure on every install shape
+    # (Copilot's extension runtime cannot strip-types). The tarball ships dist;
+    # a source checkout may not have built it yet, and those bytes are
+    # entwurf's OWN artifact (Hard Rule 17: the source bootstrap supplies
+    # entwurf's own bytes), so the source lane builds it here once when absent.
+    copilot_rc=0
+    if [ "$mode" = "source" ] && [ ! -f "$REPO_DIR/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js" ]; then
+      (cd "$REPO_DIR" && pnpm run build-bridge) || copilot_rc=$?
+    fi
+    if [ "$copilot_rc" -ne 0 ]; then
+      setup_result copilot-receive FAIL "detected copilot, but the receiver's compiled dist closure failed to build (see above) — repair, then re-run setup"
+    else
+      copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh install) || copilot_rc=$?
+      if [ "$copilot_rc" -eq 0 ]; then
+        setup_result copilot-receive PASS "receiver extension installed — verify: ./run.sh doctor-copilot-receive"
+      else
+        setup_result copilot-receive FAIL "detected copilot, but the receiver extension install did not complete (see above) — repair, then re-run setup"
+      fi
+    fi
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh install) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-statusline PASS "visible footer wired — verify: ./run.sh doctor-copilot-statusline"
+    else
+      setup_result copilot-statusline FAIL "detected copilot, but the visible-footer integration did not complete (see above) — repair, then re-run setup"
+    fi
   fi
+
+  # ── core bridge boundary ── deterministic preflight lives in `pnpm run
+  # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
+  # release-gate <scratch> --cut`. Setup is the install path, so it verifies the
+  # installed MCP bridge boundary only and does NOT run the legacy ACP/v1
+  # session-messaging/sentinel gates.
+  section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
+  if (validate_entwurf_bridge); then
+    setup_result core PASS "installed bridge boots and lists the exact v2 tool set"
+  else
+    setup_result core FAIL "installed bridge boundary did not validate (see above)"
+  fi
+
+  # ── computed summary (#86 C7/C8) ── the final verdict is DERIVED from the
+  # component outcomes above, never printed independently of them. A detected
+  # integration FAIL owns a nonzero exit while valid components stay installed;
+  # re-running the same setup is the documented repair action (idempotent).
+  section "setup summary (computed from component outcomes)"
+  local entry rest s_name s_verdict s_fails=""
+  for entry in "${SETUP_RESULTS[@]}"; do
+    s_name="${entry%%|*}"; rest="${entry#*|}"; s_verdict="${rest%%|*}"
+    printf '  %-14s %-4s %s\n' "$s_name" "$s_verdict" "${rest#*|}"
+    if [ "$s_verdict" = "FAIL" ]; then s_fails="$s_fails $s_name"; fi
+  done
+  echo ""
+  if [ -n "$s_fails" ]; then
+    echo "DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup."
+    return 1
+  fi
+  echo "DONE: entwurf setup — result: green (computed from the component outcomes above)."
   echo "Run 'LIVE=1 ./run.sh release-gate <scratch> --cut' for live substrate acceptance (--cut refuses any MUST SKIP)."
 }
 
-# wire_agy_bridge — detection-gated, NON-FATAL agy (Antigravity) MCP bridge wiring, folded into
+# wire_agy_bridge — detection-gated agy (Antigravity) MCP bridge wiring, folded into
 # setup so a relocate/clone needs ONE idempotent command (막힘 ①). Mirrors the meta-bridge
 # block: agy on PATH → idempotent install-agy-bridge; no agy → honest skip, NO state ("있으면
-# 설정, 없으면 담아준다"). NON-FATAL by contract: agy is an OPTIONAL harness, so a refused/corrupt
-# agy config must NOT brick a pi/Claude setup — the hard gate is doctor-agy-bridge (issue #45:
-# the '?' surfaces in doctor, not by killing setup). WARNs are reason-specific so a transitional
-# symlink (someone else's SSOT) and a corrupt config (invalid JSON) are never conflated.
+# 설정, 없으면 담아준다"). A refused/corrupt agy config still never bricks the rest of setup —
+# later components are attempted — but it RETURNS 1 so the aggregate verdict records a named
+# component FAIL and setup exits non-green (#86 C6/C7: the old WARN-then-exit-0 posture was the
+# false-success shape). The hard per-leaf gate stays doctor-agy-bridge (issue #45). WARNs are
+# reason-specific so a transitional symlink (someone else's SSOT) and a corrupt config
+# (invalid JSON) are never conflated.
 wire_agy_bridge() {
   # Detection = the agy binary on PATH. AGY_BIN pins the target (default `agy`) so the
   # hermetic smoke can point at a fake agy or a definitely-absent path without depending on
@@ -4359,7 +4890,8 @@ wire_agy_bridge() {
     echo "[setup] agy bridge wired (idempotent). Verify with: ./run.sh doctor-agy-bridge"
     return 0
   fi
-  # NON-FATAL: keep setup alive, surface the reason honestly (never a silent pass).
+  # Keep setup alive for the remaining components, surface the reason honestly, and return 1
+  # so the aggregate verdict records this component as FAIL (never a silent pass).
   # ORDER MATTERS: the permission failures carry the same words as the mcp_config ones ("refused
   # (symlink)", "invalid JSON") and MUST be matched first — otherwise a settings.json problem gets
   # reported as an mcp_config problem and sends the operator to repair the wrong file.
@@ -4388,14 +4920,14 @@ wire_agy_bridge() {
       echo "[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# wire_agy_statusline — detection-gated, NON-FATAL agy statusLine wiring, folded into setup (#46
+# wire_agy_statusline — detection-gated agy statusLine wiring, folded into setup (#46
 # Task 1). Mirrors wire_agy_bridge: agy on PATH → idempotent install-agy-statusline; no agy →
-# honest skip, NO state. NON-FATAL by contract (agy is OPTIONAL — a refused/corrupt settings must
-# not brick a pi/Claude setup); the hard gate is doctor-agy-statusline. The renderer is the
-# stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
+# honest skip, NO state; a refused/corrupt settings keeps the rest of setup alive but returns 1
+# for a named component FAIL (#86 C6/C7). The hard gate is doctor-agy-statusline. The renderer
+# is the stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
 wire_agy_statusline() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
     echo "[setup] no agy on PATH — skipping agy statusLine wiring (no state; this host runs no Antigravity)"
@@ -4428,12 +4960,13 @@ wire_agy_statusline() {
       echo "[setup]       statusLine NOT wired; verify with ./run.sh doctor-agy-statusline. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# wire_agy_hooks — detection-gated, NON-FATAL agy PreInvocation imprint wiring. Same setup posture
-# as the MCP/statusLine adapters, but this one is the birth writer that turns statusLine '?' into a
-# garden id after the first invocation.
+# wire_agy_hooks — detection-gated agy PreInvocation imprint wiring. Same setup posture
+# as the MCP/statusLine adapters (skip on absence, named FAIL on detected incompleteness), but
+# this one is the birth writer that turns statusLine '?' into a garden id after the first
+# invocation.
 wire_agy_hooks() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
     echo "[setup] no agy on PATH — skipping agy hooks wiring (no state; this host runs no Antigravity)"
@@ -4464,30 +4997,39 @@ wire_agy_hooks() {
       echo "[setup]       Birth imprint NOT wired; verify with ./run.sh doctor-agy-hooks. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# expose_dev_bin — make the `entwurf-bridge` STABLE bin resolve for a DEV checkout (막힘 ②).
-# setup IS the dev install command (consumers get the bin from npm bin-linking), so setup owns a
-# managed ~/.local/bin/entwurf-bridge symlink into this checkout via scripts/dev-bin.sh, recorded
-# for an honest inverse (remove-dev-bin). NON-FATAL like wire_agy_bridge: a foreign bin already on
-# PATH (a real npm install) is REFUSED not clobbered, and a BIN_DIR off PATH only WARNs — neither
-# bricks setup. The hard gate stays doctor-agy-bridge (a missing/dangling bin FAILs there).
+# expose_dev_bin — make the package's stable commands resolve for a DEV checkout (막힘 ②).
+# setup IS the dev install command (consumers get these names from npm bin-linking), so setup owns
+# managed ~/.local/bin symlinks into this checkout via scripts/dev-bin.sh, each recorded for an
+# honest inverse. The set starts with `entwurf` → run.sh: Copilot fresh deliberately launches the
+# managed `entwurf copilot`, never the raw vendor. That operator command is CORE and is certified
+# after exposure by dev-bin.sh's own target authority: our symlink, our target, and the exact PATH
+# winner. A foreign/off-PATH/shadowed operator therefore fails setup (return 1). Helper units are
+# attempted INDEPENDENTLY by dev-bin.sh (#86 C10) and any refusal propagates as return 3 — the
+# aggregate verdict records it as a named FAIL instead of the old WARN-then-green; the refused
+# names are already printed truthfully by dev-bin's attempted/ok/refused summary.
 expose_dev_bin() {
-  section "dev bin: expose entwurf-bridge on PATH (dev checkout)"
+  section "dev bins: expose stable package commands on PATH (dev checkout)"
   local rc
   set +e
   bash "$REPO_DIR/scripts/dev-bin.sh" expose
   rc=$?
   set -e
+
+  if ! bash "$REPO_DIR/scripts/dev-bin.sh" verify entwurf; then
+    return 1
+  fi
+
   [ "$rc" -eq 0 ] && return 0
   if [ "$rc" -eq 3 ]; then
-    echo "[setup] WARN: entwurf-bridge is already on PATH as someone else's bin (not ours) — left as-is." >&2
-    echo "[setup]       If that is a stale/foreign bin, remove it and re-run setup. setup continues." >&2
+    echo "[setup] dev-bin: foreign helper bin path(s) refused, never clobbered — the refused names are in the summary above." >&2
+    echo "[setup]       Every unit was attempted independently; the source operator itself is certified." >&2
   else
-    echo "[setup] WARN: dev bin exposure did not complete (rc=$rc; see above). setup continues." >&2
+    echo "[setup] dev-bin: helper exposure did not complete (rc=$rc; see above)." >&2
   fi
-  return 0
+  return "$rc"
 }
 
 # release-gate — the single command that, when GREEN, is sufficient to cut
@@ -5181,6 +5723,16 @@ case "$cmd" in
     # Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-install-state.sh)
     ;;
+  smoke-setup-verdict)
+    # #86 C1 aggregate setup verdict fixture — the first automated consumer of
+    # `entwurf setup` itself: all-absent SKIP/green, pi below-floor detected FAIL
+    # (never SKIP), pi-present wiring PASS, agy detected+corrupt named FAIL with
+    # NON-GREEN nonzero exit, installed-mode named branch before the bootstrap,
+    # and the credential store byte-identical in every cell. Sandboxed HOME/XDG/
+    # agent/dev-bin roots; presence pinned via PI_BIN/CLAUDE_BIN/AGY_BIN.
+    # Offline + deterministic (deps: bash+node+python3+pnpm).
+    (cd "$REPO_DIR" && bash scripts/smoke-setup-verdict.sh)
+    ;;
   check-agy-permission-matrix)
     # The agy permission engine's CONTRACT SPACE as a literal table (55 cells + stated
     # exclusions R2/R4-R7): parser-state × operation × settings × ownership × precedence.
@@ -5237,8 +5789,8 @@ case "$cmd" in
     # own the statusLine subtree WHOLE (preserve unrelated keys) + state (stable command, prior
     # subtree as preimage), doctor static-clean/live-SKIP (+live-consistent with a fake agy) /
     # drift-FAIL / dangling-command-FAIL / not-ours note, honest-inverse uninstall, symlink +
-    # dangling-symlink refuse, create-new inverse, the NON-FATAL wire wrapper, and checkout
-    # impurity 0. Offline + deterministic (deps: bash+python3).
+    # dangling-symlink refuse, create-new inverse, the truthful wire wrapper (detected refusal
+    # → nonzero, #86 C6/C7), and checkout impurity 0. Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-statusline-state.sh)
     ;;
   smoke-agy-hooks-state)
@@ -5268,8 +5820,10 @@ case "$cmd" in
     # 0.12.6 install-boundary gate: register-pi-package.py is the shared
     # packages[] SSOT for project/user install and remove; user scope makes
     # --entwurf-control load from any cwd. Idempotent, preserves unrelated
-    # packages/keys, normalizes stale entries, remove is symmetric, and corrupt
-    # settings fail loud. The tripwire the 2026-07-03 `pi install` removal lacked.
+    # packages/keys, remove is symmetric, corrupt settings fail loud; project
+    # scope normalizes ITS OWN stale entries while user scope carries the #86 C2
+    # explicit ownership contract (other owners refuse; takeover-user-scope moves).
+    # The tripwire the 2026-07-03 `pi install` removal lacked.
     (cd "$REPO_DIR" && bash scripts/smoke-user-scope-citizen.sh)
     ;;
   smoke-claude-native-resume-live)
@@ -5315,6 +5869,15 @@ case "$cmd" in
     shift || true
     (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh "$@")
     ;;
+  uninstall-copilot-bridge)
+    # #86 C3a: the package-owned inverse of install-copilot-bridge. The ownership state
+    # is the sole removal authority (exact qualified id, exact marketplace name+path,
+    # recorded assembly only); a failing vendor list is UNKNOWN and refuses; state is
+    # deleted LAST so any partial failure keeps a rerun-repair authority. Never touches
+    # the stale Claude unit and never uses --force.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-uninstall.sh "$@")
+    ;;
   doctor-copilot-bridge)
     # #82: the fail-loud surface for the Copilot unit. Its red conditions differ from
     # the Claude doctor's on purpose: a Copilot session mints on its FIRST PROMPT, not
@@ -5400,11 +5963,12 @@ case "$cmd" in
     (cd "$REPO_DIR" && bash scripts/agy-bridge.sh doctor "$@")
     ;;
   wire-agy-bridge)
-    # 막힘 ①: the detection-gated, NON-FATAL setup wrapper around install-agy-bridge (agy on
-    # PATH → idempotent install; no agy → honest skip, no state). HIDDEN/internal — setup calls
-    # this; it is exposed as a subcommand only so smoke-agy-install-state can drive it
-    # deterministically. The hard gate stays doctor-agy-bridge (issue #45: the '?' is a doctor
-    # signal, not a setup-killer).
+    # 막힘 ①: the detection-gated, truthful setup wrapper around install-agy-bridge (agy on
+    # PATH → idempotent install; no agy → honest skip, no state; detected refusal/corrupt →
+    # reason-specific WARN + nonzero so the aggregate records a named component FAIL while later
+    # components stay attempted, #86 C6/C7). HIDDEN/internal — setup calls this; it is exposed
+    # as a subcommand only so smoke-agy-install-state can drive it deterministically. The hard
+    # per-leaf gate stays doctor-agy-bridge (issue #45).
     wire_agy_bridge
     ;;
   install-agy-statusline)
@@ -5472,9 +6036,10 @@ case "$cmd" in
     run_ts scripts/doctor-pi-provider.ts "$@"
     ;;
   wire-agy-statusline)
-    # #46 Task 1: the detection-gated, NON-FATAL setup wrapper around install-agy-statusline.
-    # HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can drive it
-    # deterministically. The hard gate stays doctor-agy-statusline.
+    # #46 Task 1: the detection-gated, truthful setup wrapper around install-agy-statusline
+    # (detected refusal/corrupt → WARN + nonzero, named component FAIL in the aggregate, #86
+    # C6/C7). HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can
+    # drive it deterministically. The hard per-leaf gate stays doctor-agy-statusline.
     wire_agy_statusline
     ;;
   wire-agy-hooks)
@@ -5482,14 +6047,16 @@ case "$cmd" in
     wire_agy_hooks
     ;;
   expose-dev-bin)
-    # 막힘 ②: expose the entwurf-bridge STABLE bin on PATH for a DEV checkout (a managed symlink
-    # into this checkout, recorded for an honest inverse). HIDDEN/internal — setup calls the
-    # NON-FATAL expose_dev_bin wrapper; exposed here so smoke-agy-install-state can drive the
-    # foreign-refuse WARN path. The exposure logic lives in scripts/dev-bin.sh.
+    # 막힘 ②: expose the stable package commands on PATH for a DEV checkout, including the
+    # `entwurf` operator command Copilot fresh resolves. HIDDEN/internal — setup requires the
+    # core operator certification and attempts every helper unit independently; a foreign helper
+    # propagates rc=3 as a named bins FAIL (#86 C10). Exposed here so the install smoke can
+    # drive ownership/refusal.
+    # The exposure logic lives in scripts/dev-bin.sh.
     expose_dev_bin
     ;;
   remove-dev-bin)
-    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed link + state (REFUSE if
+    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed links + states (REFUSE if
     # it became foreign). The raw script (no wrapper) so an operator sees a loud failure.
     shift || true
     (cd "$REPO_DIR" && bash scripts/dev-bin.sh remove "$@")
@@ -5647,9 +6214,6 @@ case "$cmd" in
     # from under node_modules rather than re-packing the installed copy.
     (cd "$REPO_DIR" && bash scripts/check-install-container.sh "$@")
     ;;
-  sync-auth)
-    sync_auth
-    ;;
   install)
     install_local_package "$TARGET_PROJECT_DIR"
     ;;
@@ -5659,6 +6223,17 @@ case "$cmd" in
   remove-user-scope)
     remove_user_scope_citizen
     ;;
+  takeover-user-scope)
+    # #86 C2: operator-explicit ownership move — the ONLY writer allowed to replace
+    # another root's user-scope registration (normal install/setup/remove refuse).
+    takeover_user_scope
+    ;;
+  doctor-pi-package)
+    # #86 C2: package-side ownership verdict (unregistered/owned/owned-by-other/
+    # legacy-no-state/mismatch/missing-owner). Provider runtime stays with
+    # doctor-pi-provider — the two doctors are deliberately not mixed.
+    doctor_pi_package
+    ;;
   -h|--help|help|"")
     usage
     ;;