@junghanacs/entwurf 0.15.0 → 0.16.0

package/run.sh

@@ -119,7 +119,7 @@ run_vitest() {
 usage() {
   cat <<'EOF'
 Usage:
-  ./run.sh setup [project-dir]        # ONE confident install: pnpm install + install + meta-bridge (if native harness) + v2 install smoke (LIVE substrate = release-gate)
+  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
@@ -131,10 +131,13 @@ Usage:
   ./run.sh check-meta-v3-record        # deterministic gate: the ONE live record schema (v3) — canonical serialize/round-trip/mint, foreign-generation rejections name fresh-cut with the actual version value, strict keyset, no API
   ./run.sh check-mailbox-receipt-state # deterministic gate (0.11 Stage 0 step 3B): mailbox receipt state schema + store (stamp→persist→read-back) in a temp mailbox, strict keyset, no API
   ./run.sh check-copilot-birth-hook   # #82 gate: drives the real Copilot assembler into a temp dir, fires the baked launcher with NO ARGV (the way Copilot's `exec`-string schema forces), and requires a backend:"copilot" v3 record + attach + peer row + a SENDER marker the resolver joins back to that record, and still zero mailbox/receiver marker (who-sent needs a shared parent; a receiver needs a doorbell this backend has not got). Hermetic; no Copilot, no model turn
+  ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-statusline   # #82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
+  ./run.sh check-omp-fresh-preflight   # #87 C: the OMP fresh preflight reproduces omp_agent_dir and the tools.xdev read in TS (it runs from two emit depths and cannot call a sibling script). This drives the SHIPPED shell/python leaves over the same inputs — refusals included — and requires the TS half to agree, so the reproduction cannot silently drift from the installer's own oracle
+  ./run.sh check-harness-admission-parity  # #87 C: the EDGE the two closed parity loops never had. Every citizen backend is fresh-openable or a declared pre-#82 legacy admission whose exception a reader finds in DELIVERY.md — so a post-contract harness that mints records but cannot be opened by entwurf_fresh_call blocks the release package instead of only carrying an `unsupported` note (docs/adding-a-harness.md step 9)
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
   ./run.sh check-bridge-delivery      # deterministic gate (IN pnpm run check:full): demo scene 3 recovered — seed strict meta-sender + armed receiver citizens in an isolated temp world, scrub ambient pi/sender carriers, drive the BUILT DIST ENTRY over MCP stdio through a real tools/call entwurf_v2, assert the .msg landed under the seeded sender + doorbell poked. DELIVERS through the artifact, not from source. ENTWURF_DELIVERY_SUBJECT=<launcher> replays the same scene against another consumer artifact (check-pack-install passes the npm-installed bin). No model/network/cost; stale or missing dist FAILS
@@ -181,8 +184,11 @@ Usage:
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
   ./run.sh check-meta-doctor-oracle   # 0.12.8 (#51): detection power of the release ORACLE — healthy fixture must reach `doctor: PASS`, then 21 planted defects (retired shell form, partial hand-patch, launcher bypass/repoint/provenance loss, malformed exec args, owner type drift, extra leaf/group, doorbell asyncRewake/path/timeout, no live bridge, stale receiver, ambiguous/missing cache, missing hook log/writer, failing CLI probes) must each turn it FAIL naming their own cause, plus a positive case pinning that a long-writing CLI is NOT a false negative. Offline/deterministic (deps: bash+node+python3)
-  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
+  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, truthful setup outcomes. Offline/deterministic
+  ./run.sh smoke-setup-verdict        # #86 C1+C3b aggregate setup verdict fixture: all-absent SKIP/green, pi presence+floor, detected-FAIL nonzero, copilot four-unit composition (present=independent PASS/FAIL rows, absent=zero-state SKIP), installed-mode named branch, credential store untouched. Offline/deterministic
   ./run.sh check-agy-permission-matrix # AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)
+  ./run.sh smoke-omp-fresh-live        # #87 bundle C acceptance, RELEASE MUST: omp opened as ONE visible fresh sibling through the PUBLIC entwurf_fresh_call surface (never raw tmux), exact nonce callback -> garden id from the SENDER ENVELOPE -> record/backend identity -> addressed receive -> lastReadAt -> the drain visible in that same native session's own transcript. Needs LIVE=1 and spends real model turns. Self-deciding: omp outside FRESH_CALL_BACKENDS or without a mailbox rail is a protocol SKIP, which --cut reads as RED
+  ./run.sh smoke-omp-receive-live      # #87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
@@ -191,8 +197,9 @@ Usage:
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-copilot-statusline-state # Copilot custom-footer install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-copilot-mcp-state       # Copilot MCP install/doctor/inverse regression. Offline/deterministic
+  ./run.sh smoke-omp-bridge-state        # OMP birth-extension install/doctor/inverse regression: placement, stale-writer detection, honest inverse, no-state refusal (structurally VALID as well as foreign), symlink refusal, ambiguous-agent-dir refusal (ledger M6), and a poisoned PI_CODING_AGENT_DIR that attracts no artifact. Fully sandboxed HOME/PI/XDG. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
-  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry). Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
@@ -203,13 +210,25 @@ Usage:
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is not yet verified/certified and stays nonzero for this cut (future validation may reopen it). Detection power is held by check-meta-doctor-oracle
   ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
   ./run.sh install-copilot-bridge     # #82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)
-  ./run.sh doctor-copilot-bridge      # #82: fail-loud surface for that unit. Red = a hook that RAN and failed, or a broken/unbaked artifact. "Installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens (measured)
+  ./run.sh uninstall-copilot-bridge   # #86 C3a: honest inverse of install-copilot-bridge from the package-owned install-state (exact qualified id + exact marketplace name/path + recorded assembly only; state deleted LAST; a failing vendor list is UNKNOWN and refuses; never --force, never the stale Claude unit)
+  ./run.sh doctor-copilot-bridge      # #82/#86: fail-loud surface for that unit — runtime axis (red = a hook that RAN and failed, or a broken/unbaked artifact; "installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens, measured) + ownership axis (install-state shape/binding, marketplace path drift, UNKNOWN vendor lists; legacy no-state install = named non-green, repair = install-copilot-bridge adoption). Either axis red = red
   ./run.sh install-copilot-statusline # own Copilot statusLine + footer.showCustom with an install-state preimage
   ./run.sh uninstall-copilot-statusline # honest inverse of install-copilot-statusline
   ./run.sh doctor-copilot-statusline  # static ownership/config/bin doctor; never claims a render receipt
   ./run.sh install-copilot-mcp        # #82 RAIL 5: register ONE entwurf-bridge server in ~/.copilot/mcp-config.json (adopt / create / REFUSE symlink), type:local, install-state under $XDG_DATA_HOME/entwurf/copilot-mcp/
   ./run.sh uninstall-copilot-mcp      # honest inverse of install-copilot-mcp from install-state
   ./run.sh doctor-copilot-mcp         # static ownership/config/boot doctor; RED only when install-state exists
+  ./run.sh install-omp-bridge         # #87: install the OMP BIRTH extension into <omp agent dir>/extensions/entwurf-meta-omp (index.ts|js + lib + capability registry). No launcher and no bake — an omp hook is an in-process extension. Refuses when an inherited PI_CODING_AGENT_DIR/PI_CONFIG_DIR/PI_PROFILE makes the target agent dir ambiguous (ledger M6), and refuses ANY pre-existing artifact at the unit path that entwurf holds no ownership state for — a shape is not a proof of ownership
+  ./run.sh uninstall-omp-bridge       # honest inverse from install-state (exact unit dir + recorded entry; no-state host REFUSES; state deleted LAST). Records already minted are preserved
+  ./run.sh doctor-omp-bridge          # #87: runtime axis (importable unit, writer/registry parity, mint vs sender-marker errors on SEPARATE axes, scope-fence receipts, a root-grammar preflight that goes RED on a relative ENTWURF_META_* override instead of reporting on some other directory, CERTIFIED omp record count via meta-facts under the omp root policy — never a text grep, live omp processes carrying inherited PI_SESSION_ID/PI_AGENT_ID) + ownership axis. PI_CODING_AGENT_DIR is the vendor's own agent dir here and is reported as ignored, never as contamination. Zero records = NOT-YET, never red
+  ./run.sh install-omp-receive        # #87 bundle B: install the OMP RECEIVER extension into <omp agent dir>/extensions/entwurf-receive-omp. Own unit, own install-state, own doctor, own inverse. It joins the citizen BIRTH minted in the same process (sender marker for this pid + V3 record + the vendor's current session id, all three or refuse), holds an fs.watch on that citizen's mailbox signal, and rings an ANNOUNCE-ONLY doorbell via pi.sendUserMessage. It never assumes it loads after birth: extension handlers run in directory-name order and a before-sorting unit was MEASURED to see no marker, so the arm retries on a bounded ctx.setInterval cancelled with ctx.clearTimer (the vendor exposes no clearInterval)
+  ./run.sh uninstall-omp-receive      # honest inverse from install-state; records and sender identity untouched. A session that ALREADY armed keeps its marker until its process exits
+  ./run.sh doctor-omp-receive         # runtime axis (importable unit, writer parity, arm failures and doorbell failures on SEPARATE axes, who is armed RIGHT NOW through the production marker reader) + ownership axis. Zero armed receivers = NOT-YET, never red. Reports a marker for exactly what a marker proves — a live owner reached the arm emit — and never upgrades that into "a wake will happen"
+  ./run.sh omp-receive-facts          # read-only JSON projection of the omp receive rail: every receiver marker through readMetaReceiverMarker in BOTH readings (live / as-written) plus mailbox counts. The shared oracle so no consumer answers "is a doorbell held?" from a filename
+  ./run.sh install-omp-mcp            # #87 step 5: write ONE omp-native entwurf-bridge server into <omp agent dir>/mcp.json with env ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/omp. The server key is a PINNED LITERAL, byte-identical to the Claude import's — same-key first-wins at native=100 > claude=80 is what SHADOWS the import (never disabledServers, which kills both). Adopt / create / REFUSE symlink, preimage recorded
+  ./run.sh uninstall-omp-mcp          # honest inverse from install-state (restores the preimage, or removes a file we created); the Claude import becomes effective again
+  ./run.sh doctor-omp-mcp             # ownership + config + boot doctor, plus the EFFECTIVE-source read (native-wins / native-invalid / import-wins / both-suppressed) — a configuration read, never a runtime receipt. Runtime validity and ownership are SEPARATE axes: foreign provenance, a disabledServers denylist, and a malformed entry under our key are each RED even with no install-state. tools.xdev is a RUNTIME cell: absent file/key applies the vendor default (true, no inline allowlist) and is RED while the native hand is the effective source; xdev false is ok; a covering xdevInlineDevices glob is ok-with-note
+  ./run.sh smoke-omp-mcp-state        # OMP MCP install/doctor/inverse regression incl. shadowing, the denylist refusal, target confinement + retarget refusal, and a malformed entry going RED with zero install-state. Fully sandboxed HOME/PI/XDG. Offline/deterministic
   ./run.sh install-copilot-receive    # #82 RAIL 5: install the RECEIVER extension (user scope ~/.copilot/extensions/entwurf-receive). Owns the artifact and CHECKS the launch flag; it never sets one (a launch does — see `./run.sh copilot`). Arms per session after birth
   ./run.sh uninstall-copilot-receive  # honest inverse from install-state; never removes a unit it did not install
   ./run.sh doctor-copilot-receive     # artifact + digest, COPILOT_CLI_ENABLED_FEATURE_FLAGS on the LIVE copilot processes (the silent failure), live receiver markers via the production reader, receiver log. RED only when install-state exists
@@ -233,12 +252,13 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.30 must leak, @0.84.3 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
-  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (0.82.x) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
+  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
-  ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
   ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
-  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project)
+  ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
+  ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
+  ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
 
 Notes:
   - project-dir defaults to current directory
@@ -268,44 +288,12 @@ print(os.path.abspath(os.path.expanduser(sys.argv[1])))
 PY
 }
 
-sync_auth() {
-  local auth_path="$HOME/.pi/agent/auth.json"
-  python3 - "$auth_path" "$PROVIDER_ID" <<'PY'
-import json, os, sys
-from pathlib import Path
-
-auth_path = Path(sys.argv[1]).expanduser()
-provider_id = sys.argv[2]
-auth_path.parent.mkdir(parents=True, exist_ok=True)
-
-if auth_path.exists():
-    data = json.loads(auth_path.read_text())
-    if not isinstance(data, dict):
-        raise SystemExit("auth.json is not an object")
-else:
-    data = {}
-
-anthropic = data.get("anthropic")
-if not isinstance(anthropic, dict):
-    print("sync-auth: skipped (no anthropic OAuth credentials in ~/.pi/agent/auth.json)")
-    raise SystemExit(0)
-
-before = json.dumps(data.get(provider_id), sort_keys=True)
-after = json.dumps(anthropic, sort_keys=True)
-if before == after:
-    print(f"sync-auth: already synced ({provider_id})")
-    raise SystemExit(0)
-
-data[provider_id] = anthropic
-backup = auth_path.with_suffix(auth_path.suffix + ".bak")
-if auth_path.exists():
-    backup.write_text(auth_path.read_text())
-auth_path.write_text(json.dumps(data, indent=2) + "\n")
-print(f"sync-auth: wrote {provider_id} alias to {auth_path}")
-if backup.exists():
-    print(f"sync-auth: backup -> {backup}")
-PY
-}
+# The old `sync_auth` credential mutation is GONE (#86 A5): setup composes what
+# the operator already installed and NEVER reads, copies, aliases or backs up a
+# harness credential store — the `entwurf` alias it wrote had no in-repo reader
+# (the ACP provider passes pi's auth check with the no-auth sentinel), and the
+# `auth.json.bak` it left is documented manual-operator-cleanup ONLY. Do not
+# reintroduce credential copying as a convenience helper in any install path.
 
 # Repo dependency integrity is a HARD requirement for install — NOT gated on
 # backend (Claude/ACP) auth. A cloned-but-not-installed or a moved/renamed repo
@@ -514,6 +502,14 @@ PY
 }
 
 install_local_package() {
+  # Named interpreter prerequisite BEFORE any preflight/write (#86 E5): the
+  # packages[]/provider writers below are python3-backed and `entwurf install`
+  # dispatches here directly, so a python3-less host gets this verdict instead
+  # of an accidental mid-write failure.
+  command -v python3 >/dev/null 2>&1 || {
+    echo "[install] entwurf install requires python3 on PATH (settings writers are python3-backed); nothing was written." >&2
+    exit 1
+  }
   local project_dir agent_dir
   project_dir=$(normalize_project_dir "$1")
   agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
@@ -553,19 +549,79 @@ install_local_package() {
 # launchers and the npm consumer's "installs → just works" both need the entry
 # in ~/.pi/agent/settings.json's packages[]. This is the wiring that dropped when
 # `pi install` was removed from setup (2026-07-03: `--entwurf-control` unknown in
-# a foreign cwd). Idempotent: absent → append, present → no-op; a stale entwurf
-# entry at a different path is normalized to REPO_DIR. Every other package and key
-# in the operator's user settings is preserved untouched.
+# a foreign cwd). Idempotent for THIS root: absent → append + owner state, present
+# same-root → no-op. #86 C2 retires the silent normalization of other roots'
+# entries: a different owner (live or missing) is a zero-write refusal that names
+# takeover-user-scope. Every other package and key is preserved untouched.
+_pi_package_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-package/install-state.json"; }
+_pi_provider_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"; }
+
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR"
+  # #86 C2: user scope carries a recorded OWNER (packageRoot in the pi-package
+  # install-state). Another owner — live or missing — makes this a zero-write
+  # ownership refusal (exit 6) that propagates: install fails, setup records the
+  # pi component FAIL. The only writer over another owner is takeover-user-scope.
+  #
+  # ATOMIC (#86 C2 amendment): BOTH ownership halves are decided READ-ONLY before
+  # either writer runs — a provider-side refusal must leave the package side
+  # byte-identical (and vice versa), never a half-installed user scope.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)"
   # #46 Task 2: own entwurfProvider.mcpServers.entwurf-bridge as the bare stable bin at USER scope
   # (GLOBAL/durable →파급s to every cwd), so its inverse needs an install-state honest inverse
   # under $XDG_DATA_HOME/entwurf/pi-provider/ (Task 0/1 discipline). project scope is checkout-
   # local and covered by `run.sh remove` (no state) — deliberate, reasoned asymmetry.
-  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+  # #86 C2: the provider state records installerRoot, so the same foreign-owner refusal
+  # holds here — and the package refusal above fires FIRST, before any provider write.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)"
+}
+
+# takeover-user-scope — the operator-explicit ownership move (#86 C2). The ONLY
+# writer that replaces another root's user-scope registration: normal install/
+# setup/remove refuse instead. Reports old→new for both the packages[] entry
+# (packageRoot) and the provider key (installerRoot). No --force variant exists.
+takeover_user_scope() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}" pp_out
+  command -v python3 >/dev/null 2>&1 || { echo "[takeover] requires python3 on PATH; nothing was written." >&2; exit 1; }
+  section "takeover-user-scope: move the shared user-scope registration to this root"
+  # ATOMIC (#86 C2 amendment): both halves decided READ-ONLY first — an exact-entry
+  # mismatch on the package side or a refusal on the provider side leaves the other
+  # half byte-identical.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --takeover --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --takeover --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --takeover
+  pp_out=$(python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_provider_state)" --takeover)
+  printf '%s\n' "$pp_out"
+  # Split verdict (#86 C2 amendment): a user-override provider key is preserved and
+  # stays UNOWNED — say exactly which half moved instead of a false "both owned".
+  if printf '%s' "$pp_out" | grep -q 'provider override preserved'; then
+    ok "takeover-user-scope: package owner moved to this root ($REPO_DIR); provider key preserved as the operator's override (unowned — doctor-pi-provider reports it as such)"
+  else
+    ok "takeover-user-scope: this root now owns the user-scope registration ($REPO_DIR)"
+  fi
+}
+
+# doctor-pi-package — package-side ownership verdict only (#86 C2): unregistered /
+# owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner.
+# Deliberately NOT mixed into doctor-pi-provider (provider runtime verdicts stay there).
+doctor_pi_package() {
+  local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  command -v python3 >/dev/null 2>&1 || { echo "[doctor-pi-package] requires python3 on PATH." >&2; exit 1; }
+  # #86 C2 amendment: the provider state rides along for the OWNERSHIP coupling
+  # verdict only (installerRoot vs packageRoot mismatch = FAIL); provider RUNTIME
+  # verdicts stay with doctor-pi-provider.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$(_pi_package_state)" --provider-state "$(_pi_provider_state)" --doctor
 }
 
 # The honest inverse of register_user_scope_citizen: drop entwurf from the GLOBAL
@@ -581,11 +637,54 @@ register_user_scope_citizen() {
 # reported rather than deleted — install never writes that form (#53 B).
 remove_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" --remove
+  local pkg_state pp_state orphan_args=()
+  pkg_state="$(_pi_package_state)"; pp_state="$(_pi_provider_state)"
+  # #86 C2 aligned orphan path: --orphan-cleanup is passed ONLY when the package
+  # entry, the package state's packageRoot and the provider state's installerRoot
+  # all name the SAME root and that root is MISSING on disk. Any live foreign
+  # owner, or any mismatch between the three, refuses inside the SSOTs instead.
+  if python3 - "$agent_dir/settings.json" "$pkg_state" "$pp_state" <<'PY'
+import json, os, sys
+settings_path, pkg_state_path, pp_state_path = sys.argv[1:4]
+def load(p):
+    try:
+        with open(p) as fh: return json.load(fh)
+    except (OSError, json.JSONDecodeError): return None
+pkg = load(pkg_state_path)
+if not isinstance(pkg, dict) or not isinstance(pkg.get("packageRoot"), str): sys.exit(1)
+owner = pkg["packageRoot"]
+if os.path.isdir(owner): sys.exit(1)                      # live owner: never orphan
+# Alignment REQUIRES the provider state to exist AND to be bound to the same
+# missing root (#86 C2 amendment): an absent, legacy (no installerRoot) or
+# elsewhere-bound provider state is NOT alignment — both sides refuse instead.
+pp = load(pp_state_path)
+if not isinstance(pp, dict): sys.exit(1)
+if pp.get("installerRoot") != owner: sys.exit(1)
+settings = load(settings_path)
+pkgs = settings.get("packages") if isinstance(settings, dict) else None
+if not isinstance(pkgs, list): sys.exit(1)
+def src(x): return x.get("source") if isinstance(x, dict) else x
+if not any(isinstance(src(x), str) and src(x).rstrip("/") == owner for x in pkgs): sys.exit(1)
+sys.exit(0)
+PY
+  then
+    orphan_args=(--orphan-cleanup)
+    log "remove-user-scope: package entry + package state + provider installerRoot align on a MISSING owner — reported orphan cleanup"
+  fi
+  # ATOMIC (#86 C2 amendment): both removal halves are decided READ-ONLY first, so
+  # a provider-side refusal (live-other, legacy, mismatch) leaves the package
+  # entry/state byte-identical instead of a half-removed user scope.
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pkg_state" --remove ${orphan_args[@]+"${orphan_args[@]}"} --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pp_state" ${orphan_args[@]+"${orphan_args[@]}"} --preflight >/dev/null
+  python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pkg_state" --remove ${orphan_args[@]+"${orphan_args[@]}"}
   # #46 Task 2: honest inverse of the user-scope entwurfProvider ownership — the install-state
   # drives it (absent/managed-* → remove OUR key; a user-override we never owned is untouched).
-  local pp_state="${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/pi-provider/install-state.json"
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$pp_state"
+  # #86 C2: installerRoot makes this same-owner-only; the aligned orphan flag rides along.
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" remove "$agent_dir/settings.json" "$REPO_DIR" \
+    --scope user --state "$pp_state" ${orphan_args[@]+"${orphan_args[@]}"}
 }
 
 # The ~/.pi/agent/entwurf-targets.json symlink machinery (ensure_agent_dir_symlinks
@@ -692,6 +791,42 @@ check_entwurf_capabilities() {
   run_ts scripts/check-entwurf-capabilities.ts
 }
 
+smoke_omp_fresh_live() {
+  # #87 Bundle C acceptance, RELEASE MUST. Opens omp as ONE visible fresh sibling through
+  # the PUBLIC entwurf_fresh_call surface in a private tmux server, correlates the exact
+  # nonce callback to a garden id from the SENDER ENVELOPE, then delivers an addressed
+  # message the sibling drains in that same native session. Decides its own outcome: omp
+  # absent from FRESH_CALL_BACKENDS or without a mailbox rail is a protocol SKIP, LIVE!=1
+  # is a protocol SKIP, and once the composition offers the backend every missing
+  # prerequisite is a FAIL. Writes into the REAL meta roots — the extensions run inside the
+  # launched omp process and no env carrier on the fresh argv could fence them.
+  run_ts scripts/smoke-omp-fresh-live.ts
+}
+
+check_omp_fresh_preflight() {
+  # #87 Bundle C. The OMP fresh preflight REPRODUCES two resolvers that already exist
+  # in this repo in another language — omp_agent_dir (scripts/omp-bridge-oracle.sh) and
+  # the tools.xdev half of scripts/omp-tool-surface.py — because the preflight runs from
+  # two different emit depths and cannot resolve a sibling script by relative path. A
+  # reproduction nothing compares is a divergence with a date on it, so this drives the
+  # SHIPPED shell and python leaves and requires the TS half to agree, refusals included.
+  # Never asks the resolver under test to confirm itself. Fixtures only; never reads ~/.omp.
+  run_ts scripts/check-omp-fresh-preflight.ts
+}
+
+check_harness_admission_parity() {
+  # #87 Bundle C. The EDGE between two parity loops that were each closed and had
+  # nothing between them: check-entwurf-capabilities held registry ==
+  # META_CITIZEN_BACKENDS, the fresh-call surfaces contract held surfaces ==
+  # FRESH_CALL_BACKENDS, and no file read both constants. So a harness could be a
+  # full D6 citizen that entwurf_fresh_call cannot open, with every gate green and
+  # only prose saying it was not supported — which is how an `unsupported` label
+  # started reading as a partial-release permit. Asserts every citizen backend is
+  # either fresh-openable or a DECLARED pre-#82 legacy admission whose exception a
+  # reader can find in DELIVERY.md, both directions, no third state. Pure parse.
+  run_ts scripts/check-harness-admission-parity.ts
+}
+
 check_capability_bundle_reach() {
   # The gate check-entwurf-capabilities structurally cannot be. That gate imports
   # metaCapabilitiesFilePath() from ../pi-extensions/lib/ — the one location where
@@ -1156,7 +1291,11 @@ check_mux_fresh_call() {
   # copilot-fresh-preflight rides here rather than in its own gate: it exists only as
   # freshCall's pre-mutation branch (#82 RAIL 9), and splitting it would let the two halves
   # of one refusal be certified in different runs.
-  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts
+  # omp-fresh-bootstrap.contract rides here for the same reason and one more: it is the ONLY
+  # place the launcher's payload and the installed birth extension's decoder are read together.
+  # They ship in different directories and cannot import each other (#87 Bundle C), so this
+  # lane is what keeps a deliberate duplication from becoming drift.
+  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -2809,6 +2948,9 @@ check_pack() {
     # #65 — the owner-normalized store projection consumers call INSTEAD of
     # parsing the store; installed hosts are exactly where those consumers live.
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
+    # #87 Bundle B — omp-receive-doctor drives this operator projection through
+    # run.sh, so installed node_modules must have the compiled twin too.
+    "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
     # 0.12.5 — the node_modules-safe plugin hook + its lib. install-meta-bridge copies
     # these compiled JS into the assembled plugin when installed (raw .ts can't
     # strip-types under node_modules). meta-session.js is shared with the store-doctor
@@ -2817,6 +2959,13 @@ check_pack() {
     # #82 — the Copilot birth entry's compiled closure, for the same node_modules
     # strip-types refusal that forces the Claude one.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js"
+    # #87 — the OMP birth entry's compiled closure. install-omp-bridge SELECTS this path
+    # under node_modules, and docs/setup-clean-host.md tells operators to run that installer,
+    # so its absence is not a degraded path: the installed installer dies at its own artifact
+    # check before assembling anything. The unit skeleton's package.json below is the other
+    # half — the installer copies it, and `pi/` ships per-FILE.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-omp.js"
+    "pi/meta-bridge-omp/entwurf-meta-omp/package.json"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
@@ -2839,6 +2988,8 @@ check_pack() {
     "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
     "pi-extensions/meta-bridge-hook-copilot.ts"
     "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-uninstall.sh"
+    "scripts/copilot-bridge-oracle.sh"
     "scripts/copilot-bridge-doctor.sh"
     # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
     # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
@@ -3062,12 +3213,21 @@ _check_pack_install_impl() {
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js"
     # #65 — the owner-normalized store projection (see check-pack).
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
+    # #87 Bundle B — omp-receive-doctor reaches this through the installed dispatcher.
+    "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
     # hook regression below runs exactly this compiled JS from under node_modules.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js"
     # #82 — the Copilot birth entry's compiled closure, for the same node_modules
     # strip-types refusal that forces the Claude one.
     "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook-copilot.js"
+    # #87 — the OMP birth entry's compiled closure. install-omp-bridge SELECTS this path
+    # under node_modules, and docs/setup-clean-host.md tells operators to run that installer,
+    # so its absence is not a degraded path: the installed installer dies at its own artifact
+    # check before assembling anything. The unit skeleton's package.json below is the other
+    # half — the installer copies it, and `pi/` ships per-FILE.
+    "mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-omp.js"
+    "pi/meta-bridge-omp/entwurf-meta-omp/package.json"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
@@ -3089,6 +3249,8 @@ _check_pack_install_impl() {
     "pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh"
     "pi-extensions/meta-bridge-hook-copilot.ts"
     "scripts/copilot-bridge-install.sh"
+    "scripts/copilot-bridge-uninstall.sh"
+    "scripts/copilot-bridge-oracle.sh"
     "scripts/copilot-bridge-doctor.sh"
     # #82 RAIL 5 — the Copilot RECEIVER. A vendor EXTENSION (forked child, stdio
     # JSON-RPC), not a plugin, so it ships as its own unit and installs into the user
@@ -3144,9 +3306,9 @@ _check_pack_install_impl() {
   # to our pnpm-workspace.yaml; --ignore-scripts blocks the husky
   # prepare hook (and any future install scripts) from running inside
   # the consumer project. Peer deps are pinned to the CURRENT pi release
-  # baseline (0.82.x — the pins below are what check-dep-versions binds to
-  # the package.json devDep) so the smoke matches the same shape an external
-  # pi user would have after `pi install`.
+  # baseline (the package.json devDep pin — the pins below are what
+  # check-dep-versions binds to that devDep) so the smoke matches the same
+  # shape an external pi user would have after `pi install`.
   local tmp npm_tmp
   tmp=$(mktemp -d -t entwurf-install-smoke.XXXXXX)
   # Separate tree for the npm-managed regression below: npm install must NOT be
@@ -3171,8 +3333,15 @@ _check_pack_install_impl() {
   # {pi-agent-core, pi-ai, pi-tui} at 0.83.0 to {pi-agent-core, pi-ai, pi-client,
   # pi-protocol, pi-tui}, so pi-client and pi-protocol are pinned here for the
   # first time. Unpinned they would float exactly like pi-agent-core did in the
-  # 2026-07-21 incident above. (pi-telemetry arrives transitively, not as a
-  # direct caret; the leak assertion below covers it and every other pi package.)
+  # 2026-07-21 incident above. pi-telemetry joined the explicit pin list on
+  # 2026-08-31: it arrives transitively (pi-agent-core and pi-ai both carry
+  # `^0.84.3` carets on it), and upstream's 0.84.4 patch publish (2026-08-28
+  # 22:04Z) floated that caret in this lockfile-less temp install, turning CI
+  # red through the leak assertion below. The bump itself stays a separate
+  # hard-cut lane (#87 thread / NEXT "Do not touch: Pi 0.84.4") — pinning the
+  # drift shut is how the verified 0.84.3 runtime stays OURS to hold. The leak
+  # assertion below still covers every other pi package, including any package
+  # a future pi bump adds to the closure.
   echo "[check-pack-install] pnpm add into $tmp (with 0.84.x peers + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
@@ -3183,6 +3352,7 @@ _check_pack_install_impl() {
     "@earendil-works/pi-agent-core@0.84.3" \
     "@earendil-works/pi-client@0.84.3" \
     "@earendil-works/pi-protocol@0.84.3" \
+    "@earendil-works/pi-telemetry@0.84.3" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3414,6 +3584,230 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
   fi
   echo "[check-pack-install] user-scope citizen regression pass (npm consumer: --entwurf-control loads from a foreign cwd)"
 
+  # Two-root ownership row (#86 C2, L1b extension): a SECOND npm root under the
+  # SAME consumer HOME must not silently steal the user-scope registration the
+  # first root owns — normal install refuses (naming takeover-user-scope) and the
+  # operator-explicit takeover is what moves the shared entry, old→new reported.
+  local npmroot2="$npm_tmp/npmroot2" npmproj2="$npm_tmp/npmproj2" npm2_log two_root_out two_root_rc npm2_pkg
+  mkdir -p "$npmroot2" "$npmproj2"
+  npm2_log=$(cd "$npmroot2" && npm install "$tgz_path" --no-audit --no-fund 2>&1) || {
+    fail "[check-pack-install] second npm root install failed:"
+    echo "$npm2_log" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  }
+  npm2_pkg="$npmroot2/node_modules/@junghanacs/entwurf"
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" install "$npmproj2" 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -eq 0 ] || ! grep -q "takeover-user-scope" <<<"$two_root_out"; then
+    fail "[check-pack-install] a second npm root's normal install must REFUSE the owned user-scope registration and name takeover-user-scope (rc=$two_root_rc):"
+    echo "$two_root_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+ok_a=any(isinstance(s,str) and s.rstrip('/')== '$npm_pkg' for s in srcs)
+bad_b=any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs)
+sys.exit(0 if ok_a and not bad_b else 1)
+"; then
+    fail "[check-pack-install] the refused second-root install still altered the user-scope packages[] entry:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" takeover-user-scope 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -ne 0 ] || ! grep -q "takeover: user-scope entwurf registration moved" <<<"$two_root_out"; then
+    fail "[check-pack-install] explicit takeover-user-scope from the second root failed (rc=$two_root_rc):"
+    echo "$two_root_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+ok_b=any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs)
+bad_a=any(isinstance(s,str) and s.rstrip('/')== '$npm_pkg' for s in srcs)
+sys.exit(0 if ok_b and not bad_a else 1)
+"; then
+    fail "[check-pack-install] takeover did not move the user-scope entry old→new:"
+    sed 's/^/    /' "$npm_user_settings" >&2
+    return 1
+  fi
+  # #86 C2 amendment: BOTH ownership halves moved — the provider installerRoot must
+  # now name the new root, and the OLD root's inverse must refuse (live foreign owner).
+  if ! python3 -c "
+import json,sys
+st=json.load(open('$npmhome/.local/share/entwurf/pi-provider/install-state.json'))
+sys.exit(0 if st.get('installerRoot','').rstrip('/')== '$npm2_pkg' else 1)
+"; then
+    fail "[check-pack-install] takeover did not rebind the provider installerRoot to the new root:"
+    sed 's/^/    /' "$npmhome/.local/share/entwurf/pi-provider/install-state.json" >&2
+    return 1
+  fi
+  set +e
+  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" remove-user-scope 2>&1)
+  two_root_rc=$?
+  set -e
+  if [ "$two_root_rc" -eq 0 ] || ! python3 -c "
+import json,sys
+p=json.load(open('$npm_user_settings')).get('packages',[])
+srcs=[(x if isinstance(x,str) else x.get('source')) for x in p]
+sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in srcs) else 1)
+"; then
+    fail "[check-pack-install] the OLD root's remove-user-scope must refuse after takeover (rc=$two_root_rc) and leave the new owner's entry intact:"
+    echo "$two_root_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] two-root ownership row pass (second root: normal install refused naming takeover-user-scope; explicit takeover moved entry + provider installerRoot old->new; old root's inverse refused)"
+
+  # Installed-package aggregate `setup` row (#86 C1, review blocker 2026-08-26):
+  # the composed public command itself, driven through the consumer bin from the
+  # SAME installed candidate, on a FRESH sandbox home with every harness absent.
+  # This is the first living consumer of package-installed `entwurf setup`:
+  # mode=installed decided by name before anything else, NO pnpm bootstrap inside
+  # node_modules, pi/claude/agy explicit zero-state SKIPs, stable bins PASS as
+  # npm-provided, core bridge boundary PASS, computed green, zero harness/auth
+  # writes. Harness probes are pinned absent via the PI_BIN/CLAUDE_BIN/AGY_BIN/
+  # COPILOT_BIN seams so the gate host's real harnesses never leak in.
+  local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
+  mkdir -p "$setup_home/.pi/agent" "$setup_proj"
+  setup_auth="$setup_home/.pi/agent/auth.json"
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "consumer-oauth-token"\n  }\n}\n' > "$setup_auth"
+  local setup_auth_before
+  setup_auth_before="$(sha256sum "$setup_auth" | cut -d' ' -f1)"
+  set +e
+  setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
+    XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
+    PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" \
+    "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
+  setup_rc=$?
+  set -e
+  if [ "$setup_rc" -ne 0 ]; then
+    fail "[check-pack-install] installed all-absent setup exited $setup_rc — core must stay green with every harness absent, and an installed package must never re-enter the source pnpm bootstrap:"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! head -n 1 <<<"$setup_out" | grep -q "mode: installed package"; then
+    fail "[check-pack-install] installed setup did not name its mode FIRST:"
+    echo "$setup_out" | head -5 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if grep -Eqi "pnpm install|Lockfile is up to date|Progress: resolved" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup reached the source pnpm bootstrap inside node_modules:"
+    echo "$setup_out" | grep -Ei "pnpm|Lockfile|Progress" | sed 's/^/    /' >&2
+    return 1
+  fi
+  local skip_probe
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP"; do
+    if ! grep -q "$skip_probe" <<<"$setup_out"; then
+      fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
+      echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if ! grep -q "bins: PASS — provided by npm bin linking" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup must report stable bins PASS as npm-provided (capability present, not absent):"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! grep -q "core: PASS" <<<"$setup_out" || ! grep -q "result: green (computed from the component outcomes above)" <<<"$setup_out"; then
+    fail "[check-pack-install] installed setup core/computed-green missing:"
+    echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if [ -e "$setup_proj/.pi" ] || [ -e "$setup_home/.pi/agent/settings.json" ] || [ -e "$setup_home/.gemini" ] || [ -e "$setup_home/.copilot" ]; then
+    fail "[check-pack-install] installed all-absent setup wrote harness state (must be zero-write)"
+    return 1
+  fi
+  if [ "$(sha256sum "$setup_auth" | cut -d' ' -f1)" != "$setup_auth_before" ] || [ -e "$setup_auth.bak" ]; then
+    fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
+    return 1
+  fi
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 4x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+
+  # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
+  # bin on a fresh sandbox home, with the shared fake vendor
+  # (scripts/fake-copilot-vendor.sh) on PATH. The presence-driven composition
+  # must run all FOUR Copilot units from the installed package: birth assembles
+  # the COMPILED hook (no raw .ts under node_modules) and drives the real
+  # marketplace-add→plugin-install sequence, MCP + receiver + footer land their
+  # configs/units in the sandbox, each unit keeps its package-owned
+  # install-state (its inverse authority), and the verdict is computed green.
+  local cop_setup_home="$npm_tmp/copsetuphome" cop_setup_proj="$npm_tmp/copsetupproj" cop_fake="$npm_tmp/fake-copilot-vendor"
+  mkdir -p "$cop_setup_home/.pi/agent" "$cop_setup_proj"
+  printf '{\n  "anthropic": {\n    "type": "oauth",\n    "access": "consumer-oauth-token"\n  }\n}\n' > "$cop_setup_home/.pi/agent/auth.json"
+  local cop_auth_before
+  cop_auth_before="$(sha256sum "$cop_setup_home/.pi/agent/auth.json" | cut -d' ' -f1)"
+  # EXECUTED, never sourced: this impl holds a `trap … RETURN`, and bash fires a
+  # RETURN trap when a sourced script finishes — a `. factory` here deleted the
+  # whole npm sandbox mid-gate (measured 2026-08-27, C3b review).
+  bash "$REPO_DIR/scripts/fake-copilot-vendor.sh" "$cop_fake" "$npm_pkg/pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json" || {
+    fail "[check-pack-install] could not build the fake copilot vendor from the PACKED plugin.json (is pi/meta-bridge-copilot missing from the tarball?)"
+    return 1
+  }
+  set +e
+  setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
+    XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
+    PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
+    "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
+  setup_rc=$?
+  set -e
+  if [ "$setup_rc" -ne 0 ]; then
+    fail "[check-pack-install] installed copilot-present setup exited $setup_rc — the four-unit composition must be green against the fake vendor:"
+    echo "$setup_out" | tail -30 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_row
+  for cop_row in "copilot-birth: PASS" "copilot-mcp: PASS" "copilot-receive: PASS" "copilot-statusline: PASS"; do
+    if ! grep -q "$cop_row" <<<"$setup_out"; then
+      fail "[check-pack-install] installed copilot-present setup missing unit verdict '$cop_row':"
+      echo "$setup_out" | tail -30 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if ! grep -q "result: green (computed from the component outcomes above)" <<<"$setup_out"; then
+    fail "[check-pack-install] installed copilot-present setup did not compute green:"
+    echo "$setup_out" | tail -10 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local cop_setup_asm="$cop_setup_home/.local/share/entwurf/meta-bridge-copilot/.assembled/entwurf-meta-receive-copilot"
+  if [ ! -f "$cop_setup_asm/meta-bridge-hook-copilot.js" ] || [ -f "$cop_setup_asm/meta-bridge-hook-copilot.ts" ]; then
+    fail "[check-pack-install] installed copilot-present setup did not assemble the compiled birth hook (want meta-bridge-hook-copilot.js, no raw .ts) in $cop_setup_asm"
+    return 1
+  fi
+  if ! grep -q "^plugin marketplace add " "$cop_fake/calls.log" || ! grep -q "^plugin install entwurf-meta-receive-copilot@meta-bridge-copilot-local$" "$cop_fake/calls.log"; then
+    fail "[check-pack-install] installed copilot-present setup did not drive the vendor sequence (marketplace add + plugin install) — calls:"
+    sed 's/^/    /' "$cop_fake/calls.log" >&2
+    return 1
+  fi
+  if [ ! -f "$cop_setup_home/.copilot/extensions/entwurf-receive/extension.mjs" ] || [ ! -f "$cop_setup_home/.copilot/extensions/entwurf-receive/lib/meta-session.js" ]; then
+    fail "[check-pack-install] installed copilot-present setup did not deploy the receiver unit from the shipped dist closure"
+    return 1
+  fi
+  if ! grep -q "entwurf-bridge" "$cop_setup_home/.copilot/mcp-config.json" || ! grep -q "entwurf-copilot-statusline" "$cop_setup_home/.copilot/settings.json"; then
+    fail "[check-pack-install] installed copilot-present setup did not land the MCP config / footer settings in the sandbox home"
+    return 1
+  fi
+  local cop_state
+  for cop_state in copilot-bridge copilot-mcp copilot-receive copilot-statusline; do
+    if [ ! -f "$cop_setup_home/.local/share/entwurf/$cop_state/install-state.json" ]; then
+      fail "[check-pack-install] installed copilot-present setup left no package-owned install-state for $cop_state (its inverse authority)"
+      return 1
+    fi
+  done
+  if [ "$(sha256sum "$cop_setup_home/.pi/agent/auth.json" | cut -d' ' -f1)" != "$cop_auth_before" ] || [ -e "$cop_setup_home/.pi/agent/auth.json.bak" ]; then
+    fail "[check-pack-install] installed copilot-present setup touched the credential store (byte drift or .bak)"
+    return 1
+  fi
+  echo "[check-pack-install] installed copilot-present setup pass (four units PASS with install-states, compiled birth hook, vendor sequence driven, computed green, credentials untouched)"
+
   # Installed meta-bridge ownership regression (0.12.5): package upgrades must not
   # bake versioned pnpm-store paths into Claude settings. MCP already uses the
   # stable `entwurf-bridge` bin; statusLine must now use `entwurf-statusline`, and
@@ -3572,6 +3966,76 @@ SH
   fi
   rm -rf "$cop_store"
   echo "[check-pack-install] installed Copilot birth unit assembles its compiled branch and mints a citizen from a no-argv launch"
+
+  # --- #87: the OMP birth unit's INSTALLED-PACKAGE branch ---------------------
+  # Same shape and same reason as the Copilot cell above, and it is here because the gap it
+  # closes was REAL, not theoretical: the compiled entry this installer selects under
+  # node_modules was in no emit include and no artifact list, so `entwurf install-omp-bridge`
+  # — which docs/setup-clean-host.md tells operators to run — died at its own artifact check
+  # on every installed host while every gate stayed green (Terra amendment review, #87 A1).
+  # The list entries above make that artifact's ABSENCE loud; this RUNS it, which is the half
+  # Hard Rule 11 says a list can never stand in for.
+  #
+  # No omp binary is faked into doing anything: the installer only asks whether one is on
+  # PATH (entwurf never installs a harness), and the unit is a module the vendor imports, not
+  # a process we launch — so the exercise imports the placed artifact the way omp does.
+  local omp_agent="$npm_tmp/omp-agent" omp_home="$npm_tmp/omp-home" omp_bin="$npm_tmp/omp-bin" omp_log
+  mkdir -p "$omp_agent" "$omp_home" "$omp_bin"
+  printf '#!/usr/bin/env bash\nexit 0\n' > "$omp_bin/omp"
+  chmod +x "$omp_bin/omp"
+  if ! omp_log=$(HOME="$omp_home" XDG_DATA_HOME="$omp_home/.local/share" ENTWURF_OMP_AGENT_DIR="$omp_agent" PATH="$omp_bin:$npmroot/node_modules/.bin:$PATH" "$npm_pkg/run.sh" install-omp-bridge 2>&1); then
+    fail "[check-pack-install] installed install-omp-bridge failed:"
+    echo "$omp_log" | tail -20 | sed 's/^/    /' >&2
+    return 1
+  fi
+  local omp_unit="$omp_agent/extensions/entwurf-meta-omp"
+  # Branch SELECTION, pinned exactly as the Copilot cell pins its own: an installed package
+  # must place the compiled entry and NO raw .ts, or the fire below could pass on a layout
+  # that silently chose the dev-clone branch.
+  if [ ! -f "$omp_unit/index.js" ] || [ -f "$omp_unit/index.ts" ]; then
+    fail "[check-pack-install] installed install-omp-bridge did not select the compiled branch (want index.js, no raw .ts) in $omp_unit"
+    ls -l "$omp_unit" 2>/dev/null | sed 's/^/    /' >&2 || true
+    return 1
+  fi
+  if [ ! -f "$omp_unit/lib/meta-session.js" ] || [ ! -f "$omp_unit/entwurf-capabilities.json" ] || [ ! -f "$omp_unit/package.json" ]; then
+    fail "[check-pack-install] installed omp unit is incomplete (want lib/meta-session.js + entwurf-capabilities.json + package.json) in $omp_unit"
+    return 1
+  fi
+  # Fired the way omp fires it: import the module, call the exported factory with a mock
+  # ExtensionAPI, and hand the tui host context to the birth edge.
+  local omp_fire
+  if ! omp_fire=$(OMP_UNIT="$omp_unit" HOME="$omp_home" node --input-type=module <<'JS' 2>&1
+const mod = await import(process.env.OMP_UNIT + "/index.js");
+const handlers = [];
+(mod.default ?? mod)({ on: (event, handler) => { if (event === "session_start") handlers.push(handler); } });
+const ctx = {
+  mode: "tui",
+  cwd: "/tmp",
+  ui: { setStatus: () => {} },
+  sessionManager: { getSessionId: () => "pack-omp-probe", getCwd: () => "/tmp", getSessionFile: () => null },
+};
+for (const handler of handlers) await handler({ type: "session_start" }, ctx);
+process.stdout.write("fired " + handlers.length + "\n");
+JS
+  ); then
+    fail "[check-pack-install] the installed omp unit failed to import/run from its placed location: $(printf '%s' "$omp_fire" | tr '\n' ' ' | cut -c1-300)"
+    return 1
+  fi
+  # Counted through the OWNER's certified projection, not a grep — and through the INSTALLED
+  # bin, so this also proves dist/scripts/meta-facts.js is reachable from a consumer. `env -u
+  # PI_CODING_AGENT_DIR` is the omp root policy: for backend omp that variable is the vendor's
+  # own agent dir and never a garden root (#87 B1).
+  local omp_citizens
+  omp_citizens=$(env -u PI_CODING_AGENT_DIR HOME="$omp_home" "$npm_pkg/run.sh" meta-facts 2>&1 | python3 -c '
+import json, sys
+facts = json.load(sys.stdin)
+print(sum(1 for c in (facts.get("citizens") or []) if c.get("backend") == "omp"))
+' 2>/dev/null) || omp_citizens=""
+  if [ "$omp_citizens" != "1" ]; then
+    fail "[check-pack-install] the installed omp unit did not mint exactly one CERTIFIED omp citizen (found ${omp_citizens:-<unreadable>}); log: $(tail -1 "$omp_home/.pi/agent/meta-bridge-hook.log" 2>/dev/null)"
+    return 1
+  fi
+  echo "[check-pack-install] installed OMP birth unit places its compiled branch and mints a certified citizen from a tui birth edge"
   python3 - "$mb_cfg/settings.json" "$mb_home/.claude.json" "$stable_asm" <<'PY'
 import json, sys
 settings = json.load(open(sys.argv[1]))
@@ -4226,24 +4690,109 @@ check_bridge() {
 }
 
 
-# setup_all — full entwurf v2 install.
+# ── setup verdict engine (#86 C1) ────────────────────────────────────────────
+# setup composes harnesses the operator ALREADY installed. Per component the
+# verdict is PASS (detected + completed), SKIP (truly absent — zero state
+# written), or FAIL (detected but incomplete/below-floor/refused). The final
+# summary and exit status are COMPUTED from these outcomes: core survival never
+# relabels a detected harness failure as green, and a FAIL owns a nonzero setup
+# result while every valid earlier write stays installed (re-running setup is
+# the documented repair action).
+SETUP_RESULTS=()
+setup_result() {  # $1=component $2=PASS|SKIP|FAIL $3=detail
+  SETUP_RESULTS+=("$1|$2|$3")
+  case "$2" in
+    PASS) ok "$1: PASS — $3" ;;
+    SKIP) log "$1: SKIP — $3" ;;
+    *)    fail "$1: FAIL — $3" ;;
+  esac
+}
+
+# Installed-vs-source is decided by PACKAGE LOCATION — the same `*/node_modules/*`
+# seam run_ts and the bridge launcher already branch on — never by which of
+# pnpm/pi happens to be missing (an accidental failure is not a mode gate).
+setup_mode() {
+  case "$REPO_DIR" in
+    */node_modules/*) echo installed ;;
+    *) echo source ;;
+  esac
+}
+
+# Supported pi range, derived at runtime from the package.json devDependencies
+# pin (the SSOT check-dep-versions binds: peer range == `>=<pin> <0.<minor+1>`).
+# Never retyped here as a second literal.
+pi_supported_range() {
+  node -e '
+    const pkg = require(process.argv[1]);
+    const pin = pkg.devDependencies?.["@earendil-works/pi-coding-agent"];
+    if (!/^0\.\d+\.\d+$/.test(pin ?? "")) { console.error(`unparseable pi pin: ${pin}`); process.exit(1); }
+    const [, min] = pin.split(".").map(Number);
+    console.log(`>=${pin} <0.${min + 1}`);
+  ' "$REPO_DIR/package.json"
+}
+
+pi_version_in_range() {  # $1=detected version  $2=range ">=a.b.c <x.y"; exit 0 in-range
+  node -e '
+    const [ver, range] = process.argv.slice(1);
+    const m = range.match(/^>=(\d+)\.(\d+)\.(\d+) <(\d+)\.(\d+)$/);
+    const v = ver.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!m || !v) process.exit(2);
+    const [maj, min, pat] = v.slice(1).map(Number);
+    const lo = m.slice(1, 4).map(Number);
+    const hi = m.slice(4, 6).map(Number);
+    const geFloor = maj > lo[0] || (maj === lo[0] && (min > lo[1] || (min === lo[1] && pat >= lo[2])));
+    const ltCeil = maj < hi[0] || (maj === hi[0] && min < hi[1]);
+    process.exit(geFloor && ltCeil ? 0 : 1);
+  ' "$1" "$2"
+}
+
+# setup_all — one-command presence-driven composition (#86).
 #
-# Installs the v2 dispatch substrate + MCP entwurf-bridge into a target project
-# and verifies the installed bridge boundary. ACP/v1 backend interview gates are
-# deliberately not part of setup on v2-only; the heavier live v2 substrate proof
-# is release-gate's job.
+# Entwurf installs itself only: this command completes the integration of each
+# harness the operator already installed and NEVER installs a harness binary,
+# subscription, credential or login — `pi` has no privileged exception. It
+# verifies the installed bridge boundary; ACP/v1 backend interview gates are
+# deliberately not part of setup on v2-only (the heavier live v2 substrate
+# proof is release-gate's job). Copilot's four native units (birth / MCP /
+# receiver / visible footer) compose presence-driven since the birth inverse
+# landed (#86 C3a→C3b); the explicit install-copilot-* / uninstall-copilot-*
+# surfaces remain the operator-selected repair and inverse path.
 #
 # An external harness that consumes entwurf (e.g. agent-config as a
 # pi package + skills set) may still have its own install/setup for its
 # own concerns; those are outside the scope of this script.
 setup_all() {
+  # MODE FIRST (#86 C1): the installed-vs-source branch is a NAMED decision
+  # ahead of every prerequisite check and write, so an installed consumer is
+  # never mode-gated by an accidental missing `pnpm`/`pi`.
+  local mode
+  mode=$(setup_mode)
+  case "$mode" in
+    installed)
+      echo "[setup] mode: installed package — composition only (no source bootstrap; setup never runs npm/pnpm inside node_modules)" ;;
+    *)
+      echo "[setup] mode: source checkout — repo dev bootstrap, then the same composition semantics" ;;
+  esac
+
+  # Named interpreter prerequisite, decided BEFORE any write (#86 C1/E5):
+  # setup's project-path normalization and every pi/agy wiring writer are
+  # python3-backed today. `entwurf --help` / `entwurf check-bridge` stay
+  # python3-free; only the commands that invoke those writers declare it.
+  command -v python3 >/dev/null 2>&1 || {
+    echo "[setup] entwurf setup requires python3 on PATH (project-path normalization + wiring writers)." >&2
+    echo "[setup] Install python3, or use python3-free surfaces (--help, check-bridge)." >&2
+    exit 1
+  }
+  require_cmd node
+
   local project_dir
   project_dir=$(normalize_project_dir "$1")
 
-  require_cmd pnpm
-  require_cmd python3
-  require_cmd pi
-  require_cmd node
+  if [ "$mode" = "source" ]; then
+    # Source-only dev fixtures: the pinned repo dependencies are build/test
+    # fixtures, never a product promise that consumers receive them (#86 A4).
+    require_cmd pnpm
+  fi
 
   # Node 24+ is the SINGLE supported axis (GLG, 2026-07-21). The floor is not
   # derived from a feature gate: type-stripping alone would only demand 23.6.
@@ -4264,81 +4813,217 @@ setup_all() {
   echo "[setup] scope:   entwurf v2 package + detected native-harness bridges + pi adapter"
   echo "[setup] verification: v2 install smoke (entwurf-bridge; LIVE substrate = release-gate)"
 
-  # Store gate FIRST — ahead of pnpm install, sync_auth (which creates and
-  # rewrites ~/.pi/agent/auth.json) and every settings writer below. On an
-  # existing development host this is the only step standing between a `git pull`
-  # and a V3-only activation over a store the live schema cannot read; putting
-  # it inside install_local_package would already be one auth.json write too
-  # late. The store-doctor imports repo-local libs and node builtins only, so it
-  # runs before dependencies exist.
+  # Store gate FIRST — ahead of the source bootstrap and every settings writer
+  # below. On an existing development host this is the only step standing
+  # between a `git pull` and a V3-only activation over a store the live schema
+  # cannot read; putting it inside install_local_package would already be one
+  # write too late. The store-doctor imports repo-local libs and node builtins
+  # only, so it runs before dependencies exist.
   preflight_v3_store setup
 
-  (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
-  sync_auth
-  install_local_package "$project_dir"
-
-  # Single confident install command (GLG 2026-06-23): setup ALSO wires the
-  # native-harness meta-bridge, so a relocate/clone needs ONE command — not the
-  # install + install-meta-bridge two-pronged split that froze the Claude
-  # statusLine on the old path (the 2026-06-23 relocation gap). Detection-gated:
-  # a pi-only host with no native harness skips it cleanly (rail “Shipped adapters” — "있으면 설정,
-  # 없으면 담아준다"); meta-bridge-install.sh is itself idempotent.
-  if command -v claude >/dev/null 2>&1; then
+  SETUP_RESULTS=()
+
+  if [ "$mode" = "source" ]; then
+    # Source bootstrap is the ONLY install-mode difference (#86): the pinned
+    # repo dev dependencies are fixtures this checkout builds/tests with. A
+    # broken bootstrap is a broken checkout — crash, don't degrade.
+    (cd "$REPO_DIR" && pnpm install --frozen-lockfile)
+  fi
+
+  # ── pi (presence + floor, #86 C1/C9) ── pi is OPTIONAL-BY-PRESENCE: absent is
+  # an explicit zero-state SKIP (setup never installs pi and writes no Pi
+  # wiring), below-floor/unreadable is detected-incomplete FAIL — never a SKIP,
+  # so a stale pi is told the truth instead of being silently skipped. PI_BIN
+  # pins the probe for the hermetic smoke (same seam as AGY_BIN); production
+  # leaves it unset.
+  local pi_bin="${PI_BIN:-pi}" pi_range pi_ver
+  if ! command -v "$pi_bin" >/dev/null 2>&1; then
+    setup_result pi SKIP "pi not on PATH — zero Pi wiring written (the operator installs pi; setup never does)"
+  else
+    pi_range=$(pi_supported_range)
+    # Bounded capture: a resolvable pi whose --version crashes or prints garbage
+    # must land in the computed FAIL verdict below, never abort setup via set -e
+    # before the summary (review defect, 2026-08-26).
+    pi_ver="$("$pi_bin" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')" || pi_ver=""
+    if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
+      setup_result pi FAIL "detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range — Pi wiring not written; align pi, then re-run setup"
+    elif (install_local_package "$project_dir"); then
+      setup_result pi PASS "project + user-scope wiring complete (pi $pi_ver in $pi_range) — verify: ./run.sh doctor-pi-provider"
+    else
+      setup_result pi FAIL "pi wiring did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── claude (meta-bridge) ── single confident install command (GLG 2026-06-23):
+  # setup ALSO wires the native-harness meta-bridge so a relocate/clone needs ONE
+  # command. Detection-gated ("있으면 설정, 없으면 담아준다");
+  # meta-bridge-install.sh is idempotent and enforces the Claude floor + its own
+  # named prerequisites itself, so a below-floor or refused host lands here as a
+  # detected FAIL, never a cosmetic green. CLAUDE_BIN pins the probe for the
+  # hermetic smoke; production leaves it unset.
+  local claude_bin="${CLAUDE_BIN:-claude}"
+  if ! command -v "$claude_bin" >/dev/null 2>&1; then
+    setup_result claude SKIP "claude not on PATH — zero meta-bridge wiring written"
+  else
     section "meta-bridge install (native harness detected: Claude Code)"
-    (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh)
+    if (cd "$REPO_DIR" && bash scripts/meta-bridge-install.sh); then
+      setup_result claude PASS "meta-bridge wired — verify: ./run.sh doctor-meta-bridge"
+    else
+      setup_result claude FAIL "detected Claude Code, but the meta-bridge integration did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── stable command exposure ── source mode exposes entwurf's STABLE bins on
+  # PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the operator command
+  # `entwurf` that Copilot fresh resolves as its managed runtime, plus the bare
+  # bridge/statusline/imprint names native-harness configs record. An installed
+  # consumer already has the same commands from npm bin linking — nothing to
+  # expose there. The core operator stays fail-loud; helper units are attempted
+  # independently and a refused helper is a named FAIL, not a cosmetic green.
+  local bins_rc
+  if [ "$mode" = "installed" ]; then
+    # PASS, not SKIP (review, 2026-08-26): the capability IS present — npm bin
+    # linking provides the same stable commands the source lane must expose.
+    # SKIP stays reserved for a truly absent capability with zero state.
+    setup_result bins PASS "provided by npm bin linking (installed package needs no source exposure)"
   else
-    echo "[setup] no native harness (claude) on PATH — skipping meta-bridge wiring (pi-only host)"
-  fi
-
-  # Expose entwurf's STABLE bins on PATH for this DEV checkout (막힘 ②) BEFORE wiring agy: the
-  # agy mcp_config, settings.statusLine, and hooks.json record the bare names `entwurf-bridge` /
-  # `entwurf-agy-statusline` / `entwurf-agy-imprint`, so they must resolve for the agy doctors
-  # to pass. NON-FATAL — a foreign bin already on PATH is left as-is.
-  expose_dev_bin
-
-  # Fold agy (Antigravity) MCP bridge wiring into setup (막힘 ①, GLG 2026-07-04: install
-  # ownership moves to entwurf). Same detection-gated, idempotent, NON-FATAL posture as the
-  # meta-bridge block above — agy is an OPTIONAL harness, so a refused/corrupt agy config warns
-  # but never bricks a pi/Claude setup. The hard gate stays doctor-agy-bridge.
-  wire_agy_bridge
-
-  # Fold agy statusLine wiring into setup (#46 Task 1: own the ambient status area so it shows
-  # driver + garden id, the claude meta-bridge symmetry). Same detection-gated NON-FATAL posture
-  # — an explicit install-agy-statusline is fail-loud, but the setup wrapper WARNs + continues.
-  wire_agy_statusline
-
-  # Fold agy PreInvocation birth imprint wiring into setup (#46 close criterion: manual register 0).
-  # The hook runs the thin `entwurf-agy-imprint` bin and returns {"injectSteps":[]} so agy's loop
-  # survives while the meta-record is created/attached by conversationId.
-  wire_agy_hooks
-
-  # Deterministic preflight lives in `pnpm run check:full`; live substrate acceptance lives
-  # in `LIVE=1 ./run.sh release-gate <scratch> --cut`. Setup is the install path, so it
-  # verifies the installed MCP bridge boundary only and does NOT run the legacy
-  # ACP/v1 session-messaging/sentinel gates.
-  section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
-  validate_entwurf_bridge
+    bins_rc=0; expose_dev_bin || bins_rc=$?
+    if [ "$bins_rc" -eq 0 ]; then
+      setup_result bins PASS "source operator + helper bins exposed and certified (PATH winner: this checkout)"
+    elif [ "$bins_rc" -eq 3 ]; then
+      setup_result bins FAIL "foreign helper bin(s) refused (named above; every unit was attempted) — repair them, then re-run setup"
+    else
+      setup_result bins FAIL "source operator command not certified (see above) — repair PATH/link, then re-run setup"
+    fi
+  fi
 
-  echo ""
-  echo "DONE: entwurf setup (pi adapter + detected native bridges + v2 install smoke) green."
-  if command -v claude >/dev/null 2>&1; then
-    echo "Verify Claude wiring with: ./run.sh doctor-meta-bridge"
+  # ── agy (Antigravity) ── detection-gated (막힘 ①, GLG 2026-07-04: install
+  # ownership moves to entwurf); AGY_BIN pins the probe for the hermetic smoke.
+  # agy absent is one zero-state SKIP. agy PRESENT runs all three leaves
+  # (bridge / statusLine / PreInvocation imprint) independently; a refused or
+  # corrupt config is a named component FAIL that keeps the rest of setup alive
+  # but owns a nonzero final result — the old WARN-then-green posture is retired
+  # (#86 C6/C7). Hard per-leaf verdicts stay with the doctor commands.
+  local agy_rc
+  if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
+    setup_result agy SKIP "agy not on PATH — zero agy wiring written"
+  else
+    agy_rc=0; wire_agy_bridge || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-bridge PASS "MCP bridge wired — verify: ./run.sh doctor-agy-bridge"
+    else
+      setup_result agy-bridge FAIL "detected agy, but the MCP bridge integration did not complete (reason above) — repair, then re-run setup"
+    fi
+    agy_rc=0; wire_agy_statusline || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-statusline PASS "statusLine wired — verify: ./run.sh doctor-agy-statusline"
+    else
+      setup_result agy-statusline FAIL "detected agy, but the statusLine integration did not complete (reason above) — repair, then re-run setup"
+    fi
+    agy_rc=0; wire_agy_hooks || agy_rc=$?
+    if [ "$agy_rc" -eq 0 ]; then
+      setup_result agy-hooks PASS "birth imprint wired — verify: ./run.sh doctor-agy-hooks"
+    else
+      setup_result agy-hooks FAIL "detected agy, but the birth-imprint integration did not complete (reason above) — repair, then re-run setup"
+    fi
   fi
-  if command -v agy >/dev/null 2>&1; then
-    echo "Verify agy wiring with:    ./run.sh doctor-agy-bridge"
-    echo "                           ./run.sh doctor-agy-statusline"
-    echo "                           ./run.sh doctor-agy-hooks"
+
+  # ── copilot (GitHub Copilot CLI) ── presence-driven composition (#86 C3b):
+  # the operator's copilot on PATH is the ONLY trigger; absent is one zero-state
+  # SKIP (setup never installs a harness). Present runs all FOUR units the
+  # fresh-call preflight requires — birth → MCP → receiver → visible footer —
+  # INDEPENDENTLY: a failed unit is a named component FAIL that keeps the other
+  # units and the rest of setup alive but owns a nonzero final result. Every
+  # unit is an operator-selectable install with a package-owned inverse (#86
+  # C3a closed the birth inverse), so setup composes only lifecycles it can
+  # also undo. COPILOT_BIN pins the PROBE for the hermetic gates (same seam
+  # spirit as PI_BIN/CLAUDE_BIN/AGY_BIN); the unit scripts address the vendor
+  # as `copilot` on PATH, so production leaves it unset and the two agree.
+  local copilot_rc
+  if ! command -v "${COPILOT_BIN:-copilot}" >/dev/null 2>&1; then
+    setup_result copilot SKIP "copilot not on PATH — zero Copilot wiring written"
+  else
+    section "copilot units (native harness detected: GitHub Copilot CLI)"
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-birth PASS "birth plugin installed — verify: ./run.sh doctor-copilot-bridge"
+    else
+      setup_result copilot-birth FAIL "detected copilot, but the birth plugin install did not complete (see above) — repair, then re-run setup"
+    fi
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-mcp-bridge.sh install) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-mcp PASS "MCP server registered — verify: ./run.sh doctor-copilot-mcp"
+    else
+      setup_result copilot-mcp FAIL "detected copilot, but the MCP registration did not complete (see above) — repair, then re-run setup"
+    fi
+    # The receiver deploys the COMPILED dist closure on every install shape
+    # (Copilot's extension runtime cannot strip-types). The tarball ships dist;
+    # a source checkout may not have built it yet, and those bytes are
+    # entwurf's OWN artifact (Hard Rule 17: the source bootstrap supplies
+    # entwurf's own bytes), so the source lane builds it here once when absent.
+    copilot_rc=0
+    if [ "$mode" = "source" ] && [ ! -f "$REPO_DIR/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js" ]; then
+      (cd "$REPO_DIR" && pnpm run build-bridge) || copilot_rc=$?
+    fi
+    if [ "$copilot_rc" -ne 0 ]; then
+      setup_result copilot-receive FAIL "detected copilot, but the receiver's compiled dist closure failed to build (see above) — repair, then re-run setup"
+    else
+      copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-receive-bridge.sh install) || copilot_rc=$?
+      if [ "$copilot_rc" -eq 0 ]; then
+        setup_result copilot-receive PASS "receiver extension installed — verify: ./run.sh doctor-copilot-receive"
+      else
+        setup_result copilot-receive FAIL "detected copilot, but the receiver extension install did not complete (see above) — repair, then re-run setup"
+      fi
+    fi
+    copilot_rc=0; (cd "$REPO_DIR" && bash scripts/copilot-statusline-bridge.sh install) || copilot_rc=$?
+    if [ "$copilot_rc" -eq 0 ]; then
+      setup_result copilot-statusline PASS "visible footer wired — verify: ./run.sh doctor-copilot-statusline"
+    else
+      setup_result copilot-statusline FAIL "detected copilot, but the visible-footer integration did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
+  # ── core bridge boundary ── deterministic preflight lives in `pnpm run
+  # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
+  # release-gate <scratch> --cut`. Setup is the install path, so it verifies the
+  # installed MCP bridge boundary only and does NOT run the legacy ACP/v1
+  # session-messaging/sentinel gates.
+  section "v2 install smoke: entwurf-bridge (direct MCP protocol)"
+  if (validate_entwurf_bridge); then
+    setup_result core PASS "installed bridge boots and lists the exact v2 tool set"
+  else
+    setup_result core FAIL "installed bridge boundary did not validate (see above)"
+  fi
+
+  # ── computed summary (#86 C7/C8) ── the final verdict is DERIVED from the
+  # component outcomes above, never printed independently of them. A detected
+  # integration FAIL owns a nonzero exit while valid components stay installed;
+  # re-running the same setup is the documented repair action (idempotent).
+  section "setup summary (computed from component outcomes)"
+  local entry rest s_name s_verdict s_fails=""
+  for entry in "${SETUP_RESULTS[@]}"; do
+    s_name="${entry%%|*}"; rest="${entry#*|}"; s_verdict="${rest%%|*}"
+    printf '  %-14s %-4s %s\n' "$s_name" "$s_verdict" "${rest#*|}"
+    if [ "$s_verdict" = "FAIL" ]; then s_fails="$s_fails $s_name"; fi
+  done
+  echo ""
+  if [ -n "$s_fails" ]; then
+    echo "DONE: entwurf setup — result: NON-GREEN (FAIL:$s_fails). Valid components above remain installed; repair the named ones and re-run setup."
+    return 1
   fi
+  echo "DONE: entwurf setup — result: green (computed from the component outcomes above)."
   echo "Run 'LIVE=1 ./run.sh release-gate <scratch> --cut' for live substrate acceptance (--cut refuses any MUST SKIP)."
 }
 
-# wire_agy_bridge — detection-gated, NON-FATAL agy (Antigravity) MCP bridge wiring, folded into
+# wire_agy_bridge — detection-gated agy (Antigravity) MCP bridge wiring, folded into
 # setup so a relocate/clone needs ONE idempotent command (막힘 ①). Mirrors the meta-bridge
 # block: agy on PATH → idempotent install-agy-bridge; no agy → honest skip, NO state ("있으면
-# 설정, 없으면 담아준다"). NON-FATAL by contract: agy is an OPTIONAL harness, so a refused/corrupt
-# agy config must NOT brick a pi/Claude setup — the hard gate is doctor-agy-bridge (issue #45:
-# the '?' surfaces in doctor, not by killing setup). WARNs are reason-specific so a transitional
-# symlink (someone else's SSOT) and a corrupt config (invalid JSON) are never conflated.
+# 설정, 없으면 담아준다"). A refused/corrupt agy config still never bricks the rest of setup —
+# later components are attempted — but it RETURNS 1 so the aggregate verdict records a named
+# component FAIL and setup exits non-green (#86 C6/C7: the old WARN-then-exit-0 posture was the
+# false-success shape). The hard per-leaf gate stays doctor-agy-bridge (issue #45). WARNs are
+# reason-specific so a transitional symlink (someone else's SSOT) and a corrupt config
+# (invalid JSON) are never conflated.
 wire_agy_bridge() {
   # Detection = the agy binary on PATH. AGY_BIN pins the target (default `agy`) so the
   # hermetic smoke can point at a fake agy or a definitely-absent path without depending on
@@ -4359,7 +5044,8 @@ wire_agy_bridge() {
     echo "[setup] agy bridge wired (idempotent). Verify with: ./run.sh doctor-agy-bridge"
     return 0
   fi
-  # NON-FATAL: keep setup alive, surface the reason honestly (never a silent pass).
+  # Keep setup alive for the remaining components, surface the reason honestly, and return 1
+  # so the aggregate verdict records this component as FAIL (never a silent pass).
   # ORDER MATTERS: the permission failures carry the same words as the mcp_config ones ("refused
   # (symlink)", "invalid JSON") and MUST be matched first — otherwise a settings.json problem gets
   # reported as an mcp_config problem and sends the operator to repair the wrong file.
@@ -4388,14 +5074,14 @@ wire_agy_bridge() {
       echo "[setup]       Bridge NOT wired; verify with ./run.sh doctor-agy-bridge. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# wire_agy_statusline — detection-gated, NON-FATAL agy statusLine wiring, folded into setup (#46
+# wire_agy_statusline — detection-gated agy statusLine wiring, folded into setup (#46
 # Task 1). Mirrors wire_agy_bridge: agy on PATH → idempotent install-agy-statusline; no agy →
-# honest skip, NO state. NON-FATAL by contract (agy is OPTIONAL — a refused/corrupt settings must
-# not brick a pi/Claude setup); the hard gate is doctor-agy-statusline. The renderer is the
-# stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
+# honest skip, NO state; a refused/corrupt settings keeps the rest of setup alive but returns 1
+# for a named component FAIL (#86 C6/C7). The hard gate is doctor-agy-statusline. The renderer
+# is the stable bin entwurf-agy-statusline, exposed by expose_dev_bin above.
 wire_agy_statusline() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
     echo "[setup] no agy on PATH — skipping agy statusLine wiring (no state; this host runs no Antigravity)"
@@ -4428,12 +5114,13 @@ wire_agy_statusline() {
       echo "[setup]       statusLine NOT wired; verify with ./run.sh doctor-agy-statusline. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# wire_agy_hooks — detection-gated, NON-FATAL agy PreInvocation imprint wiring. Same setup posture
-# as the MCP/statusLine adapters, but this one is the birth writer that turns statusLine '?' into a
-# garden id after the first invocation.
+# wire_agy_hooks — detection-gated agy PreInvocation imprint wiring. Same setup posture
+# as the MCP/statusLine adapters (skip on absence, named FAIL on detected incompleteness), but
+# this one is the birth writer that turns statusLine '?' into a garden id after the first
+# invocation.
 wire_agy_hooks() {
   if ! command -v "${AGY_BIN:-agy}" >/dev/null 2>&1; then
     echo "[setup] no agy on PATH — skipping agy hooks wiring (no state; this host runs no Antigravity)"
@@ -4464,30 +5151,39 @@ wire_agy_hooks() {
       echo "[setup]       Birth imprint NOT wired; verify with ./run.sh doctor-agy-hooks. setup continues." >&2
       ;;
   esac
-  return 0
+  return 1
 }
 
-# expose_dev_bin — make the `entwurf-bridge` STABLE bin resolve for a DEV checkout (막힘 ②).
-# setup IS the dev install command (consumers get the bin from npm bin-linking), so setup owns a
-# managed ~/.local/bin/entwurf-bridge symlink into this checkout via scripts/dev-bin.sh, recorded
-# for an honest inverse (remove-dev-bin). NON-FATAL like wire_agy_bridge: a foreign bin already on
-# PATH (a real npm install) is REFUSED not clobbered, and a BIN_DIR off PATH only WARNs — neither
-# bricks setup. The hard gate stays doctor-agy-bridge (a missing/dangling bin FAILs there).
+# expose_dev_bin — make the package's stable commands resolve for a DEV checkout (막힘 ②).
+# setup IS the dev install command (consumers get these names from npm bin-linking), so setup owns
+# managed ~/.local/bin symlinks into this checkout via scripts/dev-bin.sh, each recorded for an
+# honest inverse. The set starts with `entwurf` → run.sh: Copilot fresh deliberately launches the
+# managed `entwurf copilot`, never the raw vendor. That operator command is CORE and is certified
+# after exposure by dev-bin.sh's own target authority: our symlink, our target, and the exact PATH
+# winner. A foreign/off-PATH/shadowed operator therefore fails setup (return 1). Helper units are
+# attempted INDEPENDENTLY by dev-bin.sh (#86 C10) and any refusal propagates as return 3 — the
+# aggregate verdict records it as a named FAIL instead of the old WARN-then-green; the refused
+# names are already printed truthfully by dev-bin's attempted/ok/refused summary.
 expose_dev_bin() {
-  section "dev bin: expose entwurf-bridge on PATH (dev checkout)"
+  section "dev bins: expose stable package commands on PATH (dev checkout)"
   local rc
   set +e
   bash "$REPO_DIR/scripts/dev-bin.sh" expose
   rc=$?
   set -e
+
+  if ! bash "$REPO_DIR/scripts/dev-bin.sh" verify entwurf; then
+    return 1
+  fi
+
   [ "$rc" -eq 0 ] && return 0
   if [ "$rc" -eq 3 ]; then
-    echo "[setup] WARN: entwurf-bridge is already on PATH as someone else's bin (not ours) — left as-is." >&2
-    echo "[setup]       If that is a stale/foreign bin, remove it and re-run setup. setup continues." >&2
+    echo "[setup] dev-bin: foreign helper bin path(s) refused, never clobbered — the refused names are in the summary above." >&2
+    echo "[setup]       Every unit was attempted independently; the source operator itself is certified." >&2
   else
-    echo "[setup] WARN: dev bin exposure did not complete (rc=$rc; see above). setup continues." >&2
+    echo "[setup] dev-bin: helper exposure did not complete (rc=$rc; see above)." >&2
   fi
-  return 0
+  return "$rc"
 }
 
 # release-gate — the single command that, when GREEN, is sufficient to cut
@@ -4775,6 +5471,21 @@ release_gate() {
   run_live_step "smoke-claude-native-resume-live (native Claude Code resume + meta-bridge neutrality)" gate bash "$self" smoke-claude-native-resume-live
   run_live_step "smoke-entwurf-chain-live (P3: Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox, identity + receipt)" gate bash "$self" smoke-entwurf-chain-live
   run_live_step "smoke-mux-lifecycle-live (mux public-harness lifecycle: fresh -> send -> dormant -> same-id visible resume -> recall)" gate bash "$self" smoke-mux-lifecycle-live
+  # #87 bundle B: MUST, and since bundle B moved omp's wakeMode to self-fetch this is a
+  # REAL demand under LIVE=1, not a standing SKIP — it reads the registry, so an honest
+  # SKIP now only ever names a missing prerequisite, and a registry claiming a receive
+  # rail with no acceptance body here is a FAIL.
+  run_live_step "smoke-omp-receive-live (#87 bundle B: other harness -> open omp citizen, addressed receive + roundtrip)" gate bash "$self" smoke-omp-receive-live
+  # #87 bundle C: the step 9 clause 7 receipt, wired as a MUST rather than left to an
+  # operator's memory. A schema is not a product — omp's bootstrap-payload submission
+  # PARSES correctly, and parsing is exactly what pi got right while submitting no message
+  # at all, so a release whose fresh_call(omp) opens a window that never runs its turn
+  # would pass every deterministic gate here. That is not hypothetical for this backend:
+  # the retired positional candidate parsed perfectly and still answered `ACK` with zero
+  # tool calls, because the turn began before the callback tool existed. New contract,
+  # applied from omp onward; it does not retroactively redesign Copilot's operator-metered
+  # exclusion.
+  run_live_step "smoke-omp-fresh-live (#87 bundle C: entwurf_fresh_call opens omp, exact nonce callback, addressed receive)" gate bash "$self" smoke-omp-fresh-live
 
   # 4. BEHAVIOR lane (advisory, non-blocking). Model-in-loop gates that probe
   #     whether the model AUTONOMOUSLY drives the MCP entwurf surface. These never
@@ -4888,6 +5599,15 @@ case "$cmd" in
   check-entwurf-capabilities)
     check_entwurf_capabilities
     ;;
+  check-harness-admission-parity)
+    check_harness_admission_parity
+    ;;
+  check-omp-fresh-preflight)
+    check_omp_fresh_preflight
+    ;;
+  smoke-omp-fresh-live)
+    smoke_omp_fresh_live
+    ;;
   check-capability-bundle-reach)
     check_capability_bundle_reach
     ;;
@@ -4912,6 +5632,18 @@ case "$cmd" in
   check-copilot-birth-hook)
     check_copilot_birth_hook
     ;;
+  check-omp-birth-hook)
+    # #87 gate: the OMP BIRTH path without omp. Drives the real assembler into a temp dir,
+    # then imports the ASSEMBLED index.ts into a mock omp host (mock ExtensionAPI + mock
+    # ExtensionContext) and fires the two birth edges. Requires: a backend:"omp" v3 record
+    # only under mode "tui"; NOTHING under print/rpc/json (a task subagent is not a citizen,
+    # and hasUI is deliberately true on the rpc rows because it is true in the vendor too);
+    # session_switch attaching on the same native id and minting the replacement on a new
+    # one; a sender marker keyed to the HOST process's OWN pid (never its parent — the
+    # one-process join) that the production resolver joins back to the record; the garden id
+    # on the status line; and still zero mailbox/receiver marker. Hermetic; no omp, no model turn
+    run_ts scripts/check-omp-birth-hook.ts
+    ;;
   check-copilot-statusline)
     check_copilot_statusline
     ;;
@@ -5044,6 +5776,12 @@ case "$cmd" in
   smoke-acp-bundled-mcp-live)
     smoke_acp_bundled_mcp_live
     ;;
+  smoke-omp-receive-live)
+    # #87 bundle B — the acceptance that makes omp's one-way garden executable.
+    # Reads the capability registry and reports its own PASS/SKIP/FAIL; see the
+    # header of the script for the three branches.
+    run_ts scripts/smoke-omp-receive-live.ts
+    ;;
   smoke-entwurf-chain-live)
     # P3 — the cross-harness delivery CHAIN on real authenticated rails:
     # native Claude Code -> pi GPT -> pi ACP Claude Sonnet -> mailbox terminus,
@@ -5181,6 +5919,16 @@ case "$cmd" in
     # Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-install-state.sh)
     ;;
+  smoke-setup-verdict)
+    # #86 C1 aggregate setup verdict fixture — the first automated consumer of
+    # `entwurf setup` itself: all-absent SKIP/green, pi below-floor detected FAIL
+    # (never SKIP), pi-present wiring PASS, agy detected+corrupt named FAIL with
+    # NON-GREEN nonzero exit, installed-mode named branch before the bootstrap,
+    # and the credential store byte-identical in every cell. Sandboxed HOME/XDG/
+    # agent/dev-bin roots; presence pinned via PI_BIN/CLAUDE_BIN/AGY_BIN.
+    # Offline + deterministic (deps: bash+node+python3+pnpm).
+    (cd "$REPO_DIR" && bash scripts/smoke-setup-verdict.sh)
+    ;;
   check-agy-permission-matrix)
     # The agy permission engine's CONTRACT SPACE as a literal table (55 cells + stated
     # exclusions R2/R4-R7): parser-state × operation × settings × ownership × precedence.
@@ -5237,8 +5985,8 @@ case "$cmd" in
     # own the statusLine subtree WHOLE (preserve unrelated keys) + state (stable command, prior
     # subtree as preimage), doctor static-clean/live-SKIP (+live-consistent with a fake agy) /
     # drift-FAIL / dangling-command-FAIL / not-ours note, honest-inverse uninstall, symlink +
-    # dangling-symlink refuse, create-new inverse, the NON-FATAL wire wrapper, and checkout
-    # impurity 0. Offline + deterministic (deps: bash+python3).
+    # dangling-symlink refuse, create-new inverse, the truthful wire wrapper (detected refusal
+    # → nonzero, #86 C6/C7), and checkout impurity 0. Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-statusline-state.sh)
     ;;
   smoke-agy-hooks-state)
@@ -5268,8 +6016,10 @@ case "$cmd" in
     # 0.12.6 install-boundary gate: register-pi-package.py is the shared
     # packages[] SSOT for project/user install and remove; user scope makes
     # --entwurf-control load from any cwd. Idempotent, preserves unrelated
-    # packages/keys, normalizes stale entries, remove is symmetric, and corrupt
-    # settings fail loud. The tripwire the 2026-07-03 `pi install` removal lacked.
+    # packages/keys, remove is symmetric, corrupt settings fail loud; project
+    # scope normalizes ITS OWN stale entries while user scope carries the #86 C2
+    # explicit ownership contract (other owners refuse; takeover-user-scope moves).
+    # The tripwire the 2026-07-03 `pi install` removal lacked.
     (cd "$REPO_DIR" && bash scripts/smoke-user-scope-citizen.sh)
     ;;
   smoke-claude-native-resume-live)
@@ -5315,6 +6065,15 @@ case "$cmd" in
     shift || true
     (cd "$REPO_DIR" && bash scripts/copilot-bridge-install.sh "$@")
     ;;
+  uninstall-copilot-bridge)
+    # #86 C3a: the package-owned inverse of install-copilot-bridge. The ownership state
+    # is the sole removal authority (exact qualified id, exact marketplace name+path,
+    # recorded assembly only); a failing vendor list is UNKNOWN and refuses; state is
+    # deleted LAST so any partial failure keeps a rerun-repair authority. Never touches
+    # the stale Claude unit and never uses --force.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/copilot-bridge-uninstall.sh "$@")
+    ;;
   doctor-copilot-bridge)
     # #82: the fail-loud surface for the Copilot unit. Its red conditions differ from
     # the Claude doctor's on purpose: a Copilot session mints on its FIRST PROMPT, not
@@ -5347,6 +6106,102 @@ case "$cmd" in
   smoke-copilot-mcp-state)
     (cd "$REPO_DIR" && bash scripts/smoke-copilot-mcp-state.sh)
     ;;
+  smoke-omp-bridge-state)
+    (cd "$REPO_DIR" && bash scripts/smoke-omp-bridge-state.sh)
+    ;;
+  install-omp-mcp)
+    (cd "$REPO_DIR" && bash scripts/omp-mcp-bridge.sh install "$@")
+    ;;
+  uninstall-omp-mcp)
+    (cd "$REPO_DIR" && bash scripts/omp-mcp-bridge.sh uninstall "$@")
+    ;;
+  doctor-omp-mcp)
+    (cd "$REPO_DIR" && bash scripts/omp-mcp-bridge.sh doctor "$@")
+    ;;
+  smoke-omp-mcp-state)
+    (cd "$REPO_DIR" && bash scripts/smoke-omp-mcp-state.sh)
+    ;;
+  install-omp-bridge)
+    # #87: the OMP BIRTH install. Not a mode of the Claude or Copilot installer, and for a
+    # structural reason rather than a stylistic one: an omp "hook" IS an in-process
+    # extension, so there is no launcher to bake a node path into and no hook manifest to
+    # declare events in — the vendor imports the module itself. What this owns is one
+    # directory under the omp agent dir; the MCP hand is install-omp-mcp.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-bridge-install.sh "$@")
+    ;;
+  uninstall-omp-bridge)
+    # The package-owned inverse: the ownership state is the sole removal authority (exact
+    # unit dir, recorded entry name, recorded assembly), a no-state host REFUSES instead of
+    # cleaning up what it cannot prove is ours, and the state is deleted LAST.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-bridge-uninstall.sh "$@")
+    ;;
+  doctor-omp-bridge)
+    # #87: the fail-loud surface for the OMP unit. Red is a unit omp cannot import, a STALE
+    # deployed writer, an unrecovered mint ERROR, a failed sender-marker write, or a live omp
+    # process carrying inherited PI_SESSION_ID/PI_AGENT_ID. "Installed with zero records" is
+    # NOT-YET, not red.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-bridge-doctor.sh "$@")
+    ;;
+  install-omp-receive)
+    # #87 bundle B: install the OMP RECEIVER extension into
+    # <omp agent dir>/extensions/entwurf-receive-omp. Its own unit, install-state, doctor and
+    # inverse — birth says who sends, this says a reply can land, and neither grants the other.
+    # Same ownership discipline as the birth installer: no adoption of an artifact entwurf holds
+    # no state for, no writing through a symlink, refusal when the agent dir is ambiguous.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-receive-install.sh "$@")
+    ;;
+  uninstall-omp-receive)
+    # honest inverse from install-state (exact unit dir + recorded entry; no-state host REFUSES;
+    # state deleted LAST). Records, sender identity and any ALREADY-armed live session are
+    # untouched — an omp TUI that armed before this ran stays addressable until it exits.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-receive-uninstall.sh "$@")
+    ;;
+  doctor-omp-receive)
+    # #87 bundle B: runtime axis (importable unit, writer parity, arm vs doorbell failures on
+    # SEPARATE axes, and WHO IS ARMED right now read through the PRODUCTION marker reader via
+    # omp-receive-facts — never a filename) + ownership axis. Zero armed receivers is NOT-YET.
+    # It reports a marker for exactly what a marker proves: a live owner reached the arm emit.
+    # It never claims the vendor's watch is still registered — see the header.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-receive-doctor.sh "$@")
+    ;;
+  smoke-omp-receive-state)
+    # #87 bundle B: OMP RECEIVER install/doctor/inverse regression — placement, stale-writer
+    # detection, honest inverse, no-state refusal (structurally VALID as well as foreign),
+    # symlink refusal, ambiguous-agent-dir refusal, a poisoned PI_CODING_AGENT_DIR that
+    # attracts no artifact, plus the two this surface owns: installing a doorbell ARMS
+    # NOTHING, and a host with no birth unit is a green doctor with a NAMED dependency note
+    # rather than a red one. Fully sandboxed HOME/PI/XDG. Offline/deterministic
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/smoke-omp-receive-state.sh "$@")
+    ;;
+  check-omp-receive-arm)
+    # #87 bundle B gate: drives the REAL receive assembler into a temp dir, imports the
+    # ASSEMBLED index.ts into a MOCK omp host and proves everything on entwurf's side of the
+    # vendor boundary — the tui-only scope fence, deferral before birth and the BOUNDED retry
+    # that arms once the sender marker appears, the refusal to start a timer this build cannot
+    # cancel, the refusal to arm when the wake surface is missing, id-drift refusal, the /new
+    # unarm that the start-key guard structurally cannot catch, no-watch-no-marker ordering,
+    # an announce-only doorbell that never carries the body, a vanished signal giving the
+    # marker back, and an identity-guarded teardown. Hermetic; no omp, no model turn. What it
+    # deliberately cannot prove — that the vendor really wakes an idle host — is
+    # smoke-omp-receive-live's job, and neither receipt substitutes for the other
+    shift || true
+    run_ts scripts/check-omp-receive-arm.ts "$@"
+    ;;
+  omp-receive-facts)
+    # #87 bundle B: read-only JSON projection of the omp receive rail — every receiver marker
+    # read through readMetaReceiverMarker in BOTH readings (live / as-written), plus the mailbox
+    # counts behind each. The shared oracle for doctor-omp-receive, the state smoke and the LIVE
+    # acceptance, so none of them answers "is a doorbell held?" from a filename.
+    shift || true
+    run_ts scripts/omp-receive-facts.ts "$@"
+    ;;
   copilot)
     # #82 RAIL 7: the managed launch. `exec` and NO subshell/cd on purpose — the vendor
     # must inherit this terminal exactly: the caller's cwd, this pid, this tty, and its own
@@ -5400,11 +6255,12 @@ case "$cmd" in
     (cd "$REPO_DIR" && bash scripts/agy-bridge.sh doctor "$@")
     ;;
   wire-agy-bridge)
-    # 막힘 ①: the detection-gated, NON-FATAL setup wrapper around install-agy-bridge (agy on
-    # PATH → idempotent install; no agy → honest skip, no state). HIDDEN/internal — setup calls
-    # this; it is exposed as a subcommand only so smoke-agy-install-state can drive it
-    # deterministically. The hard gate stays doctor-agy-bridge (issue #45: the '?' is a doctor
-    # signal, not a setup-killer).
+    # 막힘 ①: the detection-gated, truthful setup wrapper around install-agy-bridge (agy on
+    # PATH → idempotent install; no agy → honest skip, no state; detected refusal/corrupt →
+    # reason-specific WARN + nonzero so the aggregate records a named component FAIL while later
+    # components stay attempted, #86 C6/C7). HIDDEN/internal — setup calls this; it is exposed
+    # as a subcommand only so smoke-agy-install-state can drive it deterministically. The hard
+    # per-leaf gate stays doctor-agy-bridge (issue #45).
     wire_agy_bridge
     ;;
   install-agy-statusline)
@@ -5472,9 +6328,10 @@ case "$cmd" in
     run_ts scripts/doctor-pi-provider.ts "$@"
     ;;
   wire-agy-statusline)
-    # #46 Task 1: the detection-gated, NON-FATAL setup wrapper around install-agy-statusline.
-    # HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can drive it
-    # deterministically. The hard gate stays doctor-agy-statusline.
+    # #46 Task 1: the detection-gated, truthful setup wrapper around install-agy-statusline
+    # (detected refusal/corrupt → WARN + nonzero, named component FAIL in the aggregate, #86
+    # C6/C7). HIDDEN/internal — setup calls this; exposed so smoke-agy-statusline-state can
+    # drive it deterministically. The hard per-leaf gate stays doctor-agy-statusline.
     wire_agy_statusline
     ;;
   wire-agy-hooks)
@@ -5482,14 +6339,16 @@ case "$cmd" in
     wire_agy_hooks
     ;;
   expose-dev-bin)
-    # 막힘 ②: expose the entwurf-bridge STABLE bin on PATH for a DEV checkout (a managed symlink
-    # into this checkout, recorded for an honest inverse). HIDDEN/internal — setup calls the
-    # NON-FATAL expose_dev_bin wrapper; exposed here so smoke-agy-install-state can drive the
-    # foreign-refuse WARN path. The exposure logic lives in scripts/dev-bin.sh.
+    # 막힘 ②: expose the stable package commands on PATH for a DEV checkout, including the
+    # `entwurf` operator command Copilot fresh resolves. HIDDEN/internal — setup requires the
+    # core operator certification and attempts every helper unit independently; a foreign helper
+    # propagates rc=3 as a named bins FAIL (#86 C10). Exposed here so the install smoke can
+    # drive ownership/refusal.
+    # The exposure logic lives in scripts/dev-bin.sh.
     expose_dev_bin
     ;;
   remove-dev-bin)
-    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed link + state (REFUSE if
+    # 막힘 ②: honest inverse of expose-dev-bin — remove ONLY our managed links + states (REFUSE if
     # it became foreign). The raw script (no wrapper) so an operator sees a loud failure.
     shift || true
     (cd "$REPO_DIR" && bash scripts/dev-bin.sh remove "$@")
@@ -5647,9 +6506,6 @@ case "$cmd" in
     # from under node_modules rather than re-packing the installed copy.
     (cd "$REPO_DIR" && bash scripts/check-install-container.sh "$@")
     ;;
-  sync-auth)
-    sync_auth
-    ;;
   install)
     install_local_package "$TARGET_PROJECT_DIR"
     ;;
@@ -5659,6 +6515,17 @@ case "$cmd" in
   remove-user-scope)
     remove_user_scope_citizen
     ;;
+  takeover-user-scope)
+    # #86 C2: operator-explicit ownership move — the ONLY writer allowed to replace
+    # another root's user-scope registration (normal install/setup/remove refuse).
+    takeover_user_scope
+    ;;
+  doctor-pi-package)
+    # #86 C2: package-side ownership verdict (unregistered/owned/owned-by-other/
+    # legacy-no-state/mismatch/missing-owner). Provider runtime stays with
+    # doctor-pi-provider — the two doctors are deliberately not mixed.
+    doctor_pi_package
+    ;;
   -h|--help|help|"")
     usage
     ;;