@junghanacs/entwurf 0.20.0 → 0.20.1

package/BASELINE.md

@@ -33,7 +33,7 @@ not **UNSUPPORTED** — the deliberate never, which today is native Windows only
 | Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
 | Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
 | Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
-| macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental is postponed past this 0.20.0 cut. |
+| macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental remains unscheduled; no cut has carried it. |
 | Darwin install fence (meta/copilot/omp-bridge + omp-receive) | portable (Linux or Darwin) | Four installers accept Darwin; python3/node/harness presence holds the seat, not the platform name. A Darwin install is not a rail receipt. |
 | Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
 | setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |
@@ -59,7 +59,7 @@ Notes the table cannot carry without becoming prose again:
   bridge, and now runs dev wiring again.
 - **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
   CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
-  physical host (rental postponed past this cut). The package-level `os` field stays
+  physical host (rental remains unscheduled). The package-level `os` field stays
   unrestricted, and native Windows is UNSUPPORTED.
 
 **Operator acceptance rule:** on a claimed Claude host, reinstall from the released

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.20.1 - 2026-09-10
+
+### Fixed
+
+- **A second checkout of this repo no longer hijacks `--entwurf-control` from the installed one (#110).** The tracked `.pi/settings.json` shipped `packages: [".."]`, which registers "whichever checkout pi is running in"; `run.sh install` separately registers this root in user scope by absolute path. pi's package identity is `local:<resolved path>` and its dedupe collapses only EQUAL identities, so in the installed checkout the two entries are one package — and in any OTHER checkout (worktree, release scratch) they are two. Both then load `pi-extensions/entwurf-control.ts`, the loader awards `--entwurf-control` and `--emacs-agent-socket` to whoever registered first (project scope, i.e. the branch copy), and the INSTALLED extension fails to load with an error naming the installed path as the loser. Not silent — designed to be misread, while all seven `entwurf` model rows still printed and the pi session looked healthy. entwurf's own checkout now carries no project-scope self-registration in tracked bytes, and `install_local_package` skips writing one when the project it is installing into IS this root; a foreign project is unaffected, which is what `entwurf install <project>` is for. No realpath rule could have fixed this: two checkouts are genuinely two directories.
+- **The gates moved with the contract.** `check-install-surface` S7c stops pinning the SHAPE (`packages == [".."]`) and pins the invariant it was there for — no host-absolute path in the tracked, biome-governed file — which "no packages key" satisfies strictly more. `smoke-user-scope-citizen` cells 11/11b–11e and 14 no longer seed themselves from this repo's own committed bytes: a witness that depends on us shipping the shape it tests dies with the shape, while the predicate it guards (`is_settings_relative_self`, still the thing that keeps an unrelated relative package like `../../repos/gh/andenken` from reading as ours) does not. Cell 14 now demands the stronger end-to-end property — installing into entwurf's own checkout writes no packages entry and leaves the file byte-identical — and new cell 15 spawns the pinned devDep pi against two real stand-in checkouts, planting the retired registration first and requiring the collision to APPEAR before asserting it is gone, so a sandbox that silently loads nothing cannot report a green. Both halves are replant-qualified (`[QK:SECOND-CHECKOUT-EXTENSION-COLLISION]`, `[QK:SELF-CHECKOUT-PROJECT-REGISTRATION]`). That new probe also taught the gate a fence it did not have: `pi --print` reads a non-tty stdin as piped prompt input, so the probe inherited the caller's stdin and hung for 1h56m under a supervised runner while passing instantly under every shell it had been tried in. It now reads `/dev/null` under a bounded `timeout`, so a probe that cannot finish goes red with its own name instead of hanging.
+
+### Changed
+
+- **The bundled Claude ACP adapter moves to `@agentclientprotocol/claude-agent-acp 0.76.0`.** One refactor plus one opt-in extension; nothing reaches our surface. Declared runtime deps are unchanged (`@agentclientprotocol/sdk 1.4.0`, `@anthropic-ai/claude-agent-sdk 0.3.257`), so the anthropic peer floor does not move either. The one feature — upstream #1111's `recommendedValue` on AIR config options — is enabled only when `initialize` advertises it, and entwurf sends `clientCapabilities: {}`; the label normalization, `default` row and effort selector riding it are out of reach for a second, independent reason as well (`configOptions` has zero call sites here, and `EFFORT_CONFIG_ID` is never set). `setSessionConfigOption`, our only model-forcing wire call, is byte-identical across the bump. One change has a shape that WOULD reach us and does not: a string-path `configuredSettings` now does its `readFile`/`JSON.parse` on the unconditional `session/new` path, and entwurf passes `settings` as an object — so "entwurf never hands the adapter a settings PATH" is now stated as a contract at that call site rather than left as an accident. #96's readiness argument was re-measured rather than inherited: `mcpServerStatus` still has exactly two call sites, re-read at the new upstream coordinates, both still an auth handshake and not a readiness fence.
+- **Documentation matched to shipped behavior.** A repo-wide stale-prose sweep corrected live claims that had drifted: OMP described as three installer units when it ships four, a fresh-cut quiescence instruction that named four of six identity writers, a gate docstring promising byte-pinning that its gate never performed, README speaking of macOS as arriving rather than shipped in 0.20.0, and ROADMAP carrying #72 as an open failure after it was closed as an external-reaper cause. Historical records — the dep-bump ledger, measurement receipts, archived handoffs, and every occurrence that names a retired symbol AS retired — were deliberately left intact.
+
+### Upgrade note
+
+**Nothing to run.** A host that has already registered entwurf in user scope (any host that ran `./run.sh setup` or installed the npm package) is unaffected: that entry is what loaded the extensions from a foreign cwd all along, and it is untouched. What changes is a checkout that has NEVER been set up — it used to pick up the extensions from the tracked `packages: [".."]` and now does not. That is a narrower loss than it reads: the same tracked file names `entwurf-bridge` as a bare bin, which is only on PATH after setup, so a never-set-up clone never had the MCP hand either. Setup was already the prerequisite; this makes it the only one. To run a branch checkout's extensions deliberately, use `pi -ne -e pi-extensions/entwurf-control.ts`, or move ownership explicitly with `./run.sh takeover-user-scope`.
+
+### Verification
+
+Lane receipts (oracle, 2026-09-10) plus prepare P4/P5 on this host.
+
+- **`pnpm run check:full`** exit 0, 479 s (inherited, omp handoff on this tree) / again as the release-gate static MUST step (this run).
+- **Prepare P5** `LIVE=1 ./run.sh release-gate --cut`:
+  scratch `/tmp/entwurf-release-gate-0.20.1.uuZCm8`, pane exit 0, **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, `cut: OK`. Qualification **393/393 KILLED**, origin HEAD `d72225e`, purity held. stdin closed (`exec </dev/null`); PWD in scratch; `PI_SESSION_ID` / `PI_AGENT_ID` / `CLAUDE_CONFIG_DIR` unset. Wall ~55 m (16:49:37→17:44:48 KST).
+- **P9 at verdict:** prefix-blind census top was 28 `entwurf-chain` roots (Sep 2–4; not an owned `mkdtempSync` prefix, so not in the delete set). 5 reparented `/tmp` processes: 4 `entwurf-copilot-receive` Node stubs (ppid=1, ages 6h54m / 6h09m / 5h18m / 29m) named and not killed, plus the operator emacs daemon. Reclaimed 4 owned `check-probe-ordering-*` roots (64 K). Scratch preserved.
+
 ## 0.20.0 - 2026-09-09
 
 This range carries three lanes that are not one cause: the macOS

package/README.md

@@ -88,14 +88,15 @@ CERTIFIED (CI) is weaker than a physical-host doctor green.
 The npm package has no `os` restriction; that is installability, not a
 support claim.
 
-**macOS in this release.** This release adds macOS support for Entwurf's
+**macOS landed in 0.20.0.** That release added macOS support for Entwurf's
 install surface: the npm package installs, `entwurf --help` and `entwurf
 check-bridge` boot, and `entwurf setup` composes the integrations it finds.
 The four installers that previously rejected Darwin by platform name no longer
-do. We validated that surface only in macOS CI because the developers did not
+do. That surface was validated only in macOS CI because the developers did not
 have a physical Mac. So macOS native-harness rails—marker join, an ACP turn,
-and mux included—are not yet certified; setup writes their wiring but reports
-them non-green. Linux's certified rail status is unchanged.
+and mux included—are **NOT CERTIFIED — pending physical host**; setup writes
+their wiring but reports them non-green. Linux's certified rail status is
+unchanged.
 
 On Darwin, `entwurf setup` that detects a harness is intentionally
 non-green: the wiring WAS written and nothing failed to install, but the

package/docs/acp-backend-rail.md

@@ -92,10 +92,10 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
+| Entwurf package | `0.20.0` | shipped baseline | the package contract these rows belong to |
 | pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.75.1` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.76.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
@@ -151,6 +151,23 @@ different reasons, and collapsing them would hide a real risk**:
   entwurf passes that flag nowhere (repo grep, 0 hits). They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+- **Advertised but never called — 0.76.0 adds exactly one.** Upstream #1111 puts a
+  `recommendedValue` on AIR config options, and it is **opt-in**: the adapter turns it on only
+  when `initialize`'s `clientCapabilities._meta.jetbrains.air.capabilities` names
+  `recommendedValue`. entwurf sends `clientCapabilities: {}` (`backend.ts:1758`), so
+  `useRecommendedValue` is false on every branch. The label normalization, the `default` row and
+  the effort selector that ride it are unreachable for a second, independent reason as well:
+  `[측정 2026-09-10]` `git grep -c configOptions pi-extensions/lib/acp/` is **0**, and entwurf
+  has never set `EFFORT_CONFIG_ID`, which is the other gate on the SDK-side `applyFlagSettings`.
+  The rest of 0.76.0 is one refactor: `resolveModelPreference` moved into a new
+  `dist/session-model.*` (diff is comments and formatting), `dist/session-effort.*` is new, and
+  `setSessionConfigOption` — our only model-forcing wire call — is byte-identical across
+  `v0.75.1..v0.76.0`.
+- **One 0.76.0 change has a reachable SHAPE and is still inert for us.** When
+  `configuredSettings` is a STRING PATH, its `readFile` + `JSON.parse` moved out of
+  `resolvedProvider` and up onto the unconditional `session/new` path. entwurf passes `settings`
+  as an OBJECT (`tool-surface.ts:153`), so the branch is never taken. That makes "entwurf never
+  hands `settings` as a path" a contract rather than an accident; it is stated at that call site.
 - **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
   synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
   `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
@@ -275,23 +292,23 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.75.1 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.76.0 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.73.0 → 0.75.1 bump, not inherited from the previous one — and the
-0.70.0 → 0.73.0 argument is not reused either. `mcpServerStatus` call sites in
-`src/acp-agent.ts` are **2 at both v0.73.0 and v0.75.1** `[측정 2026-09-06, git grep -c]`;
-they first appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it
-where it once did not. Both were re-read at `v0.75.1 src/acp-agent.ts:1736` and `:1829`
-(the 0.73.0 coordinates were `:1618` and `:1711`): the first sits inside
+(Re-measured at the 0.75.1 → 0.76.0 bump, not inherited — the previous bump's argument is
+not reused, the way the 0.73.0 → 0.75.1 entry did not reuse 0.70.0 → 0.73.0's.
+`mcpServerStatus` call sites in `src/acp-agent.ts` are **2 at v0.75.1 and 2 at v0.76.0**
+`[측정 2026-09-10, upstream v0.76.0/src/acp-agent.ts read directly, grep -n]`; they first
+appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it where it
+once did not. Both were re-read at `v0.76.0 src/acp-agent.ts:1762` and `:1855`
+(v0.75.1: `:1736` / `:1829`; v0.73.0: `:1618` / `:1711`): the first sits inside
 `authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
 `needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
 Neither waits on every declared server before `newSession` returns. That is an auth
-handshake, not a readiness fence, so the boundary below is unchanged. The other reachable-surface findings also re-measured:
-AIR typed failures and the AIR file-change report stay capability-gated and
-unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
-unconditionally and uncalled; native subagents, async tasks, session forks, session
-titles, permission-mode kinds and clear-context planning are all new-but-uncalled.
+handshake, not a readiness fence, so the boundary below is unchanged. The surrounding 200
+lines are byte-identical and the region moved +26; the whole 0.76.0 delta is one refactor
+plus one opt-in AIR extension that `clientCapabilities: {}` never enables, so the other
+reachable-surface findings stand as re-measured at the previous bump.
 This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
@@ -384,5 +401,5 @@ Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-meas
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;
 - broader installed-host and cross-machine Cortex evidence;
-- any future Codex managed native-citizen lane—separate from ACP; 0.14.0 does not ship one;
+- any future Codex managed native-citizen lane—separate from ACP; the lane is open as #95 and no release ships one;
 - persisted ACP resume/load, which is not implemented by today's in-memory reuse.

package/docs/external-mcp-host.md

@@ -169,6 +169,7 @@ Use the managed install surface rather than editing omp's files by hand:
 ```bash
 entwurf install-omp-bridge     # the BIRTH extension (a garden id per visible TUI session)
 entwurf install-omp-mcp        # the MCP hand (this section)
+entwurf install-omp-config     # the operator setting (tools.xdev: false)
 entwurf install-omp-receive    # the RECEIVER extension (mailbox watch + announce-only doorbell)
 
 entwurf doctor-omp-bridge
@@ -176,7 +177,7 @@ entwurf doctor-omp-mcp
 entwurf doctor-omp-receive
 ```
 
-Three units, not two. The receiver is what makes the citizen answerable at all — without it omp
+Four units, not two. The receiver is what makes the citizen answerable at all — without it omp
 sends under its own garden id and every reply is refused as `mailbox-undeliverable` — and it is
 also a prerequisite of visible fresh: the fresh preflight refuses this host before touching tmux
 when the receive unit is missing, rather than opening a window that can never be reached.
@@ -244,7 +245,8 @@ bridge registered, **11 devices**: omp's own `ast_edit`, `debug`, `lsp`, `browse
 seven `entwurf_*`. So the default does not merely wrap entwurf — it wraps omp's own LSP and
 debugger too.
 
-**Set this on any omp host that is meant to work as a citizen:**
+**`entwurf setup` writes this for a detected omp host, and `entwurf install-omp-config` is
+the repair leaf. The value they own:**
 
 ```yaml
 # ~/.omp/agent/config.yml

package/docs/fresh-cut-policy.md

@@ -22,7 +22,8 @@ the new generation.
 ## What certification checks
 
 `certifyActiveStore` is shared by the doctor and all identity writers: pi birth,
-Claude's `SessionStart`, agy's imprint, and `entwurf_register_native`. Every active
+Claude's `SessionStart`, Copilot's first-prompt birth hook, OMP's birth extension,
+agy's imprint, and `entwurf_register_native`. Every active
 record must be:
 
 - a regular, non-symlink `.meta.json` file;
@@ -43,7 +44,7 @@ are opened without following symlinks; implementation and race proofs live besid
 
 ## Running a cut
 
-First close every pi, Claude Code, and agy session that could own a citizen or
+First close every pi, Claude Code, Copilot, OMP, and agy session that could own a citizen or
 transport artifact. Then run:
 
 ```bash

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -123,8 +123,8 @@ export const claudeAdapter = {
     },
     // MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
     // session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-    // and a context-occupancy scalar (`used`; both read at 0.75.1
-    // `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
+    // and a context-occupancy scalar (`used`; both read at 0.76.0
+    // `dist/acp-agent.js:3471-3486`). Both are measured, so backend.ts seals them.
     // The token partition is NOT declared here: ACP's only token carrier is a
     // per-turn round-trip aggregate, which is not what pi's four fields mean.
     sealsTurnAccounting: true,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/tool-surface.js

@@ -120,6 +120,12 @@ export function buildClaudeSessionMeta(params, normalizedSystemPrompt) {
         ...(params.modelId ? { model: params.modelId } : {}),
         tools: [...params.tools],
         settingSources: [...params.settingSources],
+        // `settings` is an OBJECT here, and that is a contract, not a convenience.
+        // claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
+        // JSON.parse for that form moved out of `resolvedProvider` up onto the
+        // unconditional `session/new` path — a shape that WOULD reach us, and does not,
+        // only because we never hand it a path. Keep it inline: a path would put file
+        // IO, and its failure modes, inside every session creation.
         settings: {
             permissions: {
                 allow: [...params.permissionAllow],

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.20.0",
+	"version": "0.20.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, and Antigravity; Claude and Snowflake Cortex Code ACP backends. Codex has verified delivery-probe evidence, not a managed native-citizen lane.",
 	"license": "MIT",
 	"author": {
@@ -82,7 +82,7 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.75.1",
+		"@agentclientprotocol/claude-agent-acp": "0.76.0",
 		"@agentclientprotocol/sdk": "1.4.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",

package/pi-extensions/lib/acp/acp-client.ts

@@ -46,8 +46,8 @@ import type { AcpTextBlock } from "./context.js";
  * shape) and never onto those four. A field rename upstream fails the typecheck
  * here rather than silently zeroing the operator's cache-effect badge.
  */
-/** One `_meta.quota.token_count` row (claude-agent-acp 0.75.1
- *  `dist/acp-agent.js:6493-6502`). `cachedInputTokens` is cache READS — the name
+/** One `_meta.quota.token_count` row (claude-agent-acp 0.76.0
+ *  `dist/acp-agent.js:6566-6575`). `cachedInputTokens` is cache READS — the name
  *  differs from `usage.cachedReadTokens` because the shape is shared with
  *  codex-acp; `cachedWriteTokens` is Claude's extra sibling. */
 export type AcpQuotaTokenCount = {
@@ -64,7 +64,7 @@ export type AcpPromptResponse = {
 	/** Vendor-private, version-pinned. `_meta` is a standard ACP extension slot
 	 *  whose values a client may not assume, and `quota` is NOT in
 	 *  claude-agent-acp's exported types — it is produced by the private
-	 *  `turnQuotaMeta()` (read at 0.75.1 `dist/acp-agent.js:6476-6485`). Read
+	 *  `turnQuotaMeta()` (read at 0.76.0 `dist/acp-agent.js:6549-6558`). Read
 	 *  defensively, never structurally required, and re-measure on a pin move. */
 	_meta?: {
 		quota?: {

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -150,7 +150,7 @@ export interface AcpAdapterSettingsParams {
  *
  * During stream handling the vendor keeps a per-message snapshot in
  * `lastAssistantUsage`, but its `usage_update` publishes only the scalar `used`
- * value (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`). Until
+ * value (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:3857-3882`). Until
  * that partition is carried on the wire, NOTHING honest can go in pi's four
  * fields, so entwurf writes none of them.
  */
@@ -342,8 +342,8 @@ export const claudeAdapter: AcpBackendAdapter = {
 
 	// MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
 	// session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-	// and a context-occupancy scalar (`used`; both read at 0.75.1
-	// `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
+	// and a context-occupancy scalar (`used`; both read at 0.76.0
+	// `dist/acp-agent.js:3471-3486`). Both are measured, so backend.ts seals them.
 	// The token partition is NOT declared here: ACP's only token carrier is a
 	// per-turn round-trip aggregate, which is not what pi's four fields mean.
 	sealsTurnAccounting: true,

package/pi-extensions/lib/acp/backend.ts

@@ -137,7 +137,7 @@ function finiteOrZero(value: unknown): number {
  * "the accounting-grade figure per the SDK" — it also counts Task subagents,
  * sidechains, and INTERNAL CALLS SUCH AS COMPACTION, so its rows "can total more
  * than `token_count`" and are "the fuller picture, not a decomposition of it"
- * (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6465-6485`). The narrower
+ * (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:6538-6558`). The narrower
  * `PromptResponse.usage` (== `quota.token_count`) is the MAIN AGENT LOOP only.
  *
  * The wider one is the right numerator because the denominator already has that
@@ -1237,7 +1237,7 @@ export function streamAcpTurn(
 		// Writing zeros is not a placeholder for a better number we could compute:
 		// the per-request partition is genuinely absent from the wire. The vendor
 		// builds it in `lastAssistantUsage` and sends only its scalar sum (read at
-		// claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`) — #96.
+		// claude-agent-acp 0.76.0 `dist/acp-agent.js:3857-3882`) — #96.
 		//
 		// But silence is NOT the resting state. A cache miss the operator never sees
 		// is a false reading, not a modest one: a session can run for hours believing
@@ -1356,7 +1356,7 @@ export function streamAcpTurn(
 				// between them is exactly why the notice below names a MECHANISM and
 				// never a cause: claude-agent-acp's `conversation_reset` handler only
 				// switches the SDK to a fresh conversation and touches no cost at all
-				// (read at 0.75.1 `dist/acp-agent.js:4282-4289`), while claude-agent-sdk
+				// (read at 0.76.0 `dist/acp-agent.js:4286-4293`), while claude-agent-sdk
 				// separately documents that "a mid-session /clear resets the running
 				// total" (read at 0.3.257 `sdk.d.ts:4884`). A reset therefore PLAUSIBLY
 				// explains a backwards total, but nothing here has MEASURED that it did,

package/pi-extensions/lib/acp/event-mapper.ts

@@ -60,8 +60,8 @@ export type AcpPiStreamState = {
 	 *
 	 * Last write wins, never a sum: both are latest session-level observations, and
 	 * one turn can legitimately see several (claude emits one per `result` message,
-	 * including a sub-agent's own — read at claude-agent-acp 0.75.1
-	 * `dist/acp-agent.js:3467-3482`), each carrying that result's current values.
+	 * including a sub-agent's own — read at claude-agent-acp 0.76.0
+	 * `dist/acp-agent.js:3471-3486`), each carrying that result's current values.
 	 */
 	observedSessionCostUsd?: number;
 	observedContextOccupancyTokens?: number;
@@ -346,8 +346,8 @@ export function applyAcpSessionUpdate(
 		case "usage_update": {
 			// `used` is OCCUPANCY-shaped — the backend's post-turn context size, not
 			// the prompt response's turn aggregate. Claude sends `lastAssistantTotalUsage`
-			// as `used` (read at claude-agent-acp 0.75.1
-			// `dist/acp-agent.js:3867-3878`), after constructing that scalar from the
+			// as `used` (read at claude-agent-acp 0.76.0
+			// `dist/acp-agent.js:3871-3882`), after constructing that scalar from the
 			// latest assistant snapshot (`:3853-3866`). pi reads `usage.totalTokens` as
 			// exactly that occupancy (`calculateContextTokens(usage) = usage.totalTokens
 			// || input + output + cacheRead + cacheWrite`, read at pi-coding-agent

package/pi-extensions/lib/acp/tool-surface.ts

@@ -150,6 +150,12 @@ export function buildClaudeSessionMeta(
 		...(params.modelId ? { model: params.modelId } : {}),
 		tools: [...params.tools],
 		settingSources: [...params.settingSources],
+		// `settings` is an OBJECT here, and that is a contract, not a convenience.
+		// claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
+		// JSON.parse for that form moved out of `resolvedProvider` up onto the
+		// unconditional `session/new` path — a shape that WOULD reach us, and does not,
+		// only because we never hand it a path. Keep it inline: a path would put file
+		// IO, and its failure modes, inside every session creation.
 		settings: {
 			permissions: {
 				allow: [...params.permissionAllow],

package/run.sh

@@ -201,7 +201,7 @@ Usage:
   ./run.sh smoke-copilot-mcp-state       # Copilot MCP install/doctor/inverse regression. Offline/deterministic
   ./run.sh smoke-omp-bridge-state        # OMP birth-extension install/doctor/inverse regression: placement, stale-writer detection, honest inverse, no-state refusal (structurally VALID as well as foreign), symlink refusal, ambiguous-agent-dir refusal (ledger M6), and a poisoned PI_CODING_AGENT_DIR that attracts no artifact. Fully sandboxed HOME/PI/XDG. Offline/deterministic
   ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
-  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry). Offline/hermetic (deps: bash+python3)
+  ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry), plus the #110 self-checkout cells: the real `run.sh install <checkout>` drive leaves the tracked .pi/settings.json byte-identical, writes NO project-scope packages[] self-registration, and REPORTS the skip; cell 15 boots the pinned devDep pi against two stand-in checkouts and requires the --entwurf-control collision to APPEAR before asserting its absence. Offline/hermetic (deps: bash+python3+pinned pi)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
@@ -537,7 +537,28 @@ install_local_package() {
   mkdir -p "$project_dir/.pi"
   # packages[] registration via the shared SSOT — same is_entwurf_source
   # predicate + idempotency as user-scope and remove (not a substring match).
-  python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  #
+  # #110: entwurf's OWN checkout is the one project that never gets this entry.
+  # pi's package identity is `local:<resolved path>` and dedupePackages collapses
+  # only EQUAL identities (package-manager.js getPackageIdentity/dedupePackages),
+  # so a project entry naming this checkout and the user-scope entry naming the
+  # installed root are the same package only while they are the same directory.
+  # In a SECOND checkout (worktree, release scratch) they differ, pi keeps both,
+  # and both copies of pi-extensions/entwurf-control.ts declare
+  # `--entwurf-control`: detectExtensionConflicts gives the flag to whoever
+  # registered first — project scope — and fails the INSTALLED extension while
+  # printing the installed path as the loser, which reads exactly backwards.
+  # user-scope already owns self-registration from any cwd, so the project entry
+  # was only ever a duplicate of it; dropping it removes the second identity in
+  # written bytes, the way the tracked `.pi/settings.json` no longer carries one.
+  # A FOREIGN project still gets its entry — that is what `entwurf install
+  # <project>` is for, and an npm consumer's REPO_DIR is inside node_modules, so
+  # it can never take this branch.
+  if [ "$(cd -P -- "$project_dir" 2>/dev/null && pwd)" = "$REPO_DIR" ]; then
+    echo "install: project-scope packages[] skipped — entwurf's own checkout self-registers through user scope (#110)"
+  else
+    python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR"
+  fi
   # entwurfProvider.mcpServers.entwurf-bridge (project scope — checkout-local, NO state; #46
   # Task 2) via the shared register-pi-provider SSOT: normalize the command to the bare stable
   # bin `entwurf-bridge` (ownership-classified: absent/managed-current/managed-legacy adopt, a
@@ -707,8 +728,11 @@ remove_local_package() {
   # install, so remove never over-deletes a look-alike repo (entwurf-notes, …)
   # that install would never have registered. Same rule, one shape further (#53 B):
   # register only ever WRITES the absolute path, so a settings-RELATIVE entry naming
-  # this repo (the committed `".."` in <repo>/.pi/settings.json) is source, not
-  # install state — remove leaves it and says so instead of editing tracked bytes.
+  # this repo is source an operator hand-wrote, not install state — remove leaves it
+  # and says so instead of editing bytes it never authored. entwurf's own checkout
+  # no longer ships such an entry (#110: user scope owns self-registration), so for
+  # THIS repo the call is a reported no-op; the predicate stays because the shape is
+  # still writable by hand and still must not be over-deleted.
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR" --remove
   # entwurfProvider.mcpServers.entwurf-bridge cleanup (project scope) via the shared SSOT: strip
   # our-managed shapes (the bare stable bin AND the legacy repo start.sh path — a true user
@@ -5775,9 +5799,11 @@ case "$cmd" in
     check_shell_quote
     ;;
   check-install-surface)
-    # 0.12.7 — structural half of the node_modules strip-types fence: run_ts is the only
-    # crossing, every operator subcommand has a compiled twin, bin wrappers branch, dev
-    # gates stay out of the tarball, and offline smokes never touch the real $HOME.
+    # structural half of the node_modules strip-types fence: run_ts is the only crossing,
+    # every operator subcommand has a compiled twin, bin wrappers branch, dev gates stay out
+    # of the tarball, offline smokes carry no OBVIOUS write to the real $HOME (a static
+    # tripwire, never a sandbox proof), and S7 pins the candidate .pi/settings.json — the
+    # shared release skill, the stable bridge bin, and NO packages key (#110).
     # check-pack-install owns the dynamic half (it drives the installed commands).
     run_ts scripts/check-install-surface.ts
     ;;

package/scripts/check-acp-usage-accounting.ts

@@ -72,7 +72,7 @@ interface WireUsage {
  * One `_meta.quota.token_count` row. The field NAMES deliberately differ from
  * `PromptResponse.usage`: cache reads are `cachedInputTokens` here because the
  * shape is shared with codex-acp, and `cachedWriteTokens` is Claude's extra
- * sibling (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6493-6502`).
+ * sibling (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:6566-6575`).
  * Reading a quota row with the `usage` field names silently yields zeros, so the
  * fixture below spells the vendor's names out rather than reusing `WireUsage`.
  */
@@ -137,7 +137,7 @@ function makeFakeChild() {
  *
  * Each `prompt` call consumes the next TurnScript: it first pushes that turn's
  * `usage_update` notification (the wire the running cost total actually arrives
- * on — read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), then answers the
+ * on — read at claude-agent-acp 0.76.0 `dist/acp-agent.js:3471-3486`), then answers the
  * prompt with that turn's `PromptResponse.usage` (the wire the turn aggregate
  * arrives on). Both orderings are the real one: the notification precedes the
  * response, because the SDK emits it from the `result` message that ENDS the turn.
@@ -393,8 +393,8 @@ try {
 	// AGENT LOOP only. `_meta.quota.model_usage` comes from `result.modelUsage` and
 	// also counts Task subagents, sidechains and INTERNAL CALLS SUCH AS COMPACTION;
 	// the vendor states its rows "can total more than `token_count`" and are "the
-	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.75.1
-	// `dist/acp-agent.js:6468-6474`).
+	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.76.0
+	// `dist/acp-agent.js:6541-6547`).
 	//
 	// The wide one is required, not merely nicer, because the DENOMINATOR already
 	// has that scope: turn cost is the adjacent diff of the backend's running total,
@@ -608,8 +608,8 @@ try {
 	// identity that produces the bound is a property of the MAIN AGENT LOOP's
 	// cache breakpoints. `_meta.quota.model_usage` is a WIDER scope: the vendor
 	// states those rows also count Task subagents, sidechains, and INTERNAL
-	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.75.1
-	// `dist/acp-agent.js:6465-6485`). Mixing the two scopes inflates the bound
+	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.76.0
+	// `dist/acp-agent.js:6538-6558`). Mixing the two scopes inflates the bound
 	// through both remaining terms that mention cacheWrite:
 	//   max(0, occupancy − cacheWrite) shrinks as wide cacheWrite grows, so
 	//   less is subtracted; min(rawBound, cacheWrite) rises with it.
@@ -749,9 +749,9 @@ try {
 	// CELL 3 — a turn with NO cost notification holds the baseline.
 	//
 	// Measured upstream: the result-path `usage_update` carries cost (read at
-	// claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), while other
+	// claude-agent-acp 0.76.0 `dist/acp-agent.js:3471-3486`), while other
 	// `usage_update` paths can carry `used` without cost (for example the
-	// rate-limit path at `:4269-4277`). A live thinkpad ledger shows such turns
+	// rate-limit path at `:4273-4281`). A live thinkpad ledger shows such turns
 	// really occur. The honest handling is to HOLD the baseline so the amount lands
 	// in the NEXT diff: misattributed by turn, exact by session. Rebaselining to 0
 	// there would double-count the whole prefix.
@@ -831,7 +831,7 @@ try {
 	// CELL 4 — a DECREASING session total is never silently absorbed.
 	//
 	// `conversation_reset` switches the session to a fresh transcript (read at
-	// claude-agent-acp 0.75.1 `dist/acp-agent.js:4282-4289`), but whether that
+	// claude-agent-acp 0.76.0 `dist/acp-agent.js:4286-4293`), but whether that
 	// changes `total_cost_usd` is an SDK-internal value we cannot observe here.
 	// A diff can therefore go negative in a session we are still holding.
 	// Absorbing it quietly would both misreport the turn and destroy the only

package/scripts/check-gate-qualification.ts

@@ -846,7 +846,7 @@ let manifestCount: number;
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
 		"pack-install": 2,
-		"pi-package-ownership": 6,
+		"pi-package-ownership": 8,
 		"mux-resume-call": 12,
 		"omp-birth": 13,
 		"omp-fresh": 24,

package/scripts/check-install-surface.ts

@@ -22,6 +22,10 @@
  *        smoke that swaps HOME into a sandbox swaps XDG_DATA_HOME with it — moving HOME
  *        alone still writes real install-state below the inherited XDG root, which is
  *        exactly how a verification sweep polluted a live host's provenance (2026-07-14).
+ *   S5b  every offline smoke that swaps HOME also swaps XDG_DATA_HOME (HOME alone still
+ *        writes real install-state below the inherited XDG root).
+ *   S5c  every MUTATING run.sh drive in the offline floor is sandboxed at every root it
+ *        writes (agent dir + XDG + HOME), not only by an enclosing export.
  *   S5d  a gate may isolate by PROCESS BOUNDARY instead of by HOME swap: lines inside a
  *        `CONTAINER_RUNNER_EOF` heredoc run in a container, so their $HOME is not this
  *        host's and S5 must not read them as host writes. The exemption covers the BLOCK,
@@ -31,7 +35,10 @@
  *        contains it while executing right here).
  *   S7   the release operator surface is one repo-local Agent Skill shared by Claude Code and
  *        pi: project settings point pi at `.claude/skills`, land/prepare/make/publish coexist in
- *        one SKILL.md, the exact-SHA CI oracle ships beside it, and retired prompt copies stay absent.
+ *        one SKILL.md, the exact-SHA CI oracle ships beside it, and retired prompt copies stay
+ *        absent. S7c also pins that the tracked settings carry NO packages key — entwurf's own
+ *        checkout self-registers through user scope alone (#110).
+ *   S6   tracked first-party text sources are NUL-free (a stray NUL makes git show nothing).
  *
  * HONEST SCOPE — what a green run does and does not mean. S1-S4 are structural: they read the
  * dispatch graph and the build manifest, so they hold for any entrypoint written in this repo's
@@ -39,8 +46,8 @@
  * of variable aliasing, and it does not see a path assembled across several variables, built
  * inside an embedded python/node heredoc, or reached through a helper in another file. A green
  * S5 therefore means "no obvious destructive line", NOT "verification is sandboxed". The real
- * guarantee is running the whole offline floor under a swapped HOME; that is an open item in
- * NEXT.md, not a claim made here. Every S was mutation-checked, including bypasses found in
+ * guarantee would be running the whole offline floor under a swapped HOME; that is not done,
+ * and not claimed here. Every S was mutation-checked, including bypasses found in
  * review — do not add an S without proving it fails on the bug it names.
  *
  * Read-only: parses sources, spawns nothing.
@@ -478,11 +485,20 @@ const operatorCmds = [...targets].filter(([cmd, ts]) => !isDevGate(cmd) && ts.le
 			(settingsParseError === "" && Array.isArray(settings.skills) && settings.skills.includes("../.claude/skills")),
 		settingsParseError || `${settingsRel}: expected skills to include ../.claude/skills`,
 	);
+	// S7c pins an INVARIANT, not a shape. #53 B: a host-absolute path must never reach
+	// this tracked, biome-governed file. It used to be pinned as "the entry is exactly
+	// `..`", which satisfied that invariant and carried a second, unintended one — the
+	// checkout registers ITSELF. #110 showed what that second one buys: user scope
+	// already registers this root absolutely, so in any OTHER checkout the two entries
+	// name different directories, pi's dedupe (identity = `local:<resolved path>`) keeps
+	// both, and two copies of pi-extensions/entwurf-control.ts fight over
+	// `--entwurf-control` — the branch copy wins and the INSTALLED one fails, printing
+	// the installed path as the loser. No packages key at all satisfies #53 B strictly
+	// more than `..` did, and leaves self-registration where it is owned.
 	ok(
-		"S7c: candidate project settings keep the local package source portable",
-		settingsText === null ||
-			(Array.isArray(settings.packages) && settings.packages.length === 1 && settings.packages[0] === ".."),
-		`${settingsRel}: expected packages to be the settings-relative repo root '..'`,
+		"S7c: candidate project settings never bind entwurf to a checkout path",
+		settingsText === null || settings.packages === undefined,
+		`${settingsRel}: expected NO packages key — entwurf's own checkout self-registers through user scope (#110)`,
 	);
 	const bridge = settings.entwurfProvider?.mcpServers?.["entwurf-bridge"];
 	ok(

package/scripts/mutants/pi-package-ownership.json

@@ -87,6 +87,32 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:MISSING-OWNER-AUTO-TAKEOVER]",
 			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "SECOND-CHECKOUT-EXTENSION-COLLISION",
+			"title": "entwurf's own checkout ships a project-scope self-registration again, so any SECOND checkout registers a rival copy of pi-extensions beside the installed one and wins --entwurf-control while the installed extension fails, printing the installed path as the loser (#110)",
+			"subject": ".pi/settings.json",
+			"find": ["\"skills\": [\"../.claude/skills\"],\n\t\"entwurfProvider\": {"],
+			"replace": ["\"skills\": [\"../.claude/skills\"],\n\t\"packages\": [\"..\"],\n\t\"entwurfProvider\": {"],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SECOND-CHECKOUT-EXTENSION-COLLISION]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
+		},
+		{
+			"claim": "SELF-CHECKOUT-PROJECT-REGISTRATION",
+			"title": "install registers entwurf project-scope into entwurf's OWN checkout, so `./run.sh setup` writes back the self-registration the tracked file no longer carries — the same #110 collision, arriving through the writer instead of through committed bytes",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$(cd -P -- \"$project_dir\" 2>/dev/null && pwd)\" = \"$REPO_DIR\" ]; then\n    echo \"install: project-scope packages[] skipped — entwurf's own checkout self-registers through user scope (#110)\"\n  else\n    python3 \"$REPO_DIR/scripts/register-pi-package.py\" \"$project_dir/.pi/settings.json\" \"$REPO_DIR\"\n  fi"
+			],
+			"replace": [
+				"  python3 \"$REPO_DIR/scripts/register-pi-package.py\" \"$project_dir/.pi/settings.json\" \"$REPO_DIR\""
+			],
+			"gate": ["bash", "run.sh", "smoke-user-scope-citizen"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SELF-CHECKOUT-PROJECT-REGISTRATION]",
+			"signatureSource": "scripts/smoke-user-scope-citizen.sh"
 		}
 	]
 }

package/scripts/pi_settings_io.py

@@ -7,7 +7,9 @@ Both Python writers touch the SAME file (`<repo>/.pi/settings.json` at project s
   - register-pi-provider.py  → entwurfProvider.mcpServers.entwurf-bridge
 
 A settings file can be tracked and owned by a formatter (this repo's own is: tab
-indented, biome-governed, pinned byte-for-byte by check-install-surface S7b–S7d), so a
+indented, biome-governed, its skills/packages/provider-bin invariants pinned by
+check-install-surface S7b-S7d and its bytes pinned end to end by smoke-user-scope-citizen
+cell 14b), so a
 writer that re-serializes it in its own house style turns `install` into a source edit.
 #53 B closed that for the packages writer and left the provider writer open — the same
 file, the same defect, one function call away. The rules therefore live HERE rather than

package/scripts/register-pi-package.py

@@ -22,29 +22,36 @@ settings-RELATIVE entry that resolves to repo_dir (see below). A look-alike repo
 removed. Every non-entwurf package and every other settings key is preserved.
 
 CANONICAL IS NOT ONLY THE ABSOLUTE PATH. A packages[] entry is resolved by pi
-against the SETTINGS FILE'S OWN DIRECTORY, so this repo's committed
-`.pi/settings.json` names itself portably as `".."` — the exact form
-check-install-surface S7c pins. Comparing entries against the resolved absolute
-path ALONE did not recognize that as entwurf, so `setup` appended the absolute
-path beside it and rewrote the tracked, biome-governed file in a foreign style:
-a dev clone went RED at `pnpm check` step 1, diagnosed as a "formatting" error
-(#53 B). Two rules follow, and they are the same rule read forwards and backwards:
+against the SETTINGS FILE'S OWN DIRECTORY, so a settings-relative entry such as
+`".."` can name the very repo being registered. Comparing entries against the
+resolved absolute path ALONE did not recognize that as entwurf, so `setup` appended
+the absolute path beside it and rewrote a tracked, biome-governed file in a foreign
+style: a dev clone went RED at `pnpm check` step 1, diagnosed as a "formatting"
+error (#53 B). Two rules follow, and they are the same rule read forwards and
+backwards:
   - register: an entry that RESOLVES to repo_dir is already canonical → no-op, and
     when a rewrite is genuinely needed a settings-relative self-reference is kept
     as the survivor, so the portable form is never silently absolutized;
   - remove: register only ever WRITES the absolute form, so a settings-relative
-    self-reference cannot be install's own output — it was authored by the repo
-    (this one commits `".."`) or by the operator. Uninstall is install's inverse,
-    not a settings editor: it leaves that ONE class in place and SAYS SO on stdout,
-    rather than deleting source bytes install never wrote. The cost is stated
-    rather than hidden: on a settings file whose only entwurf entry is relative,
-    `--remove` is a no-op and the package stays registered until a human edits it.
-    would_remove() asks the same split, so `--dry-run` can never disagree with what
-    `--remove` does.
+    self-reference cannot be install's own output — it was authored by hand.
+    Uninstall is install's inverse, not a settings editor: it leaves that ONE class
+    in place and SAYS SO on stdout, rather than deleting source bytes install never
+    wrote. The cost is stated rather than hidden: on a settings file whose only
+    entwurf entry is relative, `--remove` is a no-op and the package stays
+    registered until a human edits it. would_remove() asks the same split, so
+    `--dry-run` can never disagree with what `--remove` does.
+This repo's own `.pi/settings.json` USED to be the load-bearing instance of that
+shape. It no longer carries a packages[] entry at all: entwurf's checkout
+self-registers through USER scope only, because a project entry naming "whichever
+checkout I am in" plus a user entry naming the installed one are two package
+identities to pi, and a second checkout then loads a rival copy of pi-extensions
+and wins `--entwurf-control` (#110). The predicate stays because the shape is still
+writable by hand, and because resolving-then-comparing is also what keeps an
+unrelated relative package like `../../repos/gh/andenken` from being read as ours.
 A rewrite also preserves the file's existing indentation instead of forcing 2
 spaces. That is narrower than it sounds — it keeps the indent UNIT, not a
-formatter's line-collapsing decisions — so the byte-identity guarantee this repo's
-own settings depend on comes from the no-op path, never from the writer's style.
+formatter's line-collapsing decisions — so a byte-identity guarantee always comes
+from the no-op path, never from the writer's style.
 
 This wiring (user scope) dropped when `pi install` was removed from setup
 (2026-07-03: `--entwurf-control` unknown in a foreign cwd). Extracting it here
@@ -129,11 +136,11 @@ def source_of(item: object) -> object:
 def is_settings_relative_self(source: str, settings_dir: str, repo_dir: str) -> bool:
     """True iff this entry is a SETTINGS-RELATIVE path naming repo_dir itself.
 
-    This is the repo's own committed portable form (`".."` in
-    <repo>/.pi/settings.json) — functionally identical to the absolute entry,
-    because pi resolves a relative package source against the settings file's own
-    directory. It is also the one shape register never writes, which is what lets
-    remove treat it as source rather than as install state.
+    The portable form (`".."` in <repo>/.pi/settings.json) — functionally identical
+    to the absolute entry, because pi resolves a relative package source against the
+    settings file's own directory. It is also the one shape register never writes,
+    which is what lets remove treat it as source rather than as install state. This
+    repo stopped shipping it at #110; an operator may still write it by hand.
 
     Anything carrying a scheme (npm:/git:/https:) is a spec, not a path; anything
     absolute (`/`, `~`) is not settings-relative. Everything else is resolved and
@@ -159,8 +166,8 @@ def is_entwurf_source(source: str, repo_dir: str, settings_dir: str | None = Non
       - the exact resolved repo dir;
       - an npm install path ending in node_modules/@junghanacs/entwurf;
       - an explicit npm package source for @junghanacs/entwurf;
-      - a settings-relative path that RESOLVES to the repo dir (the committed
-        portable `".."`), when the caller supplies settings_dir;
+      - a settings-relative path that RESOLVES to the repo dir (the portable
+        `".."` form), when the caller supplies settings_dir;
       - a local filesystem path whose final directory is literally "entwurf"
         (dev clone / stale move). Remote URL/git-like strings are NOT treated as
         local paths merely because their last segment is "entwurf".
@@ -242,7 +249,7 @@ def register(settings_path: Path, repo_dir_arg: str) -> str:
     # the canonical absolute string or as a settings-relative path resolving there.
     # Both are the same registration to pi, so both are a no-op: order-insensitive, no
     # rewrite, mtime stable. Recognizing only the absolute form is what made `setup`
-    # duplicate this repo's own committed `".."` and restyle the tracked file (#53 B).
+    # duplicate a settings-relative `".."` and restyle the tracked file (#53 B).
     # Both arms require the STRING form, so an object-form entry still collapses to a
     # canonical string exactly as before.
     if len(entwurf_entries) == 1 and isinstance(entwurf_entries[0], str) and (
@@ -252,8 +259,9 @@ def register(settings_path: Path, repo_dir_arg: str) -> str:
         return "noop"
 
     # A rewrite keeps the PORTABLE form when the file already had one: absolutizing a
-    # committed `".."` would repair the duplicate and dirty the tracked bytes in the
-    # same breath. Otherwise the canonical absolute path is what install writes.
+    # hand-written `".."` would repair the duplicate and dirty bytes install never
+    # wrote in the same breath. Otherwise the canonical absolute path is what install
+    # writes.
     survivor = next(
         (
             source_of(e) for e in entwurf_entries
@@ -277,7 +285,7 @@ def _removable(packages: list, repo_dir: str, settings_dir: str) -> tuple[list,
 
     PRESERVED = settings-relative self-references, the one shape register CANNOT
     have produced (it always writes the resolved absolute path). Such an entry is
-    the repo's committed portable registration or the operator's own hand edit.
+    the operator's own hand edit.
     Deleting it would make uninstall a source editor, which is the defect #53 B is
     about, pointed the other way. main() prints what was kept so the incompleteness
     is loud rather than silent.
@@ -665,7 +673,7 @@ def remove_user(settings_path: Path, repo_dir_arg: str, state_path: Path, orphan
     else:
         print(f"remove: no entwurf packages[] entry naming this root ({settings_path})")
     if preserved_rel:
-        print(f"remove: kept {len(preserved_rel)} settings-relative entwurf entr{'y' if len(preserved_rel) == 1 else 'ies'} — committed/operator source, not install state")
+        print(f"remove: kept {len(preserved_rel)} settings-relative entwurf entr{'y' if len(preserved_rel) == 1 else 'ies'} — operator source, not install state")
     if foreign_like:
         print(f"remove: kept {len(foreign_like)} entwurf-shaped entr{'y' if len(foreign_like) == 1 else 'ies'} with no recorded owner "
               "(not provably this root's) — use './run.sh doctor-pi-package' / takeover-user-scope to resolve ownership")
@@ -829,7 +837,7 @@ def main(argv: list[str]) -> int:
         if kept:
             print(
                 f"remove: kept {kept} settings-relative entwurf entr{'y' if kept == 1 else 'ies'} "
-                f"({settings_path}) — install never writes that form, so it is committed/operator "
+                f"({settings_path}) — install never writes that form, so it is operator "
                 "source, not install state; edit the file by hand to drop it"
             )
         return 0

package/scripts/register-pi-provider.py

@@ -25,8 +25,9 @@ Scope asymmetry (봉인계약 4·6, REASONED — not the unfounded asymmetry dev
            of our key is tidied; siblings kept.
   project  <repo>/.pi/settings.json — checkout-LOCAL, disposable, re-creatable, and `run.sh
            remove` already covers it → NO state. install normalizes the command; remove strips
-           our-managed shapes (the bare bin AND the legacy repo path). project-scope state is a
-           NAMED FOLLOW-UP (NEXT), deliberately out of this lane.
+           our-managed shapes (the bare bin AND the legacy repo path). project scope takes NO
+           state, deliberately: it is checkout-local, disposable, and `run.sh remove` is its
+           whole inverse.
 
 USER-SCOPE OWNER BINDING (#86 C2): the user install-state additionally records
 `installerRoot` (the repo/package root that installed the key), so an old root's

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.75.1) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.76.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-user-scope-citizen.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # smoke-user-scope-citizen — deterministic gate for pi packages[] citizen
-# registration/removal (register-pi-package.py). Offline/hermetic: a fake
-# settings file + a fake REPO_DIR under $TMP, no pi, no network, no ~/.pi touched.
+# registration/removal (register-pi-package.py). Offline/hermetic: fake settings
+# files and fake REPO_DIRs under $TMP, sandboxed HOME/PI_CODING_AGENT_DIR/XDG,
+# no network, nothing of the operator's ~/.pi read or written.
 #
 # Guards the wiring that dropped when `pi install` was removed from setup
 # (2026-07-03: `--entwurf-control` / `--emacs-agent-socket` unknown in a foreign
@@ -10,10 +11,14 @@
 # in another repo. This gate is that missing tripwire: if the registration ever
 # regresses, `pnpm run check:full` goes red.
 #
-# Cells 11–13 close the second omission (#53 B): every case here drove a fake
-# settings file with ABSOLUTE entries, so the portable, settings-relative form this
-# repo actually commits was never registered against — and `setup` duplicated and
-# restyled the tracked file for four cuts without a single gate seeing it.
+# Cells 11–13 close the second omission (#53 B): every case before them drove a fake
+# settings file with ABSOLUTE entries, so the portable, settings-relative form was
+# never registered against — and `setup` duplicated and restyled a tracked file for
+# four cuts without a single gate seeing it.
+#
+# Cell 15 closes the third (#110), and it is the one cell here that SPAWNS pi: the
+# defect is not a byte, it is which of two checkouts wins `--entwurf-control`, and
+# only the real loader can say. It uses the pinned devDep pi, never PATH.
 set -euo pipefail
 export PYTHONDONTWRITEBYTECODE=1 # snapshot purity: no ignored scripts/__pycache__ writes under qualification
 
@@ -193,69 +198,64 @@ assert d['defaultProvider']=='openai-codex', 'run.sh remove-user-scope dropped a
 # idempotent: a second remove-user-scope is a clean no-op (no crash on absent entry)
 if XDG_DATA_HOME="$TMP/xdg" PI_CODING_AGENT_DIR="$AGENT_DIR" bash "$RUN" remove-user-scope >/dev/null 2>&1; then ok "run.sh remove-user-scope is idempotent (no-op second run)"; else bad "run.sh remove-user-scope second run crashed"; fi
 
-# ── 11–13. #53 B: install must not dirty a tracked, formatter-governed settings file
+# ── 11–13. #53 B: a settings-relative self entry is source, never install state
 # The cell whose ABSENCE let this ship. Every case above drove a fake settings file
-# with absolute entries, so the one shape this repo actually commits — the portable,
-# settings-relative `".."` that check-install-surface S7c pins — was never registered
-# against. `setup` therefore appended the absolute path BESIDE it and rewrote the
-# tracked, biome-owned bytes at indent=2, and `pnpm check` died at step 1 reading
-# "format error" instead of "install wrote this".
+# with ABSOLUTE entries, so the portable, settings-relative form — the one shape
+# register never WRITES, and must therefore never duplicate, absolutize or restyle —
+# was never registered against. `setup` appended the absolute path BESIDE it and
+# rewrote the file at indent=2, and `pnpm check` died at step 1 reading "format
+# error" instead of "install wrote this".
 #
-# The seed is the repo's OWN committed settings, copied into a stand-in checkout so
-# `".."` resolves to that clone rather than to the real repo (nothing here touches
-# $REPO). Setup landing is PROVEN before any product verdict: if the seed is not the
-# portable form, this says SETUP MISS in its own name instead of blaming the code.
+# The seed is a FIXTURE. It used to be this repo's OWN committed `.pi/settings.json`,
+# because the repo shipped `packages: [".."]`; #110 retired that entry (entwurf's own
+# checkout self-registers through user scope alone, so a second checkout can no
+# longer register a rival copy of pi-extensions). A witness that depends on us still
+# SHIPPING the shape it tests dies with the shape — and the shape it tests did not
+# die. An operator may hand-write a settings-relative entry, and
+# `is_settings_relative_self` is also what stops an unrelated relative package
+# (`../../repos/gh/andenken`) from being read as ours. Dropping the fixture to a
+# literal here makes the reason honest: the predicate is the subject, not our bytes.
 CLONE="$TMP/selfclone"; mkdir -p "$CLONE/.pi"
 CS="$CLONE/.pi/settings.json"
-seed_src=""
-if (cd "$REPO" && git show :.pi/settings.json) > "$CS" 2>/dev/null && [ -s "$CS" ]; then
-  seed_src="candidate index"
-elif cp "$REPO/.pi/settings.json" "$CS" 2>/dev/null; then
-  seed_src="worktree"
+# Tab-indented with a compact array on purpose: cell 13 pins that a genuine rewrite
+# preserves the file's own indent unit, and 11b below pins that this file is not
+# rewritten at all. A seed written in the writer's default style could not tell the
+# two apart.
+printf '{\n\t"skills": ["../.claude/skills"],\n\t"packages": [".."]\n}\n' > "$CS"
+BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
+OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
+AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
+if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
+  ok "11 register against a settings-relative self entry is a no-op"
+else
+  bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
 fi
-if [ ! -s "$CS" ]; then
-  bad "11 SETUP MISS: could not seed this repo's own .pi/settings.json (no git object, no worktree file)"
-elif ! python3 -c "
-import json,sys
-p=json.load(open(sys.argv[1])).get('packages')
-sys.exit(0 if p==['..'] else 1)" "$CS"; then
-  bad "11 SETUP MISS: the seed ($seed_src) is not the committed portable form (packages != ['..']) — product verdict withheld"
+if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
+  ok "11b the formatter-governed bytes are UNCHANGED (sha256 + mtime)"
 else
-  BEFORE="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_B="$(stat -c %Y "$CS")"; sleep 1
-  OUT_SELF="$(python3 "$REG" "$CS" "$CLONE")"
-  AFTER="$(sha256sum "$CS" | cut -d' ' -f1)"; MT_A="$(stat -c %Y "$CS")"
-  if printf '%s' "$OUT_SELF" | grep -q 'no-op'; then
-    ok "11 register against this repo's OWN committed settings is a no-op (seed: $seed_src)"
-  else
-    bad "11 register duplicated/absolutized the portable '..' entry" "$OUT_SELF"
-  fi
-  if [ "$BEFORE" = "$AFTER" ] && [ "$MT_B" = "$MT_A" ]; then
-    ok "11b the tracked, formatter-governed bytes are UNCHANGED (sha256 + mtime)"
-  else
-    bad "11b install rewrote the tracked settings file (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
-  fi
-  # The inverse direction of the same asymmetry: the shared matcher now RECOGNIZES
-  # `".."`, so an uninstall that deleted it would edit committed source — the same
-  # defect pointed the other way. remove leaves it and says so; dry-run agrees,
-  # because both ask one predicate.
-  BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
-  OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
-  OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
-  if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
-    ok "11c --remove does NOT delete the committed portable entry (bytes unchanged)"
-  else
-    bad "11c --remove edited the repo's committed settings source" "$OUT_RM"
-  fi
-  if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
-    ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
-  else
-    bad "11d --remove left the entry without saying so" "$OUT_RM"
-  fi
-  if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
-    ok "11e --dry-run agrees with remove (one predicate, no over-report)"
-  else
-    bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
-  fi
+  bad "11b register rewrote a settings file it only recognizes (sha $BEFORE -> $AFTER, mtime $MT_B -> $MT_A)"
+fi
+# The inverse direction of the same asymmetry: the shared matcher RECOGNIZES `".."`,
+# so an uninstall that deleted it would edit source it never wrote — the same defect
+# pointed the other way. remove leaves it and says so; dry-run agrees, because both
+# ask one predicate.
+BEFORE_R="$(sha256sum "$CS" | cut -d' ' -f1)"
+OUT_RM="$(python3 "$REG" "$CS" "$CLONE" --remove)"
+OUT_DRY="$(python3 "$REG" "$CS" "$CLONE" --remove --dry-run)"
+if [ "$BEFORE_R" = "$(sha256sum "$CS" | cut -d' ' -f1)" ]; then
+  ok "11c --remove does NOT delete a settings-relative self entry (bytes unchanged)"
+else
+  bad "11c --remove edited settings source it never authored" "$OUT_RM"
+fi
+if printf '%s' "$OUT_RM" | grep -q 'kept 1 settings-relative'; then
+  ok "11d the inverse REPORTS what it deliberately left behind (never a silent partial uninstall)"
+else
+  bad "11d --remove left the entry without saying so" "$OUT_RM"
+fi
+if printf '%s' "$OUT_DRY" | grep -q 'no entwurf packages\[\] entry to remove'; then
+  ok "11e --dry-run agrees with remove (one predicate, no over-report)"
+else
+  bad "11e --dry-run disagreed with what remove actually does" "$OUT_DRY"
 fi
 
 # 12. the state a pre-fix `setup` already left on real hosts: the portable entry AND
@@ -291,12 +291,20 @@ if grep -q $'^\t"packages"' "$S"; then ok "13 a rewrite preserves the file's tab
 # indent=2 — semantically a no-op, byte-wise a RED `pnpm check` diagnosed as "formatting".
 # A per-writer cell can never see that; only the real drive can. So this one runs
 # `run.sh install <checkout>` for real and demands sha256 + mtime invariance.
-#
 # The checkout is a stand-in: run.sh resolves its OWN symlinks to find REPO_DIR, so
 # run.sh is COPIED (a link would point the drive back at the operator's real repo) while
 # the trees it only reads are linked. That makes REPO_DIR == the stand-in, which is the
-# shape that matters — `".."` in <checkout>/.pi/settings.json resolves to the very repo
-# being registered, exactly as it does in a dev clone.
+# shape that matters — the drive installs entwurf INTO entwurf's own checkout, exactly
+# as `./run.sh setup` does from a dev clone (PROJECT_DIR_DEFAULT=$(pwd)).
+#
+# #110 raised what this cell demands. "install is a no-op here" used to hold because
+# the committed `packages: [".."]` already satisfied the writer. That entry is gone,
+# so the writer must instead RECOGNIZE that the project it is installing into IS this
+# root and skip project scope entirely — user scope already registers it, and a second
+# entry naming a different checkout is what made pi load two rival copies of
+# pi-extensions/entwurf-control.ts. The invariant, tested end to end below: entwurf's
+# own checkout carries no project-scope self-registration, in tracked bytes OR in
+# bytes a writer produced.
 CK="$TMP/checkout"
 mkdir -p "$CK/.pi"
 cp "$REPO/run.sh" "$CK/run.sh"
@@ -317,8 +325,8 @@ if [ ! -s "$CKS" ]; then
 elif ! python3 -c "
 import json,sys
 d=json.load(open(sys.argv[1]))
-sys.exit(0 if d.get('packages')==['..'] and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
-  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed portable form (packages ['..'] + entwurfProvider)"
+sys.exit(0 if d.get('packages') is None and isinstance(d.get('entwurfProvider'),dict) else 1)" "$CKS"; then
+  bad "14 SETUP MISS: the seed ($ck_seed) is not the committed form (no packages key + entwurfProvider)"
 else
   CK_BEFORE="$(sha256sum "$CKS" | cut -d' ' -f1)"; CK_MT="$(stat -c %Y "$CKS")"
   sleep 1
@@ -359,6 +367,124 @@ else
     else
       bad "14d the user-scope citizen was not written under the sandboxed PI_CODING_AGENT_DIR" "$ck_out"
     fi
+    # The invariant, read off the file the drive just wrote through: no writer put a
+    # project-scope self-registration back. 14b already pins the bytes, but a writer
+    # that ADDED `packages` to a file with no `packages` key would fail 14b for a
+    # reason a reader could mistake for formatting; this says the thing #110 is about,
+    # in its own words.
+    L14E="14e install into entwurf's OWN checkout wrote no project-scope packages[] self-registration [QK:SELF-CHECKOUT-PROJECT-REGISTRATION]"
+    if python3 -c "
+import json,sys
+sys.exit(0 if json.load(open(sys.argv[1])).get('packages') is None else 1)" "$CKS"; then
+      ok "$L14E"
+    else
+      bad "$L14E — violated: install self-registered this checkout, so a second checkout will load a rival copy of pi-extensions" "$(cat "$CKS")"
+    fi
+    case "$ck_out" in
+      *"project-scope packages[] skipped"*) ok "14f the drive REPORTS the skip (a silent skip and a silent write read alike)" ;;
+      *) bad "14f install skipped project scope without saying so — 14e cannot tell that apart from a writer that never ran" "$ck_out" ;;
+    esac
+  fi
+fi
+
+# ── 15. #110: the operator-observable this whole contract exists for ───────────
+# Cells 11–14 read settings bytes. Bytes are the mechanism; the SYMPTOM is what pi
+# does with them, and that is what nobody could see: a second checkout booted pi,
+# printed all seven `entwurf` model rows, and looked fine, while `--entwurf-control`
+# — the flag that makes a pi session a garden citizen — was being served by the
+# branch copy, and the INSTALLED extension failed to load with an error naming the
+# installed path as the loser. Not silent. Designed to be misread.
+#
+# pi's package identity is `local:<resolved path>` and dedupePackages collapses only
+# EQUAL identities (package-manager.js getPackageIdentity/dedupePackages), so two
+# real checkouts can never merge — no realpath rule, ours or pi's, would fix this.
+# The only lever is not registering the second one.
+#
+# The cell is control-then-assert on purpose. A sandbox where pi loads no project
+# settings at all (untrusted cwd, missing extension deps, a probe that dies early)
+# would report "no conflicts" for reasons that have nothing to do with the contract,
+# and that green would be a lie. So it first PLANTS the retired entry and demands the
+# conflict APPEAR; only a cell that has just watched the defect happen is allowed to
+# assert its absence.
+# Two different absences, and only one of them is allowed to be quiet. A tree with no
+# `node_modules` at all is a genuinely reduced checkout and the property is untestable
+# there — a named skip. A tree that HAS dependencies but no pinned pi is a broken dev
+# checkout, and skipping it would hide the breakage behind an exit-0 gate, so that one
+# fails loud. (The qualification snapshot is the first case only in principle: it
+# symlinks the origin's node_modules in after its baseline commit — mutation-qualify.ts
+# createRepoSnapshot — so cell 15 really runs there, which is what lets the two mutants
+# below cover this skip. A skip nobody can reach with a planted defect would be exactly
+# the quiet green this cell is built to refuse.)
+PI_BIN_PINNED="$REPO/node_modules/.bin/pi"
+if [ ! -d "$REPO/node_modules" ]; then
+  echo "  skip  15 second-checkout probe skipped: this tree has no node_modules (reduced checkout); the property is untestable here, not violated"
+elif [ ! -x "$PI_BIN_PINNED" ]; then
+  bad "15 the pinned pi is missing from a checkout that HAS dependencies ($PI_BIN_PINNED) — a broken dev checkout, not a reduced one; re-run pnpm install"
+else
+  A15="$TMP/dual/installed"; B15="$TMP/dual/second"
+  AG15="$TMP/agent15"
+  mkdir -p "$A15/.pi" "$B15/.pi" "$AG15"
+  # pi-extensions is COPIED into each root, not linked: the defect is two DISTINCT
+  # real paths declaring the same flag, and a shared symlink target would be one path
+  # wearing two names — a fixture that cannot reproduce what two checkouts do.
+  for root in "$A15" "$B15"; do
+    cp -R "$REPO/pi-extensions" "$root/pi-extensions"
+    for entry in node_modules package.json protocol.js; do
+      [ -e "$REPO/$entry" ] && ln -s "$REPO/$entry" "$root/$entry"
+    done
+  done
+  # user scope registers the INSTALLED root, absolutely — what `register_user_scope_citizen`
+  # writes on a real host. Trust is seeded for the second checkout because `.pi/` is a
+  # trust-gated input: an untrusted cwd loads no project settings, which would silence
+  # the control below and make the assertion vacuous.
+  printf '{"packages": ["%s"]}\n' "$A15" > "$AG15/settings.json"
+  printf '{"%s": true}\n' "$B15" > "$AG15/trust.json"
+  # Two fences on the probe child, and BOTH are load-bearing.
+  #
+  # `< /dev/null`: `pi --print` reads a non-tty stdin as piped prompt input, so it
+  # inherits whatever the CALLER handed this gate. Under an interactive shell or a
+  # /dev/null stdin that ends immediately and the probe returns in ~2s; under a
+  # supervised runner — which hands the process an open socket — it blocks forever.
+  # Measured 2026-09-10: a release-gate run sat 1h56m on this line with `pi` alive
+  # and no output, and the gate has no timeout of its own to catch it. A gate must
+  # read the loader, never the stdin of whoever started it.
+  #
+  # `timeout 60`: even so, a probe that cannot finish must go RED rather than hang.
+  # 124 lands in the captured output, the conflict grep misses, and the cell fails
+  # with its own name — the honest outcome for "the loader never answered".
+  #
+  # Ambient identity carriers are stripped for the same reason: a live pi/ACP session
+  # exports PI_SESSION_ID/PI_AGENT_ID and CLAUDE_CONFIG_DIR into children.
+  probe15() {
+    (cd "$B15" && env -u PI_SESSION_ID -u PI_AGENT_ID -u CLAUDE_CONFIG_DIR \
+      HOME="$TMP/home" PI_CODING_AGENT_DIR="$AG15" \
+      XDG_DATA_HOME="$TMP/xdg" XDG_STATE_HOME="$TMP/state" XDG_CACHE_HOME="$TMP/cache" \
+      timeout 60 "$PI_BIN_PINNED" --model zzz-no-such-provider/zzz-no-such-model --print x \
+      </dev/null 2>&1 || true)
+  }
+  # CONTROL: the retired shape, re-planted. `".."` resolves against <B>/.pi, so the
+  # project entry names B while user scope names A — two identities, both loaded.
+  printf '{"packages": [".."]}\n' > "$B15/.pi/settings.json"
+  OUT15_CTL="$(probe15)"
+  if printf '%s' "$OUT15_CTL" | grep -q 'conflicts with'; then
+    ok "15 control: a second checkout that registers itself DOES collide on the extension flags"
+  else
+    bad "15 SETUP MISS: the planted second registration produced no conflict — this sandbox cannot observe the defect, so 15b would be vacuous" "$OUT15_CTL"
+  fi
+  # ASSERT: this repo's real `.pi/settings.json`, read from the WORKING TREE — not
+  # from the candidate index the way cells 11/14 read theirs. The subject here is
+  # what pi's loader does with the file that exists ON DISK when a session starts;
+  # the index is a different question and check-install-surface S7c already owns it.
+  # Reading the index here also made this cell blind to its own replant: a mutation
+  # writes the file, git show reads the staged bytes, and the gate stayed green over
+  # a planted defect (measured — qualification reported SURVIVED, 2026-09-10).
+  cp "$REPO/.pi/settings.json" "$B15/.pi/settings.json"
+  OUT15="$(probe15)"
+  L15B="15b a second checkout of this repo boots pi with zero extension conflicts [QK:SECOND-CHECKOUT-EXTENSION-COLLISION]"
+  if printf '%s' "$OUT15" | grep -q 'conflicts with'; then
+    bad "$L15B — violated: the branch copy wins --entwurf-control and the INSTALLED extension fails, printing the installed path as the loser" "$OUT15"
+  else
+    ok "$L15B"
   fi
 fi
 
@@ -740,14 +866,16 @@ if [ "$RC34B" -ne 0 ] && printf '%s' "$OUT34B" | grep -q 'CORRUPT'; then
   ok "34b doctor coupling FAILs on a wrong-type provider installerRoot (named CORRUPT) $QK34"
 else bad "34b doctor stayed green/silent over a corrupt installerRoot (rc=$RC34B): $OUT34B $QK34"; fi
 
-# 15. WIRING: both writers of this one file must share the serializer, not copy it.
+# 35. WIRING: both writers of this one file must share the serializer, not copy it.
 #     A duplicated indent-detector is how the provider writer stayed open after the
 #     package writer was closed; a parity check is cheaper than a third round.
+#     (Numbered 35, after the ownership block: it used to be a second "15", which
+#     stopped being merely untidy once #110 added the real cell 15 above.)
 for w in register-pi-package.py register-pi-provider.py; do
   if grep -q "from pi_settings_io import" "$REPO/scripts/$w"; then
-    ok "15 $w routes through the shared pi_settings_io serializer"
+    ok "35 $w routes through the shared pi_settings_io serializer"
   else
-    bad "15 $w serializes settings on its own again (copied rule = the #53 B shape)"
+    bad "35 $w serializes settings on its own again (copied rule = the #53 B shape)"
   fi
 done