@junghanacs/entwurf 0.22.0 → 0.23.0

package/run.sh

@@ -144,7 +144,7 @@ Usage:
   ./run.sh check-codex-birth-hook     # sandboxed payload + declaration: first-turn V3 birth, one record per thread, top-level event predicate, no markers
   ./run.sh check-codex-fresh-preflight # pre-mutation birth/MCP/thread-title/default-app-server readiness
   ./run.sh smoke-codex-config-state   # sandboxed MCP + status-line ownership/install/doctor/inverse lifecycle
-  ./run.sh smoke-codex-birth          # sandboxed birth unit: exact trust identity, the vendor trust receipt read (never written), config.toml untouched, foreign/edited/symlink refusals, drift-refusing inverse
+  ./run.sh smoke-codex-birth          # sandboxed birth unit: exact trust identity, the vendor trust receipt read at our MEASURED index (never written), config.toml untouched, coexistence with a foreign SessionStart group in either ordering (joined not adopted, reported not certified, byte-preserved across install and inverse), own-declaration drift/duplication refusals, drift-refusing inverse
   ./run.sh check-harness-admission-parity  # #87 C: the EDGE the two closed parity loops never had. Every citizen backend is fresh-openable or a declared pre-#82 legacy admission whose exception a reader finds in DELIVERY.md — so a post-contract harness that mints records but cannot be opened by entwurf_fresh_call blocks the release package instead of only carrying an `unsupported` note (docs/adding-a-harness.md step 9)
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
@@ -171,6 +171,7 @@ Usage:
   ./run.sh check-mux-resume-call       # deterministic gate: S1 resume PLACEMENT composition (mux-resume-call.ts). No fake tmux. cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while being wrong: a nonexistent `-c` exits 0 and lands the child in $HOME (so it is refused HERE), `-c` is FORMAT-EXPANDED so `#{…}` silently rewrites the path and `#(…)` was observed running a command (so `#` is refused), and whitespace measured SAFE (so no escaping layer is owed). Also pins `-c` reaching tmux, runtime after `--`, carrier-free argv, zero identity in this module, and the surface seam that keeps the v2 composition from importing mux
   ./run.sh check-mux-parent-artifact  # deterministic gate for the tracked scrubbed parent-transcript fixture — a version-pinned sample of the PARENT-SIDE shape (fresh_call toolResult + the later callback custom_message) so downstream never opens a private transcript. Pins event order, the toolCallId join on the RESULT (pi writes no separate toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info> envelope field names, and the absence of operator paths / real garden ids / real uuids. NOT placement evidence
   ./run.sh check-mux-launcher-fence   # deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes
+  ./run.sh check-typing-call-fence    # deterministic gate for the boundary nobody has broken: this product composes ARGUMENTS and LETTERS, never keystrokes. Scans every tracked production source under pi-extensions/ and mcp/ — comments blanked, string literals kept — for tmux send-keys/paste-buffer/load-buffer and herdr's PTY verbs (agent.prompt, agent.send_keys, pane.send_text, pane.input.set). Prose is exempt on purpose: the sentence stating the rule names the very calls it forbids, and a scanner that read prose could be made green by deleting the law. Carries its own oracle — the detector is proven on planted code, proven blind to comments, and the scanned inventory is measured
   ./run.sh check-entwurf-v2-visible-resume # deterministic gate: S1 visible-resume COMPOSITION (entwurf-v2-visible-resume.ts) with every seam injected — the whole state machine incl. the timeout branch runs with no tmux/lock/socket/clock. Pins lock BEFORE liveness, identity under the lock and before any window (no-transcript citizen fails loud, opens nothing), live/indeterminate/address-conflict refused unlaunched, observation as a BOUNDED WAIT (measured: socket answers ~2–4s after launch, so one immediate probe would call a successful resume unobserved), exactly ONE launch on every path, timeout → lock released + window left open + nothing retried/killed, failed release throws, and the two receipts staying separate in type and text
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
@@ -181,8 +182,15 @@ Usage:
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
+  ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one peer-facts + one agent list per open (counted, not claimed), skip-by-name when Entwurf is absent, four distinct named refusals instead of an empty table, ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
+  ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
+  ./run.sh check-herdr-activation      # deterministic gate for the #116 M3-b2 scoped activation: the pi user-scope-ONLY forward seam (no project write, OpenCode byte-untouched), the absolute command DERIVED from the runtime root for BOTH harnesses (relative/unnormalised refused), default bare/clone bytes unchanged when no mode is asked, the pi inverse refusing a drifted command instead of deleting an override, a certified activation ledger that can never name an atom outside {pi, claude-code}, add-only reinstall (a shrinking H retains, never removes), a roots-drift refusal before the first byte, the teardown order components->runtime->ledger LAST, one refused preflight leaving every byte untouched, and no deferred module load on the path that deletes its own runtime. Drives the REAL pi writers; the vendor `claude` CLI is NOT invoked and its acceptance of an absolute executable stays a named LIVE boundary
+  ./run.sh check-herdr-plugin-profile  # deterministic gate for the #116 M3-a PURE activation leaf (`plugins/herdr/lib/integration-profile.mjs`): the closed {pi→pi, claude→claude-code} table, exactly-one-row-or-named-refusal, the FRONT-ANCHORED state grammar (a `/srv/current (v9)/` directory name may not decide a verdict), no path in the plan, outdated/needs-repair as named FAILs, not-installed as a zero-write SKIP, `current` as herdr's admission with no floor of our own, OpenCode observed but never planned, and the leaf's purity. Listing strings only — no herdr binary, no install, no environment, no writes
+  ./run.sh check-herdr-plugin-build    # deterministic gate for the #116 M3-b3 build runner (`plugins/herdr/lib/build.mjs`): the ONE command Herdr's [[build]] calls, composing integration status -> pure profile -> runtime bootstrap -> activation THROUGH THE INSTALLED PACKAGE (never this checkout, which herdr deletes on uninstall with no cleanup hook). Pins one [[build]] with argv `node lib/build.mjs` and a runner npm does not ship, missing-herdr vs unanswerable-status as separate named refusals, a selected outdated/needs-repair/malformed/duplicate atom failing BEFORE any runtime work, A-empty as exit 0 with ZERO writes, absent/incapable activation entries as distinct refusals, the two-stage {pi} -> {pi, claude-code} composition with OpenCode never named, and the post-build herdr commit gap named rather than called atomic. Listing via the runner's own spawn seam (no fake herdr); one cell drives the REAL binary, named SKIP without it
+  ./run.sh check-peer-facts            # deterministic gate for the peer-facts projection (#116 M2-a): drives the REAL CLI with every ambient root sandboxed — placement crosses STRUCTURED (never the human `herdr <pane>` string), the peer keyset is exactly the provider's facts (no herdr agent_status may enter an entwurf payload), no socket coordinate is published (#50 C4), diagnostics in-band, the probed socket world is the one ENTWURF_DIR names (proved by a record-less socket surfacing — there is no field to echo), no observation budget, exit contract 0/2/3, dispatch+emit reachability. No herdr binary
   ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
   ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — full-store parse/probe/quarantine/resolve stays intact; #112 bounds expensive receiver/transcript observation to the newest 32 rendered rows while older machine rows say unobserved; Q112 pins full payload + exact observer budget; C-원칙 keeps corruption diagnostic and impossible wiring loud; deps injected, no IO
+  ./run.sh check-herdr-placement      # deterministic gate (#116 S1): the PURE placement-evidence axis — herdr `pane list` parse (unreadable payload → null → `unobserved`, never `none`), the two measured join rules (claude kind=id byte equality / pi kind=path uuid tail of a .jsonl basename, both strict), unmeasured kind → NO key, two panes on one key → `ambiguous` (never last-write-wins), provider reads the placement owner EXACTLY ONCE per listing (anti-watcher, docs/mux-launch-rail.md §7), and no entwurf_v2 dispatch module names or imports the axis (Hard Rule 16 — a pane is a view, not a rail). No fake herdr, no binary, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
   ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta splits by RAIL: self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows), native-push ⟺ recordBacked ∧ probeAlive (separate axis — no mailbox fact may rescue or sink it), unsupplied rail fail-closed; SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected AND renders the meta rail per-rail (mailbox only inside the self-fetch branch; native-push denies an inbox and gates injection on the probe)
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
@@ -251,9 +259,9 @@ Usage:
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
   ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
   ./run.sh doctor-agy-bridge          # fail-loud doctor: MCP config + exact permission rule + state + live probe label
-  ./run.sh install-codex-birth        # publish $CODEX_HOME/hooks.json + the helper closure; no root, and the operator trusts the declaration once in their own Codex
-  ./run.sh uninstall-codex-birth      # exact inverse from the install-state digest inventory; refuses drifted bytes instead of deleting them
-  ./run.sh doctor-codex-birth         # RUNTIME + UNIT bytes/ownership + the vendor TRUST receipt for this declaration (--unit-only skips the receipt; sandboxes only)
+  ./run.sh install-codex-birth        # publish ONE SessionStart declaration inside $CODEX_HOME/hooks.json (a file it shares) + the helper closure; no root, and the operator trusts the declaration once in their own Codex
+  ./run.sh uninstall-codex-birth      # exact inverse from the install-state digest inventory; removes only entwurf's own declaration (foreign groups byte-for-byte) and refuses drifted bytes instead of deleting them
+  ./run.sh doctor-codex-birth         # RUNTIME + UNIT bytes/ownership + FOREIGN neighbours (reported, never certified) + the vendor TRUST receipt at this declaration's measured index (--unit-only skips the receipt; sandboxes only)
   ./run.sh install-codex-mcp          # own only [mcp_servers.entwurf-bridge] in the user's Codex config
   ./run.sh uninstall-codex-mcp        # remove/restore only the recorded MCP atom
   ./run.sh doctor-codex-mcp           # effective config + ownership + actual bridge boot
@@ -274,6 +282,7 @@ Usage:
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
   ./run.sh meta-bridge-fresh-cut      # the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only. EXIT CONTRACT (#54, `--help` prints it): 0 complete / 1 NOTHING MOVED (re-run, do not setup) / 2 usage / 3 cut transition incomplete (inspect) / 4 cut complete but residue cleanup failed (`setup` may run; re-run only before new citizen birth, otherwise remove residue manually)
   ./run.sh meta-facts                 # #65 owner-normalized READ-ONLY store projection: deterministic JSON {schemaVersion:1, storeDir, citizens: full v3 records sorted by gardenId, defects: {filename,message}} — THE listing contract emitted by the owner so consumers stop copying the certification. No liveness/sockets/transcript contents. EXIT: 0 readable (defects in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
+  ./run.sh peer-facts                 # #116 M2-a owner-normalized READ-ONLY peer projection: the same listEntwurfFacts provider through the same renderer entwurf_peers uses, emitted as deterministic JSON {schemaVersion:1, storeDir, peers, diagnostics} so a consumer never re-implements the placement join (whose pi half is a measured vendor floor). NOT the same bytes as an entwurf_peers call and deliberately so: that surface is a human listing (observationLimit, text over the wire), this is a machine projection with UNBOUNDED observation, because a rationed row says `unobserved` and a machine cannot tell that from "nobody could look". `placement` stays a STRUCTURED tagged union ({kind:"herdr-pane",paneId} / unobserved / none / ambiguous) — never the human `herdr <pane>` string. Publishes NO socket coordinate (ENTWURF_DIR selects what is PROBED, #50 C4) and NO herdr agent_status / interactive_ready / screen text. One placement read per listing, no watcher. EXIT: 0 readable (diagnostics in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
   ./run.sh meta-bridge-managed-keys   # 0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)
   ./run.sh check-keyset-overlap <fragment.json...>  # 0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
@@ -281,10 +290,13 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
-  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
+  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
   ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
+  ./run.sh install-user-scope [--plugin-runtime <root>]  # #116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope
+  ./run.sh herdr-plugin-activate <backend...>  # #116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status
+  ./run.sh herdr-plugin-deactivate   # #116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots and BOTH component inverses read-only first; mutates only when every preflight is green; then Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails
   ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
   ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
   ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
@@ -656,8 +668,15 @@ codex_terminal_title() {
   esac
 }
 
+# $1 (optional): a certified stable plugin runtime root. Given, the provider half is written in
+# PLUGIN MODE — its managed command becomes the absolute bridge under that root instead of the bare
+# bin. That is the whole difference, and it exists because a Herdr plugin activates on a host where
+# nothing entwurf is on PATH, so a bare command cannot resolve. Absent, every byte is what it has
+# always been (#116 M3-b2).
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  local plugin_mode=()
+  [ -n "${1:-}" ] && plugin_mode=(--plugin-runtime "$1")
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
   # #86 C2: user scope carries a recorded OWNER (packageRoot in the pi-package
   # install-state). Another owner — live or missing — makes this a zero-write
@@ -670,7 +689,7 @@ register_user_scope_citizen() {
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
     --scope user --state "$(_pi_package_state)" --preflight >/dev/null
   python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
-    --scope user --state "$(_pi_provider_state)" --preflight >/dev/null
+    --scope user --state "$(_pi_provider_state)" ${plugin_mode[@]+"${plugin_mode[@]}"} --preflight >/dev/null
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
     --scope user --state "$(_pi_package_state)"
   # #46 Task 2: own entwurfProvider.mcpServers.entwurf-bridge as the bare stable bin at USER scope
@@ -679,7 +698,33 @@ register_user_scope_citizen() {
   # local and covered by `run.sh remove` (no state) — deliberate, reasoned asymmetry.
   # #86 C2: the provider state records installerRoot, so the same foreign-owner refusal
   # holds here — and the package refusal above fires FIRST, before any provider write.
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)"
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)" ${plugin_mode[@]+"${plugin_mode[@]}"}
+}
+
+# install-user-scope — the PLUGIN-ONLY forward seam (#116 M3-b2). Generic `install` writes both a
+# project `.pi/settings.json` and the global user-scope citizen; a Herdr plugin activation has no
+# project and must not invent one, so this verb composes the user-scope half and nothing else. Its
+# inverse is the one that already existed, `remove-user-scope` — the asymmetry this closes is that
+# the inverse was public and the forward was not.
+install_user_scope() {
+  command -v python3 >/dev/null 2>&1 || { echo "[install-user-scope] requires python3 on PATH; nothing was written." >&2; exit 1; }
+  local plugin_runtime=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --plugin-runtime)
+        shift
+        # A flag with no value must not fall through to bare mode: the caller asked for the plugin
+        # runtime and would otherwise be told, silently, that it got it.
+        [ -n "${1:-}" ] || { echo "run.sh install-user-scope: --plugin-runtime requires a value" >&2; exit 2; }
+        plugin_runtime="$1" ;;
+      *) echo "usage: run.sh install-user-scope [--plugin-runtime <stable active root>]" >&2; exit 2 ;;
+    esac
+    shift
+  done
+  preflight_v3_store install-user-scope
+  section "install-user-scope: the GLOBAL pi citizen only (no project wiring)"
+  register_user_scope_citizen "$plugin_runtime"
+  ok "install-user-scope: user-scope packages[] + provider registered${plugin_runtime:+ (plugin runtime: $plugin_runtime)}"
 }
 
 # takeover-user-scope — the operator-explicit ownership move (#86 C2). The ONLY
@@ -1349,6 +1394,17 @@ check_mux_launcher_fence() {
   run_ts scripts/check-mux-launcher-fence.ts
 }
 
+check_typing_call_fence() {
+  # The rule kept since day one, now kept by NAME: entwurf composes arguments and letters, never
+  # keystrokes. An outside reader measured the tree on 2026-09-17 and found the law perfectly kept
+  # and nothing keeping it — zero typing calls in pi-extensions/, zero checks and zero mutants that
+  # would notice one arriving. Scans tracked production sources under pi-extensions/ and mcp/ with
+  # comments blanked and string literals kept, because a typing call spelled as a string is the
+  # call. Comment exemption is load-bearing: the sentence that states the rule contains the names
+  # the rule forbids. Offline, no binaries, no fixtures on disk.
+  run_ts scripts/check-typing-call-fence.ts
+}
+
 check_mux_parent_artifact() {
   # Deterministic gate for the tracked scrubbed parent-transcript fixture
   # (scripts/fixtures/mux-parent-transcript.scrubbed.jsonl). The fixture is a version-pinned
@@ -1449,7 +1505,7 @@ check_mux_fresh_call() {
   # codex-caller-seat rides here for the same reason as the two preflights: the leaf exists
   # only as freshCall's Codex placement input (#95 lane B), so certifying it apart from the
   # composition it feeds would let the two halves of one seat decision drift.
-  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts test/codex-caller-seat.test.ts
+  run_vitest test/mux-fresh-call.test.ts test/fresh-call-composition.contract.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts test/codex-caller-seat.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -1806,6 +1862,117 @@ check_meta_facts() {
   run_ts scripts/check-meta-facts.ts
 }
 
+check_herdr_plugin() {
+  # Deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`). Two halves.
+  # STATIC: the manifest is parsed with the package's own TOML reader and held to the
+  # shape herdr 0.9.0 accepts (min_herdr_version required + semver, dot-free pane id,
+  # popup-only sizing, argv arrays), and the ABSENT sections are asserted as hard as the
+  # present ones — [[startup]]/[[events]] are where a watcher would grow, [[actions]]
+  # would send a report nobody can read into a 64 KiB log. ([[build]] LEFT that list in
+  # #116 M3-b3; the one runner it may call is check-herdr-plugin-build's subject.)
+  # BEHAVIOURAL: the REAL pane entry is
+  # spawned with a stub `entwurf` and a stub HERDR_BIN_PATH that log every call, so
+  # "exactly one read each per open" is COUNTED; success, skip-by-name, four distinct
+  # named refusals, the ambiguous pane, diagnostics and the no-write claim are each
+  # driven for real. The stub stands for the CONSUMER's input, never for herdr's
+  # behaviour — no claim about herdr is made here, which is why this is not the fake
+  # fixture check-herdr-sandbox forbids. No herdr binary, no Entwurf install, no writes
+  # outside mkdtemp.
+  run_ts scripts/check-herdr-plugin.ts
+}
+
+check_herdr_activation() {
+  # Deterministic gate for the #116 M3-b2 scoped activation. The pi cells drive the REAL writers
+  # (run.sh install-user-scope, register-pi-provider.py, remove-user-scope) against a sandboxed
+  # HOME/XDG/PI_CODING_AGENT_DIR, so the bytes asserted are bytes those writers produced. The Claude
+  # cells drive the REAL state owner's pure surfaces; the vendor `claude` CLI is NOT invoked and its
+  # acceptance of an absolute executable stays a named LIVE boundary. The oracle for a roundtrip is
+  # JSON equality plus unrelated-key survival, never byte equality: the pi settings writer preserves
+  # semantics but may reindent (measured 2026-09-16). No network, no operator HOME.
+  run_ts scripts/check-herdr-activation.ts
+}
+
+check_herdr_runtime_bootstrap() {
+  # Deterministic gate for the #116 M3-b1 runtime transaction. Every root comes from XDG, so the
+  # gate hands the module a mkdtemp HOME and asserts nothing appeared outside the two XDG roots it
+  # was given. `acquire` is a FUNCTION seam: the fixture stands in for the REGISTRY, so this gate
+  # proves the transaction (ownership certification, torn-swap recovery, leftover states, rollback,
+  # idempotence, the inverse) but NOT that the real Entwurf package boots — that actual-package
+  # proof is a named cell inside check-pack-install, which runs this module's own
+  # verifyInstalledRuntime against the tarball it packed and installed. npm is pinned here the only
+  # way a hermetic gate honestly can: the production pack/install argv and the npm environment are
+  # pure functions and are asserted directly. No network, no npm, no operator HOME, no writes
+  # outside mkdtemp.
+  run_ts scripts/check-herdr-runtime-bootstrap.ts
+}
+
+check_herdr_plugin_profile() {
+  # Deterministic gate for the #116 M3-a pure leaf: the function that turns ONE
+  # `herdr integration status` listing into this plugin's activation plan. Every listing
+  # is an INPUT STRING (verbatim herdr 0.9.0 rows measured 2026-09-16 in a sandboxed
+  # HOME/XDG, plus the two forms cross-checked in herdr source at c77af189), so nothing
+  # here claims a fact about herdr. Pins: the closed atom->backend table, exactly one row
+  # per selected atom or a NAMED refusal (never a first/last-match guess), the state read
+  # FRONT-ANCHORED so an operator's directory name cannot spell a verdict, the display
+  # path leaving no trace in the plan, outdated/needs-repair as named FAILs (measured:
+  # empty, unreadable and marker-less files all collapse into `outdated`), not-installed
+  # as a zero-write SKIP, `current` as herdr's admission with no second floor invented
+  # here, OpenCode observed but never planned, and the leaf's purity. No herdr binary, no
+  # Entwurf install, no environment read, no writes.
+  run_ts scripts/check-herdr-plugin-profile.ts
+}
+
+check_herdr_plugin_build() {
+  # Deterministic gate for the #116 M3-b3 build runner (`plugins/herdr/lib/build.mjs`) — the ONE
+  # command Herdr's `[[build]]` calls, and the order it composes: integration status -> pure
+  # profile -> runtime bootstrap -> activation THROUGH THE INSTALLED PACKAGE. There is no fake
+  # herdr binary here (the repo forbids one); the listing arrives through the runner's own spawn
+  # seam as the prose shape 0.9.0 emits, and one cell drives the REAL binary with a named SKIP
+  # when the host has none (ENTWURF_REQUIRE_HERDR=1 makes absence red). Pins: exactly one
+  # [[build]] whose argv is `node lib/build.mjs` and a runner the npm package does NOT ship;
+  # missing herdr vs unanswerable status as separate named refusals with zero writes; a selected
+  # atom that is outdated/needs-repair/malformed/duplicated failing BEFORE any runtime work;
+  # A-empty as a clean exit 0 that writes nothing (no runtime, no wiring, no removal); the
+  # activation entry resolved under the stable runtime with absent/incapable as distinct named
+  # refusals and no checkout fallback; the two-stage {pi} -> {pi, claude-code} composition where a
+  # new commit reinstalls and OpenCode is never named; and the post-build Herdr commit gap being a
+  # NAMED gap, not an atomic transaction. The real `herdr plugin install` + real `npm pack
+  # git+https://...#<sha>` journey needs the network and lives in smoke-herdr-plugin-build-live.
+  run_ts scripts/check-herdr-plugin-build.ts
+}
+
+smoke_herdr_plugin_build_live() {
+  # #116 M3-b3 LIVE: a REAL `herdr plugin install` drives this plugin's REAL `[[build]]`, which
+  # packs the FIXED product git spec for real. Needs LIVE=1, herdr/git/npm, and the NETWORK (a
+  # git-spec pack builds the bridge through `prepare`, which installs devDependencies) — which is
+  # the axis check-herdr-plugin-build cannot have and does not claim. Hermetic by two substitutions
+  # only: sandbox HOME/XDG, and git `insteadOf` redirecting the unchanged product remote to a local
+  # bare clone of this worktree, so an unpushed candidate is testable without weakening the argv.
+  # Cells 1/2/4 are the real-Herdr journey: remote-commit available, reinstall widening to
+  # {pi, claude-code} with OpenCode zero-write and ONE COUNTED vendor MCP owner entry, and the
+  # post-build gap where herdr's own commit fails after our runner already rebound the activation.
+  # Cell 3 is deliberately NOT a journey: it calls the shipped runtime leaf directly with the fixed
+  # product argv at a commit the remote lacks, so it is acquisition-leaf evidence — named refusal,
+  # active runtime/ledger/harness bytes preserved, journal left as the certified retry authority.
+  run_ts scripts/smoke-herdr-plugin-build-live.ts
+}
+
+check_peer_facts() {
+  # Deterministic gate for the #116 M2-a observed-peer projection. Drives the REAL
+  # scripts/peer-facts.ts as a subprocess with every ambient root replaced (store,
+  # ENTWURF_DIR, HOME, XDG_DATA_HOME, pi agent dir), so the live store, sockets and
+  # markers are never read. Owns only what this verb ADDS on top of the provider:
+  # placement crosses as the structured tagged union rather than the human string,
+  # the peer keyset is exactly the provider's facts (no herdr agent_status may enter
+  # an entwurf payload — that is the door observed activity would use to become
+  # delivery liveness) and no socket coordinate is published at all, diagnostics ride
+  # in-band, the probed socket world is the one ENTWURF_DIR names (proved by a
+  # record-less socket surfacing — there is no field to echo), no observation budget
+  # rations a machine projection, exit contract 0/2/3,
+  # plus dispatch + compiled-twin reachability. No herdr binary, no model turn.
+  run_ts scripts/check-peer-facts.ts
+}
+
 check_entwurf_fact_provider() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4b): the
   # ASSEMBLY layer listEntwurfFacts. listAllMetaIdentities → scanSocketProbes →
@@ -1820,6 +1987,94 @@ check_entwurf_fact_provider() {
   run_ts scripts/check-entwurf-fact-provider.ts
 }
 
+check_herdr_placement() {
+  # Deterministic gate for #116 S1: the placement evidence axis
+  # (pi-extensions/lib/herdr-placement.ts) plus the ONE read the fact provider is
+  # allowed. Pins only what is decidable WITHOUT a herdr binary — payload parse, the
+  # two measured join rules, the ambiguity rule, the four-word vocabulary, the render,
+  # the once-per-listing read, and the STRUCTURAL absence of placement from every
+  # entwurf_v2 dispatch module. There is no fake herdr here for the same reason
+  # check-mux-placement refuses a fake tmux: a stand-in authors the contract before the
+  # real thing is measured. Every payload literal is verbatim herdr 0.9.0 output
+  # recorded 2026-09-14. The real-binary half is an isolated private herdr server
+  # (sandbox HOME/XDG, no client attach); the join/callback round trip stays LIVE.
+  run_ts scripts/check-herdr-placement.ts
+}
+
+check_herdr_fresh_call() {
+  # Deterministic gate for #116 S2-c1: the herdr LAUNCH rail core
+  # (pi-extensions/lib/herdr-fresh-call.ts). Pins only what is decidable WITHOUT a herdr
+  # binary — the import fence that keeps the two rails separately deletable, the closed
+  # pi|claude-code pilot, the option-G one-line JSON encoding (exact round trip, zero
+  # Unicode Cc including the C1 block JSON.stringify leaves literal, max public task),
+  # the pre-mutation refusals with the CLI never invoked, the ONE placement policy (a new
+  # tab in the caller's own workspace, read from herdr's own answer about the caller's pane
+  # and never from a pane id's shape, focus left alone), tab-create/start/get/close argv
+  # grammar, strict response parsing, the opaque pane id, the receipt's missing address,
+  # and the conditional-close matrix. No fake herdr executable and no fake server, for the
+  # reason check-mux-placement refuses a fake tmux. Payload literals are verbatim herdr
+  # 0.9.0 output (pane/tab replies 2026-09-15, agent_started 2026-09-14); the real-binary
+  # half is an isolated private server (c2).
+  run_ts scripts/check-herdr-fresh-call.ts
+}
+
+check_herdr_sandbox() {
+  # REAL herdr acceptance for #116 C2a: a PRIVATE herdr server in a fully sandboxed
+  # HOME/XDG/PI_CODING_AGENT_DIR creates a tab with the production placement argv, installs
+  # herdr's own pi integration, and starts a BLANK pi in that tab's initial pane from ONE
+  # checkout package registration. Asserts the official witness
+  # triple, the strict path->native id join, exactly one sandbox V3 record, a control socket
+  # that answers the production probe, and the conditional-close decision in both directions
+  # (refuses a pane holding an agent, reclaims one we own and with it the tab it was the
+  # whole of). No fake herdr, no model turn, no
+  # credentials, no keystrokes; the fixture's `pi --approve` is a one-run authorisation that
+  # writes no trust state and never enters production argv. herdr is an OPTIONAL rail: an
+  # absent binary prints a named SKIP and exits 0, a PRESENT-but-incomplete rail FAILS, and
+  # ENTWURF_REQUIRE_HERDR=1 turns absence itself into a failure (CI admission is C2b).
+  run_ts scripts/check-herdr-sandbox.ts
+}
+
+check_herdr_supply() {
+  # Deterministic supply-authority gate for #116 C2b: WHICH herdr bytes CI runs, and who
+  # decides. No herdr binary and no network — it reads scripts/fixtures/herdr-supply.json,
+  # scripts/install-herdr-ci.sh and .github/workflows/ci.yml as text. Pins the manifest as the
+  # only copy of version/tag/digest, the digest shape, the fail-closed architecture map, the
+  # verify-before-chmod order, the absence of curl-pipe/latest/package-manager/global install,
+  # the absence of a `gh attestation verify` dependency (measured: gh 2.97.0 cannot close
+  # herdr's in-toto release predicate), the CI install-before-floor order with
+  # ENTWURF_REQUIRE_HERDR=1, Linux-job-only wiring, that no product script or bin reaches the
+  # installer (Hard Rule 17), and that the x86_64 asset stays recorded as never executed.
+  run_ts scripts/check-herdr-supply.ts
+}
+
+check_fresh_call_dispatch() {
+  # Deterministic gate for #116 C3: the seam ABOVE the two rails. Pins that the rail is a
+  # capability fact (exactly HERDR_ENV=1) and never a caller parameter, that neither direction
+  # falls back, that a non-pilot backend refuses inside herdr before any preflight or mutation,
+  # that the Codex preflight keeps its pre-existing ordering on the tmux path only, that one
+  # nonce per call reaches the selected rail, that BOTH public surfaces reach one composition
+  # root (no second copy of rail choice, preflight ordering or rendering), that pi still uses
+  # its lazy dynamic import, and that herdr rendering shows view-not-address plus which recovery
+  # happened. No tmux and no herdr binary: the seam runs with an injected spawn.
+  run_ts scripts/check-fresh-call-dispatch.ts
+}
+
+smoke_herdr_fresh_call_live() {
+  # LIVE acceptance for the #116 herdr rail: a REAL caller that is itself inside a herdr pane
+  # invokes the REAL PUBLIC entwurf_fresh_call, and a REAL child's first model action is the
+  # nonce callback. Opt-in (LIVE=1), four model turns, one private herdr server PER CELL —
+  # herdr's socket follows XDG_CONFIG_HOME and each cell is fenced into its own.
+  # `[측정 2026-09-14]` BOTH runtimes keep the operator's REAL HOME and real auth roots: a pi
+  # given a fixture HOME dies before readiness (an installed extension resolves its npm
+  # dependency through $HOME) and a claude given one enters first-run onboarding. Only
+  # Entwurf-OWNED writes are fenced into the fixture (XDG roots, the meta roots, the v2 lock
+  # dir). Evidence is source receipts only, in two named grades: pi from its own vendor
+  # transcript, claude from the runtime's own entwurf-bridge MCP activity log joined by exact
+  # sessionId plus entwurf's mailbox artifact and hook journal — never screen text, never a
+  # keystroke. The operator's herdr panes are snapshotted before and after.
+  run_ts scripts/smoke-herdr-fresh-call-live.ts
+}
+
 check_entwurf_peers_surface() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4c; #50 C4
   # re-author): the MCP entwurf_peers RENDER/PAYLOAD layer renderEntwurfPeers.
@@ -3135,6 +3390,10 @@ check_pack() {
     # #65 — the owner-normalized store projection consumers call INSTEAD of
     # parsing the store; installed hosts are exactly where those consumers live.
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
+    # #116 M2-a — the owner-normalized PEER projection, for the same reason one step
+    # out: the placement join it emits is the copy a herdr-side consumer would
+    # otherwise fork, and such a consumer runs against an installed host.
+    "mcp/entwurf-bridge/dist/scripts/peer-facts.js"
     # #87 Bundle B — omp-receive-doctor drives this operator projection through
     # run.sh, so installed node_modules must have the compiled twin too.
     "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
@@ -3430,6 +3689,8 @@ _check_pack_install_impl() {
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js"
     # #65 — the owner-normalized store projection (see check-pack).
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
+    # #116 M2-a — the owner-normalized peer projection (see check-pack).
+    "mcp/entwurf-bridge/dist/scripts/peer-facts.js"
     # #87 Bundle B — omp-receive-doctor reaches this through the installed dispatcher.
     "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
@@ -3617,6 +3878,60 @@ _check_pack_install_impl() {
   }
   echo "[check-pack-install] installed: $probe"
 
+  # #116 M3-b1/b2 — THE ACTUAL-PACKAGE RUNTIME PROOF, THROUGH THE SHIPPED OWNER.
+  # The Herdr plugin's runtime verifier decides whether a tree npm placed is a runtime the scoped
+  # wiring may name: exact name@version, the compiled entry, all three required bins present AND
+  # executable, and a real `entwurf check-bridge`. Its own focused gate drives that verifier against
+  # a FIXTURE package, which proves the transaction but not this package — so the real artifact is
+  # verified HERE, against the tarball this gate already packed and installed. No second pack, no
+  # network.
+  #
+  # It imports from the INSTALLED tree's own scripts/herdr-runtime.mjs, not from the checkout. That
+  # is the point: Herdr's `plugin uninstall` deletes the plugin checkout and calls no cleanup hook,
+  # so the code that retires a runtime has to be IN the package. Reaching into $REPO_DIR here would
+  # prove the checkout works and say nothing about what a clean host receives.
+  local runtime_proof
+  runtime_proof=$(cd "$tmp" && node --input-type=module -e "
+    const pkg = process.cwd() + '/node_modules/@junghanacs/entwurf';
+    const { verifyInstalledRuntime, readCheckoutPackageSpec, REQUIRED_BINS } =
+      await import(pkg + '/scripts/herdr-runtime.mjs');
+    const spec = readCheckoutPackageSpec(pkg);
+    const seen = verifyInstalledRuntime(process.cwd(), spec);
+    console.log(seen.name + '@' + seen.version + ' verified through the SHIPPED owner (' + REQUIRED_BINS.join(', ') + ')');
+  " 2>&1) || {
+    fail "[check-pack-install] #116 runtime verifier REFUSED the actual installed package (or does not ship):"
+    echo "$runtime_proof" | sed 's/^/    /' >&2
+    return 1
+  }
+  echo "[check-pack-install] herdr-plugin runtime verifier: $runtime_proof"
+
+  # #116 M3-b2 — THE DEACTIVATE VERB MUST ACTUALLY TEAR DOWN, WITH NO CHECKOUT. Herdr's `plugin
+  # uninstall` deletes the plugin checkout and calls no cleanup hook, so the teardown entry has to
+  # be IN the package AND has to survive deleting the runtime it is executing from. So this does not
+  # settle for the "nothing to undo" verdict: it stages the real shape — the installed package
+  # sitting AT the stable active root, a certified runtime journal, and a certified activation
+  # ledger whose components are already removed — then runs THAT copy's own entry with a throwaway
+  # HOME/XDG and no reference to this repo. What it proves is the self-delete: the process removes
+  # the tree it is executing from and still finishes retiring the ledger.
+  local deact_home deact_active deact_pkg deact_proof deact_rc runtime_left ledger_left
+  deact_home=$(mktemp -d -t entwurf-deact.XXXXXX)
+  deact_active="$deact_home/.data/entwurf/herdr-plugin/runtime/active"
+  mkdir -p "$deact_active" "$deact_home/.state/entwurf/herdr-plugin"
+  cp -R "$tmp/node_modules" "$deact_active/node_modules"
+  deact_pkg="$deact_active/node_modules/@junghanacs/entwurf"
+  node -e 'const fs=require("fs"),path=require("path");const [home,active]=process.argv.slice(1);const pkg=path.join(active,"node_modules","@junghanacs","entwurf");const version=JSON.parse(fs.readFileSync(path.join(pkg,"package.json"),"utf8")).version;fs.writeFileSync(path.join(home,".data","entwurf","herdr-plugin","journal.json"),JSON.stringify({schemaVersion:2,phase:"runtime-ready",runtimeRoot:active,artifactIdentity:{kind:"herdr-checkout",repository:"junghan0611/entwurf",commit:"c".repeat(40),packageName:"@junghanacs/entwurf",packageVersion:version,observedDigest:"sha256-"+"a".repeat(64)},previousRuntime:null}));fs.writeFileSync(path.join(home,".state","entwurf","herdr-plugin","activation.json"),JSON.stringify({schemaVersion:2,phase:"deactivating",runtimeRoot:active,artifactIdentity:{kind:"herdr-checkout",repository:"junghan0611/entwurf",commit:"c".repeat(40),packageName:"@junghanacs/entwurf",packageVersion:version,observedDigest:"sha256-"+"a".repeat(64)},piAgentDir:{path:path.join(home,".pi","agent"),source:"default"},claudeConfigDir:{path:path.join(home,".claude"),source:"default"},claudeUserConfig:{path:path.join(home,".claude.json"),source:"HOME"},activatedBackends:["pi"],components:[{backend:"pi",state:"removed"}]}));' "$deact_home" "$deact_active"
+  deact_proof=$(env -i PATH="$PATH" HOME="$deact_home" XDG_DATA_HOME="$deact_home/.data" XDG_STATE_HOME="$deact_home/.state" XDG_CACHE_HOME="$deact_home/.cache" node "$deact_pkg/scripts/herdr-plugin-deactivate.mjs" 2>&1)
+  deact_rc=$?
+  runtime_left=$([ -e "$deact_home/.data/entwurf/herdr-plugin/runtime" ] && echo yes || echo no)
+  ledger_left=$([ -e "$deact_home/.state/entwurf/herdr-plugin/activation.json" ] && echo yes || echo no)
+  rm -rf "$deact_home"
+  if [ "$deact_rc" -ne 0 ] || [ "$runtime_left" != "no" ] || [ "$ledger_left" != "no" ]; then
+    fail "[check-pack-install] #116 M3-b2 installed herdr-plugin-deactivate did not complete the self-delete (rc=$deact_rc runtime-left=$runtime_left ledger-left=$ledger_left):"
+    echo "$deact_proof" | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed herdr-plugin-deactivate removed its OWN runtime and retired the ledger with no checkout: $deact_proof"
+
   # Pi package loader smoke — actual `pi` reads the manifest and
   # registers the provider. rc=0 + the curated model list in the
   # output means pi accepted the package as a real extension, not
@@ -6177,6 +6492,9 @@ case "$cmd" in
   check-mux-launcher-fence)
     check_mux_launcher_fence
     ;;
+  check-typing-call-fence)
+    check_typing_call_fence
+    ;;
   check-entwurf-v2-visible-resume)
     check_entwurf_v2_visible_resume
     ;;
@@ -6264,9 +6582,48 @@ case "$cmd" in
   check-meta-facts)
     check_meta_facts
     ;;
+  check-herdr-activation)
+    check_herdr_activation
+    ;;
+  check-herdr-runtime-bootstrap)
+    check_herdr_runtime_bootstrap
+    ;;
+  check-herdr-plugin-profile)
+    check_herdr_plugin_profile
+    ;;
+  check-herdr-plugin-build)
+    check_herdr_plugin_build
+    ;;
+  smoke-herdr-plugin-build-live)
+    smoke_herdr_plugin_build_live
+    ;;
+  check-peer-facts)
+    check_peer_facts
+    ;;
+  check-herdr-plugin)
+    check_herdr_plugin
+    ;;
   check-entwurf-fact-provider)
     check_entwurf_fact_provider
     ;;
+  check-herdr-placement)
+    check_herdr_placement
+    ;;
+  check-herdr-fresh-call)
+    check_herdr_fresh_call
+    ;;
+  check-herdr-sandbox)
+    check_herdr_sandbox
+    ;;
+  check-herdr-supply)
+    check_herdr_supply
+    ;;
+  check-fresh-call-dispatch)
+    check_fresh_call_dispatch
+    ;;
+  smoke-herdr-fresh-call-live)
+    smoke_herdr_fresh_call_live
+    ;;
   check-entwurf-peers-surface)
     check_entwurf_peers_surface
     ;;
@@ -6926,6 +7283,22 @@ case "$cmd" in
     shift || true
     run_ts scripts/meta-facts.ts "$@"
     ;;
+  peer-facts)
+    # #116 M2-a READ-ONLY projection of the OBSERVED peer listing: one provider
+    # (`listEntwurfFacts`) through one renderer (`renderEntwurfPeers().payload`), so
+    # the payload SHAPE is the entwurf_peers payload shape and the join is never
+    # re-implemented — the pi half of that join is a measured vendor floor, and a
+    # forked copy decays silently. It is NOT the same bytes as an entwurf_peers call:
+    # that surface rations observation and returns text, this one is unbounded because
+    # a rationed row says `unobserved` and a machine consumer cannot tell that from
+    # "nobody could look". `placement` stays the structured tagged union. No socket
+    # coordinate is published (#50 C4 retired the legacy listing with the controlDir it
+    # exposed; ENTWURF_DIR only selects what is probed) and herdr's own
+    # agent_status/screen verdicts are absent (docs/herdr-launch-rail.md §9). No
+    # writes, no watcher, no dispatch. Same exit contract as meta-facts.
+    shift || true
+    run_ts scripts/peer-facts.ts "$@"
+    ;;
   meta-bridge-managed-keys)
     # 0.10.0 meta-bridge: emit the SSOT of settings.json/~/.claude.json keys that
     # entwurf's install OWNS. Consumers (agent-config fragment, future
@@ -7084,6 +7457,21 @@ case "$cmd" in
   remove)
     remove_local_package "$TARGET_PROJECT_DIR"
     ;;
+  herdr-plugin-activate)
+    # #116 M3-b2 public forward verb. Takes a subset of {pi, claude-code} and NOTHING else — the
+    # stable runtime root is derived, never supplied. Plain `node` in both modes: shipped .mjs.
+    shift
+    (cd "$REPO_DIR" && node "$REPO_DIR/scripts/herdr-plugin-activate.mjs" "$@")
+    ;;
+  herdr-plugin-deactivate)
+    # #116 M3-b2 public verb. Plain `node` in BOTH modes on purpose: this is shipped .mjs, not TS,
+    # because it has to run from an installed package after Herdr deleted the plugin checkout.
+    (cd "$REPO_DIR" && node "$REPO_DIR/scripts/herdr-plugin-deactivate.mjs" "$@")
+    ;;
+  install-user-scope)
+    shift
+    install_user_scope "$@"
+    ;;
   remove-user-scope)
     remove_user_scope_citizen
     ;;