@junghanacs/entwurf 0.22.0 → 0.23.1

package/run.sh

@@ -144,7 +144,7 @@ Usage:
   ./run.sh check-codex-birth-hook     # sandboxed payload + declaration: first-turn V3 birth, one record per thread, top-level event predicate, no markers
   ./run.sh check-codex-fresh-preflight # pre-mutation birth/MCP/thread-title/default-app-server readiness
   ./run.sh smoke-codex-config-state   # sandboxed MCP + status-line ownership/install/doctor/inverse lifecycle
-  ./run.sh smoke-codex-birth          # sandboxed birth unit: exact trust identity, the vendor trust receipt read (never written), config.toml untouched, foreign/edited/symlink refusals, drift-refusing inverse
+  ./run.sh smoke-codex-birth          # sandboxed birth unit: exact trust identity, the vendor trust receipt read at our MEASURED index (never written), config.toml untouched, coexistence with a foreign SessionStart group in either ordering (joined not adopted, reported not certified, byte-preserved across install and inverse), own-declaration drift/duplication refusals, drift-refusing inverse
   ./run.sh check-harness-admission-parity  # #87 C: the EDGE the two closed parity loops never had. Every citizen backend is fresh-openable or a declared pre-#82 legacy admission whose exception a reader finds in DELIVERY.md — so a post-contract harness that mints records but cannot be opened by entwurf_fresh_call blocks the release package instead of only carrying an `unsupported` note (docs/adding-a-harness.md step 9)
   ./run.sh check-capability-bundle-reach # deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS
   ./run.sh smoke-pi-attach            # deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:"pi"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read
@@ -158,31 +158,27 @@ Usage:
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
   ./run.sh check-entwurf-v2-contract   # FROZEN entwurf_v2 contract — control-socket liveness domain is currently pi; self-fetch/native-push citizens are out of that domain, not globally unsupported; pure, no IO
-  ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
-  ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
-  ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/native-push + bad-target/conflict/locked/undeliverable/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
-  ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — the spawn-observation policy and its four release events went with the transport in the visible-first cut, so the shipped machine is meta-mailbox=never release (no lock) + control-socket=release once on send-final; decideReleasePolicy still enforces the lock-nullness invariant; pure, no IO
-  ./run.sh check-entwurf-v2-send       # deterministic gate (0.11 Stage 0 step 5c-2a): control-socket SEND hand (executeControlSocketSend) wiring transport IO onto the 5c-1 reducer — ack→sent, in-band reject→rejected (no fallback), dead→same-lock one-shot re-resolve (control retry / mailbox enqueue), indeterminate→failed+rethrow with NO fallback (no double-delivery); release exactly once, releaseLock throw never masks the send error; IO-via-dep
   ./run.sh check-compaction-send-guard # deterministic gate (#111): control-socket send during Pi compaction — event-armed refuse compacting, quiet unknown non-idle refuse busy (ctx.signal is not isStreaming); no pi.sendMessage, no delivered:true; idle/live-run steer/followUp preserved; pure, no IO
-  ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (nothing is ever launched), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
-  ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/mailbox→matching hand with decision.lock verbatim / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
-  ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
-  ./run.sh check-entwurf-resume-args   # deterministic gate: resume-argv SSOT (buildResumePiArgs) for the S1 VISIBLE resume. The headless shape was measured wrong for a window before the consumer was written (`-p` is pi's own non-interactive mode), so the one shipped posture is `--entwurf-control` FIRST + ext args exactly once + `--session <abs file>` + optional `--provider` + `--model <m>` — and the gate pins the ABSENCES as hard as the presences: no --mode, no -p, no positional prompt (a resume runs no turn), no --no-extensions, never --session-id (which MINTS a session instead of resuming one)
   ./run.sh check-mux-resume-call       # deterministic gate: S1 resume PLACEMENT composition (mux-resume-call.ts). No fake tmux. cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while being wrong: a nonexistent `-c` exits 0 and lands the child in $HOME (so it is refused HERE), `-c` is FORMAT-EXPANDED so `#{…}` silently rewrites the path and `#(…)` was observed running a command (so `#` is refused), and whitespace measured SAFE (so no escaping layer is owed). Also pins `-c` reaching tmux, runtime after `--`, carrier-free argv, zero identity in this module, and the surface seam that keeps the v2 composition from importing mux
   ./run.sh check-mux-parent-artifact  # deterministic gate for the tracked scrubbed parent-transcript fixture — a version-pinned sample of the PARENT-SIDE shape (fresh_call toolResult + the later callback custom_message) so downstream never opens a private transcript. Pins event order, the toolCallId join on the RESULT (pi writes no separate toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info> envelope field names, and the absence of operator paths / real garden ids / real uuids. NOT placement evidence
   ./run.sh check-mux-launcher-fence   # deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes
-  ./run.sh check-entwurf-v2-visible-resume # deterministic gate: S1 visible-resume COMPOSITION (entwurf-v2-visible-resume.ts) with every seam injected — the whole state machine incl. the timeout branch runs with no tmux/lock/socket/clock. Pins lock BEFORE liveness, identity under the lock and before any window (no-transcript citizen fails loud, opens nothing), live/indeterminate/address-conflict refused unlaunched, observation as a BOUNDED WAIT (measured: socket answers ~2–4s after launch, so one immediate probe would call a successful resume unobserved), exactly ONE launch on every path, timeout → lock released + window left open + nothing retried/killed, failed release throws, and the two receipts staying separate in type and text
+  ./run.sh check-typing-call-fence    # deterministic gate for the boundary nobody has broken: this product composes ARGUMENTS and LETTERS, never keystrokes. Scans every tracked production source under pi-extensions/ and mcp/ — comments blanked, string literals kept — for tmux send-keys/paste-buffer/load-buffer and herdr's PTY verbs (agent.prompt, agent.send_keys, pane.send_text, pane.input.set). Prose is exempt on purpose: the sentence stating the rule names the very calls it forbids, and a scanner that read prose could be made green by deleting the law. Carries its own oracle — the detector is proven on planted code, proven blind to comments, and the scanned inventory is measured
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
   ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
-  ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
-  ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
+  ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one peer-facts + one agent list per open (counted, not claimed), skip-by-name when Entwurf is absent, four distinct named refusals instead of an empty table, ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
+  ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
+  ./run.sh check-herdr-activation      # deterministic gate for the #116 M3-b2 scoped activation: the pi user-scope-ONLY forward seam (no project write, OpenCode byte-untouched), the absolute command DERIVED from the runtime root for BOTH harnesses (relative/unnormalised refused), default bare/clone bytes unchanged when no mode is asked, the pi inverse refusing a drifted command instead of deleting an override, a certified activation ledger that can never name an atom outside {pi, claude-code}, add-only reinstall (a shrinking H retains, never removes), a roots-drift refusal before the first byte, the teardown order components->runtime->ledger LAST, one refused preflight leaving every byte untouched, and no deferred module load on the path that deletes its own runtime. Drives the REAL pi writers; the vendor `claude` CLI is NOT invoked and its acceptance of an absolute executable stays a named LIVE boundary
+  ./run.sh check-herdr-plugin-profile  # deterministic gate for the #116 M3-a PURE activation leaf (`plugins/herdr/lib/integration-profile.mjs`): the closed {pi→pi, claude→claude-code} table, exactly-one-row-or-named-refusal, the FRONT-ANCHORED state grammar (a `/srv/current (v9)/` directory name may not decide a verdict), no path in the plan, outdated/needs-repair as named FAILs, not-installed as a zero-write SKIP, `current` as herdr's admission with no floor of our own, OpenCode observed but never planned, and the leaf's purity. Listing strings only — no herdr binary, no install, no environment, no writes
+  ./run.sh check-herdr-plugin-build    # deterministic gate for the #116 M3-b3 build runner (`plugins/herdr/lib/build.mjs`): the ONE command Herdr's [[build]] calls, composing integration status -> pure profile -> runtime bootstrap -> activation THROUGH THE INSTALLED PACKAGE (never this checkout, which herdr deletes on uninstall with no cleanup hook). Pins one [[build]] with argv `node lib/build.mjs` and a runner npm does not ship, missing-herdr vs unanswerable-status as separate named refusals, a selected outdated/needs-repair/malformed/duplicate atom failing BEFORE any runtime work, A-empty as exit 0 with ZERO writes, absent/incapable activation entries as distinct refusals, the two-stage {pi} -> {pi, claude-code} composition with OpenCode never named, and the post-build herdr commit gap named rather than called atomic. Listing via the runner's own spawn seam (no fake herdr); one cell drives the REAL binary, named SKIP without it
+  ./run.sh check-peer-facts            # deterministic gate for the peer-facts projection (#116 M2-a): drives the REAL CLI with every ambient root sandboxed — placement crosses STRUCTURED (never the human `herdr <pane>` string), the peer keyset is exactly the provider's facts (no herdr agent_status may enter an entwurf payload), no socket coordinate is published (#50 C4), diagnostics in-band, the probed socket world is the one ENTWURF_DIR names (proved by a record-less socket surfacing — there is no field to echo), no observation budget, exit contract 0/2/3, dispatch+emit reachability. No herdr binary
   ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
   ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — full-store parse/probe/quarantine/resolve stays intact; #112 bounds expensive receiver/transcript observation to the newest 32 rendered rows while older machine rows say unobserved; Q112 pins full payload + exact observer budget; C-원칙 keeps corruption diagnostic and impossible wiring loud; deps injected, no IO
+  ./run.sh check-herdr-placement      # deterministic gate (#116 S1): the PURE placement-evidence axis — herdr `pane list` parse (unreadable payload → null → `unobserved`, never `none`), the two measured join rules (claude kind=id byte equality / pi kind=path uuid tail of a .jsonl basename, both strict), unmeasured kind → NO key, two panes on one key → `ambiguous` (never last-write-wins), provider reads the placement owner EXACTLY ONCE per listing (anti-watcher, docs/mux-launch-rail.md §7), and no entwurf_v2 dispatch module names or imports the axis (Hard Rule 16 — a pane is a view, not a rail). No fake herdr, no binary, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
   ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta splits by RAIL: self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows), native-push ⟺ recordBacked ∧ probeAlive (separate axis — no mailbox fact may rescue or sink it), unsupplied rail fail-closed; SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected AND renders the meta rail per-rail (mailbox only inside the self-fetch branch; native-push denies an inbox and gates injection on the probe)
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
@@ -251,9 +247,9 @@ Usage:
   ./run.sh uninstall-agy-bridge       # 봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)
   ./run.sh probe-bridge-command <cmd> [args...]  # #81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{"command":"…","args":[],"env":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf.
   ./run.sh doctor-agy-bridge          # fail-loud doctor: MCP config + exact permission rule + state + live probe label
-  ./run.sh install-codex-birth        # publish $CODEX_HOME/hooks.json + the helper closure; no root, and the operator trusts the declaration once in their own Codex
-  ./run.sh uninstall-codex-birth      # exact inverse from the install-state digest inventory; refuses drifted bytes instead of deleting them
-  ./run.sh doctor-codex-birth         # RUNTIME + UNIT bytes/ownership + the vendor TRUST receipt for this declaration (--unit-only skips the receipt; sandboxes only)
+  ./run.sh install-codex-birth        # publish ONE SessionStart declaration inside $CODEX_HOME/hooks.json (a file it shares) + the helper closure; no root, and the operator trusts the declaration once in their own Codex
+  ./run.sh uninstall-codex-birth      # exact inverse from the install-state digest inventory; removes only entwurf's own declaration (foreign groups byte-for-byte) and refuses drifted bytes instead of deleting them
+  ./run.sh doctor-codex-birth         # RUNTIME + UNIT bytes/ownership + FOREIGN neighbours (reported, never certified) + the vendor TRUST receipt at this declaration's measured index (--unit-only skips the receipt; sandboxes only)
   ./run.sh install-codex-mcp          # own only [mcp_servers.entwurf-bridge] in the user's Codex config
   ./run.sh uninstall-codex-mcp        # remove/restore only the recorded MCP atom
   ./run.sh doctor-codex-mcp           # effective config + ownership + actual bridge boot
@@ -274,6 +270,7 @@ Usage:
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
   ./run.sh meta-bridge-fresh-cut      # the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only. EXIT CONTRACT (#54, `--help` prints it): 0 complete / 1 NOTHING MOVED (re-run, do not setup) / 2 usage / 3 cut transition incomplete (inspect) / 4 cut complete but residue cleanup failed (`setup` may run; re-run only before new citizen birth, otherwise remove residue manually)
   ./run.sh meta-facts                 # #65 owner-normalized READ-ONLY store projection: deterministic JSON {schemaVersion:1, storeDir, citizens: full v3 records sorted by gardenId, defects: {filename,message}} — THE listing contract emitted by the owner so consumers stop copying the certification. No liveness/sockets/transcript contents. EXIT: 0 readable (defects in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
+  ./run.sh peer-facts                 # #116 M2-a owner-normalized READ-ONLY peer projection: the same listEntwurfFacts provider through the same renderer entwurf_peers uses, emitted as deterministic JSON {schemaVersion:1, storeDir, peers, diagnostics} so a consumer never re-implements the placement join (whose pi half is a measured vendor floor). NOT the same bytes as an entwurf_peers call and deliberately so: that surface is a human listing (observationLimit, text over the wire), this is a machine projection with UNBOUNDED observation, because a rationed row says `unobserved` and a machine cannot tell that from "nobody could look". `placement` stays a STRUCTURED tagged union ({kind:"herdr-pane",paneId} / unobserved / none / ambiguous) — never the human `herdr <pane>` string. Publishes NO socket coordinate (ENTWURF_DIR selects what is PROBED, #50 C4) and NO herdr agent_status / interactive_ready / screen text. One placement read per listing, no watcher. EXIT: 0 readable (diagnostics in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
   ./run.sh meta-bridge-managed-keys   # 0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)
   ./run.sh check-keyset-overlap <fragment.json...>  # 0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
@@ -281,10 +278,13 @@ Usage:
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
-  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
+  ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
   ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
+  ./run.sh install-user-scope [--plugin-runtime <root>]  # #116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope
+  ./run.sh herdr-plugin-activate <backend...>  # #116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status
+  ./run.sh herdr-plugin-deactivate   # #116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots and BOTH component inverses read-only first; mutates only when every preflight is green; then Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails
   ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
   ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
   ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
@@ -656,8 +656,15 @@ codex_terminal_title() {
   esac
 }
 
+# $1 (optional): a certified stable plugin runtime root. Given, the provider half is written in
+# PLUGIN MODE — its managed command becomes the absolute bridge under that root instead of the bare
+# bin. That is the whole difference, and it exists because a Herdr plugin activates on a host where
+# nothing entwurf is on PATH, so a bare command cannot resolve. Absent, every byte is what it has
+# always been (#116 M3-b2).
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+  local plugin_mode=()
+  [ -n "${1:-}" ] && plugin_mode=(--plugin-runtime "$1")
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
   # #86 C2: user scope carries a recorded OWNER (packageRoot in the pi-package
   # install-state). Another owner — live or missing — makes this a zero-write
@@ -670,7 +677,7 @@ register_user_scope_citizen() {
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
     --scope user --state "$(_pi_package_state)" --preflight >/dev/null
   python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" \
-    --scope user --state "$(_pi_provider_state)" --preflight >/dev/null
+    --scope user --state "$(_pi_provider_state)" ${plugin_mode[@]+"${plugin_mode[@]}"} --preflight >/dev/null
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" \
     --scope user --state "$(_pi_package_state)"
   # #46 Task 2: own entwurfProvider.mcpServers.entwurf-bridge as the bare stable bin at USER scope
@@ -679,7 +686,33 @@ register_user_scope_citizen() {
   # local and covered by `run.sh remove` (no state) — deliberate, reasoned asymmetry.
   # #86 C2: the provider state records installerRoot, so the same foreign-owner refusal
   # holds here — and the package refusal above fires FIRST, before any provider write.
-  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)"
+  python3 "$REPO_DIR/scripts/register-pi-provider.py" install "$agent_dir/settings.json" "$REPO_DIR" --scope user --state "$(_pi_provider_state)" ${plugin_mode[@]+"${plugin_mode[@]}"}
+}
+
+# install-user-scope — the PLUGIN-ONLY forward seam (#116 M3-b2). Generic `install` writes both a
+# project `.pi/settings.json` and the global user-scope citizen; a Herdr plugin activation has no
+# project and must not invent one, so this verb composes the user-scope half and nothing else. Its
+# inverse is the one that already existed, `remove-user-scope` — the asymmetry this closes is that
+# the inverse was public and the forward was not.
+install_user_scope() {
+  command -v python3 >/dev/null 2>&1 || { echo "[install-user-scope] requires python3 on PATH; nothing was written." >&2; exit 1; }
+  local plugin_runtime=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --plugin-runtime)
+        shift
+        # A flag with no value must not fall through to bare mode: the caller asked for the plugin
+        # runtime and would otherwise be told, silently, that it got it.
+        [ -n "${1:-}" ] || { echo "run.sh install-user-scope: --plugin-runtime requires a value" >&2; exit 2; }
+        plugin_runtime="$1" ;;
+      *) echo "usage: run.sh install-user-scope [--plugin-runtime <stable active root>]" >&2; exit 2 ;;
+    esac
+    shift
+  done
+  preflight_v3_store install-user-scope
+  section "install-user-scope: the GLOBAL pi citizen only (no project wiring)"
+  register_user_scope_citizen "$plugin_runtime"
+  ok "install-user-scope: user-scope packages[] + provider registered${plugin_runtime:+ (plugin runtime: $plugin_runtime)}"
 }
 
 # takeover-user-scope — the operator-explicit ownership move (#86 C2). The ONLY
@@ -1050,6 +1083,14 @@ check_copilot_launch() {
   run_ts scripts/check-copilot-launch.ts
 }
 
+check_pi_launch() {
+  # #118 홉 2. Same oracle as check-copilot-launch and for the same reason: the subject is
+  # a process replacement, so a fake vendor named `pi` on a sandbox PATH reports the argv,
+  # env and pid it was handed — never a reading of the launcher's source. Also carries the
+  # --entwurf-control literal cross-check, because the shell cannot import the TS constant.
+  run_ts scripts/check-pi-launch.ts
+}
+
 check_codex_app_server_launch() {
   # #95: the managed app-server SPELLING, proved against a fake vendor. There is no second
   # spelling of the address to compare any more — the launcher asks `codex-socket-path` — so
@@ -1140,123 +1181,28 @@ check_entwurf_v2_contract() {
   run_ts scripts/check-entwurf-v2-contract.ts
 }
 
-check_entwurf_v2_lock() {
-  # Deterministic gate for 0.11 Stage 0 step 5a (버킷 B F2): the per-gid dispatch
-  # LOCK primitive — what serializes concurrent in-domain dispatch at one
-  # target (pi self-guards CREATE but not RESUME, 검증원장 F2). acquire =
-  # openSync(lockPath,"wx") atomic; a second acquire without release =
-  # target-locked conflict carrying the holder JSON (F2-P2 human cleanup). release
-  # = unlink ONLY when the on-disk nonce is still ours (a successor's re-acquire
-  # survives a late release). Stale reclaim ONLY for same host + ESRCH; EPERM
-  # (other user's live pid) / different host / alive pid / unknown error all
-  # fail-closed to conflict. Empty/corrupt lockfile = conflict, never
-  # auto-deleted. F2-P1: a malformed gid throws before any path is built. Real
-  # temp dir (wx atomicity under test); clock/nonce/pid/host/kill injected.
-  run_ts scripts/check-entwurf-v2-lock.ts
-}
-
-check_entwurf_v2_decider() {
-  # Deterministic gate for 0.11 Stage 0 step 5b: the PURE dispatch decider
-  # decideDispatch. Drives the frozen 7-step order over INJECTED fakes (target
-  # lookup / lock / socket inspect+probe / preflight / capability), tracking lock
-  # acquire+release so "reject ⇒ no plan AND no lock retained" is PROVEN. Covers:
-  # bad-target/target-locked/target-address-conflict carry observedLiveness=null
-  # (pre-probe), every other reject carries a measured value; a control-socket send
-  # executes KEEPING the lock, meta-mailbox send takes NO lock (？7); an invalid gid throws before
-  # any lookup (F2-P1). Pure, no IO, no API.
-  run_ts scripts/check-entwurf-v2-decider.ts
-}
-
-check_entwurf_v2_matrix() {
-  # Deterministic gate for 0.11 Stage 0 step 5d-5 (a): the REACHABILITY + LOCK SSOT
-  # TABLE. Drives the REAL decideDispatch over minimal injected fakes and fixes, as
-  # one readable table, every (target kind → transport → lock class) cell the 5d-5
-  # claim covers: bad-target/address-conflict/target-locked rejects, unsupported
-  # meta-mailbox (deliverable) vs mailbox-undeliverable (inactive) reject,
-  # in-domain control-socket (live) / released rejects
-  # (ff-dormant, indeterminate, under-lock conflict). A coverage pass
-  # FAILS if any transport / lock class / pre-probe reject is missing — a dropped
-  # decider cell cannot pass silently. Thin coverage, NOT a decider re-impl; surface
-  # parity stays in check-entwurf-v2-surface. Pure, no IO, no API.
-  run_ts scripts/check-entwurf-v2-matrix.ts
-}
-
-check_entwurf_v2_release() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-1: the PURE release-policy reducer
-  # (decideReleasePolicy + reduceRelease) for the 5c transport hand. Proves the
-  # Fable-3 "release-after-observation" timing as a pure state machine BEFORE any
-  # send IO: meta-mailbox=never release (no lock), control-socket=release once
-  # on send-final. The spawn-observation policy and its four release events went with
-  # the transport in the visible-first cut; decideReleasePolicy still enforces the
-  # lock-nullness invariant (？7). Pure, no IO.
-  run_ts scripts/check-entwurf-v2-release.ts
-}
-
 check_entwurf_v2_send() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-2a: the control-socket SEND hand
-  # (executeControlSocketSend) that WIRES real transport IO onto the 5c-1 release
-  # reducer. Proves the send->outcome->release ordering over injected fakes (no socket):
-  # ack->sent / in-band reject->rejected (no fallback) / dead->same-lock one-shot
-  # re-resolve (control retry or mailbox enqueue)->fallback-sent|rejected|failed /
-  # indeterminate->failed+rethrow with deadFallback+mailbox NEVER called (no
-  # double-delivery on an alive-but-stalled socket). Release fires exactly once per
-  # send-final; a releaseLock throw never masks the send failure (5b). IO-via-dep.
-  run_ts scripts/check-entwurf-v2-send.ts
-}
-
-check_entwurf_v2_send_fallback() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-2b: the same-lock re-resolve RESOLVER
-  # (resolveDeadControlSendFallback) the 5c-2a hand calls on a dead connect. Proves the
-  # fire-and-forget re-resolve routing over injected fakes (no filesystem): alive->
-  # control-socket retry (inspected socketPath) / dead(absent)->reject (dormant-fire-
-  # forget-unsupported, and nothing is launched) / indeterminate->reject / unsupported+deliverable
-  # ->meta-mailbox plan (mini-table, no inspect/probe) / unsupported+undeliverable->reject
-  # / bad-target + address-conflict->reject pre-probe. Mis-wire (plan/lock gid) fails loud
-  # before IO; inspect/probe throws PROPAGATE (the hand owns failed+release); the resolver
-  # has NO release seam; every execute plan keeps the held gid.
-  run_ts scripts/check-entwurf-v2-send-fallback.ts
-}
-
-check_entwurf_v2_mailbox() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-4 (the LAST 5c transport slice): the
-  # ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + its production
-  # sendViaMailbox adapter (makeProductionSendViaMailbox). Proves the wiring over an
-  # injected fake enqueue (no filesystem): sender present -> formatMetaMailboxBody with
-  # plan.wantsReply threaded (yes/no in body, the deliberate divergence from legacy's
-  # hard-coded false) / sender absent -> raw plan.message / enqueue opts EXACTLY
-  # {gardenId: plan.targetGardenId, body, sessionsDir, mailboxDir} (no re-derivation) /
-  # enqueue throw PROPAGATES (never folded into success:false — a mailbox has no in-band
-  # refuse) / success -> {success:true}. Production adapter resolves {success:true},
-  # consults senderProvider once, and NEVER touches the lock (a poison LockClaim whose
-  # every access throws still resolves). Source guard: the lib code has NO release seam
-  # and NO routing seam (no releaseLock / inspect / probe / resolve) — a lock leak or
-  # re-route is structurally impossible.
-  run_ts scripts/check-entwurf-v2-mailbox.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the V2SEND-INBAND-REJECT-REASON mutant names it as gate argv, and attribution is
+  # read from the JSON test titles `run_vitest` emits (run.sh:104-113). Narrow file filter: a
+  # mutant pointed at the glob shim would re-run every beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "control-socket send hand (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-send.test.ts
 }
 
 check_entwurf_v2_native_push() {
-  # Deterministic gate for 봉인 3/4: the native-push SEND hand (deliverViaNativePush +
-  # makeNativePushSend), the executor half of the native-push rail — where the 1-shot retry
-  # lives (moved out of the adapter leaf). Proves over a fake adapter (no agy/socket): success
-  # first try -> {retried:false}, ONE send over the planted route, ZERO re-probe; fail ->
-  # re-probe alive -> re-send success -> {retried:true}, TWO sends, the 2nd over the RE-
-  # DISCOVERED route; re-send FAIL -> throws (no 3rd attempt); re-probe dead/indeterminate ->
-  # throws (not retried), NO second send. makeNativePushSend resolves the adapter from
-  # plan.backend and IGNORES the lock (lock-free rail).
-  run_ts scripts/check-entwurf-v2-native-push.ts
-}
-
-check_entwurf_v2_runner() {
-  # Deterministic gate for 0.11 Stage 0 step 5d-1: the execute-router (executeDispatch) that
-  # routes an already-decided DispatchDecision to its 5c transport hand and maps the outcome
-  # to one outcome-rich EntwurfV2RunResult. Proves over injected fake hands (no socket/spawn/
-  # timer): reject -> rejected (receipt+diagnostic carried, NO hand called) / control-socket ->
-  # sendControl(plan, lock) / meta-mailbox -> sendMailbox(plan, NULL
-  # lock, ？7). Carry-overs: N3 control `rejected` carries rejectReason verbatim; N1
-  # SendDeliveredReleaseFailedError -> execution-failed{finalizedOutcome, releaseFailed,
-  # retrySafe:false}; a plain hand throw -> execution-failed{retrySafe:false} with no
-  # finalizedOutcome. Exactly one hand runs per execute.
-  run_ts scripts/check-entwurf-v2-runner.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the NATIVE-PUSH-RETRY-BYTE-IDENTITY mutant names it as gate argv, and attribution
+  # is read from the JSON test titles `run_vitest` emits (run.sh:104-113). Narrow file filter:
+  # a mutant pointed at the glob shim would re-run every beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "native-push send hand (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-native-push.test.ts
 }
 
 check_entwurf_v2_surface() {
@@ -1323,15 +1269,22 @@ check_compaction_send_guard() {
 }
 
 check_entwurf_resume_args() {
-  # Deterministic gate for the resume-argv SSOT (buildResumePiArgs). S1 replaced the headless
-  # shape with the VISIBLE one, measured against the runtime before the consumer was written:
-  # `-p` is pi's own non-interactive mode, so the old `--mode json -p … <prompt>` prefix would
-  # put a JSON stream in the operator's window instead of a session they can use. Pins the one
-  # shipped posture — `--entwurf-control` FIRST (the resumed session stands its socket up), no
-  # --mode/-p/positional prompt (a resume runs no turn), explicitExtensionArgs exactly once
-  # between the control flag and --session (#29 provider-resolution footgun), --session <abs
-  # file> never --session-id (which MINTS), and a null provider emitting no --provider.
-  run_ts scripts/check-entwurf-resume-args.ts
+  # NOT a discovery path — the test is found by check-tests-beside-behavior like every other
+  # beside-behaviour lane. This case exists as the MUTANT EXECUTION COORDINATE: the six
+  # resume-args mutants name it as their gate argv, the qualification runner re-invokes that
+  # argv once per mutant, and attribution is read from the JSON test titles `run_vitest` emits
+  # under ENTWURF_MUTATION_VITEST_REPORT (run.sh:104-113). A gate argv that called vitest
+  # directly would skip that reporter and every kill would come back unattributed.
+  #
+  # The file filter is NARROW on purpose. Pointing a mutant at the glob shim would make the
+  # runner re-run every beside-behaviour test once per mutant.
+  #
+  # It stays inside check:contracts even though the discovery door also runs this file, and the
+  # duplicate is deliberate: check-release-gate-outcomes requires every gate a mutant names to
+  # run inside check:full, because a gate reachable ONLY through qualification makes the
+  # 28-minute mutant body the only thing that can notice it going red on a clean tree.
+  section "resume-argv SSOT (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-resume-args.test.ts
 }
 
 check_mux_launcher_fence() {
@@ -1349,6 +1302,17 @@ check_mux_launcher_fence() {
   run_ts scripts/check-mux-launcher-fence.ts
 }
 
+check_typing_call_fence() {
+  # The rule kept since day one, now kept by NAME: entwurf composes arguments and letters, never
+  # keystrokes. An outside reader measured the tree on 2026-09-17 and found the law perfectly kept
+  # and nothing keeping it — zero typing calls in pi-extensions/, zero checks and zero mutants that
+  # would notice one arriving. Scans tracked production sources under pi-extensions/ and mcp/ with
+  # comments blanked and string literals kept, because a typing call spelled as a string is the
+  # call. Comment exemption is load-bearing: the sentence that states the rule contains the names
+  # the rule forbids. Offline, no binaries, no fixtures on disk.
+  run_ts scripts/check-typing-call-fence.ts
+}
+
 check_mux_parent_artifact() {
   # Deterministic gate for the tracked scrubbed parent-transcript fixture
   # (scripts/fixtures/mux-parent-transcript.scrubbed.jsonl). The fixture is a version-pinned
@@ -1376,16 +1340,16 @@ check_mux_resume_call() {
 }
 
 check_entwurf_v2_visible_resume() {
-  # Deterministic gate for the S1 visible-resume composition (entwurf-v2-visible-resume.ts).
-  # Every seam is injected, so the whole state machine — including the timeout branch — runs
-  # without tmux, a lock file, a socket or a clock. Pins: lock BEFORE liveness, identity under
-  # the lock and before any window (a citizen with no transcript fails loud and opens nothing),
-  # live/indeterminate/address-conflict refused unlaunched, the observation as a BOUNDED WAIT
-  # (measured: the socket answers ~2–4s after launch, so one immediate probe would report a
-  # successful resume as unobserved), exactly one launch on every path, timeout releasing the
-  # lock and leaving the window open, a failed release throwing, and the two receipts staying
-  # separate in both the type and the rendered text.
-  run_ts scripts/check-entwurf-v2-visible-resume.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because SEVENTEEN mutants name it as gate argv, and attribution is read from the JSON test
+  # titles `run_vitest` emits (run.sh:104-113), which is why each of those claims is its own
+  # test title. Narrow file filter: pointing them at the glob shim would re-run every
+  # beside-behaviour test seventeen times. It stays inside check:contracts even though the
+  # discovery door also runs this file — see check-release-gate-outcomes: a gate a mutant names
+  # must be reachable outside qualification.
+  section "visible same-id resume (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-visible-resume.test.ts
 }
 
 check_resume_launch_identity() {
@@ -1449,7 +1413,7 @@ check_mux_fresh_call() {
   # codex-caller-seat rides here for the same reason as the two preflights: the leaf exists
   # only as freshCall's Codex placement input (#95 lane B), so certifying it apart from the
   # composition it feeds would let the two halves of one seat decision drift.
-  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts test/codex-caller-seat.test.ts
+  run_vitest test/mux-fresh-call.test.ts test/fresh-call-composition.contract.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts test/codex-caller-seat.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -1732,7 +1696,7 @@ smoke_acp_cortex_live() {
 
 smoke_entwurf_v2_matrix_live() {
   # LIVE sentinel for 0.11 Stage 0 step 5d-5 (D4-b) — kept OUT of `pnpm check`. The deterministic
-  # sibling (check-entwurf-v2-matrix) fixes every (target kind → transport → lock) cell over fakes
+  # sibling (pi-extensions/lib/entwurf-v2-decider.matrix.test.ts) fixes every (target kind → transport → lock) cell over fakes
   # with ZERO IO; this drives the REAL production runEntwurfV2 deps against REAL OS objects on the
   # substrate happy path across 3 cells: C1 control-socket (a real `pi --entwurf-control` resident
   # → control-socket RPC send → lock acquire→release ×1), C2 meta-mailbox deliverable (armed
@@ -1750,18 +1714,6 @@ smoke_entwurf_v2_matrix_live() {
   run_ts scripts/smoke-entwurf-v2-matrix-live.ts
 }
 
-check_entwurf_facts() {
-  # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 1): the PURE
-  # fact core. Locks the PeerFact shape + R1/R3b liveness invariant before any IO
-  # wiring (gate-first). R1: out-of-domain backend (claude-code/codex/antigravity)
-  # → unsupported for EVERY socket input (never coerced to the socket value or
-  # dead). R3b: in-domain pi → alive/dead/indeterminate, null → indeterminate
-  # (no proof ≠ dead). facts-only keyset: identity facts + liveness, NO
-  # verb-routing (resumable/sendable/transport/dispatch/action) and NO
-  # transcriptPath (동결결정 10). Pure, no IO, no API.
-  run_ts scripts/check-entwurf-facts.ts
-}
-
 check_control_socket_path() {
   # Deterministic gate: the control-socket path grammar `<dir>/<gid>.sock` has ONE
   # definition (pi-extensions/lib/control-socket-path.js) instead of one per
@@ -1772,18 +1724,6 @@ check_control_socket_path() {
   run_ts scripts/check-control-socket-path.ts
 }
 
-check_socket_discovery() {
-  # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 3): the
-  # SOCKET-axis wiring scanSocketProbes. Probes the union of (dir sockets) ∪
-  # (every in-domain pi citizen's canonical path) so a dormant citizen with no
-  # socket file reads dead (ENOENT) → resumable, never an unprobed gap (slice 2
-  # throws on that). Three-valued throughout — a stalled socket stays
-  # indeterminate (F3), never folded to dead by an alive-only listing. Dir
-  # hygiene (non-.sock / malformed names ignored), dedup, missing-dir, sort, and
-  # an end-to-end scanSocketProbes→resolveFactList. readdir/probe injected, no IO.
-  run_ts scripts/check-socket-discovery.ts
-}
-
 check_meta_listing() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4a): the
   # meta-store axis listAllMetaIdentities. Explicit-partial: a parse failure or
@@ -1806,6 +1746,117 @@ check_meta_facts() {
   run_ts scripts/check-meta-facts.ts
 }
 
+check_herdr_plugin() {
+  # Deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`). Two halves.
+  # STATIC: the manifest is parsed with the package's own TOML reader and held to the
+  # shape herdr 0.9.0 accepts (min_herdr_version required + semver, dot-free pane id,
+  # popup-only sizing, argv arrays), and the ABSENT sections are asserted as hard as the
+  # present ones — [[startup]]/[[events]] are where a watcher would grow, [[actions]]
+  # would send a report nobody can read into a 64 KiB log. ([[build]] LEFT that list in
+  # #116 M3-b3; the one runner it may call is check-herdr-plugin-build's subject.)
+  # BEHAVIOURAL: the REAL pane entry is
+  # spawned with a stub `entwurf` and a stub HERDR_BIN_PATH that log every call, so
+  # "exactly one read each per open" is COUNTED; success, skip-by-name, four distinct
+  # named refusals, the ambiguous pane, diagnostics and the no-write claim are each
+  # driven for real. The stub stands for the CONSUMER's input, never for herdr's
+  # behaviour — no claim about herdr is made here, which is why this is not the fake
+  # fixture check-herdr-sandbox forbids. No herdr binary, no Entwurf install, no writes
+  # outside mkdtemp.
+  run_ts scripts/check-herdr-plugin.ts
+}
+
+check_herdr_activation() {
+  # Deterministic gate for the #116 M3-b2 scoped activation. The pi cells drive the REAL writers
+  # (run.sh install-user-scope, register-pi-provider.py, remove-user-scope) against a sandboxed
+  # HOME/XDG/PI_CODING_AGENT_DIR, so the bytes asserted are bytes those writers produced. The Claude
+  # cells drive the REAL state owner's pure surfaces; the vendor `claude` CLI is NOT invoked and its
+  # acceptance of an absolute executable stays a named LIVE boundary. The oracle for a roundtrip is
+  # JSON equality plus unrelated-key survival, never byte equality: the pi settings writer preserves
+  # semantics but may reindent (measured 2026-09-16). No network, no operator HOME.
+  run_ts scripts/check-herdr-activation.ts
+}
+
+check_herdr_runtime_bootstrap() {
+  # Deterministic gate for the #116 M3-b1 runtime transaction. Every root comes from XDG, so the
+  # gate hands the module a mkdtemp HOME and asserts nothing appeared outside the two XDG roots it
+  # was given. `acquire` is a FUNCTION seam: the fixture stands in for the REGISTRY, so this gate
+  # proves the transaction (ownership certification, torn-swap recovery, leftover states, rollback,
+  # idempotence, the inverse) but NOT that the real Entwurf package boots — that actual-package
+  # proof is a named cell inside check-pack-install, which runs this module's own
+  # verifyInstalledRuntime against the tarball it packed and installed. npm is pinned here the only
+  # way a hermetic gate honestly can: the production pack/install argv and the npm environment are
+  # pure functions and are asserted directly. No network, no npm, no operator HOME, no writes
+  # outside mkdtemp.
+  run_ts scripts/check-herdr-runtime-bootstrap.ts
+}
+
+check_herdr_plugin_profile() {
+  # Deterministic gate for the #116 M3-a pure leaf: the function that turns ONE
+  # `herdr integration status` listing into this plugin's activation plan. Every listing
+  # is an INPUT STRING (verbatim herdr 0.9.0 rows measured 2026-09-16 in a sandboxed
+  # HOME/XDG, plus the two forms cross-checked in herdr source at c77af189), so nothing
+  # here claims a fact about herdr. Pins: the closed atom->backend table, exactly one row
+  # per selected atom or a NAMED refusal (never a first/last-match guess), the state read
+  # FRONT-ANCHORED so an operator's directory name cannot spell a verdict, the display
+  # path leaving no trace in the plan, outdated/needs-repair as named FAILs (measured:
+  # empty, unreadable and marker-less files all collapse into `outdated`), not-installed
+  # as a zero-write SKIP, `current` as herdr's admission with no second floor invented
+  # here, OpenCode observed but never planned, and the leaf's purity. No herdr binary, no
+  # Entwurf install, no environment read, no writes.
+  run_ts scripts/check-herdr-plugin-profile.ts
+}
+
+check_herdr_plugin_build() {
+  # Deterministic gate for the #116 M3-b3 build runner (`plugins/herdr/lib/build.mjs`) — the ONE
+  # command Herdr's `[[build]]` calls, and the order it composes: integration status -> pure
+  # profile -> runtime bootstrap -> activation THROUGH THE INSTALLED PACKAGE. There is no fake
+  # herdr binary here (the repo forbids one); the listing arrives through the runner's own spawn
+  # seam as the prose shape 0.9.0 emits, and one cell drives the REAL binary with a named SKIP
+  # when the host has none (ENTWURF_REQUIRE_HERDR=1 makes absence red). Pins: exactly one
+  # [[build]] whose argv is `node lib/build.mjs` and a runner the npm package does NOT ship;
+  # missing herdr vs unanswerable status as separate named refusals with zero writes; a selected
+  # atom that is outdated/needs-repair/malformed/duplicated failing BEFORE any runtime work;
+  # A-empty as a clean exit 0 that writes nothing (no runtime, no wiring, no removal); the
+  # activation entry resolved under the stable runtime with absent/incapable as distinct named
+  # refusals and no checkout fallback; the two-stage {pi} -> {pi, claude-code} composition where a
+  # new commit reinstalls and OpenCode is never named; and the post-build Herdr commit gap being a
+  # NAMED gap, not an atomic transaction. The real `herdr plugin install` + real `npm pack
+  # git+https://...#<sha>` journey needs the network and lives in smoke-herdr-plugin-build-live.
+  run_ts scripts/check-herdr-plugin-build.ts
+}
+
+smoke_herdr_plugin_build_live() {
+  # #116 M3-b3 LIVE: a REAL `herdr plugin install` drives this plugin's REAL `[[build]]`, which
+  # packs the FIXED product git spec for real. Needs LIVE=1, herdr/git/npm, and the NETWORK (a
+  # git-spec pack builds the bridge through `prepare`, which installs devDependencies) — which is
+  # the axis check-herdr-plugin-build cannot have and does not claim. Hermetic by two substitutions
+  # only: sandbox HOME/XDG, and git `insteadOf` redirecting the unchanged product remote to a local
+  # bare clone of this worktree, so an unpushed candidate is testable without weakening the argv.
+  # Cells 1/2/4 are the real-Herdr journey: remote-commit available, reinstall widening to
+  # {pi, claude-code} with OpenCode zero-write and ONE COUNTED vendor MCP owner entry, and the
+  # post-build gap where herdr's own commit fails after our runner already rebound the activation.
+  # Cell 3 is deliberately NOT a journey: it calls the shipped runtime leaf directly with the fixed
+  # product argv at a commit the remote lacks, so it is acquisition-leaf evidence — named refusal,
+  # active runtime/ledger/harness bytes preserved, journal left as the certified retry authority.
+  run_ts scripts/smoke-herdr-plugin-build-live.ts
+}
+
+check_peer_facts() {
+  # Deterministic gate for the #116 M2-a observed-peer projection. Drives the REAL
+  # scripts/peer-facts.ts as a subprocess with every ambient root replaced (store,
+  # ENTWURF_DIR, HOME, XDG_DATA_HOME, pi agent dir), so the live store, sockets and
+  # markers are never read. Owns only what this verb ADDS on top of the provider:
+  # placement crosses as the structured tagged union rather than the human string,
+  # the peer keyset is exactly the provider's facts (no herdr agent_status may enter
+  # an entwurf payload — that is the door observed activity would use to become
+  # delivery liveness) and no socket coordinate is published at all, diagnostics ride
+  # in-band, the probed socket world is the one ENTWURF_DIR names (proved by a
+  # record-less socket surfacing — there is no field to echo), no observation budget
+  # rations a machine projection, exit contract 0/2/3,
+  # plus dispatch + compiled-twin reachability. No herdr binary, no model turn.
+  run_ts scripts/check-peer-facts.ts
+}
+
 check_entwurf_fact_provider() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4b): the
   # ASSEMBLY layer listEntwurfFacts. listAllMetaIdentities → scanSocketProbes →
@@ -1820,6 +1871,94 @@ check_entwurf_fact_provider() {
   run_ts scripts/check-entwurf-fact-provider.ts
 }
 
+check_herdr_placement() {
+  # Deterministic gate for #116 S1: the placement evidence axis
+  # (pi-extensions/lib/herdr-placement.ts) plus the ONE read the fact provider is
+  # allowed. Pins only what is decidable WITHOUT a herdr binary — payload parse, the
+  # two measured join rules, the ambiguity rule, the four-word vocabulary, the render,
+  # the once-per-listing read, and the STRUCTURAL absence of placement from every
+  # entwurf_v2 dispatch module. There is no fake herdr here for the same reason
+  # check-mux-placement refuses a fake tmux: a stand-in authors the contract before the
+  # real thing is measured. Every payload literal is verbatim herdr 0.9.0 output
+  # recorded 2026-09-14. The real-binary half is an isolated private herdr server
+  # (sandbox HOME/XDG, no client attach); the join/callback round trip stays LIVE.
+  run_ts scripts/check-herdr-placement.ts
+}
+
+check_herdr_fresh_call() {
+  # Deterministic gate for #116 S2-c1: the herdr LAUNCH rail core
+  # (pi-extensions/lib/herdr-fresh-call.ts). Pins only what is decidable WITHOUT a herdr
+  # binary — the import fence that keeps the two rails separately deletable, the closed
+  # pi|claude-code pilot, the option-G one-line JSON encoding (exact round trip, zero
+  # Unicode Cc including the C1 block JSON.stringify leaves literal, max public task),
+  # the pre-mutation refusals with the CLI never invoked, the ONE placement policy (a new
+  # tab in the caller's own workspace, read from herdr's own answer about the caller's pane
+  # and never from a pane id's shape, focus left alone), tab-create/start/get/close argv
+  # grammar, strict response parsing, the opaque pane id, the receipt's missing address,
+  # and the conditional-close matrix. No fake herdr executable and no fake server, for the
+  # reason check-mux-placement refuses a fake tmux. Payload literals are verbatim herdr
+  # 0.9.0 output (pane/tab replies 2026-09-15, agent_started 2026-09-14); the real-binary
+  # half is an isolated private server (c2).
+  run_ts scripts/check-herdr-fresh-call.ts
+}
+
+check_herdr_sandbox() {
+  # REAL herdr acceptance for #116 C2a: a PRIVATE herdr server in a fully sandboxed
+  # HOME/XDG/PI_CODING_AGENT_DIR creates a tab with the production placement argv, installs
+  # herdr's own pi integration, and starts a BLANK pi in that tab's initial pane from ONE
+  # checkout package registration. Asserts the official witness
+  # triple, the strict path->native id join, exactly one sandbox V3 record, a control socket
+  # that answers the production probe, and the conditional-close decision in both directions
+  # (refuses a pane holding an agent, reclaims one we own and with it the tab it was the
+  # whole of). No fake herdr, no model turn, no
+  # credentials, no keystrokes; the fixture's `pi --approve` is a one-run authorisation that
+  # writes no trust state and never enters production argv. herdr is an OPTIONAL rail: an
+  # absent binary prints a named SKIP and exits 0, a PRESENT-but-incomplete rail FAILS, and
+  # ENTWURF_REQUIRE_HERDR=1 turns absence itself into a failure (CI admission is C2b).
+  run_ts scripts/check-herdr-sandbox.ts
+}
+
+check_herdr_supply() {
+  # Deterministic supply-authority gate for #116 C2b: WHICH herdr bytes CI runs, and who
+  # decides. No herdr binary and no network — it reads scripts/fixtures/herdr-supply.json,
+  # scripts/install-herdr-ci.sh and .github/workflows/ci.yml as text. Pins the manifest as the
+  # only copy of version/tag/digest, the digest shape, the fail-closed architecture map, the
+  # verify-before-chmod order, the absence of curl-pipe/latest/package-manager/global install,
+  # the absence of a `gh attestation verify` dependency (measured: gh 2.97.0 cannot close
+  # herdr's in-toto release predicate), the CI install-before-floor order with
+  # ENTWURF_REQUIRE_HERDR=1, Linux-job-only wiring, that no product script or bin reaches the
+  # installer (Hard Rule 17), and that the x86_64 asset stays recorded as never executed.
+  run_ts scripts/check-herdr-supply.ts
+}
+
+check_fresh_call_dispatch() {
+  # Deterministic gate for #116 C3: the seam ABOVE the two rails. Pins that the rail is a
+  # capability fact (exactly HERDR_ENV=1) and never a caller parameter, that neither direction
+  # falls back, that a non-pilot backend refuses inside herdr before any preflight or mutation,
+  # that the Codex preflight keeps its pre-existing ordering on the tmux path only, that one
+  # nonce per call reaches the selected rail, that BOTH public surfaces reach one composition
+  # root (no second copy of rail choice, preflight ordering or rendering), that pi still uses
+  # its lazy dynamic import, and that herdr rendering shows view-not-address plus which recovery
+  # happened. No tmux and no herdr binary: the seam runs with an injected spawn.
+  run_ts scripts/check-fresh-call-dispatch.ts
+}
+
+smoke_herdr_fresh_call_live() {
+  # LIVE acceptance for the #116 herdr rail: a REAL caller that is itself inside a herdr pane
+  # invokes the REAL PUBLIC entwurf_fresh_call, and a REAL child's first model action is the
+  # nonce callback. Opt-in (LIVE=1), four model turns, one private herdr server PER CELL —
+  # herdr's socket follows XDG_CONFIG_HOME and each cell is fenced into its own.
+  # `[측정 2026-09-14]` BOTH runtimes keep the operator's REAL HOME and real auth roots: a pi
+  # given a fixture HOME dies before readiness (an installed extension resolves its npm
+  # dependency through $HOME) and a claude given one enters first-run onboarding. Only
+  # Entwurf-OWNED writes are fenced into the fixture (XDG roots, the meta roots, the v2 lock
+  # dir). Evidence is source receipts only, in two named grades: pi from its own vendor
+  # transcript, claude from the runtime's own entwurf-bridge MCP activity log joined by exact
+  # sessionId plus entwurf's mailbox artifact and hook journal — never screen text, never a
+  # keystroke. The operator's herdr panes are snapshotted before and after.
+  run_ts scripts/smoke-herdr-fresh-call-live.ts
+}
+
 check_entwurf_peers_surface() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4c; #50 C4
   # re-author): the MCP entwurf_peers RENDER/PAYLOAD layer renderEntwurfPeers.
@@ -2820,6 +2959,70 @@ check_acp_sdk_surface() {
   run_vitest test/acp-sdk-surface.contract.test.ts
 }
 
+check_tests_beside_behavior() {
+  # The DISCOVERY door (issue #119 V2). A `.test.ts` beside a pi extension or a
+  # `.test.mjs` beside the herdr plugin lib is run by public `pnpm check` without
+  # anyone adding its filename anywhere. That is the whole contract: the other two
+  # vitest shims list their files, and a door that also listed files would shut
+  # again the first time someone forgot.
+  #
+  # The globs are EXPANDED here, not handed to vitest as positional filters. The first
+  # cut passed `pi-extensions plugins/herdr` as positionals, and vitest reads a positional
+  # as a path SUBSTRING — so `test/pi-extensions-probe.test.ts` was selected too, which is
+  # the opposite of the two-locations contract this gate exists to hold (measured: that file
+  # ran as "Test Files 1 passed"). Expanding first keeps the selected set exactly the two
+  # globs while the shim still contains no filename: it computes them every run.
+  #
+  # Keeping these globs out of the other two shims stays deliberate — those are mutant gate
+  # argv (mux-fresh-call carries 56), and widening their include would rerun unrelated tests
+  # once per mutant.
+  #
+  # An empty expansion RETURNS rather than calling vitest with no arguments, because a
+  # vitest run with no filter runs the whole include — that is, all of test/**. The honest
+  # steady state is "the door is open and unused", and it must not be spelled as a run.
+  section "tests beside behavior (discovery, not a filename list)"
+  local cfg="$REPO_DIR/vitest.config.ts" glob
+  for glob in 'pi-extensions/**/*.test.ts' 'plugins/herdr/**/*.test.mjs'; do
+    if ! grep -qF "\"$glob\"" "$cfg"; then
+      fail "[check-tests-beside-behavior] vitest.config.ts no longer includes $glob — the discovery door is shut, and an expansion that found nothing would still pass"
+      return 1
+    fi
+  done
+
+  local -a selected=()
+  local f
+  while IFS= read -r f; do
+    [ -n "$f" ] && selected+=("$f")
+  done < <(cd "$REPO_DIR" && {
+    find pi-extensions -name node_modules -prune -o -type f -name '*.test.ts' -print
+    find plugins/herdr -name node_modules -prune -o -type f -name '*.test.mjs' -print
+  } 2>/dev/null | LC_ALL=C sort)
+
+  # Independent of HOW the expansion was produced: every selected path must be under one of
+  # the two declared locations, and none may come from test/. The second clause is the one
+  # that names the defect above, so it is asserted rather than left implied by the first.
+  for f in "${selected[@]}"; do
+    case "$f" in
+      test/*)
+        fail "[check-tests-beside-behavior] selected $f — this gate covers the two behavior-adjacent locations, never test/**"
+        return 1
+        ;;
+      pi-extensions/*.test.ts | plugins/herdr/*.test.mjs) ;;
+      *)
+        fail "[check-tests-beside-behavior] selected $f, which matches neither declared glob"
+        return 1
+        ;;
+    esac
+  done
+
+  if [ "${#selected[@]}" -eq 0 ]; then
+    echo "  the door is open and unused — 0 tests beside behavior at this HEAD"
+    return 0
+  fi
+  echo "  selected ${#selected[@]}: ${selected[*]}"
+  run_vitest "${selected[@]}"
+}
+
 check_acp_overlay() {
   # Deterministic gate for the S2b Claude config overlay materializer. Drives
   # ensureClaudeConfigOverlay against injected temp realDir/overlayDir (no
@@ -3135,6 +3338,10 @@ check_pack() {
     # #65 — the owner-normalized store projection consumers call INSTEAD of
     # parsing the store; installed hosts are exactly where those consumers live.
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
+    # #116 M2-a — the owner-normalized PEER projection, for the same reason one step
+    # out: the placement join it emits is the copy a herdr-side consumer would
+    # otherwise fork, and such a consumer runs against an installed host.
+    "mcp/entwurf-bridge/dist/scripts/peer-facts.js"
     # #87 Bundle B — omp-receive-doctor drives this operator projection through
     # run.sh, so installed node_modules must have the compiled twin too.
     "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
@@ -3219,6 +3426,13 @@ check_pack() {
     # tripwire that fails loud if that negation is ever dropped (결합 규칙).
     '__pycache__'
     '\.pyc$'
+    # Tests written beside behavior (#119 V2) are a dev surface, and `pi-extensions/`
+    # ships WHOLE through the files allowlist, so the `!pi-extensions/**/*.test.ts`
+    # negation is the only thing keeping them out — same 결합 규칙 as __pycache__ above,
+    # this pattern is its tripwire. Written loose rather than anchored under
+    # pi-extensions/ so it also covers any future allowlist entry; `plugins/` needs no
+    # companion negation because `^plugins/` above already refuses that whole tree.
+    '\.test\.[cm]?[jt]s$'
   )
 
   local pass=1 f pat hit
@@ -3430,6 +3644,8 @@ _check_pack_install_impl() {
     "mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js"
     # #65 — the owner-normalized store projection (see check-pack).
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
+    # #116 M2-a — the owner-normalized peer projection (see check-pack).
+    "mcp/entwurf-bridge/dist/scripts/peer-facts.js"
     # #87 Bundle B — omp-receive-doctor reaches this through the installed dispatcher.
     "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
@@ -3617,6 +3833,60 @@ _check_pack_install_impl() {
   }
   echo "[check-pack-install] installed: $probe"
 
+  # #116 M3-b1/b2 — THE ACTUAL-PACKAGE RUNTIME PROOF, THROUGH THE SHIPPED OWNER.
+  # The Herdr plugin's runtime verifier decides whether a tree npm placed is a runtime the scoped
+  # wiring may name: exact name@version, the compiled entry, all three required bins present AND
+  # executable, and a real `entwurf check-bridge`. Its own focused gate drives that verifier against
+  # a FIXTURE package, which proves the transaction but not this package — so the real artifact is
+  # verified HERE, against the tarball this gate already packed and installed. No second pack, no
+  # network.
+  #
+  # It imports from the INSTALLED tree's own scripts/herdr-runtime.mjs, not from the checkout. That
+  # is the point: Herdr's `plugin uninstall` deletes the plugin checkout and calls no cleanup hook,
+  # so the code that retires a runtime has to be IN the package. Reaching into $REPO_DIR here would
+  # prove the checkout works and say nothing about what a clean host receives.
+  local runtime_proof
+  runtime_proof=$(cd "$tmp" && node --input-type=module -e "
+    const pkg = process.cwd() + '/node_modules/@junghanacs/entwurf';
+    const { verifyInstalledRuntime, readCheckoutPackageSpec, REQUIRED_BINS } =
+      await import(pkg + '/scripts/herdr-runtime.mjs');
+    const spec = readCheckoutPackageSpec(pkg);
+    const seen = verifyInstalledRuntime(process.cwd(), spec);
+    console.log(seen.name + '@' + seen.version + ' verified through the SHIPPED owner (' + REQUIRED_BINS.join(', ') + ')');
+  " 2>&1) || {
+    fail "[check-pack-install] #116 runtime verifier REFUSED the actual installed package (or does not ship):"
+    echo "$runtime_proof" | sed 's/^/    /' >&2
+    return 1
+  }
+  echo "[check-pack-install] herdr-plugin runtime verifier: $runtime_proof"
+
+  # #116 M3-b2 — THE DEACTIVATE VERB MUST ACTUALLY TEAR DOWN, WITH NO CHECKOUT. Herdr's `plugin
+  # uninstall` deletes the plugin checkout and calls no cleanup hook, so the teardown entry has to
+  # be IN the package AND has to survive deleting the runtime it is executing from. So this does not
+  # settle for the "nothing to undo" verdict: it stages the real shape — the installed package
+  # sitting AT the stable active root, a certified runtime journal, and a certified activation
+  # ledger whose components are already removed — then runs THAT copy's own entry with a throwaway
+  # HOME/XDG and no reference to this repo. What it proves is the self-delete: the process removes
+  # the tree it is executing from and still finishes retiring the ledger.
+  local deact_home deact_active deact_pkg deact_proof deact_rc runtime_left ledger_left
+  deact_home=$(mktemp -d -t entwurf-deact.XXXXXX)
+  deact_active="$deact_home/.data/entwurf/herdr-plugin/runtime/active"
+  mkdir -p "$deact_active" "$deact_home/.state/entwurf/herdr-plugin"
+  cp -R "$tmp/node_modules" "$deact_active/node_modules"
+  deact_pkg="$deact_active/node_modules/@junghanacs/entwurf"
+  node -e 'const fs=require("fs"),path=require("path");const [home,active]=process.argv.slice(1);const pkg=path.join(active,"node_modules","@junghanacs","entwurf");const version=JSON.parse(fs.readFileSync(path.join(pkg,"package.json"),"utf8")).version;fs.writeFileSync(path.join(home,".data","entwurf","herdr-plugin","journal.json"),JSON.stringify({schemaVersion:2,phase:"runtime-ready",runtimeRoot:active,artifactIdentity:{kind:"herdr-checkout",repository:"junghan0611/entwurf",commit:"c".repeat(40),packageName:"@junghanacs/entwurf",packageVersion:version,observedDigest:"sha256-"+"a".repeat(64)},previousRuntime:null}));fs.writeFileSync(path.join(home,".state","entwurf","herdr-plugin","activation.json"),JSON.stringify({schemaVersion:2,phase:"deactivating",runtimeRoot:active,artifactIdentity:{kind:"herdr-checkout",repository:"junghan0611/entwurf",commit:"c".repeat(40),packageName:"@junghanacs/entwurf",packageVersion:version,observedDigest:"sha256-"+"a".repeat(64)},piAgentDir:{path:path.join(home,".pi","agent"),source:"default"},claudeConfigDir:{path:path.join(home,".claude"),source:"default"},claudeUserConfig:{path:path.join(home,".claude.json"),source:"HOME"},activatedBackends:["pi"],components:[{backend:"pi",state:"removed"}]}));' "$deact_home" "$deact_active"
+  deact_proof=$(env -i PATH="$PATH" HOME="$deact_home" XDG_DATA_HOME="$deact_home/.data" XDG_STATE_HOME="$deact_home/.state" XDG_CACHE_HOME="$deact_home/.cache" node "$deact_pkg/scripts/herdr-plugin-deactivate.mjs" 2>&1)
+  deact_rc=$?
+  runtime_left=$([ -e "$deact_home/.data/entwurf/herdr-plugin/runtime" ] && echo yes || echo no)
+  ledger_left=$([ -e "$deact_home/.state/entwurf/herdr-plugin/activation.json" ] && echo yes || echo no)
+  rm -rf "$deact_home"
+  if [ "$deact_rc" -ne 0 ] || [ "$runtime_left" != "no" ] || [ "$ledger_left" != "no" ]; then
+    fail "[check-pack-install] #116 M3-b2 installed herdr-plugin-deactivate did not complete the self-delete (rc=$deact_rc runtime-left=$runtime_left ledger-left=$ledger_left):"
+    echo "$deact_proof" | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed herdr-plugin-deactivate removed its OWN runtime and retired the ledger with no checkout: $deact_proof"
+
   # Pi package loader smoke — actual `pi` reads the manifest and
   # registers the provider. rc=0 + the curated model list in the
   # output means pi accepted the package as a real extension, not
@@ -6090,6 +6360,9 @@ case "$cmd" in
   check-copilot-launch)
     check_copilot_launch
     ;;
+  check-pi-launch)
+    check_pi_launch
+    ;;
   check-copilot-receive-arm)
     check_copilot_receive_arm
     ;;
@@ -6105,33 +6378,12 @@ case "$cmd" in
   check-entwurf-v2-contract)
     check_entwurf_v2_contract
     ;;
-  check-entwurf-v2-lock)
-    check_entwurf_v2_lock
-    ;;
-  check-entwurf-v2-decider)
-    check_entwurf_v2_decider
-    ;;
-  check-entwurf-v2-matrix)
-    check_entwurf_v2_matrix
-    ;;
-  check-entwurf-v2-release)
-    check_entwurf_v2_release
-    ;;
   check-entwurf-v2-send)
     check_entwurf_v2_send
     ;;
-  check-entwurf-v2-send-fallback)
-    check_entwurf_v2_send_fallback
-    ;;
-  check-entwurf-v2-mailbox)
-    check_entwurf_v2_mailbox
-    ;;
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
-  check-entwurf-v2-runner)
-    check_entwurf_v2_runner
-    ;;
   check-entwurf-control-rpc)
     check_entwurf_control_rpc
     ;;
@@ -6177,6 +6429,9 @@ case "$cmd" in
   check-mux-launcher-fence)
     check_mux_launcher_fence
     ;;
+  check-typing-call-fence)
+    check_typing_call_fence
+    ;;
   check-entwurf-v2-visible-resume)
     check_entwurf_v2_visible_resume
     ;;
@@ -6249,24 +6504,71 @@ case "$cmd" in
   smoke-acp-socket-citizen-live)
     smoke_acp_socket_citizen_live
     ;;
-  check-entwurf-facts)
-    check_entwurf_facts
-    ;;
   check-control-socket-path)
     check_control_socket_path
     ;;
-  check-socket-discovery)
-    check_socket_discovery
-    ;;
   check-meta-listing)
     check_meta_listing
     ;;
   check-meta-facts)
     check_meta_facts
     ;;
+  check-herdr-activation)
+    check_herdr_activation
+    ;;
+  check-herdr-runtime-bootstrap)
+    check_herdr_runtime_bootstrap
+    ;;
+  check-herdr-plugin-profile)
+    check_herdr_plugin_profile
+    ;;
+  check-herdr-plugin-build)
+    check_herdr_plugin_build
+    ;;
+  smoke-herdr-plugin-build-live)
+    smoke_herdr_plugin_build_live
+    ;;
+  smoke-herdr-raw-install-live)
+    # #118 홉 1: the FIRST USER PATH. Every other herdr gate proves the plugin against a
+    # source we control — a stub, or the product remote redirected by git insteadOf to a
+    # local bare clone asserting identity.kind === "herdr-checkout". None has watched the
+    # plugin acquire its runtime from npm on a machine that has never seen this repo, which
+    # is the one axis VERIFY.md:61 leaves open while the production lock says npm. Clean
+    # container, public remote, no mounts, no insteadOf. Its first question is whether
+    # `plugin install --yes` completes with no herdr server; a "no" is #118 investigation
+    # output, not a completion. on-demand LIVE, never an aggregate MUST.
+    # shift is load-bearing: this dispatcher keeps the verb in "$@" and each branch that
+    # forwards arguments drops it for itself. Without it `--ref` arrives behind the gate name.
+    shift
+    (cd "$REPO_DIR" && bash scripts/smoke-herdr-raw-install-live.sh "$@")
+    ;;
+  check-peer-facts)
+    check_peer_facts
+    ;;
+  check-herdr-plugin)
+    check_herdr_plugin
+    ;;
   check-entwurf-fact-provider)
     check_entwurf_fact_provider
     ;;
+  check-herdr-placement)
+    check_herdr_placement
+    ;;
+  check-herdr-fresh-call)
+    check_herdr_fresh_call
+    ;;
+  check-herdr-sandbox)
+    check_herdr_sandbox
+    ;;
+  check-herdr-supply)
+    check_herdr_supply
+    ;;
+  check-fresh-call-dispatch)
+    check_fresh_call_dispatch
+    ;;
+  smoke-herdr-fresh-call-live)
+    smoke_herdr_fresh_call_live
+    ;;
   check-entwurf-peers-surface)
     check_entwurf_peers_surface
     ;;
@@ -6755,6 +7057,54 @@ case "$cmd" in
     shift || true
     exec bash "$REPO_DIR/scripts/copilot-launch.sh" "$@"
     ;;
+  pi)
+    # #118 홉 2: the managed pi launch. Same shape and same reasons as `copilot` above —
+    # `exec`, no subshell and no cd, because this operates on the operator's session; and
+    # `shift`, because this branch forwards straight into the VENDOR argv where a stray
+    # "pi" would arrive as a prompt argument.
+    #
+    # NO separate launcher script, and no precondition check, because the precondition is
+    # ZERO and that was measured rather than assumed: on a host where entwurf's pi extension
+    # is not registered, `pi --entwurf-control` already fails as
+    # `Error: Unknown option: --entwurf-control` with exit 1. A pre-check here would only
+    # duplicate a refusal pi owns and would go stale the day pi renames it.
+    #
+    # ONE recursion fence, not copilot's two, and the difference is measured. The sentinel
+    # closes the only real loop: a PATH executable named `pi` that shells back to
+    # `entwurf pi` re-enters this branch, and finds the flag already exported. Copilot's
+    # second fence — resolving the binary and refusing our own entrypoints — closes a case
+    # that is not a loop here: a PATH `pi` symlinked to run.sh would be exec'd as
+    # `run.sh --entwurf-control …`, which is an unknown verb this dispatcher already
+    # refuses. `type -P` is what keeps the operator's own shell wrappers out of it
+    # entirely: it returns a PATH file only, never a function or alias, so a
+    # `pi() { entwurf pi "$@"; }` in a profile can never be re-entered through it.
+    #
+    # The flag is added, never deduplicated: `pit`/`pius`-style wrappers already pass
+    # `--entwurf-control`, and passing it twice was measured to be byte-identical to
+    # passing it once. An argv scan would be code earning nothing.
+    #
+    # Nothing else is injected. `--emacs-agent-socket` and friends are operator taste, and
+    # a launcher that decides them stops being a spelling (Hard Rule 9).
+    shift || true
+    if [ -n "${ENTWURF_PI_LAUNCH_ACTIVE:-}" ]; then
+      echo "entwurf: recursive managed launch detected (ENTWURF_PI_LAUNCH_ACTIVE is already set)." >&2
+      echo "         Something on PATH named 'pi' resolves back to this launcher. Fix PATH so 'pi'" >&2
+      echo "         is the pi coding agent, or run the vendor binary by its full path." >&2
+      exit 1
+    fi
+    entwurf_pi_bin="$(type -P pi 2>/dev/null || true)"
+    if [ -z "$entwurf_pi_bin" ]; then
+      echo "entwurf: no 'pi' executable found on PATH." >&2
+      echo "         'entwurf pi' launches the pi coding agent; it does not install one." >&2
+      exit 1
+    fi
+    if [ ! -f "$entwurf_pi_bin" ] || [ ! -x "$entwurf_pi_bin" ]; then
+      echo "entwurf: '$entwurf_pi_bin' is not an executable regular file — refusing to exec it." >&2
+      exit 1
+    fi
+    export ENTWURF_PI_LAUNCH_ACTIVE=1
+    exec "$entwurf_pi_bin" --entwurf-control "$@"
+    ;;
   install-copilot-receive)
     # #82 RAIL 5: install the RECEIVER extension into the Copilot USER extensions dir.
     # Artifact ownership only — it sets no launch flag (`run.sh copilot` owns one
@@ -6926,6 +7276,22 @@ case "$cmd" in
     shift || true
     run_ts scripts/meta-facts.ts "$@"
     ;;
+  peer-facts)
+    # #116 M2-a READ-ONLY projection of the OBSERVED peer listing: one provider
+    # (`listEntwurfFacts`) through one renderer (`renderEntwurfPeers().payload`), so
+    # the payload SHAPE is the entwurf_peers payload shape and the join is never
+    # re-implemented — the pi half of that join is a measured vendor floor, and a
+    # forked copy decays silently. It is NOT the same bytes as an entwurf_peers call:
+    # that surface rations observation and returns text, this one is unbounded because
+    # a rationed row says `unobserved` and a machine consumer cannot tell that from
+    # "nobody could look". `placement` stays the structured tagged union. No socket
+    # coordinate is published (#50 C4 retired the legacy listing with the controlDir it
+    # exposed; ENTWURF_DIR only selects what is probed) and herdr's own
+    # agent_status/screen verdicts are absent (docs/herdr-launch-rail.md §9). No
+    # writes, no watcher, no dispatch. Same exit contract as meta-facts.
+    shift || true
+    run_ts scripts/peer-facts.ts "$@"
+    ;;
   meta-bridge-managed-keys)
     # 0.10.0 meta-bridge: emit the SSOT of settings.json/~/.claude.json keys that
     # entwurf's install OWNS. Consumers (agent-config fragment, future
@@ -6976,6 +7342,9 @@ case "$cmd" in
   check-acp-sdk-surface)
     check_acp_sdk_surface
     ;;
+  check-tests-beside-behavior)
+    check_tests_beside_behavior
+    ;;
   check-acp-overlay)
     check_acp_overlay
     ;;
@@ -7084,6 +7453,21 @@ case "$cmd" in
   remove)
     remove_local_package "$TARGET_PROJECT_DIR"
     ;;
+  herdr-plugin-activate)
+    # #116 M3-b2 public forward verb. Takes a subset of {pi, claude-code} and NOTHING else — the
+    # stable runtime root is derived, never supplied. Plain `node` in both modes: shipped .mjs.
+    shift
+    (cd "$REPO_DIR" && node "$REPO_DIR/scripts/herdr-plugin-activate.mjs" "$@")
+    ;;
+  herdr-plugin-deactivate)
+    # #116 M3-b2 public verb. Plain `node` in BOTH modes on purpose: this is shipped .mjs, not TS,
+    # because it has to run from an installed package after Herdr deleted the plugin checkout.
+    (cd "$REPO_DIR" && node "$REPO_DIR/scripts/herdr-plugin-deactivate.mjs" "$@")
+    ;;
+  install-user-scope)
+    shift
+    install_user_scope "$@"
+    ;;
   remove-user-scope)
     remove_user_scope_citizen
     ;;