@junghanacs/entwurf 0.23.0 → 0.23.1

package/pi-extensions/lib/acp/event-mapper.ts

@@ -60,8 +60,8 @@ export type AcpPiStreamState = {
 	 *
 	 * Last write wins, never a sum: both are latest session-level observations, and
 	 * one turn can legitimately see several (claude emits one per `result` message,
-	 * including a sub-agent's own — read at claude-agent-acp 0.76.0
-	 * `dist/acp-agent.js:3471-3486`), each carrying that result's current values.
+	 * including a sub-agent's own — read at claude-agent-acp 0.79.0
+	 * `dist/acp-agent.js:3504-3519`), each carrying that result's current values.
 	 */
 	observedSessionCostUsd?: number;
 	observedContextOccupancyTokens?: number;
@@ -346,9 +346,9 @@ export function applyAcpSessionUpdate(
 		case "usage_update": {
 			// `used` is OCCUPANCY-shaped — the backend's post-turn context size, not
 			// the prompt response's turn aggregate. Claude sends `lastAssistantTotalUsage`
-			// as `used` (read at claude-agent-acp 0.76.0
-			// `dist/acp-agent.js:3871-3882`), after constructing that scalar from the
-			// latest assistant snapshot (`:3853-3866`). pi reads `usage.totalTokens` as
+			// as `used` (read at claude-agent-acp 0.79.0
+			// `dist/acp-agent.js:3934-3945`), after constructing that scalar from the
+			// latest assistant snapshot (`:3916-3929`). pi reads `usage.totalTokens` as
 			// exactly that occupancy (`calculateContextTokens(usage) = usage.totalTokens
 			// || input + output + cacheRead + cacheWrite`, read at pi-coding-agent
 			// `dist/core/compaction/compaction.js:86-88`). The assignment below is the

package/pi-extensions/lib/acp/tool-surface.ts

@@ -154,7 +154,8 @@ export function buildClaudeSessionMeta(
 		// claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
 		// JSON.parse for that form moved out of `resolvedProvider` up onto the
 		// unconditional `session/new` path — a shape that WOULD reach us, and does not,
-		// only because we never hand it a path. Keep it inline: a path would put file
+		// only because we never hand it a path. Still on that path at 0.79.0
+		// (`dist/acp-agent.js:6010-6012`). Keep it inline: a path would put file
 		// IO, and its failure modes, inside every session creation.
 		settings: {
 			permissions: {

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -111,7 +111,7 @@ export type DispatchLiveness = (typeof DISPATCH_LIVENESSES)[number];
 // unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
 // THIS set is a deliberate future decision, gated by a real compatible
 // control-socket predicate — never by silently mapping sessions to dead/indeterminate
-// (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
+// (R1 핵심). pi-extensions/lib/entwurf-facts.test.ts pins this == ["pi"] and asserts the native-push
 // domain is disjoint from it.
 export const LIVENESS_DOMAIN_BACKENDS = ["pi"] as const;
 export type LivenessDomainBackend = (typeof LIVENESS_DOMAIN_BACKENDS)[number];
@@ -125,7 +125,7 @@ export function isLivenessSupported(backend: string): boolean {
 // live vendor app-server target probe), NOT a control socket. This domain is DISJOINT
 // from LIVENESS_DOMAIN_BACKENDS: an Antigravity or Codex session is `unsupported` on
 // the socket FACT axis (entwurf_peers) yet independently measured on the native-push
-// axis. The two are separate rails on purpose — check-entwurf-facts pins both sets
+// axis. The two are separate rails on purpose — pi-extensions/lib/entwurf-facts.test.ts pins both sets
 // and asserts their intersection is ∅ (a backend can never be in both domains).
 export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"] as const;
 export type NativePushBackend = (typeof NATIVE_PUSH_BACKENDS)[number];

package/pi-extensions/lib/entwurf-v2-lock.ts

@@ -82,7 +82,7 @@ export const LOCK_SUFFIX = ".lock";
 export const LOCK_OWNER = "entwurf_v2" as const;
 
 /** The reject reason a lock conflict maps to. Kept as a literal here (the lock
- * primitive stays decoupled from the full contract); `check-entwurf-v2-lock`
+ * primitive stays decoupled from the full contract); `pi-extensions/lib/entwurf-v2-lock.test.ts`
  * cross-checks it against the contract's ENTWURF_V2_REJECT_REASONS so the two
  * cannot drift. */
 export const LOCK_CONFLICT_REASON = "target-locked" as const;

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -201,7 +201,7 @@ export async function executeDispatch(
 /**
  * 5d-2a: the deps `runEntwurfV2` joins. `decide` is the WHOLE decider as ONE injected
  * function — NOT `DispatchDeciderDeps`. The runner does not re-validate the 5b decider
- * logic (that is `check-entwurf-v2-decider`'s job); it proves only the decide→execute
+ * logic (that is `pi-extensions/lib/entwurf-v2-decider.test.ts`'s job); it proves only the decide→execute
  * COMPOSITION contract over a fake `decide`. Production wraps the real decider as
  * `decide: (input) => decideDispatch(input, productionDeciderDeps)` (assembled in 5d-2b),
  * so the runner stays gate-provable without any decider IO seam leaking in.

package/run.sh

@@ -158,29 +158,17 @@ Usage:
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
   ./run.sh check-entwurf-v2-contract   # FROZEN entwurf_v2 contract — control-socket liveness domain is currently pi; self-fetch/native-push citizens are out of that domain, not globally unsupported; pure, no IO
-  ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
-  ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
-  ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/native-push + bad-target/conflict/locked/undeliverable/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
-  ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — the spawn-observation policy and its four release events went with the transport in the visible-first cut, so the shipped machine is meta-mailbox=never release (no lock) + control-socket=release once on send-final; decideReleasePolicy still enforces the lock-nullness invariant; pure, no IO
-  ./run.sh check-entwurf-v2-send       # deterministic gate (0.11 Stage 0 step 5c-2a): control-socket SEND hand (executeControlSocketSend) wiring transport IO onto the 5c-1 reducer — ack→sent, in-band reject→rejected (no fallback), dead→same-lock one-shot re-resolve (control retry / mailbox enqueue), indeterminate→failed+rethrow with NO fallback (no double-delivery); release exactly once, releaseLock throw never masks the send error; IO-via-dep
   ./run.sh check-compaction-send-guard # deterministic gate (#111): control-socket send during Pi compaction — event-armed refuse compacting, quiet unknown non-idle refuse busy (ctx.signal is not isStreaming); no pi.sendMessage, no delivered:true; idle/live-run steer/followUp preserved; pure, no IO
-  ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (nothing is ever launched), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
-  ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/mailbox→matching hand with decision.lock verbatim / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
-  ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
-  ./run.sh check-entwurf-resume-args   # deterministic gate: resume-argv SSOT (buildResumePiArgs) for the S1 VISIBLE resume. The headless shape was measured wrong for a window before the consumer was written (`-p` is pi's own non-interactive mode), so the one shipped posture is `--entwurf-control` FIRST + ext args exactly once + `--session <abs file>` + optional `--provider` + `--model <m>` — and the gate pins the ABSENCES as hard as the presences: no --mode, no -p, no positional prompt (a resume runs no turn), no --no-extensions, never --session-id (which MINTS a session instead of resuming one)
   ./run.sh check-mux-resume-call       # deterministic gate: S1 resume PLACEMENT composition (mux-resume-call.ts). No fake tmux. cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while being wrong: a nonexistent `-c` exits 0 and lands the child in $HOME (so it is refused HERE), `-c` is FORMAT-EXPANDED so `#{…}` silently rewrites the path and `#(…)` was observed running a command (so `#` is refused), and whitespace measured SAFE (so no escaping layer is owed). Also pins `-c` reaching tmux, runtime after `--`, carrier-free argv, zero identity in this module, and the surface seam that keeps the v2 composition from importing mux
   ./run.sh check-mux-parent-artifact  # deterministic gate for the tracked scrubbed parent-transcript fixture — a version-pinned sample of the PARENT-SIDE shape (fresh_call toolResult + the later callback custom_message) so downstream never opens a private transcript. Pins event order, the toolCallId join on the RESULT (pi writes no separate toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info> envelope field names, and the absence of operator paths / real garden ids / real uuids. NOT placement evidence
   ./run.sh check-mux-launcher-fence   # deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes
   ./run.sh check-typing-call-fence    # deterministic gate for the boundary nobody has broken: this product composes ARGUMENTS and LETTERS, never keystrokes. Scans every tracked production source under pi-extensions/ and mcp/ — comments blanked, string literals kept — for tmux send-keys/paste-buffer/load-buffer and herdr's PTY verbs (agent.prompt, agent.send_keys, pane.send_text, pane.input.set). Prose is exempt on purpose: the sentence stating the rule names the very calls it forbids, and a scanner that read prose could be made green by deleting the law. Carries its own oracle — the detector is proven on planted code, proven blind to comments, and the scanned inventory is measured
-  ./run.sh check-entwurf-v2-visible-resume # deterministic gate: S1 visible-resume COMPOSITION (entwurf-v2-visible-resume.ts) with every seam injected — the whole state machine incl. the timeout branch runs with no tmux/lock/socket/clock. Pins lock BEFORE liveness, identity under the lock and before any window (no-transcript citizen fails loud, opens nothing), live/indeterminate/address-conflict refused unlaunched, observation as a BOUNDED WAIT (measured: socket answers ~2–4s after launch, so one immediate probe would call a successful resume unobserved), exactly ONE launch on every path, timeout → lock released + window left open + nothing retried/killed, failed release throws, and the two receipts staying separate in type and text
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
   ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
-  ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
-  ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one peer-facts + one agent list per open (counted, not claimed), skip-by-name when Entwurf is absent, four distinct named refusals instead of an empty table, ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
   ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
@@ -1095,6 +1083,14 @@ check_copilot_launch() {
   run_ts scripts/check-copilot-launch.ts
 }
 
+check_pi_launch() {
+  # #118 홉 2. Same oracle as check-copilot-launch and for the same reason: the subject is
+  # a process replacement, so a fake vendor named `pi` on a sandbox PATH reports the argv,
+  # env and pid it was handed — never a reading of the launcher's source. Also carries the
+  # --entwurf-control literal cross-check, because the shell cannot import the TS constant.
+  run_ts scripts/check-pi-launch.ts
+}
+
 check_codex_app_server_launch() {
   # #95: the managed app-server SPELLING, proved against a fake vendor. There is no second
   # spelling of the address to compare any more — the launcher asks `codex-socket-path` — so
@@ -1185,123 +1181,28 @@ check_entwurf_v2_contract() {
   run_ts scripts/check-entwurf-v2-contract.ts
 }
 
-check_entwurf_v2_lock() {
-  # Deterministic gate for 0.11 Stage 0 step 5a (버킷 B F2): the per-gid dispatch
-  # LOCK primitive — what serializes concurrent in-domain dispatch at one
-  # target (pi self-guards CREATE but not RESUME, 검증원장 F2). acquire =
-  # openSync(lockPath,"wx") atomic; a second acquire without release =
-  # target-locked conflict carrying the holder JSON (F2-P2 human cleanup). release
-  # = unlink ONLY when the on-disk nonce is still ours (a successor's re-acquire
-  # survives a late release). Stale reclaim ONLY for same host + ESRCH; EPERM
-  # (other user's live pid) / different host / alive pid / unknown error all
-  # fail-closed to conflict. Empty/corrupt lockfile = conflict, never
-  # auto-deleted. F2-P1: a malformed gid throws before any path is built. Real
-  # temp dir (wx atomicity under test); clock/nonce/pid/host/kill injected.
-  run_ts scripts/check-entwurf-v2-lock.ts
-}
-
-check_entwurf_v2_decider() {
-  # Deterministic gate for 0.11 Stage 0 step 5b: the PURE dispatch decider
-  # decideDispatch. Drives the frozen 7-step order over INJECTED fakes (target
-  # lookup / lock / socket inspect+probe / preflight / capability), tracking lock
-  # acquire+release so "reject ⇒ no plan AND no lock retained" is PROVEN. Covers:
-  # bad-target/target-locked/target-address-conflict carry observedLiveness=null
-  # (pre-probe), every other reject carries a measured value; a control-socket send
-  # executes KEEPING the lock, meta-mailbox send takes NO lock (？7); an invalid gid throws before
-  # any lookup (F2-P1). Pure, no IO, no API.
-  run_ts scripts/check-entwurf-v2-decider.ts
-}
-
-check_entwurf_v2_matrix() {
-  # Deterministic gate for 0.11 Stage 0 step 5d-5 (a): the REACHABILITY + LOCK SSOT
-  # TABLE. Drives the REAL decideDispatch over minimal injected fakes and fixes, as
-  # one readable table, every (target kind → transport → lock class) cell the 5d-5
-  # claim covers: bad-target/address-conflict/target-locked rejects, unsupported
-  # meta-mailbox (deliverable) vs mailbox-undeliverable (inactive) reject,
-  # in-domain control-socket (live) / released rejects
-  # (ff-dormant, indeterminate, under-lock conflict). A coverage pass
-  # FAILS if any transport / lock class / pre-probe reject is missing — a dropped
-  # decider cell cannot pass silently. Thin coverage, NOT a decider re-impl; surface
-  # parity stays in check-entwurf-v2-surface. Pure, no IO, no API.
-  run_ts scripts/check-entwurf-v2-matrix.ts
-}
-
-check_entwurf_v2_release() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-1: the PURE release-policy reducer
-  # (decideReleasePolicy + reduceRelease) for the 5c transport hand. Proves the
-  # Fable-3 "release-after-observation" timing as a pure state machine BEFORE any
-  # send IO: meta-mailbox=never release (no lock), control-socket=release once
-  # on send-final. The spawn-observation policy and its four release events went with
-  # the transport in the visible-first cut; decideReleasePolicy still enforces the
-  # lock-nullness invariant (？7). Pure, no IO.
-  run_ts scripts/check-entwurf-v2-release.ts
-}
-
 check_entwurf_v2_send() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-2a: the control-socket SEND hand
-  # (executeControlSocketSend) that WIRES real transport IO onto the 5c-1 release
-  # reducer. Proves the send->outcome->release ordering over injected fakes (no socket):
-  # ack->sent / in-band reject->rejected (no fallback) / dead->same-lock one-shot
-  # re-resolve (control retry or mailbox enqueue)->fallback-sent|rejected|failed /
-  # indeterminate->failed+rethrow with deadFallback+mailbox NEVER called (no
-  # double-delivery on an alive-but-stalled socket). Release fires exactly once per
-  # send-final; a releaseLock throw never masks the send failure (5b). IO-via-dep.
-  run_ts scripts/check-entwurf-v2-send.ts
-}
-
-check_entwurf_v2_send_fallback() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-2b: the same-lock re-resolve RESOLVER
-  # (resolveDeadControlSendFallback) the 5c-2a hand calls on a dead connect. Proves the
-  # fire-and-forget re-resolve routing over injected fakes (no filesystem): alive->
-  # control-socket retry (inspected socketPath) / dead(absent)->reject (dormant-fire-
-  # forget-unsupported, and nothing is launched) / indeterminate->reject / unsupported+deliverable
-  # ->meta-mailbox plan (mini-table, no inspect/probe) / unsupported+undeliverable->reject
-  # / bad-target + address-conflict->reject pre-probe. Mis-wire (plan/lock gid) fails loud
-  # before IO; inspect/probe throws PROPAGATE (the hand owns failed+release); the resolver
-  # has NO release seam; every execute plan keeps the held gid.
-  run_ts scripts/check-entwurf-v2-send-fallback.ts
-}
-
-check_entwurf_v2_mailbox() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-4 (the LAST 5c transport slice): the
-  # ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + its production
-  # sendViaMailbox adapter (makeProductionSendViaMailbox). Proves the wiring over an
-  # injected fake enqueue (no filesystem): sender present -> formatMetaMailboxBody with
-  # plan.wantsReply threaded (yes/no in body, the deliberate divergence from legacy's
-  # hard-coded false) / sender absent -> raw plan.message / enqueue opts EXACTLY
-  # {gardenId: plan.targetGardenId, body, sessionsDir, mailboxDir} (no re-derivation) /
-  # enqueue throw PROPAGATES (never folded into success:false — a mailbox has no in-band
-  # refuse) / success -> {success:true}. Production adapter resolves {success:true},
-  # consults senderProvider once, and NEVER touches the lock (a poison LockClaim whose
-  # every access throws still resolves). Source guard: the lib code has NO release seam
-  # and NO routing seam (no releaseLock / inspect / probe / resolve) — a lock leak or
-  # re-route is structurally impossible.
-  run_ts scripts/check-entwurf-v2-mailbox.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the V2SEND-INBAND-REJECT-REASON mutant names it as gate argv, and attribution is
+  # read from the JSON test titles `run_vitest` emits (run.sh:104-113). Narrow file filter: a
+  # mutant pointed at the glob shim would re-run every beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "control-socket send hand (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-send.test.ts
 }
 
 check_entwurf_v2_native_push() {
-  # Deterministic gate for 봉인 3/4: the native-push SEND hand (deliverViaNativePush +
-  # makeNativePushSend), the executor half of the native-push rail — where the 1-shot retry
-  # lives (moved out of the adapter leaf). Proves over a fake adapter (no agy/socket): success
-  # first try -> {retried:false}, ONE send over the planted route, ZERO re-probe; fail ->
-  # re-probe alive -> re-send success -> {retried:true}, TWO sends, the 2nd over the RE-
-  # DISCOVERED route; re-send FAIL -> throws (no 3rd attempt); re-probe dead/indeterminate ->
-  # throws (not retried), NO second send. makeNativePushSend resolves the adapter from
-  # plan.backend and IGNORES the lock (lock-free rail).
-  run_ts scripts/check-entwurf-v2-native-push.ts
-}
-
-check_entwurf_v2_runner() {
-  # Deterministic gate for 0.11 Stage 0 step 5d-1: the execute-router (executeDispatch) that
-  # routes an already-decided DispatchDecision to its 5c transport hand and maps the outcome
-  # to one outcome-rich EntwurfV2RunResult. Proves over injected fake hands (no socket/spawn/
-  # timer): reject -> rejected (receipt+diagnostic carried, NO hand called) / control-socket ->
-  # sendControl(plan, lock) / meta-mailbox -> sendMailbox(plan, NULL
-  # lock, ？7). Carry-overs: N3 control `rejected` carries rejectReason verbatim; N1
-  # SendDeliveredReleaseFailedError -> execution-failed{finalizedOutcome, releaseFailed,
-  # retrySafe:false}; a plain hand throw -> execution-failed{retrySafe:false} with no
-  # finalizedOutcome. Exactly one hand runs per execute.
-  run_ts scripts/check-entwurf-v2-runner.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the NATIVE-PUSH-RETRY-BYTE-IDENTITY mutant names it as gate argv, and attribution
+  # is read from the JSON test titles `run_vitest` emits (run.sh:104-113). Narrow file filter:
+  # a mutant pointed at the glob shim would re-run every beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "native-push send hand (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-native-push.test.ts
 }
 
 check_entwurf_v2_surface() {
@@ -1368,15 +1269,22 @@ check_compaction_send_guard() {
 }
 
 check_entwurf_resume_args() {
-  # Deterministic gate for the resume-argv SSOT (buildResumePiArgs). S1 replaced the headless
-  # shape with the VISIBLE one, measured against the runtime before the consumer was written:
-  # `-p` is pi's own non-interactive mode, so the old `--mode json -p … <prompt>` prefix would
-  # put a JSON stream in the operator's window instead of a session they can use. Pins the one
-  # shipped posture — `--entwurf-control` FIRST (the resumed session stands its socket up), no
-  # --mode/-p/positional prompt (a resume runs no turn), explicitExtensionArgs exactly once
-  # between the control flag and --session (#29 provider-resolution footgun), --session <abs
-  # file> never --session-id (which MINTS), and a null provider emitting no --provider.
-  run_ts scripts/check-entwurf-resume-args.ts
+  # NOT a discovery path — the test is found by check-tests-beside-behavior like every other
+  # beside-behaviour lane. This case exists as the MUTANT EXECUTION COORDINATE: the six
+  # resume-args mutants name it as their gate argv, the qualification runner re-invokes that
+  # argv once per mutant, and attribution is read from the JSON test titles `run_vitest` emits
+  # under ENTWURF_MUTATION_VITEST_REPORT (run.sh:104-113). A gate argv that called vitest
+  # directly would skip that reporter and every kill would come back unattributed.
+  #
+  # The file filter is NARROW on purpose. Pointing a mutant at the glob shim would make the
+  # runner re-run every beside-behaviour test once per mutant.
+  #
+  # It stays inside check:contracts even though the discovery door also runs this file, and the
+  # duplicate is deliberate: check-release-gate-outcomes requires every gate a mutant names to
+  # run inside check:full, because a gate reachable ONLY through qualification makes the
+  # 28-minute mutant body the only thing that can notice it going red on a clean tree.
+  section "resume-argv SSOT (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-resume-args.test.ts
 }
 
 check_mux_launcher_fence() {
@@ -1432,16 +1340,16 @@ check_mux_resume_call() {
 }
 
 check_entwurf_v2_visible_resume() {
-  # Deterministic gate for the S1 visible-resume composition (entwurf-v2-visible-resume.ts).
-  # Every seam is injected, so the whole state machine — including the timeout branch — runs
-  # without tmux, a lock file, a socket or a clock. Pins: lock BEFORE liveness, identity under
-  # the lock and before any window (a citizen with no transcript fails loud and opens nothing),
-  # live/indeterminate/address-conflict refused unlaunched, the observation as a BOUNDED WAIT
-  # (measured: the socket answers ~2–4s after launch, so one immediate probe would report a
-  # successful resume as unobserved), exactly one launch on every path, timeout releasing the
-  # lock and leaving the window open, a failed release throwing, and the two receipts staying
-  # separate in both the type and the rendered text.
-  run_ts scripts/check-entwurf-v2-visible-resume.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because SEVENTEEN mutants name it as gate argv, and attribution is read from the JSON test
+  # titles `run_vitest` emits (run.sh:104-113), which is why each of those claims is its own
+  # test title. Narrow file filter: pointing them at the glob shim would re-run every
+  # beside-behaviour test seventeen times. It stays inside check:contracts even though the
+  # discovery door also runs this file — see check-release-gate-outcomes: a gate a mutant names
+  # must be reachable outside qualification.
+  section "visible same-id resume (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-visible-resume.test.ts
 }
 
 check_resume_launch_identity() {
@@ -1788,7 +1696,7 @@ smoke_acp_cortex_live() {
 
 smoke_entwurf_v2_matrix_live() {
   # LIVE sentinel for 0.11 Stage 0 step 5d-5 (D4-b) — kept OUT of `pnpm check`. The deterministic
-  # sibling (check-entwurf-v2-matrix) fixes every (target kind → transport → lock) cell over fakes
+  # sibling (pi-extensions/lib/entwurf-v2-decider.matrix.test.ts) fixes every (target kind → transport → lock) cell over fakes
   # with ZERO IO; this drives the REAL production runEntwurfV2 deps against REAL OS objects on the
   # substrate happy path across 3 cells: C1 control-socket (a real `pi --entwurf-control` resident
   # → control-socket RPC send → lock acquire→release ×1), C2 meta-mailbox deliverable (armed
@@ -1806,18 +1714,6 @@ smoke_entwurf_v2_matrix_live() {
   run_ts scripts/smoke-entwurf-v2-matrix-live.ts
 }
 
-check_entwurf_facts() {
-  # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 1): the PURE
-  # fact core. Locks the PeerFact shape + R1/R3b liveness invariant before any IO
-  # wiring (gate-first). R1: out-of-domain backend (claude-code/codex/antigravity)
-  # → unsupported for EVERY socket input (never coerced to the socket value or
-  # dead). R3b: in-domain pi → alive/dead/indeterminate, null → indeterminate
-  # (no proof ≠ dead). facts-only keyset: identity facts + liveness, NO
-  # verb-routing (resumable/sendable/transport/dispatch/action) and NO
-  # transcriptPath (동결결정 10). Pure, no IO, no API.
-  run_ts scripts/check-entwurf-facts.ts
-}
-
 check_control_socket_path() {
   # Deterministic gate: the control-socket path grammar `<dir>/<gid>.sock` has ONE
   # definition (pi-extensions/lib/control-socket-path.js) instead of one per
@@ -1828,18 +1724,6 @@ check_control_socket_path() {
   run_ts scripts/check-control-socket-path.ts
 }
 
-check_socket_discovery() {
-  # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 3): the
-  # SOCKET-axis wiring scanSocketProbes. Probes the union of (dir sockets) ∪
-  # (every in-domain pi citizen's canonical path) so a dormant citizen with no
-  # socket file reads dead (ENOENT) → resumable, never an unprobed gap (slice 2
-  # throws on that). Three-valued throughout — a stalled socket stays
-  # indeterminate (F3), never folded to dead by an alive-only listing. Dir
-  # hygiene (non-.sock / malformed names ignored), dedup, missing-dir, sort, and
-  # an end-to-end scanSocketProbes→resolveFactList. readdir/probe injected, no IO.
-  run_ts scripts/check-socket-discovery.ts
-}
-
 check_meta_listing() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4a): the
   # meta-store axis listAllMetaIdentities. Explicit-partial: a parse failure or
@@ -3075,6 +2959,70 @@ check_acp_sdk_surface() {
   run_vitest test/acp-sdk-surface.contract.test.ts
 }
 
+check_tests_beside_behavior() {
+  # The DISCOVERY door (issue #119 V2). A `.test.ts` beside a pi extension or a
+  # `.test.mjs` beside the herdr plugin lib is run by public `pnpm check` without
+  # anyone adding its filename anywhere. That is the whole contract: the other two
+  # vitest shims list their files, and a door that also listed files would shut
+  # again the first time someone forgot.
+  #
+  # The globs are EXPANDED here, not handed to vitest as positional filters. The first
+  # cut passed `pi-extensions plugins/herdr` as positionals, and vitest reads a positional
+  # as a path SUBSTRING — so `test/pi-extensions-probe.test.ts` was selected too, which is
+  # the opposite of the two-locations contract this gate exists to hold (measured: that file
+  # ran as "Test Files 1 passed"). Expanding first keeps the selected set exactly the two
+  # globs while the shim still contains no filename: it computes them every run.
+  #
+  # Keeping these globs out of the other two shims stays deliberate — those are mutant gate
+  # argv (mux-fresh-call carries 56), and widening their include would rerun unrelated tests
+  # once per mutant.
+  #
+  # An empty expansion RETURNS rather than calling vitest with no arguments, because a
+  # vitest run with no filter runs the whole include — that is, all of test/**. The honest
+  # steady state is "the door is open and unused", and it must not be spelled as a run.
+  section "tests beside behavior (discovery, not a filename list)"
+  local cfg="$REPO_DIR/vitest.config.ts" glob
+  for glob in 'pi-extensions/**/*.test.ts' 'plugins/herdr/**/*.test.mjs'; do
+    if ! grep -qF "\"$glob\"" "$cfg"; then
+      fail "[check-tests-beside-behavior] vitest.config.ts no longer includes $glob — the discovery door is shut, and an expansion that found nothing would still pass"
+      return 1
+    fi
+  done
+
+  local -a selected=()
+  local f
+  while IFS= read -r f; do
+    [ -n "$f" ] && selected+=("$f")
+  done < <(cd "$REPO_DIR" && {
+    find pi-extensions -name node_modules -prune -o -type f -name '*.test.ts' -print
+    find plugins/herdr -name node_modules -prune -o -type f -name '*.test.mjs' -print
+  } 2>/dev/null | LC_ALL=C sort)
+
+  # Independent of HOW the expansion was produced: every selected path must be under one of
+  # the two declared locations, and none may come from test/. The second clause is the one
+  # that names the defect above, so it is asserted rather than left implied by the first.
+  for f in "${selected[@]}"; do
+    case "$f" in
+      test/*)
+        fail "[check-tests-beside-behavior] selected $f — this gate covers the two behavior-adjacent locations, never test/**"
+        return 1
+        ;;
+      pi-extensions/*.test.ts | plugins/herdr/*.test.mjs) ;;
+      *)
+        fail "[check-tests-beside-behavior] selected $f, which matches neither declared glob"
+        return 1
+        ;;
+    esac
+  done
+
+  if [ "${#selected[@]}" -eq 0 ]; then
+    echo "  the door is open and unused — 0 tests beside behavior at this HEAD"
+    return 0
+  fi
+  echo "  selected ${#selected[@]}: ${selected[*]}"
+  run_vitest "${selected[@]}"
+}
+
 check_acp_overlay() {
   # Deterministic gate for the S2b Claude config overlay materializer. Drives
   # ensureClaudeConfigOverlay against injected temp realDir/overlayDir (no
@@ -3478,6 +3426,13 @@ check_pack() {
     # tripwire that fails loud if that negation is ever dropped (결합 규칙).
     '__pycache__'
     '\.pyc$'
+    # Tests written beside behavior (#119 V2) are a dev surface, and `pi-extensions/`
+    # ships WHOLE through the files allowlist, so the `!pi-extensions/**/*.test.ts`
+    # negation is the only thing keeping them out — same 결합 규칙 as __pycache__ above,
+    # this pattern is its tripwire. Written loose rather than anchored under
+    # pi-extensions/ so it also covers any future allowlist entry; `plugins/` needs no
+    # companion negation because `^plugins/` above already refuses that whole tree.
+    '\.test\.[cm]?[jt]s$'
   )
 
   local pass=1 f pat hit
@@ -6405,6 +6360,9 @@ case "$cmd" in
   check-copilot-launch)
     check_copilot_launch
     ;;
+  check-pi-launch)
+    check_pi_launch
+    ;;
   check-copilot-receive-arm)
     check_copilot_receive_arm
     ;;
@@ -6420,33 +6378,12 @@ case "$cmd" in
   check-entwurf-v2-contract)
     check_entwurf_v2_contract
     ;;
-  check-entwurf-v2-lock)
-    check_entwurf_v2_lock
-    ;;
-  check-entwurf-v2-decider)
-    check_entwurf_v2_decider
-    ;;
-  check-entwurf-v2-matrix)
-    check_entwurf_v2_matrix
-    ;;
-  check-entwurf-v2-release)
-    check_entwurf_v2_release
-    ;;
   check-entwurf-v2-send)
     check_entwurf_v2_send
     ;;
-  check-entwurf-v2-send-fallback)
-    check_entwurf_v2_send_fallback
-    ;;
-  check-entwurf-v2-mailbox)
-    check_entwurf_v2_mailbox
-    ;;
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
-  check-entwurf-v2-runner)
-    check_entwurf_v2_runner
-    ;;
   check-entwurf-control-rpc)
     check_entwurf_control_rpc
     ;;
@@ -6567,15 +6504,9 @@ case "$cmd" in
   smoke-acp-socket-citizen-live)
     smoke_acp_socket_citizen_live
     ;;
-  check-entwurf-facts)
-    check_entwurf_facts
-    ;;
   check-control-socket-path)
     check_control_socket_path
     ;;
-  check-socket-discovery)
-    check_socket_discovery
-    ;;
   check-meta-listing)
     check_meta_listing
     ;;
@@ -6597,6 +6528,20 @@ case "$cmd" in
   smoke-herdr-plugin-build-live)
     smoke_herdr_plugin_build_live
     ;;
+  smoke-herdr-raw-install-live)
+    # #118 홉 1: the FIRST USER PATH. Every other herdr gate proves the plugin against a
+    # source we control — a stub, or the product remote redirected by git insteadOf to a
+    # local bare clone asserting identity.kind === "herdr-checkout". None has watched the
+    # plugin acquire its runtime from npm on a machine that has never seen this repo, which
+    # is the one axis VERIFY.md:61 leaves open while the production lock says npm. Clean
+    # container, public remote, no mounts, no insteadOf. Its first question is whether
+    # `plugin install --yes` completes with no herdr server; a "no" is #118 investigation
+    # output, not a completion. on-demand LIVE, never an aggregate MUST.
+    # shift is load-bearing: this dispatcher keeps the verb in "$@" and each branch that
+    # forwards arguments drops it for itself. Without it `--ref` arrives behind the gate name.
+    shift
+    (cd "$REPO_DIR" && bash scripts/smoke-herdr-raw-install-live.sh "$@")
+    ;;
   check-peer-facts)
     check_peer_facts
     ;;
@@ -7112,6 +7057,54 @@ case "$cmd" in
     shift || true
     exec bash "$REPO_DIR/scripts/copilot-launch.sh" "$@"
     ;;
+  pi)
+    # #118 홉 2: the managed pi launch. Same shape and same reasons as `copilot` above —
+    # `exec`, no subshell and no cd, because this operates on the operator's session; and
+    # `shift`, because this branch forwards straight into the VENDOR argv where a stray
+    # "pi" would arrive as a prompt argument.
+    #
+    # NO separate launcher script, and no precondition check, because the precondition is
+    # ZERO and that was measured rather than assumed: on a host where entwurf's pi extension
+    # is not registered, `pi --entwurf-control` already fails as
+    # `Error: Unknown option: --entwurf-control` with exit 1. A pre-check here would only
+    # duplicate a refusal pi owns and would go stale the day pi renames it.
+    #
+    # ONE recursion fence, not copilot's two, and the difference is measured. The sentinel
+    # closes the only real loop: a PATH executable named `pi` that shells back to
+    # `entwurf pi` re-enters this branch, and finds the flag already exported. Copilot's
+    # second fence — resolving the binary and refusing our own entrypoints — closes a case
+    # that is not a loop here: a PATH `pi` symlinked to run.sh would be exec'd as
+    # `run.sh --entwurf-control …`, which is an unknown verb this dispatcher already
+    # refuses. `type -P` is what keeps the operator's own shell wrappers out of it
+    # entirely: it returns a PATH file only, never a function or alias, so a
+    # `pi() { entwurf pi "$@"; }` in a profile can never be re-entered through it.
+    #
+    # The flag is added, never deduplicated: `pit`/`pius`-style wrappers already pass
+    # `--entwurf-control`, and passing it twice was measured to be byte-identical to
+    # passing it once. An argv scan would be code earning nothing.
+    #
+    # Nothing else is injected. `--emacs-agent-socket` and friends are operator taste, and
+    # a launcher that decides them stops being a spelling (Hard Rule 9).
+    shift || true
+    if [ -n "${ENTWURF_PI_LAUNCH_ACTIVE:-}" ]; then
+      echo "entwurf: recursive managed launch detected (ENTWURF_PI_LAUNCH_ACTIVE is already set)." >&2
+      echo "         Something on PATH named 'pi' resolves back to this launcher. Fix PATH so 'pi'" >&2
+      echo "         is the pi coding agent, or run the vendor binary by its full path." >&2
+      exit 1
+    fi
+    entwurf_pi_bin="$(type -P pi 2>/dev/null || true)"
+    if [ -z "$entwurf_pi_bin" ]; then
+      echo "entwurf: no 'pi' executable found on PATH." >&2
+      echo "         'entwurf pi' launches the pi coding agent; it does not install one." >&2
+      exit 1
+    fi
+    if [ ! -f "$entwurf_pi_bin" ] || [ ! -x "$entwurf_pi_bin" ]; then
+      echo "entwurf: '$entwurf_pi_bin' is not an executable regular file — refusing to exec it." >&2
+      exit 1
+    fi
+    export ENTWURF_PI_LAUNCH_ACTIVE=1
+    exec "$entwurf_pi_bin" --entwurf-control "$@"
+    ;;
   install-copilot-receive)
     # #82 RAIL 5: install the RECEIVER extension into the Copilot USER extensions dir.
     # Artifact ownership only — it sets no launch flag (`run.sh copilot` owns one
@@ -7349,6 +7342,9 @@ case "$cmd" in
   check-acp-sdk-surface)
     check_acp_sdk_surface
     ;;
+  check-tests-beside-behavior)
+    check_tests_beside_behavior
+    ;;
   check-acp-overlay)
     check_acp_overlay
     ;;