@junghanacs/entwurf 0.23.0 → 0.24.0

package/run.sh

@@ -122,7 +122,7 @@ Usage:
   ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
-  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
+  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f/G1h, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2, entwurf_resume_call and entwurf_callback registered/schema + the tools/list surface is EXACTLY the eight shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
   ./run.sh check-model-lock           # deterministic unit test for pi-extensions/model-lock.ts (4-quadrant + edge cases, no API)
   ./run.sh check-shell-quote          # POSIX-safety gate for shellQuote (remote SSH arg quoting in entwurf paths) — source parity + behavior matrix, no SSH
@@ -158,29 +158,17 @@ Usage:
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
   ./run.sh check-entwurf-v2-contract   # FROZEN entwurf_v2 contract — control-socket liveness domain is currently pi; self-fetch/native-push citizens are out of that domain, not globally unsupported; pure, no IO
-  ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
-  ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
-  ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/native-push + bad-target/conflict/locked/undeliverable/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
-  ./run.sh check-entwurf-v2-release    # deterministic gate (0.11 Stage 0 step 5c-1): PURE release-policy reducer (decideReleasePolicy + reduceRelease) — the spawn-observation policy and its four release events went with the transport in the visible-first cut, so the shipped machine is meta-mailbox=never release (no lock) + control-socket=release once on send-final; decideReleasePolicy still enforces the lock-nullness invariant; pure, no IO
-  ./run.sh check-entwurf-v2-send       # deterministic gate (0.11 Stage 0 step 5c-2a): control-socket SEND hand (executeControlSocketSend) wiring transport IO onto the 5c-1 reducer — ack→sent, in-band reject→rejected (no fallback), dead→same-lock one-shot re-resolve (control retry / mailbox enqueue), indeterminate→failed+rethrow with NO fallback (no double-delivery); release exactly once, releaseLock throw never masks the send error; IO-via-dep
   ./run.sh check-compaction-send-guard # deterministic gate (#111): control-socket send during Pi compaction — event-armed refuse compacting, quiet unknown non-idle refuse busy (ctx.signal is not isStreaming); no pi.sendMessage, no delivered:true; idle/live-run steer/followUp preserved; pure, no IO
-  ./run.sh check-entwurf-v2-send-fallback # deterministic gate (0.11 Stage 0 step 5c-2b): same-lock re-resolve RESOLVER (resolveDeadControlSendFallback) — fire-and-forget re-resolve: alive→control retry, dead→reject (nothing is ever launched), indeterminate→reject, unsupported+deliverable→mailbox plan, undeliverable/bad-target/conflict→reject; resolver never releases, mis-wire fails loud, inspect/probe throws propagate; no IO (fakes)
-  ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/mailbox→matching hand with decision.lock verbatim / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
-  ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
-  ./run.sh check-entwurf-resume-args   # deterministic gate: resume-argv SSOT (buildResumePiArgs) for the S1 VISIBLE resume. The headless shape was measured wrong for a window before the consumer was written (`-p` is pi's own non-interactive mode), so the one shipped posture is `--entwurf-control` FIRST + ext args exactly once + `--session <abs file>` + optional `--provider` + `--model <m>` — and the gate pins the ABSENCES as hard as the presences: no --mode, no -p, no positional prompt (a resume runs no turn), no --no-extensions, never --session-id (which MINTS a session instead of resuming one)
   ./run.sh check-mux-resume-call       # deterministic gate: S1 resume PLACEMENT composition (mux-resume-call.ts). No fake tmux. cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while being wrong: a nonexistent `-c` exits 0 and lands the child in $HOME (so it is refused HERE), `-c` is FORMAT-EXPANDED so `#{…}` silently rewrites the path and `#(…)` was observed running a command (so `#` is refused), and whitespace measured SAFE (so no escaping layer is owed). Also pins `-c` reaching tmux, runtime after `--`, carrier-free argv, zero identity in this module, and the surface seam that keeps the v2 composition from importing mux
   ./run.sh check-mux-parent-artifact  # deterministic gate for the tracked scrubbed parent-transcript fixture — a version-pinned sample of the PARENT-SIDE shape (fresh_call toolResult + the later callback custom_message) so downstream never opens a private transcript. Pins event order, the toolCallId join on the RESULT (pi writes no separate toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info> envelope field names, and the absence of operator paths / real garden ids / real uuids. NOT placement evidence
   ./run.sh check-mux-launcher-fence   # deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes
   ./run.sh check-typing-call-fence    # deterministic gate for the boundary nobody has broken: this product composes ARGUMENTS and LETTERS, never keystrokes. Scans every tracked production source under pi-extensions/ and mcp/ — comments blanked, string literals kept — for tmux send-keys/paste-buffer/load-buffer and herdr's PTY verbs (agent.prompt, agent.send_keys, pane.send_text, pane.input.set). Prose is exempt on purpose: the sentence stating the rule names the very calls it forbids, and a scanner that read prose could be made green by deleting the law. Carries its own oracle — the detector is proven on planted code, proven blind to comments, and the scanned inventory is measured
-  ./run.sh check-entwurf-v2-visible-resume # deterministic gate: S1 visible-resume COMPOSITION (entwurf-v2-visible-resume.ts) with every seam injected — the whole state machine incl. the timeout branch runs with no tmux/lock/socket/clock. Pins lock BEFORE liveness, identity under the lock and before any window (no-transcript citizen fails loud, opens nothing), live/indeterminate/address-conflict refused unlaunched, observation as a BOUNDED WAIT (measured: socket answers ~2–4s after launch, so one immediate probe would call a successful resume unobserved), exactly ONE launch on every path, timeout → lock released + window left open + nothing retried/killed, failed release throws, and the two receipts staying separate in type and text
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
   ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
-  ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
-  ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one peer-facts + one agent list per open (counted, not claimed), skip-by-name when Entwurf is absent, four distinct named refusals instead of an empty table, ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
   ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
@@ -288,7 +276,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (a prefix-extended @0.86.0-beta.1 and an off-pin @0.85.1 must leak, @0.86.0 bare or with any measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -721,6 +709,31 @@ install_user_scope() {
     esac
     shift
   done
+  # pi FLOOR — the same closed range `setup` enforces (#119 door symmetry). setup refuses an
+  # out-of-range pi by name before it writes any Pi wiring; this verb is the OTHER door onto the
+  # same registration (herdr plugin activation reaches it through plugins/herdr/lib/build.mjs →
+  # scripts/herdr-plugin-activate.mjs → `run.sh install-user-scope --plugin-runtime …`) and had no
+  # version check at all, so a host pi setup would name as FAIL got its citizen written here in
+  # silence. Both doors now tell the same truth, off the SAME derived range — `pi_supported_range`
+  # reads the package.json devDep pin, so there is one range in the repo and no second parser.
+  #
+  # ABSENT pi is deliberately NOT changed here. This verb is called by an activation that has
+  # already decided pi is one of its backends; inventing a presence verdict at the writer would put
+  # a second detection authority next to setup's. Out-of-range is the asymmetry that was real, and
+  # it is the only one closed. PI_BIN is the same probe seam setup uses (hermetic gates pin it;
+  # production leaves it unset).
+  local pi_bin="${PI_BIN:-pi}" pi_range pi_ver
+  if command -v "$pi_bin" >/dev/null 2>&1; then
+    pi_range=$(pi_supported_range)
+    # Bounded capture, same reason as setup's: a resolvable pi whose --version crashes or prints
+    # garbage must reach the refusal below, never abort through set -e with nothing said.
+    pi_ver="$("$pi_bin" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')" || pi_ver=""
+    if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
+      echo "[install-user-scope] pi: FAIL — detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range; nothing was written. Align pi, then re-run." >&2
+      exit 1
+    fi
+  fi
+
   preflight_v3_store install-user-scope
   section "install-user-scope: the GLOBAL pi citizen only (no project wiring)"
   register_user_scope_citizen "$plugin_runtime"
@@ -1095,6 +1108,14 @@ check_copilot_launch() {
   run_ts scripts/check-copilot-launch.ts
 }
 
+check_pi_launch() {
+  # #118 홉 2. Same oracle as check-copilot-launch and for the same reason: the subject is
+  # a process replacement, so a fake vendor named `pi` on a sandbox PATH reports the argv,
+  # env and pid it was handed — never a reading of the launcher's source. Also carries the
+  # --entwurf-control literal cross-check, because the shell cannot import the TS constant.
+  run_ts scripts/check-pi-launch.ts
+}
+
 check_codex_app_server_launch() {
   # #95: the managed app-server SPELLING, proved against a fake vendor. There is no second
   # spelling of the address to compare any more — the launcher asks `codex-socket-path` — so
@@ -1185,123 +1206,28 @@ check_entwurf_v2_contract() {
   run_ts scripts/check-entwurf-v2-contract.ts
 }
 
-check_entwurf_v2_lock() {
-  # Deterministic gate for 0.11 Stage 0 step 5a (버킷 B F2): the per-gid dispatch
-  # LOCK primitive — what serializes concurrent in-domain dispatch at one
-  # target (pi self-guards CREATE but not RESUME, 검증원장 F2). acquire =
-  # openSync(lockPath,"wx") atomic; a second acquire without release =
-  # target-locked conflict carrying the holder JSON (F2-P2 human cleanup). release
-  # = unlink ONLY when the on-disk nonce is still ours (a successor's re-acquire
-  # survives a late release). Stale reclaim ONLY for same host + ESRCH; EPERM
-  # (other user's live pid) / different host / alive pid / unknown error all
-  # fail-closed to conflict. Empty/corrupt lockfile = conflict, never
-  # auto-deleted. F2-P1: a malformed gid throws before any path is built. Real
-  # temp dir (wx atomicity under test); clock/nonce/pid/host/kill injected.
-  run_ts scripts/check-entwurf-v2-lock.ts
-}
-
-check_entwurf_v2_decider() {
-  # Deterministic gate for 0.11 Stage 0 step 5b: the PURE dispatch decider
-  # decideDispatch. Drives the frozen 7-step order over INJECTED fakes (target
-  # lookup / lock / socket inspect+probe / preflight / capability), tracking lock
-  # acquire+release so "reject ⇒ no plan AND no lock retained" is PROVEN. Covers:
-  # bad-target/target-locked/target-address-conflict carry observedLiveness=null
-  # (pre-probe), every other reject carries a measured value; a control-socket send
-  # executes KEEPING the lock, meta-mailbox send takes NO lock (？7); an invalid gid throws before
-  # any lookup (F2-P1). Pure, no IO, no API.
-  run_ts scripts/check-entwurf-v2-decider.ts
-}
-
-check_entwurf_v2_matrix() {
-  # Deterministic gate for 0.11 Stage 0 step 5d-5 (a): the REACHABILITY + LOCK SSOT
-  # TABLE. Drives the REAL decideDispatch over minimal injected fakes and fixes, as
-  # one readable table, every (target kind → transport → lock class) cell the 5d-5
-  # claim covers: bad-target/address-conflict/target-locked rejects, unsupported
-  # meta-mailbox (deliverable) vs mailbox-undeliverable (inactive) reject,
-  # in-domain control-socket (live) / released rejects
-  # (ff-dormant, indeterminate, under-lock conflict). A coverage pass
-  # FAILS if any transport / lock class / pre-probe reject is missing — a dropped
-  # decider cell cannot pass silently. Thin coverage, NOT a decider re-impl; surface
-  # parity stays in check-entwurf-v2-surface. Pure, no IO, no API.
-  run_ts scripts/check-entwurf-v2-matrix.ts
-}
-
-check_entwurf_v2_release() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-1: the PURE release-policy reducer
-  # (decideReleasePolicy + reduceRelease) for the 5c transport hand. Proves the
-  # Fable-3 "release-after-observation" timing as a pure state machine BEFORE any
-  # send IO: meta-mailbox=never release (no lock), control-socket=release once
-  # on send-final. The spawn-observation policy and its four release events went with
-  # the transport in the visible-first cut; decideReleasePolicy still enforces the
-  # lock-nullness invariant (？7). Pure, no IO.
-  run_ts scripts/check-entwurf-v2-release.ts
-}
-
 check_entwurf_v2_send() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-2a: the control-socket SEND hand
-  # (executeControlSocketSend) that WIRES real transport IO onto the 5c-1 release
-  # reducer. Proves the send->outcome->release ordering over injected fakes (no socket):
-  # ack->sent / in-band reject->rejected (no fallback) / dead->same-lock one-shot
-  # re-resolve (control retry or mailbox enqueue)->fallback-sent|rejected|failed /
-  # indeterminate->failed+rethrow with deadFallback+mailbox NEVER called (no
-  # double-delivery on an alive-but-stalled socket). Release fires exactly once per
-  # send-final; a releaseLock throw never masks the send failure (5b). IO-via-dep.
-  run_ts scripts/check-entwurf-v2-send.ts
-}
-
-check_entwurf_v2_send_fallback() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-2b: the same-lock re-resolve RESOLVER
-  # (resolveDeadControlSendFallback) the 5c-2a hand calls on a dead connect. Proves the
-  # fire-and-forget re-resolve routing over injected fakes (no filesystem): alive->
-  # control-socket retry (inspected socketPath) / dead(absent)->reject (dormant-fire-
-  # forget-unsupported, and nothing is launched) / indeterminate->reject / unsupported+deliverable
-  # ->meta-mailbox plan (mini-table, no inspect/probe) / unsupported+undeliverable->reject
-  # / bad-target + address-conflict->reject pre-probe. Mis-wire (plan/lock gid) fails loud
-  # before IO; inspect/probe throws PROPAGATE (the hand owns failed+release); the resolver
-  # has NO release seam; every execute plan keeps the held gid.
-  run_ts scripts/check-entwurf-v2-send-fallback.ts
-}
-
-check_entwurf_v2_mailbox() {
-  # Deterministic gate for 0.11 Stage 0 step 5c-4 (the LAST 5c transport slice): the
-  # ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + its production
-  # sendViaMailbox adapter (makeProductionSendViaMailbox). Proves the wiring over an
-  # injected fake enqueue (no filesystem): sender present -> formatMetaMailboxBody with
-  # plan.wantsReply threaded (yes/no in body, the deliberate divergence from legacy's
-  # hard-coded false) / sender absent -> raw plan.message / enqueue opts EXACTLY
-  # {gardenId: plan.targetGardenId, body, sessionsDir, mailboxDir} (no re-derivation) /
-  # enqueue throw PROPAGATES (never folded into success:false — a mailbox has no in-band
-  # refuse) / success -> {success:true}. Production adapter resolves {success:true},
-  # consults senderProvider once, and NEVER touches the lock (a poison LockClaim whose
-  # every access throws still resolves). Source guard: the lib code has NO release seam
-  # and NO routing seam (no releaseLock / inspect / probe / resolve) — a lock leak or
-  # re-route is structurally impossible.
-  run_ts scripts/check-entwurf-v2-mailbox.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the V2SEND-INBAND-REJECT-REASON mutant names it as gate argv, and attribution is
+  # read from the JSON test titles `run_vitest` emits (run.sh:104-113). Narrow file filter: a
+  # mutant pointed at the glob shim would re-run every beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "control-socket send hand (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-send.test.ts
 }
 
 check_entwurf_v2_native_push() {
-  # Deterministic gate for 봉인 3/4: the native-push SEND hand (deliverViaNativePush +
-  # makeNativePushSend), the executor half of the native-push rail — where the 1-shot retry
-  # lives (moved out of the adapter leaf). Proves over a fake adapter (no agy/socket): success
-  # first try -> {retried:false}, ONE send over the planted route, ZERO re-probe; fail ->
-  # re-probe alive -> re-send success -> {retried:true}, TWO sends, the 2nd over the RE-
-  # DISCOVERED route; re-send FAIL -> throws (no 3rd attempt); re-probe dead/indeterminate ->
-  # throws (not retried), NO second send. makeNativePushSend resolves the adapter from
-  # plan.backend and IGNORES the lock (lock-free rail).
-  run_ts scripts/check-entwurf-v2-native-push.ts
-}
-
-check_entwurf_v2_runner() {
-  # Deterministic gate for 0.11 Stage 0 step 5d-1: the execute-router (executeDispatch) that
-  # routes an already-decided DispatchDecision to its 5c transport hand and maps the outcome
-  # to one outcome-rich EntwurfV2RunResult. Proves over injected fake hands (no socket/spawn/
-  # timer): reject -> rejected (receipt+diagnostic carried, NO hand called) / control-socket ->
-  # sendControl(plan, lock) / meta-mailbox -> sendMailbox(plan, NULL
-  # lock, ？7). Carry-overs: N3 control `rejected` carries rejectReason verbatim; N1
-  # SendDeliveredReleaseFailedError -> execution-failed{finalizedOutcome, releaseFailed,
-  # retrySafe:false}; a plain hand throw -> execution-failed{retrySafe:false} with no
-  # finalizedOutcome. Exactly one hand runs per execute.
-  run_ts scripts/check-entwurf-v2-runner.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the NATIVE-PUSH-RETRY-BYTE-IDENTITY mutant names it as gate argv, and attribution
+  # is read from the JSON test titles `run_vitest` emits (run.sh:104-113). Narrow file filter:
+  # a mutant pointed at the glob shim would re-run every beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "native-push send hand (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-native-push.test.ts
 }
 
 check_entwurf_v2_surface() {
@@ -1368,15 +1294,22 @@ check_compaction_send_guard() {
 }
 
 check_entwurf_resume_args() {
-  # Deterministic gate for the resume-argv SSOT (buildResumePiArgs). S1 replaced the headless
-  # shape with the VISIBLE one, measured against the runtime before the consumer was written:
-  # `-p` is pi's own non-interactive mode, so the old `--mode json -p … <prompt>` prefix would
-  # put a JSON stream in the operator's window instead of a session they can use. Pins the one
-  # shipped posture — `--entwurf-control` FIRST (the resumed session stands its socket up), no
-  # --mode/-p/positional prompt (a resume runs no turn), explicitExtensionArgs exactly once
-  # between the control flag and --session (#29 provider-resolution footgun), --session <abs
-  # file> never --session-id (which MINTS), and a null provider emitting no --provider.
-  run_ts scripts/check-entwurf-resume-args.ts
+  # NOT a discovery path — the test is found by check-tests-beside-behavior like every other
+  # beside-behaviour lane. This case exists as the MUTANT EXECUTION COORDINATE: the six
+  # resume-args mutants name it as their gate argv, the qualification runner re-invokes that
+  # argv once per mutant, and attribution is read from the JSON test titles `run_vitest` emits
+  # under ENTWURF_MUTATION_VITEST_REPORT (run.sh:104-113). A gate argv that called vitest
+  # directly would skip that reporter and every kill would come back unattributed.
+  #
+  # The file filter is NARROW on purpose. Pointing a mutant at the glob shim would make the
+  # runner re-run every beside-behaviour test once per mutant.
+  #
+  # It stays inside check:contracts even though the discovery door also runs this file, and the
+  # duplicate is deliberate: check-release-gate-outcomes requires every gate a mutant names to
+  # run inside check:full, because a gate reachable ONLY through qualification makes the
+  # 28-minute mutant body the only thing that can notice it going red on a clean tree.
+  section "resume-argv SSOT (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-resume-args.test.ts
 }
 
 check_mux_launcher_fence() {
@@ -1432,16 +1365,16 @@ check_mux_resume_call() {
 }
 
 check_entwurf_v2_visible_resume() {
-  # Deterministic gate for the S1 visible-resume composition (entwurf-v2-visible-resume.ts).
-  # Every seam is injected, so the whole state machine — including the timeout branch — runs
-  # without tmux, a lock file, a socket or a clock. Pins: lock BEFORE liveness, identity under
-  # the lock and before any window (a citizen with no transcript fails loud and opens nothing),
-  # live/indeterminate/address-conflict refused unlaunched, the observation as a BOUNDED WAIT
-  # (measured: the socket answers ~2–4s after launch, so one immediate probe would report a
-  # successful resume as unobserved), exactly one launch on every path, timeout releasing the
-  # lock and leaving the window open, a failed release throwing, and the two receipts staying
-  # separate in both the type and the rendered text.
-  run_ts scripts/check-entwurf-v2-visible-resume.ts
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because SEVENTEEN mutants name it as gate argv, and attribution is read from the JSON test
+  # titles `run_vitest` emits (run.sh:104-113), which is why each of those claims is its own
+  # test title. Narrow file filter: pointing them at the glob shim would re-run every
+  # beside-behaviour test seventeen times. It stays inside check:contracts even though the
+  # discovery door also runs this file — see check-release-gate-outcomes: a gate a mutant names
+  # must be reachable outside qualification.
+  section "visible same-id resume (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-visible-resume.test.ts
 }
 
 check_resume_launch_identity() {
@@ -1788,7 +1721,7 @@ smoke_acp_cortex_live() {
 
 smoke_entwurf_v2_matrix_live() {
   # LIVE sentinel for 0.11 Stage 0 step 5d-5 (D4-b) — kept OUT of `pnpm check`. The deterministic
-  # sibling (check-entwurf-v2-matrix) fixes every (target kind → transport → lock) cell over fakes
+  # sibling (pi-extensions/lib/entwurf-v2-decider.matrix.test.ts) fixes every (target kind → transport → lock) cell over fakes
   # with ZERO IO; this drives the REAL production runEntwurfV2 deps against REAL OS objects on the
   # substrate happy path across 3 cells: C1 control-socket (a real `pi --entwurf-control` resident
   # → control-socket RPC send → lock acquire→release ×1), C2 meta-mailbox deliverable (armed
@@ -1806,18 +1739,6 @@ smoke_entwurf_v2_matrix_live() {
   run_ts scripts/smoke-entwurf-v2-matrix-live.ts
 }
 
-check_entwurf_facts() {
-  # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 1): the PURE
-  # fact core. Locks the PeerFact shape + R1/R3b liveness invariant before any IO
-  # wiring (gate-first). R1: out-of-domain backend (claude-code/codex/antigravity)
-  # → unsupported for EVERY socket input (never coerced to the socket value or
-  # dead). R3b: in-domain pi → alive/dead/indeterminate, null → indeterminate
-  # (no proof ≠ dead). facts-only keyset: identity facts + liveness, NO
-  # verb-routing (resumable/sendable/transport/dispatch/action) and NO
-  # transcriptPath (동결결정 10). Pure, no IO, no API.
-  run_ts scripts/check-entwurf-facts.ts
-}
-
 check_control_socket_path() {
   # Deterministic gate: the control-socket path grammar `<dir>/<gid>.sock` has ONE
   # definition (pi-extensions/lib/control-socket-path.js) instead of one per
@@ -1828,18 +1749,6 @@ check_control_socket_path() {
   run_ts scripts/check-control-socket-path.ts
 }
 
-check_socket_discovery() {
-  # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 3): the
-  # SOCKET-axis wiring scanSocketProbes. Probes the union of (dir sockets) ∪
-  # (every in-domain pi citizen's canonical path) so a dormant citizen with no
-  # socket file reads dead (ENOENT) → resumable, never an unprobed gap (slice 2
-  # throws on that). Three-valued throughout — a stalled socket stays
-  # indeterminate (F3), never folded to dead by an alive-only listing. Dir
-  # hygiene (non-.sock / malformed names ignored), dedup, missing-dir, sort, and
-  # an end-to-end scanSocketProbes→resolveFactList. readdir/probe injected, no IO.
-  run_ts scripts/check-socket-discovery.ts
-}
-
 check_meta_listing() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4a): the
   # meta-store axis listAllMetaIdentities. Explicit-partial: a parse failure or
@@ -2236,13 +2145,16 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.86+ at the current 0.85.1 pin) whose
+// pi (past the declared ceiling — 0.87+ at the current 0.86.0 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
-// factory churn is exactly this), so an open `>=` floor is exactly how the next
-// installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.85.1` an existing 0.85.0 host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.85.1 <0.86`).
+// factory churn is exactly this, and 0.86 is the same shape again: a custom
+// provider's streamSimple now receives a branded TranscriptContext instead of a
+// raw Context, with systemPrompt/tools folded into a leading system message), so
+// an open `>=` floor is exactly how the next installer re-acquires the drift.
+// The floor is also the HARD MINIMUM a consumer install resolves: at `>=0.86.0`
+// an existing 0.85.1 host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.86.0 <0.87`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2273,10 +2185,48 @@ assert.equal(peerDepTui, expectedPeer,
 // read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
 // because it was outside this list. Its declaration is a plain range, so the
 // range scan below binds it — no new PROSE_DECL is needed for it.
-const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
+// plugins/herdr/README.md joined on 2026-09-20, the same repair one bump later:
+// its step-1 `npm install -g @earendil-works/pi-coding-agent` was UNPINNED, so
+// from the hour 0.86.0 published it installed a pi outside the range the plugin
+// ships against — and nothing read that line. It now carries the range and is
+// scanned here, which is the only reason writing the number down is allowed.
+// docs/acp-backend-rail.md joined on 2026-09-20 for the same reason the two before it did:
+// its support table declared `peer >=0.85.1 <0.86` in prose no gate read, and the 0.86.0 bump
+// would have carried that into a release. Its declaration is a plain closed range and it is the
+// ONLY one in that file (the other rows declare exact versions of non-pi packages, which neither
+// pattern below matches), so the range scan binds it with no new PROSE_DECL. The bare `0.86.0`
+// devDep mentions in the same cell are prose, not an install pin, and stay unscanned — the range
+// half is what holds the row honest.
+const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md', 'plugins/herdr/README.md', 'docs/acp-backend-rail.md'];
+
+// ROADMAP.md is a baseline doc AND the home of the dated bump ledger, and those
+// are opposite kinds of sentence. A ledger entry is a RECEIPT: `2026-09-06 bump
+// — pi 0.84.4 → 0.85.1` records the range that landed THAT day, and rewriting it
+// at the next bump would destroy the evidence trail the entry exists to keep.
+// The comment above always said history keeps its old versions; until 0.86.0
+// that was only true because the newest entry happened to name the live pin, so
+// the FIRST bump after an entry was written is what exposed it. A ledger entry
+// opens at its dated bullet and runs until the enclosing list resumes at column
+// 0 (measured: every `  - ` bullet inside the Dep-bump block is a bump entry).
+function stripBumpLedger(file, text) {
+  if (file !== 'ROADMAP.md') return text;
+  let inLedger = false, dropped = 0;
+  const kept = text.split('\n').filter((line) => {
+    if (/^  - \*\*\d{4}-\d{2}-\d{2} bump — /.test(line)) { inLedger = true; }
+    else if (inLedger && /^(- |#|\S)/.test(line)) { inLedger = false; }
+    if (inLedger) dropped++;
+    return !inLedger;
+  });
+  // Guard the exclusion itself: it must find a real ledger and must not eat the
+  // whole file. Either way the range/exact scans below would pass vacuously.
+  assert.ok(dropped > 0, 'ROADMAP.md: no dated bump-ledger entry found — the ledger moved or its bullet shape changed; re-point stripBumpLedger instead of leaving history inside the pin scan');
+  assert.ok(kept.length > 100, `ROADMAP.md: the bump-ledger exclusion swallowed the document (${kept.length} lines left) — the live pin declarations would no longer be scanned`);
+  return kept.join('\n');
+}
+
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
-  const text = readFileSync(file, 'utf8');
+  const text = stripBumpLedger(file, readFileSync(file, 'utf8'));
   // Closed-range declarations: `>=<floor> <0.<ceiling>` (spaces optional).
   for (const [decl, floor, ceilMinor] of text.matchAll(/>=\s?(\d+\.\d+\.\d+)\s?<\s?0\.(\d+)/g)) {
     rangeDecls++;
@@ -3075,6 +3025,70 @@ check_acp_sdk_surface() {
   run_vitest test/acp-sdk-surface.contract.test.ts
 }
 
+check_tests_beside_behavior() {
+  # The DISCOVERY door (issue #119 V2). A `.test.ts` beside a pi extension or a
+  # `.test.mjs` beside the herdr plugin lib is run by public `pnpm check` without
+  # anyone adding its filename anywhere. That is the whole contract: the other two
+  # vitest shims list their files, and a door that also listed files would shut
+  # again the first time someone forgot.
+  #
+  # The globs are EXPANDED here, not handed to vitest as positional filters. The first
+  # cut passed `pi-extensions plugins/herdr` as positionals, and vitest reads a positional
+  # as a path SUBSTRING — so `test/pi-extensions-probe.test.ts` was selected too, which is
+  # the opposite of the two-locations contract this gate exists to hold (measured: that file
+  # ran as "Test Files 1 passed"). Expanding first keeps the selected set exactly the two
+  # globs while the shim still contains no filename: it computes them every run.
+  #
+  # Keeping these globs out of the other two shims stays deliberate — those are mutant gate
+  # argv (mux-fresh-call carries 56), and widening their include would rerun unrelated tests
+  # once per mutant.
+  #
+  # An empty expansion RETURNS rather than calling vitest with no arguments, because a
+  # vitest run with no filter runs the whole include — that is, all of test/**. The honest
+  # steady state is "the door is open and unused", and it must not be spelled as a run.
+  section "tests beside behavior (discovery, not a filename list)"
+  local cfg="$REPO_DIR/vitest.config.ts" glob
+  for glob in 'pi-extensions/**/*.test.ts' 'plugins/herdr/**/*.test.mjs'; do
+    if ! grep -qF "\"$glob\"" "$cfg"; then
+      fail "[check-tests-beside-behavior] vitest.config.ts no longer includes $glob — the discovery door is shut, and an expansion that found nothing would still pass"
+      return 1
+    fi
+  done
+
+  local -a selected=()
+  local f
+  while IFS= read -r f; do
+    [ -n "$f" ] && selected+=("$f")
+  done < <(cd "$REPO_DIR" && {
+    find pi-extensions -name node_modules -prune -o -type f -name '*.test.ts' -print
+    find plugins/herdr -name node_modules -prune -o -type f -name '*.test.mjs' -print
+  } 2>/dev/null | LC_ALL=C sort)
+
+  # Independent of HOW the expansion was produced: every selected path must be under one of
+  # the two declared locations, and none may come from test/. The second clause is the one
+  # that names the defect above, so it is asserted rather than left implied by the first.
+  for f in "${selected[@]}"; do
+    case "$f" in
+      test/*)
+        fail "[check-tests-beside-behavior] selected $f — this gate covers the two behavior-adjacent locations, never test/**"
+        return 1
+        ;;
+      pi-extensions/*.test.ts | plugins/herdr/*.test.mjs) ;;
+      *)
+        fail "[check-tests-beside-behavior] selected $f, which matches neither declared glob"
+        return 1
+        ;;
+    esac
+  done
+
+  if [ "${#selected[@]}" -eq 0 ]; then
+    echo "  the door is open and unused — 0 tests beside behavior at this HEAD"
+    return 0
+  fi
+  echo "  selected ${#selected[@]}: ${selected[*]}"
+  run_vitest "${selected[@]}"
+}
+
 check_acp_overlay() {
   # Deterministic gate for the S2b Claude config overlay materializer. Drives
   # ensureClaudeConfigOverlay against injected temp realDir/overlayDir (no
@@ -3478,6 +3492,13 @@ check_pack() {
     # tripwire that fails loud if that negation is ever dropped (결합 규칙).
     '__pycache__'
     '\.pyc$'
+    # Tests written beside behavior (#119 V2) are a dev surface, and `pi-extensions/`
+    # ships WHOLE through the files allowlist, so the `!pi-extensions/**/*.test.ts`
+    # negation is the only thing keeping them out — same 결합 규칙 as __pycache__ above,
+    # this pattern is its tripwire. Written loose rather than anchored under
+    # pi-extensions/ so it also covers any future allowlist entry; `plugins/` needs no
+    # companion negation because `^plugins/` above already refuses that whole tree.
+    '\.test\.[cm]?[jt]s$'
   )
 
   local pass=1 f pat hit
@@ -3515,8 +3536,10 @@ check_pack() {
 #
 # (1) The version BOUNDARY. A pnpm .pnpm entry is `<name>@<version>` followed by either
 #     `_<peer-hash>` or end-of-name (measured pnpm 11.20.0 on this tree), so an unbounded
-#     substring match would bless a lookalike such as `@0.85.10` while announcing the pinned
-#     floor — a false-green oracle (found by independent review, 2026-08-25).
+#     substring match would bless a lookalike whose version merely STARTS with the pin — a
+#     prerelease such as `@0.86.0-beta.1`, or the `@0.85.10` shape that first exposed this —
+#     while announcing the pinned floor: a false-green oracle (found by independent review,
+#     2026-08-25).
 # (2) The name PREFIX covers the whole @earendil-works closure, not the `pi-` families alone.
 #     0.85.0 added `@earendil-works/chord`, declared as a runtime `dependencies` entry by
 #     pi-coding-agent, pi-agent-core, pi-client and pi-protocol — inside the closure, with a
@@ -3524,15 +3547,17 @@ check_pack() {
 #     `@earendil-works+chord@0.85.1` next to the seven pi entries, and the old
 #     `^@earendil-works+pi-` filter did not see it: chord would have floated silently while
 #     this gate printed a verified pin. The prefix is the closure's org, not one family in it.
-#     (The measured peer-hash suffix moved too — `_ws@8.21.3` at 0.85.1 where 0.84.4 carried
-#     `_@modelcontextprotocol+sdk@…` — which is exactly what property (1)'s `(_|$)` absorbs;
-#     both shapes are fixtures below so a future suffix change cannot pass vacuously.)
+#     (The measured peer-hash suffix keeps moving — `_@modelcontextprotocol+sdk@…` at 0.84.4,
+#     `_ws@8.21.3` at 0.85.1, and `[측정 2026-09-20]` the combined
+#     `_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6` on a 0.86.0 tree —
+#     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
+#     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@0\.85\.1(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@0\.86\.0(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
-# false-green shape (it contains no 0.85.10 and no off-pin chord), so the oracle is proven
+# false-green shape (it contains no prefix-extended version and no off-pin chord), so the oracle is proven
 # against fixture listings. One cell per property of pack_install_leaked_pi, so a regression
 # in either is named by its own signature rather than folded into a single verdict. Exposed
 # as its own snapshot-safe subcommand because the heavy check-pack-install cannot run inside
@@ -3542,30 +3567,33 @@ pack_install_leaked_pi() {
 check_pack_pin_matcher() {
   local matcher_probe
 
-  # Cell 1 — the version boundary. Both measured peer-hash shapes are fixtures: the
-  # 0.84.4-era `_@modelcontextprotocol+sdk@…` and the `_ws@8.21.3` observed on a real
-  # 0.85.1 tree. Neither may leak; the two lookalikes must.
+  # Cell 1 — the version boundary. Every measured peer-hash shape is a fixture: the
+  # 0.84.4-era `_@modelcontextprotocol+sdk@…`, the `_ws@8.21.3` observed on a real
+  # 0.85.1 tree, and `[측정 2026-09-20]` the combined suffix a 0.86.0 install carries.
+  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
+  # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.85.1' \
-    '@earendil-works+pi-ai@0.85.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.85.1_ws@8.21.3' \
-    '@earendil-works+pi-ai@0.85.10' \
-    '@earendil-works+pi-agent-core@0.85.0' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.85.10
-@earendil-works+pi-agent-core@0.85.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.85.10/0.85.0 lookalikes and pass 0.85.1 bare or with either measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.86.0' \
+    '@earendil-works+pi-ai@0.86.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.86.0_ws@8.21.3' \
+    '@earendil-works+pi-ai@0.86.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.86.0-beta.1' \
+    '@earendil-works+pi-agent-core@0.85.1' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.86.0-beta.1
+@earendil-works+pi-agent-core@0.85.1' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 0.86.0-beta.1 and the off-pin 0.85.1 lookalikes, and pass 0.86.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
   # Cell 2 — the closure prefix. chord is a non-`pi-` member of the same runtime closure
-  # (0.85.0 onward). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
+  # (0.85.0 onward, still true at 0.86.0). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
+    '@earendil-works+chord@0.86.0' \
     '@earendil-works+chord@0.85.1' \
-    '@earendil-works+chord@0.85.0' \
-    '@earendil-works+pi-ai@0.85.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+chord@0.85.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol at 0.85.x) — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.86.0' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+chord@0.85.1' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol at 0.86.0 — `[측정 2026-09-20]` `npm view <pkg>@0.86.0 dependencies`) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -3798,7 +3826,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.85.x`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.86.x`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3827,19 +3855,31 @@ _check_pack_install_impl() {
   # It is pinned here for the first time. The leak assertion below covers every
   # other @earendil-works package too — but only because the matcher's prefix was
   # widened from `pi-` to the org in the same change; before that it was blind to
-  # precisely this class of new member. The verified floor is 0.85.1 as of 2026-09-06.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.85.x peers + chord + typebox)"
+  # precisely this class of new member.
+  #
+  # `[측정 2026-09-20]` at 0.86.0 the constellation SHRANK for the first time:
+  # `npm view @earendil-works/pi-coding-agent@0.86.0 dependencies` lists only
+  # {chord, pi-ai, pi-tui, pi-agent-core} — pi-client and pi-protocol are no
+  # longer reachable from the three packages we import (pi-client still carries
+  # {chord, pi-protocol}, pi-protocol still carries {chord}, both published at
+  # 0.86.0). Their explicit pins stay: a pin that is momentarily redundant costs
+  # two frozen rows in a temp tree, while retiring one is how a caret re-enters
+  # the closure unwatched on the next minor — the same shape as the 2026-07-21
+  # pi-agent-core incident. The list moves WITH the floor and is re-measured at
+  # each bump, never pruned on a single quiet minor.
+  # The verified floor is 0.86.0 as of 2026-09-20.
+  echo "[check-pack-install] pnpm add into $tmp (with 0.86.x peers + chord + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.85.1" \
-    "@earendil-works/pi-coding-agent@0.85.1" \
-    "@earendil-works/pi-tui@0.85.1" \
-    "@earendil-works/pi-agent-core@0.85.1" \
-    "@earendil-works/pi-client@0.85.1" \
-    "@earendil-works/pi-protocol@0.85.1" \
-    "@earendil-works/pi-telemetry@0.85.1" \
-    "@earendil-works/chord@0.85.1" \
+    "@earendil-works/pi-ai@0.86.0" \
+    "@earendil-works/pi-coding-agent@0.86.0" \
+    "@earendil-works/pi-tui@0.86.0" \
+    "@earendil-works/pi-agent-core@0.86.0" \
+    "@earendil-works/pi-client@0.86.0" \
+    "@earendil-works/pi-protocol@0.86.0" \
+    "@earendil-works/pi-telemetry@0.86.0" \
+    "@earendil-works/chord@0.86.0" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3849,17 +3889,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works package present — direct or transitive, top level or nested,
-  # chord included — must be the pinned 0.85.1. Anything else means an unpinned caret
+  # chord included — must be the pinned 0.86.0. Anything else means an unpinned caret
   # floated and the rest of this gate would be exercising a runtime nobody verified,
-  # while still printing "pinned pi 0.85.1". Fail loud instead of proving the wrong floor.
+  # while still printing "pinned pi 0.86.0". Fail loud instead of proving the wrong floor.
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.85.1):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.86.0):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.85.1 (chord included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.86.0 (chord included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4665,7 +4705,7 @@ function finish(trimmed) {
   // gate that exists to catch "green clone, dead consumer". Equality also catches the
   // other direction the narrow-surface rule cares about: an extra or duplicated verb
   // reaching hosts without a decision. Written sorted; `names` is sorted above.
-  const EXPECT_TOOLS = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
     console.error('installed MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
     process.exit(1);
@@ -5224,12 +5264,12 @@ function finishOk(trimmed) {
   }
   const names = tools.map((t) => t?.name).sort();
   // EXACT set, not a floor. This is the assertion behind the operator-facing claim that
-  // `entwurf check-bridge` proves the installed bytes list the seven garden tools — and
+  // `entwurf check-bridge` proves the installed bytes list the eight garden tools — and
   // under an installed package this launcher IS the dist branch of start.sh, so a subset
   // check here let an artifact missing entwurf_fresh_call / entwurf_resume_call read as a
   // green bridge. Equality also refuses an undecided extra verb. Written sorted; `names`
   // is sorted above.
-  const expected = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const expected = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== expected.length || expected.some((n, i) => names[i] !== n)) {
     console.error(`MCP tool set MISMATCH — want exactly [${expected.join(',')}] got [${names.join(',')}]`);
     process.exit(1);
@@ -6405,6 +6445,9 @@ case "$cmd" in
   check-copilot-launch)
     check_copilot_launch
     ;;
+  check-pi-launch)
+    check_pi_launch
+    ;;
   check-copilot-receive-arm)
     check_copilot_receive_arm
     ;;
@@ -6420,33 +6463,12 @@ case "$cmd" in
   check-entwurf-v2-contract)
     check_entwurf_v2_contract
     ;;
-  check-entwurf-v2-lock)
-    check_entwurf_v2_lock
-    ;;
-  check-entwurf-v2-decider)
-    check_entwurf_v2_decider
-    ;;
-  check-entwurf-v2-matrix)
-    check_entwurf_v2_matrix
-    ;;
-  check-entwurf-v2-release)
-    check_entwurf_v2_release
-    ;;
   check-entwurf-v2-send)
     check_entwurf_v2_send
     ;;
-  check-entwurf-v2-send-fallback)
-    check_entwurf_v2_send_fallback
-    ;;
-  check-entwurf-v2-mailbox)
-    check_entwurf_v2_mailbox
-    ;;
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
-  check-entwurf-v2-runner)
-    check_entwurf_v2_runner
-    ;;
   check-entwurf-control-rpc)
     check_entwurf_control_rpc
     ;;
@@ -6567,15 +6589,9 @@ case "$cmd" in
   smoke-acp-socket-citizen-live)
     smoke_acp_socket_citizen_live
     ;;
-  check-entwurf-facts)
-    check_entwurf_facts
-    ;;
   check-control-socket-path)
     check_control_socket_path
     ;;
-  check-socket-discovery)
-    check_socket_discovery
-    ;;
   check-meta-listing)
     check_meta_listing
     ;;
@@ -6597,6 +6613,20 @@ case "$cmd" in
   smoke-herdr-plugin-build-live)
     smoke_herdr_plugin_build_live
     ;;
+  smoke-herdr-raw-install-live)
+    # #118 홉 1: the FIRST USER PATH. Every other herdr gate proves the plugin against a
+    # source we control — a stub, or the product remote redirected by git insteadOf to a
+    # local bare clone asserting identity.kind === "herdr-checkout". None has watched the
+    # plugin acquire its runtime from npm on a machine that has never seen this repo, which
+    # is the one axis VERIFY.md:61 leaves open while the production lock says npm. Clean
+    # container, public remote, no mounts, no insteadOf. Its first question is whether
+    # `plugin install --yes` completes with no herdr server; a "no" is #118 investigation
+    # output, not a completion. on-demand LIVE, never an aggregate MUST.
+    # shift is load-bearing: this dispatcher keeps the verb in "$@" and each branch that
+    # forwards arguments drops it for itself. Without it `--ref` arrives behind the gate name.
+    shift
+    (cd "$REPO_DIR" && bash scripts/smoke-herdr-raw-install-live.sh "$@")
+    ;;
   check-peer-facts)
     check_peer_facts
     ;;
@@ -7112,6 +7142,54 @@ case "$cmd" in
     shift || true
     exec bash "$REPO_DIR/scripts/copilot-launch.sh" "$@"
     ;;
+  pi)
+    # #118 홉 2: the managed pi launch. Same shape and same reasons as `copilot` above —
+    # `exec`, no subshell and no cd, because this operates on the operator's session; and
+    # `shift`, because this branch forwards straight into the VENDOR argv where a stray
+    # "pi" would arrive as a prompt argument.
+    #
+    # NO separate launcher script, and no precondition check, because the precondition is
+    # ZERO and that was measured rather than assumed: on a host where entwurf's pi extension
+    # is not registered, `pi --entwurf-control` already fails as
+    # `Error: Unknown option: --entwurf-control` with exit 1. A pre-check here would only
+    # duplicate a refusal pi owns and would go stale the day pi renames it.
+    #
+    # ONE recursion fence, not copilot's two, and the difference is measured. The sentinel
+    # closes the only real loop: a PATH executable named `pi` that shells back to
+    # `entwurf pi` re-enters this branch, and finds the flag already exported. Copilot's
+    # second fence — resolving the binary and refusing our own entrypoints — closes a case
+    # that is not a loop here: a PATH `pi` symlinked to run.sh would be exec'd as
+    # `run.sh --entwurf-control …`, which is an unknown verb this dispatcher already
+    # refuses. `type -P` is what keeps the operator's own shell wrappers out of it
+    # entirely: it returns a PATH file only, never a function or alias, so a
+    # `pi() { entwurf pi "$@"; }` in a profile can never be re-entered through it.
+    #
+    # The flag is added, never deduplicated: `pit`/`pius`-style wrappers already pass
+    # `--entwurf-control`, and passing it twice was measured to be byte-identical to
+    # passing it once. An argv scan would be code earning nothing.
+    #
+    # Nothing else is injected. `--emacs-agent-socket` and friends are operator taste, and
+    # a launcher that decides them stops being a spelling (Hard Rule 9).
+    shift || true
+    if [ -n "${ENTWURF_PI_LAUNCH_ACTIVE:-}" ]; then
+      echo "entwurf: recursive managed launch detected (ENTWURF_PI_LAUNCH_ACTIVE is already set)." >&2
+      echo "         Something on PATH named 'pi' resolves back to this launcher. Fix PATH so 'pi'" >&2
+      echo "         is the pi coding agent, or run the vendor binary by its full path." >&2
+      exit 1
+    fi
+    entwurf_pi_bin="$(type -P pi 2>/dev/null || true)"
+    if [ -z "$entwurf_pi_bin" ]; then
+      echo "entwurf: no 'pi' executable found on PATH." >&2
+      echo "         'entwurf pi' launches the pi coding agent; it does not install one." >&2
+      exit 1
+    fi
+    if [ ! -f "$entwurf_pi_bin" ] || [ ! -x "$entwurf_pi_bin" ]; then
+      echo "entwurf: '$entwurf_pi_bin' is not an executable regular file — refusing to exec it." >&2
+      exit 1
+    fi
+    export ENTWURF_PI_LAUNCH_ACTIVE=1
+    exec "$entwurf_pi_bin" --entwurf-control "$@"
+    ;;
   install-copilot-receive)
     # #82 RAIL 5: install the RECEIVER extension into the Copilot USER extensions dir.
     # Artifact ownership only — it sets no launch flag (`run.sh copilot` owns one
@@ -7349,6 +7427,9 @@ case "$cmd" in
   check-acp-sdk-surface)
     check_acp_sdk_surface
     ;;
+  check-tests-beside-behavior)
+    check_tests_beside_behavior
+    ;;
   check-acp-overlay)
     check_acp_overlay
     ;;