@junghanacs/entwurf 0.23.1 → 0.25.0

package/run.sh

@@ -122,7 +122,7 @@ Usage:
   ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
-  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
+  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f/G1h, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2, entwurf_resume_call and entwurf_callback registered/schema + the tools/list surface is EXACTLY the eight shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
   ./run.sh check-model-lock           # deterministic unit test for pi-extensions/model-lock.ts (4-quadrant + edge cases, no API)
   ./run.sh check-shell-quote          # POSIX-safety gate for shellQuote (remote SSH arg quoting in entwurf paths) — source parity + behavior matrix, no SSH
@@ -170,7 +170,7 @@ Usage:
   ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
-  ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one peer-facts + one agent list per open (counted, not claimed), skip-by-name when Entwurf is absent, four distinct named refusals instead of an empty table, ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
+  ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one `herdr integration status` + one `entwurf peer-facts` + one `herdr agent list` per open, in that order (counted, not claimed), through ONE spawn call site; the four blocks each naming their own owner/observation time with no aggregate verdict; the D3=C fallback reading the activation ledger from the path its WRITER owns (XDG state, never the runtime's data root) and only when the phase is `active`, with ENTWURF_BIN and PATH still winning outright; the citizen axis alone skipping by name when no binary is reachable; every broken-evidence state a named red rather than a crash or an empty table, and a selected herdr atom that is `outdated`/`needs repair` as block [1]'s OWN red (`not installed` stays a reported skip); ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
   ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
   ./run.sh check-herdr-activation      # deterministic gate for the #116 M3-b2 scoped activation: the pi user-scope-ONLY forward seam (no project write, OpenCode byte-untouched), the absolute command DERIVED from the runtime root for BOTH harnesses (relative/unnormalised refused), default bare/clone bytes unchanged when no mode is asked, the pi inverse refusing a drifted command instead of deleting an override, a certified activation ledger that can never name an atom outside {pi, claude-code}, add-only reinstall (a shrinking H retains, never removes), a roots-drift refusal before the first byte, the teardown order components->runtime->ledger LAST, one refused preflight leaving every byte untouched, and no deferred module load on the path that deletes its own runtime. Drives the REAL pi writers; the vendor `claude` CLI is NOT invoked and its acceptance of an absolute executable stays a named LIVE boundary
   ./run.sh check-herdr-plugin-profile  # deterministic gate for the #116 M3-a PURE activation leaf (`plugins/herdr/lib/integration-profile.mjs`): the closed {pi→pi, claude→claude-code} table, exactly-one-row-or-named-refusal, the FRONT-ANCHORED state grammar (a `/srv/current (v9)/` directory name may not decide a verdict), no path in the plan, outdated/needs-repair as named FAILs, not-installed as a zero-write SKIP, `current` as herdr's admission with no floor of our own, OpenCode observed but never planned, and the leaf's purity. Listing strings only — no herdr binary, no install, no environment, no writes
@@ -276,7 +276,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (a prefix-extended @0.86.0-beta.1 and an off-pin @0.85.1 must leak, @0.86.0 bare or with any measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -709,6 +709,31 @@ install_user_scope() {
     esac
     shift
   done
+  # pi FLOOR — the same closed range `setup` enforces (#119 door symmetry). setup refuses an
+  # out-of-range pi by name before it writes any Pi wiring; this verb is the OTHER door onto the
+  # same registration (herdr plugin activation reaches it through plugins/herdr/lib/build.mjs →
+  # scripts/herdr-plugin-activate.mjs → `run.sh install-user-scope --plugin-runtime …`) and had no
+  # version check at all, so a host pi setup would name as FAIL got its citizen written here in
+  # silence. Both doors now tell the same truth, off the SAME derived range — `pi_supported_range`
+  # reads the package.json devDep pin, so there is one range in the repo and no second parser.
+  #
+  # ABSENT pi is deliberately NOT changed here. This verb is called by an activation that has
+  # already decided pi is one of its backends; inventing a presence verdict at the writer would put
+  # a second detection authority next to setup's. Out-of-range is the asymmetry that was real, and
+  # it is the only one closed. PI_BIN is the same probe seam setup uses (hermetic gates pin it;
+  # production leaves it unset).
+  local pi_bin="${PI_BIN:-pi}" pi_range pi_ver
+  if command -v "$pi_bin" >/dev/null 2>&1; then
+    pi_range=$(pi_supported_range)
+    # Bounded capture, same reason as setup's: a resolvable pi whose --version crashes or prints
+    # garbage must reach the refusal below, never abort through set -e with nothing said.
+    pi_ver="$("$pi_bin" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')" || pi_ver=""
+    if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
+      echo "[install-user-scope] pi: FAIL — detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range; nothing was written. Align pi, then re-run." >&2
+      exit 1
+    fi
+  fi
+
   preflight_v3_store install-user-scope
   section "install-user-scope: the GLOBAL pi citizen only (no project wiring)"
   register_user_scope_citizen "$plugin_runtime"
@@ -1193,6 +1218,30 @@ check_entwurf_v2_send() {
   run_vitest pi-extensions/lib/entwurf-v2-send.test.ts
 }
 
+check_entwurf_v2_runner() {
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the file is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists because
+  # the #120 P2 SEND-DIRTY-LOCK-RUNNER-MOVES-ACCEPTANCE mutant names it as gate argv, and
+  # attribution is read from the JSON test titles `run_vitest` emits. Narrow file filter, same
+  # reason as check-entwurf-v2-send: a mutant pointed at the discovery door would re-run every
+  # beside-behaviour test once per mutant.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "v2 dispatch runner (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-runner.test.ts
+}
+
+check_control_send_receipt() {
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists because
+  # the #120 P2 SEND-RECEIPT-* mutants name it as gate argv, and attribution is read from the JSON
+  # test titles `run_vitest` emits. Narrow file filter, same reason as check-entwurf-v2-send.
+  # It stays inside check:contracts even though the discovery door also runs this file — see
+  # check-release-gate-outcomes: a gate a mutant names must be reachable outside qualification.
+  section "control-socket acceptance boundary (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/control-send-receipt.test.ts
+}
+
 check_entwurf_v2_native_push() {
   # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
   # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
@@ -2098,7 +2147,14 @@ const runSh = readFileSync('run.sh', 'utf8');
 const piAi = pkg.devDependencies?.['@earendil-works/pi-ai'];
 const piCoding = pkg.devDependencies?.['@earendil-works/pi-coding-agent'];
 const piTui = pkg.devDependencies?.['@earendil-works/pi-tui'];
+// #120 P2: pi-agent-core is now DIRECTLY imported by test/pi-queue.oracle.test.ts, which proves
+// what the control-socket receipt says about a receiver's queues. An oracle pinned to a DIFFERENT
+// pi than the one this repo targets would answer honestly about a pi nobody runs, so its exact
+// dev pin moves with the floor or the floor is not a floor.
+const piCore = pkg.devDependencies?.['@earendil-works/pi-agent-core'];
 assert.ok(piAi, 'package.json devDependencies must pin @earendil-works/pi-ai');
+assert.equal(piCore, piAi,
+  `[QK:PI-CORE-PIN-TRACKS-FLOOR] @earendil-works/pi-agent-core (${piCore}) must match @earendil-works/pi-ai (${piAi}) — the queue oracle imports it directly to prove what the control-socket receipt claims about a receiver's queues, so a pin that drifts off the floor would answer honestly about a pi nobody here runs`);
 assert.equal(piCoding, piAi,
   `@earendil-works/pi-coding-agent (${piCoding}) must match @earendil-works/pi-ai (${piAi})`);
 assert.equal(piTui, piAi,
@@ -2120,13 +2176,16 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.86+ at the current 0.85.1 pin) whose
+// pi (past the declared ceiling — 0.87+ at the current 0.86.0 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
-// factory churn is exactly this), so an open `>=` floor is exactly how the next
-// installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.85.1` an existing 0.85.0 host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.85.1 <0.86`).
+// factory churn is exactly this, and 0.86 is the same shape again: a custom
+// provider's streamSimple now receives a branded TranscriptContext instead of a
+// raw Context, with systemPrompt/tools folded into a leading system message), so
+// an open `>=` floor is exactly how the next installer re-acquires the drift.
+// The floor is also the HARD MINIMUM a consumer install resolves: at `>=0.86.0`
+// an existing 0.85.1 host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.86.0 <0.87`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2157,10 +2216,48 @@ assert.equal(peerDepTui, expectedPeer,
 // read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
 // because it was outside this list. Its declaration is a plain range, so the
 // range scan below binds it — no new PROSE_DECL is needed for it.
-const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
+// plugins/herdr/README.md joined on 2026-09-20, the same repair one bump later:
+// its step-1 `npm install -g @earendil-works/pi-coding-agent` was UNPINNED, so
+// from the hour 0.86.0 published it installed a pi outside the range the plugin
+// ships against — and nothing read that line. It now carries the range and is
+// scanned here, which is the only reason writing the number down is allowed.
+// docs/acp-backend-rail.md joined on 2026-09-20 for the same reason the two before it did:
+// its support table declared `peer >=0.85.1 <0.86` in prose no gate read, and the 0.86.0 bump
+// would have carried that into a release. Its declaration is a plain closed range and it is the
+// ONLY one in that file (the other rows declare exact versions of non-pi packages, which neither
+// pattern below matches), so the range scan binds it with no new PROSE_DECL. The bare `0.86.0`
+// devDep mentions in the same cell are prose, not an install pin, and stay unscanned — the range
+// half is what holds the row honest.
+const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md', 'plugins/herdr/README.md', 'docs/acp-backend-rail.md'];
+
+// ROADMAP.md is a baseline doc AND the home of the dated bump ledger, and those
+// are opposite kinds of sentence. A ledger entry is a RECEIPT: `2026-09-06 bump
+// — pi 0.84.4 → 0.85.1` records the range that landed THAT day, and rewriting it
+// at the next bump would destroy the evidence trail the entry exists to keep.
+// The comment above always said history keeps its old versions; until 0.86.0
+// that was only true because the newest entry happened to name the live pin, so
+// the FIRST bump after an entry was written is what exposed it. A ledger entry
+// opens at its dated bullet and runs until the enclosing list resumes at column
+// 0 (measured: every `  - ` bullet inside the Dep-bump block is a bump entry).
+function stripBumpLedger(file, text) {
+  if (file !== 'ROADMAP.md') return text;
+  let inLedger = false, dropped = 0;
+  const kept = text.split('\n').filter((line) => {
+    if (/^  - \*\*\d{4}-\d{2}-\d{2} bump — /.test(line)) { inLedger = true; }
+    else if (inLedger && /^(- |#|\S)/.test(line)) { inLedger = false; }
+    if (inLedger) dropped++;
+    return !inLedger;
+  });
+  // Guard the exclusion itself: it must find a real ledger and must not eat the
+  // whole file. Either way the range/exact scans below would pass vacuously.
+  assert.ok(dropped > 0, 'ROADMAP.md: no dated bump-ledger entry found — the ledger moved or its bullet shape changed; re-point stripBumpLedger instead of leaving history inside the pin scan');
+  assert.ok(kept.length > 100, `ROADMAP.md: the bump-ledger exclusion swallowed the document (${kept.length} lines left) — the live pin declarations would no longer be scanned`);
+  return kept.join('\n');
+}
+
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
-  const text = readFileSync(file, 'utf8');
+  const text = stripBumpLedger(file, readFileSync(file, 'utf8'));
   // Closed-range declarations: `>=<floor> <0.<ceiling>` (spaces optional).
   for (const [decl, floor, ceilMinor] of text.matchAll(/>=\s?(\d+\.\d+\.\d+)\s?<\s?0\.(\d+)/g)) {
     rangeDecls++;
@@ -2188,6 +2285,79 @@ for (const [file, re, shape] of PROSE_DECLS) {
   assert.ok(m, `${file}: the baseline sentence "${shape}" is gone — restore it or update check-dep-versions; a doc reword must not silently drop the pin from the gate`);
   assert.equal(m[1], piAi, `${file}: "${shape}" declares ${m[1]}, but the devDep pin is ${piAi}`);
 }
+// ── #120 P4: ONE FLOOR, FOUR MECHANICAL SURFACES ──────────────────────────
+// The bump is mostly a number substitution, and that is exactly how a bump goes
+// wrong: three surfaces move and the fourth is noticed months later by an install
+// that fails somewhere else. `[측정 2026-09-22]` the workspace closure was already
+// outside this gate — nothing here read `pnpm-workspace.yaml` at all — so a stale
+// row there could only surface at `pnpm install` time, far from the change.
+//
+// ONE assertion, because the claim token may appear exactly once in a gate source.
+// Every way the floor can fragment is collected first and named individually in the
+// failure, so "which surface" is never lost to the single-token rule.
+const nextFloorRange = `>=${piAi} <0.${piMin + 1}`;
+const floorGaps = [];
+const PI_CONSTELLATION = [
+  '@earendil-works/pi-ai', '@earendil-works/pi-coding-agent', '@earendil-works/pi-tui',
+  '@earendil-works/pi-agent-core', '@earendil-works/pi-client', '@earendil-works/pi-protocol',
+  '@earendil-works/pi-telemetry', '@earendil-works/chord',
+];
+const sameSet = (got, want, where) => {
+  const missing = want.filter((n) => !got.includes(n));
+  const extra = got.filter((n) => !want.includes(n));
+  if (missing.length > 0) floorGaps.push(`${where}: missing ${missing.join(', ')}`);
+  if (extra.length > 0) floorGaps.push(`${where}: unexpected ${extra.join(', ')}`);
+};
+// run.sh check-pack-install: the packages a consumer's fresh tree must resolve.
+const installed = [];
+for (const [, name, ver] of runSh.matchAll(/"(@earendil-works\/[a-z-]+)@(\d+\.\d+\.\d+)"/g)) {
+  installed.push(name);
+  if (ver !== piAi) floorGaps.push(`run.sh install constellation: ${name}@${ver} is not the floor ${piAi}`);
+}
+sameSet(installed, PI_CONSTELLATION, 'run.sh install constellation');
+// pnpm-workspace.yaml minimumReleaseAgeExclude: the same eight, each ADMITTING the
+// current floor. History stays (`0.85.0 || 0.85.1 || …`) — only the newest term is
+// the contract, because that is what an install resolves against.
+const closure = [...readFileSync('pnpm-workspace.yaml', 'utf8').matchAll(/^\s*-\s*'(@earendil-works\/[a-z-]+)@([^']+)'/gm)];
+sameSet(closure.map(([, name]) => name), PI_CONSTELLATION, 'pnpm-workspace.yaml closure');
+for (const [, name, spec] of closure) {
+  if (!spec.split('||').map((t) => t.trim()).includes(piAi)) {
+    floorGaps.push(`pnpm-workspace.yaml closure: ${name}@${spec} does not admit the floor ${piAi} — a stranded row fails only at install time`);
+  }
+}
+// The PIN-LEAK MATCHER's own version bound. `[측정 2026-09-22]` this one was missed by the
+// first cut of this very claim and only surfaced when check-pack-install actually ran: the
+// install resolved 0.87.0 correctly and the gate refused it, because the matcher still said
+// `@0\.86\.0`. It is a regex literal, not a quoted `@pkg@version` spec, so the scan above
+// walked straight past it — which is exactly the "surface nothing else reads" this claim is
+// about, found the hard way. It is bound by name now.
+const matcherPin = runSh.match(/grep -Ev '@(\d+\\?\.\d+\\?\.\d+)\(_\|\$\)'/);
+if (!matcherPin) {
+  floorGaps.push("run.sh pack_install_leaked_pi: the version-bounded pin regex is gone — a matcher that stopped bounding the version would pass every leaked runtime");
+} else if (matcherPin[1].replace(/\\/g, '') !== piAi) {
+  floorGaps.push(`run.sh pack_install_leaked_pi: the pin-leak matcher bounds @${matcherPin[1].replace(/\\/g, '')}, but the floor is ${piAi} — the consumer install proof would refuse the very runtime this repo pins`);
+}
+
+// The three CURRENT-contract doc sentences the range/exact scans above cannot see,
+// each anchored on its own wording. Historical samples (the 0.84.x placement
+// measurement in docs/mux-launch-rail.md, for one) are deliberately NOT scanned:
+// they record what was true then, and rewriting them would falsify evidence.
+const CURRENT_CONTRACT_DECLS = [
+  ['plugins/herdr/README.md', /npm install -g "@earendil-works\/pi-coding-agent@(>=[\d.]+ <0\.\d+)"/, 'the herdr install line'],
+  ['docs/mux-launch-rail.md', /현 supported range 는 `(>=[\d.]+ <0\.\d+)`/, "mux-launch-rail's current supported range"],
+  ['docs/acp-backend-rail.md', /devDep exact `(\d+\.\d+\.\d+)`, peer `(>=[\d.]+ <0\.\d+)`/, "the ACP support row's exact+range pair"],
+];
+for (const [file, re, shape] of CURRENT_CONTRACT_DECLS) {
+  const m = readFileSync(file, 'utf8').match(re);
+  if (!m) { floorGaps.push(`${file}: ${shape} is gone — a reworded current-contract sentence must fail loud, not drop out silently`); continue; }
+  for (const captured of m.slice(1)) {
+    const expected = captured.startsWith('>=') ? nextFloorRange : piAi;
+    if (captured !== expected) floorGaps.push(`${file}: ${shape} declares "${captured}", but the floor is ${piAi} (${nextFloorRange})`);
+  }
+}
+assert.deepEqual(floorGaps, [],
+  `[QK:PI-FLOOR-SINGLE-SOURCE] the pi floor is declared on four mechanical surfaces — the package's exact dev pins and peer ceiling, run.sh's install constellation, the pnpm workspace closure, and the current-contract sentences in the docs — and every one of them must name the SAME floor. A bump that moves three of the four is the ordinary way this breaks, and the surface left behind is the one nothing else reads`);
+
 // Guard the guard: if the patterns ever stop matching, the loops above pass
 // vacuously and the docs fall back OUT of the gate without a word.
 assert.ok(rangeDecls >= 5, `expected at least 5 pi range declarations across the baseline docs, found ${rangeDecls} — the doc scan matched (almost) nothing and would pass vacuously`);
@@ -2959,6 +3129,21 @@ check_acp_sdk_surface() {
   run_vitest test/acp-sdk-surface.contract.test.ts
 }
 
+check_pi_queue_oracle() {
+  # #120 P2. The PUBLIC execution coordinate for `test/pi-queue.oracle.test.ts`, and the reason it
+  # needs one: the discovery door below selects `pi-extensions/**/*.test.ts` and
+  # `plugins/herdr/**/*.test.mjs` and deliberately NOT `test/**`, so a file under `test/` that
+  # nothing names is green only when somebody runs `pnpm test` by hand. This oracle backs every
+  # sentence the receipt and DELIVERY.md make about `queued-steer` / `queued-follow-up`, which is
+  # exactly the kind of claim that must not rest on a manual run.
+  #
+  # It is a Vitest file, not a new hand-built gate: the subject is the INSTALLED
+  # @earendil-works/pi-agent-core (exact dev pin), driven with a fake stream function. Zero model,
+  # zero network, zero child process.
+  section "pi receiver queue oracle (installed pi-agent-core, no model)"
+  run_vitest test/pi-queue.oracle.test.ts
+}
+
 check_tests_beside_behavior() {
   # The DISCOVERY door (issue #119 V2). A `.test.ts` beside a pi extension or a
   # `.test.mjs` beside the herdr plugin lib is run by public `pnpm check` without
@@ -2989,6 +3174,44 @@ check_tests_beside_behavior() {
     fi
   done
 
+  # #120 P2 — THE OTHER HALF OF THE SAME CONTRACT: what this door deliberately does NOT open.
+  # `test/**` is excluded on purpose (see the positional-substring measurement above), so a vitest
+  # file under `test/` is reached by public `pnpm check` ONLY if some run.sh verb names it AND that
+  # verb is in the `check:vitest` chain. Measured: a queue-oracle file under test/ landed green under
+  # a manual `pnpm test` while the floor never ran it at all. A claim proven only when somebody
+  # remembers to run it by hand is not on the floor, so the reachability is asserted rather than
+  # assumed — every file, every time, with no filename list living here either.
+  #
+  # AND NO PATH IS SPELLED IN THIS FUNCTION. Measured: naming the oracle's path in the comment above
+  # made the scan match its OWN comment — this verb is in the chain, so every file appeared reachable
+  # and the regression mutant survived. A checker that can satisfy itself is not a checker.
+  local chain tf verb
+  chain="$(cd "$REPO_DIR" && node -e 'process.stdout.write(require("./package.json").scripts["check:vitest"] ?? "")')"
+  while IFS= read -r tf; do
+    [ -n "$tf" ] || continue
+    # The enclosing `check_xxx()` is the coordinate; `check:vitest` must call its `check-xxx` form.
+    # ONE failure message, because the claim token may appear exactly once in a gate source — and
+    # the two ways this can break ("nothing names it" / "what names it is never called") are the
+    # same defect seen from two sides: the file is not on the floor.
+      # THE COORDINATE IS AN EXECUTABLE LINE, NOT A MENTION. Measured: when this scan accepted any
+    # line inside an enclosing function that contained the path, deleting the `run_vitest` call
+    # itself left the function's own COMMENT matching — the file stopped being run and the checker
+    # stayed green. So only `run_vitest <path>` counts, and the two seams are separated: does
+    # something execute it, and is that something on the floor.
+    verb="$(awk -v needle="$tf" -v chain="$chain" '
+      /^check_[a-z0-9_]+\(\) \{/ { fn = $1; sub(/\(\).*/, "", fn); gsub(/_/, "-", fn) }
+      $1 == "run_vitest" && fn != "" { for (i = 2; i <= NF; i++) if ($i == needle) { print fn; found = 1; exit } }
+      END { if (!found) print "" }' "$REPO_DIR/run.sh")"
+    if [ -z "$verb" ]; then
+      fail "[QK:VITEST-TEST-DIR-HAS-COORDINATE] $tf is under test/, which the discovery door deliberately excludes, and no run.sh verb EXECUTES it — a mention in a comment is not a coordinate, so nothing runs this file at all"
+      return 1
+    fi
+    if ! printf '%s' "$chain" | grep -qF "$verb"; then
+      fail "[QK:VITEST-TEST-DIR-ON-THE-FLOOR] $tf is executed by run.sh verb '$verb', which check:vitest does not call — the file has a coordinate nobody walks, so it is green only when somebody remembers to run pnpm test by hand"
+      return 1
+    fi
+  done < <(cd "$REPO_DIR" && find test -type f -name '*.test.ts' -print | LC_ALL=C sort)
+
   local -a selected=()
   local f
   while IFS= read -r f; do
@@ -3470,8 +3693,10 @@ check_pack() {
 #
 # (1) The version BOUNDARY. A pnpm .pnpm entry is `<name>@<version>` followed by either
 #     `_<peer-hash>` or end-of-name (measured pnpm 11.20.0 on this tree), so an unbounded
-#     substring match would bless a lookalike such as `@0.85.10` while announcing the pinned
-#     floor — a false-green oracle (found by independent review, 2026-08-25).
+#     substring match would bless a lookalike whose version merely STARTS with the pin — a
+#     prerelease such as `@0.86.0-beta.1`, or the `@0.85.10` shape that first exposed this —
+#     while announcing the pinned floor: a false-green oracle (found by independent review,
+#     2026-08-25).
 # (2) The name PREFIX covers the whole @earendil-works closure, not the `pi-` families alone.
 #     0.85.0 added `@earendil-works/chord`, declared as a runtime `dependencies` entry by
 #     pi-coding-agent, pi-agent-core, pi-client and pi-protocol — inside the closure, with a
@@ -3479,15 +3704,17 @@ check_pack() {
 #     `@earendil-works+chord@0.85.1` next to the seven pi entries, and the old
 #     `^@earendil-works+pi-` filter did not see it: chord would have floated silently while
 #     this gate printed a verified pin. The prefix is the closure's org, not one family in it.
-#     (The measured peer-hash suffix moved too — `_ws@8.21.3` at 0.85.1 where 0.84.4 carried
-#     `_@modelcontextprotocol+sdk@…` — which is exactly what property (1)'s `(_|$)` absorbs;
-#     both shapes are fixtures below so a future suffix change cannot pass vacuously.)
+#     (The measured peer-hash suffix keeps moving — `_@modelcontextprotocol+sdk@…` at 0.84.4,
+#     `_ws@8.21.3` at 0.85.1, and `[측정 2026-09-20]` the combined
+#     `_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6` on a 0.86.0 tree —
+#     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
+#     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@0\.85\.1(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@0\.87\.1(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
-# false-green shape (it contains no 0.85.10 and no off-pin chord), so the oracle is proven
+# false-green shape (it contains no prefix-extended version and no off-pin chord), so the oracle is proven
 # against fixture listings. One cell per property of pack_install_leaked_pi, so a regression
 # in either is named by its own signature rather than folded into a single verdict. Exposed
 # as its own snapshot-safe subcommand because the heavy check-pack-install cannot run inside
@@ -3497,30 +3724,33 @@ pack_install_leaked_pi() {
 check_pack_pin_matcher() {
   local matcher_probe
 
-  # Cell 1 — the version boundary. Both measured peer-hash shapes are fixtures: the
-  # 0.84.4-era `_@modelcontextprotocol+sdk@…` and the `_ws@8.21.3` observed on a real
-  # 0.85.1 tree. Neither may leak; the two lookalikes must.
+  # Cell 1 — the version boundary. Every measured peer-hash shape is a fixture: the
+  # 0.84.4-era `_@modelcontextprotocol+sdk@…`, the `_ws@8.21.3` observed on a real
+  # 0.85.1 tree, and `[측정 2026-09-20]` the combined suffix a 0.86.0 install carries.
+  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
+  # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.85.1' \
-    '@earendil-works+pi-ai@0.85.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.85.1_ws@8.21.3' \
-    '@earendil-works+pi-ai@0.85.10' \
-    '@earendil-works+pi-agent-core@0.85.0' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.85.10
-@earendil-works+pi-agent-core@0.85.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.85.10/0.85.0 lookalikes and pass 0.85.1 bare or with either measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.87.1' \
+    '@earendil-works+pi-ai@0.87.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.87.1_ws@8.21.3' \
+    '@earendil-works+pi-ai@0.87.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.87.1-beta.1' \
+    '@earendil-works+pi-agent-core@0.87.0' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.87.1-beta.1
+@earendil-works+pi-agent-core@0.87.0' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 0.87.1-beta.1 and the off-pin 0.87.0 lookalikes, and pass 0.87.1 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
   # Cell 2 — the closure prefix. chord is a non-`pi-` member of the same runtime closure
-  # (0.85.0 onward). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
+  # (0.85.0 onward, still true at 0.87.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+chord@0.85.1' \
-    '@earendil-works+chord@0.85.0' \
-    '@earendil-works+pi-ai@0.85.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+chord@0.85.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol at 0.85.x) — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+chord@0.87.1' \
+    '@earendil-works+chord@0.87.0' \
+    '@earendil-works+pi-ai@0.87.1' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+chord@0.87.0' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0 and `[측정 2026-09-23]` at 0.87.1: the same four @earendil-works direct deps) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -3752,8 +3982,10 @@ _check_pack_install_impl() {
 
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
-  # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.85.x`), so with no lockfile in this fresh temp project it
+  # pi-agent-core is pinned for TWO reasons now. Directly: `test/pi-queue.oracle.test.ts` imports
+  # it to drive a real `Agent` (#120 P2), so its version is part of what the receipt's claims are
+  # true OF. And transitively, which is why it was pinned here first: pi-coding-agent depends
+  # on it by CARET (`^0.86.x`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3782,19 +4014,31 @@ _check_pack_install_impl() {
   # It is pinned here for the first time. The leak assertion below covers every
   # other @earendil-works package too — but only because the matcher's prefix was
   # widened from `pi-` to the org in the same change; before that it was blind to
-  # precisely this class of new member. The verified floor is 0.85.1 as of 2026-09-06.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.85.x peers + chord + typebox)"
+  # precisely this class of new member.
+  #
+  # `[측정 2026-09-20]` at 0.86.0 the constellation SHRANK for the first time:
+  # `npm view @earendil-works/pi-coding-agent@0.86.0 dependencies` lists only
+  # {chord, pi-ai, pi-tui, pi-agent-core} — pi-client and pi-protocol are no
+  # longer reachable from the three packages we import (pi-client still carries
+  # {chord, pi-protocol}, pi-protocol still carries {chord}, both published at
+  # 0.86.0). Their explicit pins stay: a pin that is momentarily redundant costs
+  # two frozen rows in a temp tree, while retiring one is how a caret re-enters
+  # the closure unwatched on the next minor — the same shape as the 2026-07-21
+  # pi-agent-core incident. The list moves WITH the floor and is re-measured at
+  # each bump, never pruned on a single quiet minor.
+  # The verified floor is 0.86.0 as of 2026-09-20.
+  echo "[check-pack-install] pnpm add into $tmp (with 0.87.x peers + chord + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.85.1" \
-    "@earendil-works/pi-coding-agent@0.85.1" \
-    "@earendil-works/pi-tui@0.85.1" \
-    "@earendil-works/pi-agent-core@0.85.1" \
-    "@earendil-works/pi-client@0.85.1" \
-    "@earendil-works/pi-protocol@0.85.1" \
-    "@earendil-works/pi-telemetry@0.85.1" \
-    "@earendil-works/chord@0.85.1" \
+    "@earendil-works/pi-ai@0.87.1" \
+    "@earendil-works/pi-coding-agent@0.87.1" \
+    "@earendil-works/pi-tui@0.87.1" \
+    "@earendil-works/pi-agent-core@0.87.1" \
+    "@earendil-works/pi-client@0.87.1" \
+    "@earendil-works/pi-protocol@0.87.1" \
+    "@earendil-works/pi-telemetry@0.87.1" \
+    "@earendil-works/chord@0.87.1" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3804,17 +4048,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works package present — direct or transitive, top level or nested,
-  # chord included — must be the pinned 0.85.1. Anything else means an unpinned caret
+  # chord included — must be the pinned 0.86.0. Anything else means an unpinned caret
   # floated and the rest of this gate would be exercising a runtime nobody verified,
-  # while still printing "pinned pi 0.85.1". Fail loud instead of proving the wrong floor.
+  # while still printing "pinned pi 0.86.0". Fail loud instead of proving the wrong floor.
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.85.1):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.87.1):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.85.1 (chord included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.87.1 (chord included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4620,7 +4864,7 @@ function finish(trimmed) {
   // gate that exists to catch "green clone, dead consumer". Equality also catches the
   // other direction the narrow-surface rule cares about: an extra or duplicated verb
   // reaching hosts without a decision. Written sorted; `names` is sorted above.
-  const EXPECT_TOOLS = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
     console.error('installed MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
     process.exit(1);
@@ -5179,12 +5423,12 @@ function finishOk(trimmed) {
   }
   const names = tools.map((t) => t?.name).sort();
   // EXACT set, not a floor. This is the assertion behind the operator-facing claim that
-  // `entwurf check-bridge` proves the installed bytes list the seven garden tools — and
+  // `entwurf check-bridge` proves the installed bytes list the eight garden tools — and
   // under an installed package this launcher IS the dist branch of start.sh, so a subset
   // check here let an artifact missing entwurf_fresh_call / entwurf_resume_call read as a
   // green bridge. Equality also refuses an undecided extra verb. Written sorted; `names`
   // is sorted above.
-  const expected = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const expected = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== expected.length || expected.some((n, i) => names[i] !== n)) {
     console.error(`MCP tool set MISMATCH — want exactly [${expected.join(',')}] got [${names.join(',')}]`);
     process.exit(1);
@@ -6381,6 +6625,12 @@ case "$cmd" in
   check-entwurf-v2-send)
     check_entwurf_v2_send
     ;;
+  check-entwurf-v2-runner)
+    check_entwurf_v2_runner
+    ;;
+  check-control-send-receipt)
+    check_control_send_receipt
+    ;;
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
@@ -7342,6 +7592,9 @@ case "$cmd" in
   check-acp-sdk-surface)
     check_acp_sdk_surface
     ;;
+  check-pi-queue-oracle)
+    check_pi_queue_oracle
+    ;;
   check-tests-beside-behavior)
     check_tests_beside_behavior
     ;;