@junghanacs/entwurf 0.25.0 → 0.30.0

package/run.sh

@@ -140,6 +140,9 @@ Usage:
   ./run.sh check-omp-fresh-preflight   # #87 C: the OMP fresh preflight reproduces omp_agent_dir and the tools.xdev read in TS (it runs from two emit depths and cannot call a sibling script). This drives the SHIPPED shell/python leaves over the same inputs — refusals included — and requires the TS half to agree, so the reproduction cannot silently drift from the installer's own oracle
   ./run.sh check-codex-sender-identity # Codex tools/call _meta triple agreement + addressable record join + cross-carrier conflict refusal
   ./run.sh check-codex-bridge-identity # real MCP bridge request identity for entwurf_self/v2/fresh; malformed or conflicting _meta fails loud
+  ./run.sh check-pi-mcp-register      # #125: mutant execution coordinate for pi-extensions/entwurf-control.test.ts — the real extension births through Pi's real loader and registers the compiled bridge after birth, before UI, direct with two hidden. Needs build-bridge
+  ./run.sh check-pi-mcp-bridge        # #125: a real Pi runtime (builtin MCP, default stdio, faux model only) spawns the COMPILED bridge as the born citizen — six prefixed verbs declared, hidden two absent, child env = record = entwurf_self, cwd = session cwd; newSession vendor conformance observed (old child gone, new record+child, old record kept). Needs build-bridge
+  ./run.sh check-pi-bridge-sender     # #125: real bridge pi-session carrier is served only when it names a readable pi RECORD; missing / foreign-backend / unreadable each refuse with their own cause; no socket = replyable:false, not refusal
   ./run.sh check-codex-native-push    # app-server WebSocket-over-UDS probe + measured one-shot codex queue delivery; no replay
   ./run.sh check-codex-birth-hook     # sandboxed payload + declaration: first-turn V3 birth, one record per thread, top-level event predicate, no markers
   ./run.sh check-codex-fresh-preflight # pre-mutation birth/MCP/thread-title/default-app-server readiness
@@ -199,7 +202,7 @@ Usage:
   ./run.sh smoke-omp-receive-live      # #87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
-  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO mutants and never snapshots this repo (~8s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
+  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
@@ -277,6 +280,7 @@ Usage:
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (a prefix-extended @0.86.0-beta.1 and an off-pin @0.85.1 must leak, @0.86.0 bare or with any measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-consumer-roots  # pure self-test of check-pack-install's consumer sandbox: under a poisoned inherited HOME/XDG/PI_CODING_AGENT_DIR every writable root a consumer subcall sees resolves inside its own consumer home; snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -1336,6 +1340,24 @@ check_entwurf_resume_args() {
   run_vitest pi-extensions/lib/entwurf-resume-args.test.ts
 }
 
+check_acp_foreground_only() {
+  # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
+  # MUTANT EXECUTION COORDINATE for scripts/mutants/acp-foreground-only.json (same reasoning as
+  # check_entwurf_resume_args above), with a file filter narrow on purpose.
+  section "claude ACP foreground-only launch env (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
+}
+
+check_pi_mcp_register() {
+  # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
+  # MUTANT EXECUTION COORDINATE for scripts/mutants/pi-mcp-register.json (same reasoning as
+  # check_entwurf_resume_args above): run_vitest is what emits the structured failed-test titles a
+  # kill is attributed from. It sits in check:hermetic, not check:contracts, because the subject
+  # registers the COMPILED bridge and refuses by name when `build-bridge` has not run.
+  section "pi MCP registration after birth (mutant execution coordinate)"
+  run_vitest pi-extensions/entwurf-control.test.ts
+}
+
 check_mux_launcher_fence() {
   # Deterministic gate for the shared operator-launcher fence (issue #67):
   # scripts/lib/claude-launcher-fence.ts plus its wiring into BOTH mux LIVE smokes. Replants the
@@ -2185,11 +2207,11 @@ assert.equal(peerTui, piAi,
 // an open `>=` floor is exactly how the next installer re-acquires the drift.
 // The floor is also the HARD MINIMUM a consumer install resolves: at `>=0.86.0`
 // an existing 0.85.1 host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.86.0 <0.87`).
+// Expected shape: `>=<devDep> <<major>.<minor+1>` (e.g. `>=0.86.0 <0.87`, `>=1.0.0 <1.1`).
+// Pi 1.0 did not change the rule: an unverified minor is still unverified, so the ceiling
+// stays the next minor of the pin's own major.
 const [piMaj, piMin] = piAi.split('.').map(Number);
-assert.equal(piMaj, 0,
-  `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
-const expectedPeer = `>=${piAi} <0.${piMin + 1}`;
+const expectedPeer = `>=${piAi} <${piMaj}.${piMin + 1}`;
 const peerDepAi = pkg.peerDependencies?.['@earendil-works/pi-ai'];
 const peerDepCoding = pkg.peerDependencies?.['@earendil-works/pi-coding-agent'];
 const peerDepTui = pkg.peerDependencies?.['@earendil-works/pi-tui'];
@@ -2258,13 +2280,13 @@ function stripBumpLedger(file, text) {
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
   const text = stripBumpLedger(file, readFileSync(file, 'utf8'));
-  // Closed-range declarations: `>=<floor> <0.<ceiling>` (spaces optional).
-  for (const [decl, floor, ceilMinor] of text.matchAll(/>=\s?(\d+\.\d+\.\d+)\s?<\s?0\.(\d+)/g)) {
+  // Closed-range declarations: `>=<floor> <<major>.<ceiling>` (spaces optional).
+  for (const [decl, floor, ceilMajor, ceilMinor] of text.matchAll(/>=\s?(\d+\.\d+\.\d+)\s?<\s?(\d+)\.(\d+)/g)) {
     rangeDecls++;
     assert.equal(floor, piAi,
       `${file}: declared pi floor in "${decl}" is ${floor}, but the devDep pin is ${piAi} — a baseline doc may not advertise a version no gate drives`);
-    assert.equal(Number(ceilMinor), piMin + 1,
-      `${file}: declared pi ceiling in "${decl}" must be the next minor (0.${piMin + 1})`);
+    assert.equal(`${ceilMajor}.${ceilMinor}`, `${piMaj}.${piMin + 1}`,
+      `${file}: declared pi ceiling in "${decl}" must be the next minor (${piMaj}.${piMin + 1})`);
   }
   // Exact install pins: `@earendil-works/pi-<pkg>@<version>`.
   for (const [decl, ver] of text.matchAll(/@earendil-works\/pi-(?:ai|coding-agent|tui)@(\d+\.\d+\.\d+)/g)) {
@@ -2295,12 +2317,14 @@ for (const [file, re, shape] of PROSE_DECLS) {
 // ONE assertion, because the claim token may appear exactly once in a gate source.
 // Every way the floor can fragment is collected first and named individually in the
 // failure, so "which surface" is never lost to the single-token rule.
-const nextFloorRange = `>=${piAi} <0.${piMin + 1}`;
+const nextFloorRange = `>=${piAi} <${piMaj}.${piMin + 1}`;
 const floorGaps = [];
 const PI_CONSTELLATION = [
   '@earendil-works/pi-ai', '@earendil-works/pi-coding-agent', '@earendil-works/pi-tui',
   '@earendil-works/pi-agent-core', '@earendil-works/pi-client', '@earendil-works/pi-protocol',
   '@earendil-works/pi-telemetry', '@earendil-works/chord',
+  // `[측정 2026-09-30]` 0.99.1: pi-coding-agent's runtime deps gained the built-in extensions' packages.
+  '@earendil-works/pi-codemode', '@earendil-works/pi-mcp',
 ];
 const sameSet = (got, want, where) => {
   const missing = want.filter((n) => !got.includes(n));
@@ -2343,9 +2367,9 @@ if (!matcherPin) {
 // measurement in docs/mux-launch-rail.md, for one) are deliberately NOT scanned:
 // they record what was true then, and rewriting them would falsify evidence.
 const CURRENT_CONTRACT_DECLS = [
-  ['plugins/herdr/README.md', /npm install -g "@earendil-works\/pi-coding-agent@(>=[\d.]+ <0\.\d+)"/, 'the herdr install line'],
-  ['docs/mux-launch-rail.md', /현 supported range 는 `(>=[\d.]+ <0\.\d+)`/, "mux-launch-rail's current supported range"],
-  ['docs/acp-backend-rail.md', /devDep exact `(\d+\.\d+\.\d+)`, peer `(>=[\d.]+ <0\.\d+)`/, "the ACP support row's exact+range pair"],
+  ['plugins/herdr/README.md', /npm install -g "@earendil-works\/pi-coding-agent@(>=[\d.]+ <\d+\.\d+)"/, 'the herdr install line'],
+  ['docs/mux-launch-rail.md', /현 supported range 는 `(>=[\d.]+ <\d+\.\d+)`/, "mux-launch-rail's current supported range"],
+  ['docs/acp-backend-rail.md', /devDep exact `(\d+\.\d+\.\d+)`, peer `(>=[\d.]+ <\d+\.\d+)`/, "the ACP support row's exact+range pair"],
 ];
 for (const [file, re, shape] of CURRENT_CONTRACT_DECLS) {
   const m = readFileSync(file, 'utf8').match(re);
@@ -2864,13 +2888,14 @@ if (typeof FLOOR !== 'string' || !/^\d+\.\d+\.\d+$/.test(FLOOR)) {
   console.error(`[check-pi-runtime-version] FAIL: package.json devDependencies['@earendil-works/pi-coding-agent'] must be an EXACT x.y.z pin to serve as the runtime floor (got ${FLOOR ?? 'nothing'})`);
   process.exit(1);
 }
-// The declared contract is a CLOSED range (`>=<devDep> <0.<minor+1>`, enforced on
+// The declared contract is a CLOSED range (`>=<devDep> <<major>.<minor+1>`, enforced on
 // package.json by check-dep-versions), so the runtime check must be closed too.
 // A floor-only comparison would bless a resolved pi ABOVE the ceiling — and an
 // out-of-range pi is exactly the drift this cut exists to stop: 0.80.6 landed on
 // the dev box while the repo still declared 0.80.3, and every gate stayed green.
 // Verifying only half of a declared range is the same lie in the other direction.
-const CEILING = `0.${Number(FLOOR.split('.')[1]) + 1}.0`;
+const [FLOOR_MAJOR, FLOOR_MINOR] = FLOOR.split('.').map(Number);
+const CEILING = `${FLOOR_MAJOR}.${FLOOR_MINOR + 1}.0`;
 const cmp = (a, b) => {
   const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
   for (let i = 0; i < 3; i++) { if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0); }
@@ -3710,7 +3735,7 @@ check_pack() {
 #     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
 #     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@0\.87\.1(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@1\.0\.0(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
@@ -3730,35 +3755,88 @@ check_pack_pin_matcher() {
   # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
   # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.87.1' \
-    '@earendil-works+pi-ai@0.87.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.87.1_ws@8.21.3' \
-    '@earendil-works+pi-ai@0.87.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.87.1-beta.1' \
-    '@earendil-works+pi-agent-core@0.87.0' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.87.1-beta.1
-@earendil-works+pi-agent-core@0.87.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 0.87.1-beta.1 and the off-pin 0.87.0 lookalikes, and pass 0.87.1 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@1.0.0' \
+    '@earendil-works+pi-ai@1.0.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.0.0_ws@8.21.3' \
+    '@earendil-works+pi-ai@1.0.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.0.0-beta.1' \
+    '@earendil-works+pi-agent-core@0.87.1' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.0.0-beta.1
+@earendil-works+pi-agent-core@0.87.1' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.0.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.0.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
   # Cell 2 — the closure prefix. chord is a non-`pi-` member of the same runtime closure
-  # (0.85.0 onward, still true at 0.87.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
+  # (0.85.0 onward, still true at 0.99.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
+    '@earendil-works+chord@1.0.0' \
     '@earendil-works+chord@0.87.1' \
-    '@earendil-works+chord@0.87.0' \
-    '@earendil-works+pi-ai@0.87.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+chord@0.87.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0 and `[측정 2026-09-23]` at 0.87.1: the same four @earendil-works direct deps) — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@1.0.0' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+chord@0.87.1' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0, `[측정 2026-09-23]` at 0.87.1 and `[측정 2026-09-30]` at 0.99.1, where pi-coding-agent adds pi-codemode and pi-mcp beside them) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
   echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with either measured peer-hash) and covers the whole @earendil-works closure (chord included)"
 }
 
+# The writable roots of ONE consumer sandbox, shared by every consumer subcall of
+# check-pack-install that drives an installed `run.sh` writer. The writers resolve their agent
+# dir as `${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}` (`resolve`/`install` below), so swapping HOME
+# alone let an INHERITED PI_CODING_AGENT_DIR win and the consumer's user-scope registration land
+# outside the sandbox (#125, measured 2026-10-01: an inherited agent dir received the npm
+# consumer's settings.json while the gate looked under the temp HOME). Every root is named here,
+# none is left to the caller's environment. One NAME=value per line; read with mapfile.
+pack_install_consumer_env() {
+  local h="$1"
+  printf '%s\n' \
+    "HOME=$h" \
+    "XDG_CONFIG_HOME=$h/.config" \
+    "XDG_DATA_HOME=$h/.local/share" \
+    "XDG_STATE_HOME=$h/.local/state" \
+    "XDG_CACHE_HOME=$h/.cache" \
+    "PI_CODING_AGENT_DIR=$h/.pi/agent"
+}
+
+# Self-test of the consumer roots, snapshot-safe like the pin matcher: under a POISONED inherited
+# environment every root a consumer subcall sees must sit inside the consumer home. Runs first
+# inside check-pack-install too, so the heavy gate cannot proceed on a leaking root set.
+check_pack_consumer_roots() {
+  local h="/pack-consumer-home" roots=() seen line
+  mapfile -t roots < <(pack_install_consumer_env "$h")
+  seen=$(env HOME=/poisoned/home XDG_CONFIG_HOME=/poisoned/config XDG_DATA_HOME=/poisoned/data \
+    XDG_STATE_HOME=/poisoned/state XDG_CACHE_HOME=/poisoned/cache PI_CODING_AGENT_DIR=/poisoned/agent \
+    "${roots[@]}" sh -c 'printf "%s\n" "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME" "$PI_CODING_AGENT_DIR"')
+  while IFS= read -r line; do
+    case "$line" in
+      "$h" | "$h"/*) ;;
+      *)
+        fail "[QK:PACK-INSTALL-CONSUMER-ROOTS-CONTAINED] every writable root of a consumer subcall must be inside its own consumer home ($h) whatever the caller inherited — got: $(printf '%s' "$seen" | tr '\n' ' ')"
+        return 1
+        ;;
+    esac
+  done <<<"$seen"
+  echo "[check-pack-consumer-roots] ok — HOME, the four XDG roots and PI_CODING_AGENT_DIR of a consumer subcall all resolve inside the consumer home under a poisoned inherited environment"
+}
+
+# Hand-built oracle for the REAL consumer run: check-pack-install exports a sentinel agent dir for
+# its whole body, standing in for whatever a caller inherits; a subcall that falls back to it
+# writes there, and this names the stage that did.
+pack_install_sentinel_untouched() {
+  local sentinel="$1" stage="$2" found
+  found=$(find "$sentinel" -mindepth 1 2>/dev/null | head -5)
+  if [ -n "$found" ]; then
+    fail "[QK:PACK-INSTALL-INHERITED-AGENTDIR-UNTOUCHED] $stage wrote into the inherited PI_CODING_AGENT_DIR instead of its own consumer sandbox:"
+    printf '%s\n' "$found" | sed 's/^/    /' >&2
+    return 1
+  fi
+}
+
 _check_pack_install_impl() {
   check_pack_pin_matcher || return 1
+  check_pack_consumer_roots || return 1
 
   # Heavy publish gate. Runs the remaining three checks in #13's
   # publish checklist that check_pack (dry-run only) does not cover:
@@ -3797,6 +3875,11 @@ _check_pack_install_impl() {
   local pack_tmp
   pack_tmp=$(mktemp -d -t entwurf-pack.XXXXXX)
   tgz_path="${pack_tmp}/${tgz_name}"
+  # Stand-in for an inherited agent dir, scoped to this function: no consumer subcall may fall
+  # back to it (pack_install_sentinel_untouched). It also keeps the caller's own one out of reach.
+  local agentdir_sentinel="${pack_tmp}/inherited-agent-dir"
+  mkdir -p "$agentdir_sentinel"
+  local -x PI_CODING_AGENT_DIR="$agentdir_sentinel"
 
   # 0.12.1 C — stale-dist guard. `tsc` emit does NOT prune orphaned files from
   # outDir, and `files: ["mcp/"]` would carry any leftover dist file into the
@@ -4027,18 +4110,24 @@ _check_pack_install_impl() {
   # pi-agent-core incident. The list moves WITH the floor and is re-measured at
   # each bump, never pruned on a single quiet minor.
   # The verified floor is 0.86.0 as of 2026-09-20.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.87.x peers + chord + typebox)"
+  # `[측정 2026-09-30]` at 0.99.1 the constellation GREW: pi-coding-agent now declares
+  # @earendil-works/pi-codemode and @earendil-works/pi-mcp as runtime dependencies (the built-in
+  # codemode and MCP extensions), so both are pinned beside the eight. pi-client and pi-protocol are
+  # still published at 0.99.1 and keep their pins under the rule above.
+  echo "[check-pack-install] pnpm add into $tmp (with 1.0.x peers + chord + codemode + mcp + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.87.1" \
-    "@earendil-works/pi-coding-agent@0.87.1" \
-    "@earendil-works/pi-tui@0.87.1" \
-    "@earendil-works/pi-agent-core@0.87.1" \
-    "@earendil-works/pi-client@0.87.1" \
-    "@earendil-works/pi-protocol@0.87.1" \
-    "@earendil-works/pi-telemetry@0.87.1" \
-    "@earendil-works/chord@0.87.1" \
+    "@earendil-works/pi-ai@1.0.0" \
+    "@earendil-works/pi-coding-agent@1.0.0" \
+    "@earendil-works/pi-tui@1.0.0" \
+    "@earendil-works/pi-agent-core@1.0.0" \
+    "@earendil-works/pi-client@1.0.0" \
+    "@earendil-works/pi-protocol@1.0.0" \
+    "@earendil-works/pi-telemetry@1.0.0" \
+    "@earendil-works/chord@1.0.0" \
+    "@earendil-works/pi-codemode@1.0.0" \
+    "@earendil-works/pi-mcp@1.0.0" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -4054,11 +4143,11 @@ _check_pack_install_impl() {
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.87.1):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.0.0):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.87.1 (chord included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.0.0 (chord included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4271,11 +4360,14 @@ _check_pack_install_impl() {
     ls -l "$npmroot/node_modules/.bin" 2>/dev/null | sed 's/^/    /' >&2 || true
     return 1
   fi
-  wire_log=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
+  local consumer_env=()
+  mapfile -t consumer_env < <(pack_install_consumer_env "$npmhome")
+  wire_log=$(env "${consumer_env[@]}" "$npm_pkg/run.sh" install "$npmproj" 2>&1) || {
     fail "[check-pack-install] npm-managed run.sh install failed (preflight rejected hoisted deps?):"
     echo "$wire_log" | tail -15 | sed 's/^/    /' >&2
     return 1
   }
+  pack_install_sentinel_untouched "$agentdir_sentinel" "npm-managed run.sh install" || return 1
   if [ ! -f "$npmproj/.pi/settings.json" ]; then
     fail "[check-pack-install] npm-managed run.sh install did not write settings.json:"
     echo "$wire_log" | tail -15 | sed 's/^/    /' >&2
@@ -4313,7 +4405,7 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
   # a KNOWN flag and the entwurf provider must load, sourced only from user scope.
   # Before the fix this printed "Unknown options: --entwurf-control".
   local foreign_out
-  foreign_out=$(cd "$tmp" && HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" PI_CODING_AGENT_DIR="$npmhome/.pi/agent" "$pi_bin" --entwurf-control --list-models entwurf 2>&1) || {
+  foreign_out=$(cd "$tmp" && env "${consumer_env[@]}" "$pi_bin" --entwurf-control --list-models entwurf 2>&1) || {
     fail "[check-pack-install] foreign-cwd --entwurf-control smoke failed (user-scope citizen not loading?):"
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1
@@ -4338,7 +4430,7 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
   }
   npm2_pkg="$npmroot2/node_modules/@junghanacs/entwurf"
   set +e
-  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" install "$npmproj2" 2>&1)
+  two_root_out=$(env "${consumer_env[@]}" "$npm2_pkg/run.sh" install "$npmproj2" 2>&1)
   two_root_rc=$?
   set -e
   if [ "$two_root_rc" -eq 0 ] || ! grep -q "takeover-user-scope" <<<"$two_root_out"; then
@@ -4359,7 +4451,7 @@ sys.exit(0 if ok_a and not bad_b else 1)
     return 1
   fi
   set +e
-  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm2_pkg/run.sh" takeover-user-scope 2>&1)
+  two_root_out=$(env "${consumer_env[@]}" "$npm2_pkg/run.sh" takeover-user-scope 2>&1)
   two_root_rc=$?
   set -e
   if [ "$two_root_rc" -ne 0 ] || ! grep -q "takeover: user-scope entwurf registration moved" <<<"$two_root_out"; then
@@ -4391,7 +4483,7 @@ sys.exit(0 if st.get('installerRoot','').rstrip('/')== '$npm2_pkg' else 1)
     return 1
   fi
   set +e
-  two_root_out=$(HOME="$npmhome" XDG_DATA_HOME="$npmhome/.local/share" XDG_STATE_HOME="$npmhome/.local/state" XDG_CACHE_HOME="$npmhome/.cache" "$npm_pkg/run.sh" remove-user-scope 2>&1)
+  two_root_out=$(env "${consumer_env[@]}" "$npm_pkg/run.sh" remove-user-scope 2>&1)
   two_root_rc=$?
   set -e
   if [ "$two_root_rc" -eq 0 ] || ! python3 -c "
@@ -4404,6 +4496,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     echo "$two_root_out" | tail -8 | sed 's/^/    /' >&2
     return 1
   fi
+  pack_install_sentinel_untouched "$agentdir_sentinel" "two-root ownership row (install / takeover-user-scope / remove-user-scope)" || return 1
   echo "[check-pack-install] two-root ownership row pass (second root: normal install refused naming takeover-user-scope; explicit takeover moved entry + provider installerRoot old->new; old root's inverse refused)"
 
   # Installed-package aggregate `setup` row (#86 C1, review blocker 2026-08-26):
@@ -5153,7 +5246,9 @@ process.stdout.write(resolveCodexDefaultSocketPath(process.env));
 JSON
   local pc_seed_sha
   pc_seed_sha=$(sha256sum "$pc_store/$pc_record" | cut -d' ' -f1)
-  local pc_env=(HOME="$pc_home" XDG_DATA_HOME="$pc_home/.local/share" XDG_STATE_HOME="$pc_home/.local/state" XDG_CACHE_HOME="$pc_home/.cache" CLAUDE_CONFIG_DIR="$pc_cfg" FAKE_CLAUDE_LOG="$pc_claude_log" PATH="$fake_claude_dir:$npmroot/node_modules/.bin:$PATH")
+  # `-u`: the default resolution is only proven if no inherited agent dir can pre-empt it
+  # (check-pack-install exports a sentinel one for its whole body).
+  local pc_env=(-u PI_CODING_AGENT_DIR HOME="$pc_home" XDG_DATA_HOME="$pc_home/.local/share" XDG_STATE_HOME="$pc_home/.local/state" XDG_CACHE_HOME="$pc_home/.cache" CLAUDE_CONFIG_DIR="$pc_cfg" FAKE_CLAUDE_LOG="$pc_claude_log" PATH="$fake_claude_dir:$npmroot/node_modules/.bin:$PATH")
   local pc_before pc_after pc_out pc_rc
   pc_before=$(cd "$pc_home" && find . -type f -exec sha256sum {} + 2>/dev/null | sort)
 
@@ -5338,6 +5433,7 @@ JSON
   fi
   echo "[check-pack-install] installed doctor dispatch lock pass (store-scan → dist JS, v2-surface deferred)"
 
+  pack_install_sentinel_untouched "$agentdir_sentinel" "a later installed-consumer cell" || return 1
   ok "[check-pack-install] publish install smoke pass"
   return 0
 }
@@ -5563,15 +5659,15 @@ setup_mode() {
 }
 
 # Supported pi range, derived at runtime from the package.json devDependencies
-# pin (the SSOT check-dep-versions binds: peer range == `>=<pin> <0.<minor+1>`).
+# pin (the SSOT check-dep-versions binds: peer range == `>=<pin> <<major>.<minor+1>`).
 # Never retyped here as a second literal.
 pi_supported_range() {
   node -e '
     const pkg = require(process.argv[1]);
     const pin = pkg.devDependencies?.["@earendil-works/pi-coding-agent"];
-    if (!/^0\.\d+\.\d+$/.test(pin ?? "")) { console.error(`unparseable pi pin: ${pin}`); process.exit(1); }
-    const [, min] = pin.split(".").map(Number);
-    console.log(`>=${pin} <0.${min + 1}`);
+    if (!/^\d+\.\d+\.\d+$/.test(pin ?? "")) { console.error(`unparseable pi pin: ${pin}`); process.exit(1); }
+    const [maj, min] = pin.split(".").map(Number);
+    console.log(`>=${pin} <${maj}.${min + 1}`);
   ' "$REPO_DIR/package.json"
 }
 
@@ -6655,6 +6751,9 @@ case "$cmd" in
   check-entwurf-resume-args)
     check_entwurf_resume_args
     ;;
+  check-acp-foreground-only)
+    check_acp_foreground_only
+    ;;
   check-resume-launch-identity)
     check_resume_launch_identity
     ;;
@@ -6938,9 +7037,10 @@ case "$cmd" in
     # floor can pay for it: the runner self-test (classifier truth table + synthetic
     # negatives) plus the REAL manifests — schema, global claim uniqueness, subjects
     # tracked and lstat-regular in the origin index, claim tokens exactly once in their
-    # gate sources — plus the declared lane inventory. It executes ZERO mutants and
-    # makes NO snapshot of this repo; the body (check-gate-qualification) owns that and
-    # is unchanged. Cheap enough for check:hermetic (~8s).
+    # gate sources — plus the declared lane inventory. It executes ZERO committed mutants
+    # (the self-test runs only synthetic fixture mutants in tmp fixture repos) and makes NO
+    # snapshot of this repo; the body (check-gate-qualification) owns the committed set and
+    # is unchanged. Cheap enough for check:hermetic (~20s measured 2026-09-29 on oracle).
     run_ts scripts/check-gate-qualification.ts --manifests-only
     ;;
   check-gate-qualification)
@@ -7661,6 +7761,17 @@ case "$cmd" in
     shift || true
     run_ts scripts/check-codex-bridge-identity.ts "$@"
     ;;
+  check-pi-bridge-sender)
+    shift || true
+    run_ts scripts/check-pi-bridge-sender.ts "$@"
+    ;;
+  check-pi-mcp-register)
+    check_pi_mcp_register
+    ;;
+  check-pi-mcp-bridge)
+    shift || true
+    run_ts scripts/check-pi-mcp-bridge.ts "$@"
+    ;;
   check-codex-native-push)
     shift || true
     run_ts scripts/check-codex-native-push.ts "$@"
@@ -7687,6 +7798,9 @@ case "$cmd" in
   check-pack-pin-matcher)
     check_pack_pin_matcher
     ;;
+  check-pack-consumer-roots)
+    check_pack_consumer_roots
+    ;;
   check-pack-install)
     check_pack_install
     ;;

package/scripts/check-entwurf-peers-surface.ts

@@ -1,5 +1,5 @@
 /**
- * check-entwurf-peers-surface — deterministic gate for the MCP + pi-native `entwurf_peers`
+ * check-entwurf-peers-surface — deterministic gate for the `entwurf_peers` (one MCP surface since #125)
  * RENDER/PAYLOAD layer (0.11 Stage 0 step 4, slice 4c; #50 C4 re-author). Drives the PURE
  * `renderEntwurfPeers` with a fabricated `EntwurfFactsResult` (no IO) and proves
  * the surface contract (GPi + Fable 수렴 + the C4 demotion):
@@ -17,9 +17,9 @@
  *     dropped),
  *   - diagnostics sharing one (kind + message) AGGREGATE in text (F8) — including
  *     record-less-socket groups, which share a message per liveness,
- *   - WIRING guard (Fable e②/6): the MCP handler and pi-native tool call
- *     listEntwurfFacts + renderEntwurfPeers; getLiveSessions and the
- *     `/entwurf-sessions` socket-scan command stay gone from both surfaces.
+ *   - WIRING guard (Fable e②/6): the MCP handler calls listEntwurfFacts +
+ *     renderEntwurfPeers; getLiveSessions and the `/entwurf-sessions` socket-scan
+ *     command stay gone from the bridge AND the pi extension.
  *
  * No IO — the facts are fabricated; only the wiring guard reads the bridge source
  * as text (a static assertion, not an execution).
@@ -252,31 +252,24 @@ function main(): void {
 		ok("the aggregated record-less line samples gids", agg.text.includes(gids[0] as string));
 	}
 
-	// ── WIRING guard: both surfaces call the provider+render; the socket-scan lane is gone ──
+	// ── WIRING guard: the bridge calls the provider+render; the socket-scan lane is gone ──
+	// #125: the pi-native entwurf_peers copy is retired — a pi session reads the bridge's own
+	// surface through Pi's built-in MCP — so its wiring halves left with it. The pi file is still
+	// held to the lanes it must NOT grow back.
 	{
 		const here = path.dirname(fileURLToPath(import.meta.url));
 		const bridgeSrc = readFileSync(path.join(here, "..", "mcp", "entwurf-bridge", "src", "index.ts"), "utf8");
 		const nativeSrc = readFileSync(path.join(here, "..", "pi-extensions", "entwurf-control.ts"), "utf8");
 		ok("wiring: bridge calls listEntwurfFacts(", bridgeSrc.includes("listEntwurfFacts("));
 		ok("wiring: bridge calls renderEntwurfPeers(", bridgeSrc.includes("renderEntwurfPeers("));
-		ok("wiring: native pi tool calls listEntwurfFacts(", nativeSrc.includes("listEntwurfFacts("));
-		ok("wiring: native pi tool calls renderEntwurfPeers(", nativeSrc.includes("renderEntwurfPeers("));
 		ok(
 			"#112 wiring: MCP observation uses the render limit",
 			bridgeSrc.includes("observationLimit: ENTWURF_PEERS_RENDER_LIMIT"),
 		);
-		ok(
-			"#112 wiring: native pi observation uses the render limit",
-			nativeSrc.includes("observationLimit: render.ENTWURF_PEERS_RENDER_LIMIT"),
-		);
 		ok(
 			"wiring: bridge does not paste full JSON payload into human text",
 			!bridgeSrc.includes("JSON.stringify(payload)"),
 		);
-		ok(
-			"wiring: native pi tool does not paste full JSON payload into human text",
-			!nativeSrc.includes("JSON.stringify(payload)"),
-		);
 		// `\bname\s*\(` catches a definition OR a call (tolerating a space before the
 		// paren, GPi Q4); a bare prose mention in a removal-note comment (no paren) is
 		// allowed — the guard targets the second scan, not the word.

package/scripts/check-entwurf-self-address.ts

@@ -495,17 +495,13 @@ ok(
 	/origin:\s*"meta-session"/.test(metaBody) && /replyable:\s*self\.replyable/.test(metaBody),
 );
 
-// ── SE-1 2e-a: pi-native surface derives pi-session replyability the SAME way ──
-// entwurf-control.ts is a root-tsc emit surface, so it reaches the self-address fence via a
-// non-literal dynamic import (never a static `.ts` import — TS5097), then decorates the
-// sender with computeSelfAddressability + canonical socket existsSync (no hardcoded true).
+// ── pi-session replyability has ONE computation now (#125) ──
+// The pi-native sender decoration (`decoratePiSenderAddressability`) left with the native verbs: a
+// pi session reaches entwurf_v2/entwurf_self through the bridge, whose `buildStrictPiSenderEnvelope`
+// derives replyability from the same computeSelfAddressability + canonical-socket existsSync and is
+// pinned above. What the pi file still takes from this fence is the not-a-citizen notice below,
+// reached through the non-literal dynamic import that keeps the `.ts` fence out of root tsc.
 const nativeSrc = readFileSync(path.join(REPO_DIR, "pi-extensions", "entwurf-control.ts"), "utf8");
-ok(
-	"pi-native: decoratePiSenderAddressability derives replyable from computeSelfAddressability + canonical existsSync",
-	/function\s+decoratePiSenderAddressability/.test(nativeSrc) &&
-		/computeSelfAddressability/.test(nativeSrc) &&
-		/existsSync\s*\(\s*getSocketPath/.test(nativeSrc),
-);
 ok(
 	"pi-native: reaches the self-address fence via non-literal dynamic import (no static import; TS5097)",
 	/const ENTWURF_SELF_ADDRESS_MODULE\s*=/.test(nativeSrc) &&
@@ -555,7 +551,7 @@ ok(
 // a mutant to move it into, and passing a constant would make the decision above unreachable.
 const noticeBody = nativeSrc.slice(
 	nativeSrc.indexOf("async function noticeUncitizenedSession"),
-	nativeSrc.indexOf("function shouldRegisterControlTools"),
+	nativeSrc.indexOf("// Extension Export", nativeSrc.indexOf("async function noticeUncitizenedSession")),
 );
 ok(
 	"pi-native: the not-a-citizen notice is decided from the REAL flag, on the UI only, never on stderr " +