@junghanacs/entwurf 0.41.2 → 0.50.0

package/ENTWURF-CLI.json

@@ -0,0 +1,1229 @@
+{
+	"_about": {
+		"purpose": "The description of the entwurf command line: the short root page `entwurf --help` prints, the full catalog `entwurf help all` prints, each command's page — its synopsis, summary and optional longer details — that `entwurf help <command>` prints, and the few guide topics `entwurf help <topic>` prints. The root page names catalog entries and takes their synopses from the catalog. A topic is read-only text whose name no command and no other topic takes, and `all` neither. It describes commands and guides; it never selects, registers or runs one.",
+		"ownership": "This root file is the sole editable source of that text. run.sh dispatch and its source-defined gate functions own execution; check-install-surface compares the two independently."
+	},
+	"schemaVersion": 4,
+	"root": {
+		"title": "entwurf - native harness entrypoints and garden facts",
+		"usage": {
+			"title": "Usage:",
+			"column": 38,
+			"rows": [
+				{
+					"form": "<command> [args...]"
+				},
+				{
+					"form": "help [<name>]",
+					"text": "this overview, or command/topic help"
+				},
+				{
+					"form": "help all",
+					"text": "all documented commands, developer gates included"
+				},
+				{
+					"form": "-h",
+					"text": "this overview (--help works too)"
+				}
+			]
+		},
+		"sections": [
+			{
+				"title": "Launch native runtimes:",
+				"column": 38,
+				"rows": [
+					{
+						"name": "pi",
+						"text": "pi with Entwurf control; args go to pi"
+					},
+					{
+						"name": "pi-durable",
+						"text": "the packaged durable pi launcher"
+					},
+					{
+						"name": "claude",
+						"text": "Claude Code itself; args go to claude unchanged"
+					},
+					{
+						"name": "copilot",
+						"text": "Copilot with its Entwurf extension enabled"
+					},
+					{
+						"name": "codex-app-server",
+						"text": "Codex's app-server on the socket Entwurf reads"
+					}
+				]
+			},
+			{
+				"title": "Set up and check this host:",
+				"column": 38,
+				"rows": [
+					{
+						"name": "setup",
+						"text": "wire detected harnesses; report PASS/SKIP/FAIL each"
+					},
+					{
+						"name": "doctor-meta-bridge",
+						"text": "check the Claude Code wiring"
+					},
+					{
+						"name": "doctor-pi-package",
+						"text": "inspect ownership of the global pi registration"
+					}
+				]
+			},
+			{
+				"title": "Look at the garden (read-only JSON):",
+				"column": 38,
+				"rows": [
+					{
+						"name": "peer-facts",
+						"text": "siblings and their live-rail facts"
+					},
+					{
+						"name": "meta-facts",
+						"text": "garden records and store diagnostics"
+					}
+				]
+			},
+			{
+				"title": "Remove wiring:",
+				"column": 38,
+				"rows": [
+					{
+						"name": "remove",
+						"text": "remove this project's pi registration"
+					},
+					{
+						"name": "remove-user-scope",
+						"text": "remove the global pi registration"
+					},
+					{
+						"name": "uninstall-meta-bridge",
+						"text": "restore what the Claude Code install recorded"
+					}
+				]
+			},
+			{
+				"title": "Herdr plugin (from its active runtime):",
+				"column": 56,
+				"rows": [
+					{
+						"name": "herdr-plugin-expose-operator",
+						"text": "create the one operator link"
+					},
+					{
+						"name": "herdr-plugin-withdraw-operator",
+						"text": "remove the owned link"
+					},
+					{
+						"name": "herdr-plugin-deactivate",
+						"text": "undo plugin wiring and runtime"
+					}
+				]
+			}
+		],
+		"examples": {
+			"title": "Examples:",
+			"items": [
+				{
+					"comment": "Start pi in the current project",
+					"command": "entwurf pi"
+				},
+				{
+					"comment": "Read a command before changing this host",
+					"command": "entwurf help setup"
+				},
+				{
+					"comment": "See who is in the garden",
+					"command": "entwurf peer-facts"
+				}
+			]
+		},
+		"footer": [
+			"Fresh call, send, resume and retire are entwurf-bridge MCP tools inside a session,",
+			"not commands here. Advanced maintenance and development gates: entwurf help all",
+			"Guides: entwurf help team | entwurf help remote-pair"
+		]
+	},
+	"topics": [
+		{
+			"name": "team",
+			"title": "Guide: team - bookmarks of the siblings a project works with (team.json)",
+			"lines": [
+				"A person's own bookmark: who the siblings are, on which backend, at which",
+				"garden id. Entwurf never loads it, and it is not configuration for identity,",
+				"routes, roles, permissions or lifecycle.",
+				"",
+				"Where it lives:",
+				"  team.json at the project root, kept out of git (add /team.json to",
+				"  .gitignore). Start from team.json.example, shipped at the root of this",
+				"  entwurf package; its notes give the rules in full.",
+				"",
+				"What it holds:",
+				"  version, project, cwd   the bookmark's shape, its project and shared cwd",
+				"  notes                   free text for the people who read it",
+				"  members[]               one entry per sibling:",
+				"    name, role            how you address it; a role assigns no task or right",
+				"    backend               pi, pi-durable, claude-code, ...",
+				"    garden_id             its address: entwurf_v2 sends to this id",
+				"    native_session_id     that harness's own conversation id",
+				"",
+				"Where the facts come from:",
+				"  Copy ids, backend and cwd from the records (entwurf meta-facts); never",
+				"  guess them. If the bookmark and a record disagree, the record wins: fix",
+				"  the bookmark, never the record. Liveness is not kept here; read it when",
+				"  you send (entwurf_peers in a session, or entwurf peer-facts). Keep a",
+				"  member after it retires; membership grants no send, resume or retire."
+			]
+		},
+		{
+			"name": "remote-pair",
+			"title": "Guide: remote-pair - sibling pairs across two hosts (entwurf-remote-pair.json)",
+			"lines": [
+				"Opt-in, one file per host. Each route pairs a garden id here with one on",
+				"another host, so entwurf_v2 to the remote id makes one SSH attempt over your",
+				"own account. There is no discovery, wake or retry, and Entwurf sets up no",
+				"SSH, key or network.",
+				"",
+				"Where it lives (the rule; this page reads none of your settings):",
+				"  entwurf-remote-pair.json, in the directory that holds the garden record",
+				"  store. By default the store is the pi agent dir's meta-sessions, so:",
+				"    ~/.pi/agent/entwurf-remote-pair.json",
+				"  PI_CODING_AGENT_DIR moves the agent dir and ENTWURF_META_SESSIONS_DIR",
+				"  moves the store; the file follows the store. On each host, its bridge and",
+				"  its incoming SSH receive process must resolve the same local opt-in path.",
+				"  The paths on the two hosts need not be identical.",
+				"",
+				"What it holds:",
+				"  version                 2",
+				"  routes[]                one object per pair:",
+				"    localGardenId         this host's garden id in the pair",
+				"    remoteGardenId        the other host's garden id",
+				"    ssh                   your existing SSH alias for the other host",
+				"    remotePairFile        the absolute path of the other host's own file",
+				"",
+				"Write it with mode 0600, and never over a file you have not inspected. The",
+				"other host's file carries the mirror route: the two garden ids swapped, its",
+				"own SSH alias for this host, and this file's absolute path. No file means",
+				"off; a symlink, a non-regular file or an invalid declaration is refused, not",
+				"read as off. Delivery never starts, resumes or wakes a sibling that is off.",
+				"",
+				"Steps, checks and converting an older file: section 2c of",
+				"docs/setup-clean-host.md, shipped in this entwurf package."
+			]
+		}
+	],
+	"usage": {
+		"title": "Usage:",
+		"commandGroups": [
+			[
+				{
+					"synopsis": "menu",
+					"column": 38,
+					"summary": "source-only Herdr developer board: read-only readiness check or explicitly confirmed return to checkout wiring; never closes sessions or acquires npm artifacts"
+				},
+				{
+					"synopsis": "setup [project-dir]",
+					"column": 38,
+					"summary": "ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt"
+				},
+				{
+					"synopsis": "release-gate [project-dir] [--cut] [--allow-skip-gemini]",
+					"column": 69,
+					"summary": "SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — \"green\" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes \"a CUT needs LIVE=1, SKIP=0\" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's."
+				},
+				{
+					"synopsis": "check-bridge",
+					"column": 38,
+					"summary": "entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)"
+				},
+				{
+					"synopsis": "check-entwurf-bridge-boot",
+					"column": 37,
+					"summary": "deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f/G1h, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2, entwurf_resume_call and entwurf_callback registered/schema + the tools/list surface is EXACTLY the nine shipped garden verbs; tools/list only, no auth/side-effect"
+				},
+				{
+					"synopsis": "check-entwurf-bridge-pi-free",
+					"column": 40,
+					"summary": "deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free"
+				},
+				{
+					"synopsis": "check-model-lock",
+					"column": 38,
+					"summary": "deterministic unit test for pi-extensions/model-lock.ts (4-quadrant + edge cases, no API)"
+				},
+				{
+					"synopsis": "check-shell-quote",
+					"column": 38,
+					"summary": "POSIX-safety gate for shellQuote (remote SSH arg quoting in entwurf paths) — source parity + behavior matrix, no SSH"
+				},
+				{
+					"synopsis": "check-entwurf-session-identity",
+					"column": 42,
+					"summary": "deterministic gate for record-era session identity (garden-id grammar + readSessionIdentity: first-model_change authority, name-blind — #50 C3), no API"
+				},
+				{
+					"synopsis": "check-meta-session",
+					"column": 39,
+					"summary": "deterministic gate (#30 step 2, V3-only): fs store — idempotent decideUpsert/upsertMetaSession + mailbox enqueue/read + receipt state, no API"
+				},
+				{
+					"synopsis": "check-meta-v3-record",
+					"column": 39,
+					"summary": "deterministic gate: the ONE live record schema (v3) — canonical serialize/round-trip/mint, foreign-generation rejections name fresh-cut with the actual version value, strict keyset, no API"
+				},
+				{
+					"synopsis": "check-mailbox-receipt-state",
+					"column": 39,
+					"summary": "deterministic gate (0.11 Stage 0 step 3B): mailbox receipt state schema + store (stamp→persist→read-back) in a temp mailbox, strict keyset, no API"
+				},
+				{
+					"synopsis": "check-copilot-birth-hook",
+					"column": 38,
+					"summary": "#82 gate: drives the real Copilot assembler into a temp dir, fires the baked launcher with NO ARGV (the way Copilot's `exec`-string schema forces), and requires a backend:\"copilot\" v3 record + attach + peer row + a SENDER marker the resolver joins back to that record, and still zero mailbox/receiver marker (who-sent needs a shared parent; a receiver needs a doorbell this backend has not got). Hermetic; no Copilot, no model turn"
+				},
+				{
+					"synopsis": "check-omp-birth-hook",
+					"column": 38,
+					"summary": "#87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:\"omp\" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn"
+				},
+				{
+					"synopsis": "check-pi-durable-contact",
+					"column": 38,
+					"summary": "#129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass"
+				},
+				{
+					"synopsis": "check-pi-durable-send",
+					"column": 38,
+					"summary": "#129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)"
+				},
+				{
+					"synopsis": "check-demo-reproducibility",
+					"column": 38,
+					"summary": "source-checkout-only: discover offline demo Node tests; no LIVE, model, render or publication"
+				},
+				{
+					"synopsis": "check-pi-durable-beside",
+					"column": 38,
+					"summary": "#129 mutant execution coordinate (VERIFY rule 3): run_vitest over four pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join) — a pi-durable qualification lane gate argv. Same files check-tests-beside-behavior already runs."
+				},
+				{
+					"synopsis": "check-pi-durable-carrier",
+					"column": 38,
+					"summary": "#144 mutant execution coordinate (VERIFY rule 3): run_vitest over the carrier test alone (relocation/resolver, owned-source emission and typecheck fence, package file list, task footer, the real bootstrap on the 1.2 SDK, stream transport, skills prompt) — the gate argv of the carrier claims, whose QKs live only in that file. Same file check-tests-beside-behavior already runs."
+				},
+				{
+					"synopsis": "check-pi-durable-native-module",
+					"column": 42,
+					"summary": "#144 mutant execution coordinate (VERIFY rule 3): run_vitest over the bootstrap's native-module file and directory ingress test alone — the gate argv of the ingress claims, whose QKs live only in that file. Same file check-tests-beside-behavior already runs."
+				},
+				{
+					"synopsis": "check-remote-pair-beside",
+					"column": 38,
+					"summary": "#149 mutant execution coordinate (VERIFY rule 3): run_vitest over the five remote-pair beside tests (send, receive, roundtrip, transport, mailbox body) — the gate argv of the remote-pair claims. Same files check-tests-beside-behavior already runs."
+				},
+				{
+					"synopsis": "check-pi-durable-receive",
+					"column": 38,
+					"summary": "#129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)"
+				},
+				{
+					"synopsis": "check-copilot-receive-arm",
+					"column": 38,
+					"summary": "#82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn"
+				},
+				{
+					"synopsis": "check-copilot-launch",
+					"column": 38,
+					"summary": "#82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn"
+				},
+				{
+					"synopsis": "check-codex-app-server-launch",
+					"column": 41,
+					"summary": "#95 gate: the MANAGED app-server launch `entwurf codex-app-server`, driven through its public address against a FAKE VENDOR on a sandbox PATH. The injected `app-server --listen unix://<socket>` required to equal the product's own resolveCodexDefaultSocketPath over an env matrix that includes the inputs a bash transcription was MEASURED to diverge on (BOM-only CODEX_HOME, trailing slash, `..`), non-absolute and control-character addresses refused before any write, byte-identical operator argv, exec (not fork) parent identity, exit passthrough, live-socket and indeterminate-socket and second---listen and recursion refusals, dead-socket launch-over, the tmux fact line, and both identity carriers stripped. Hermetic; no Codex, no app-server, no model turn"
+				},
+				{
+					"synopsis": "check-claude-launch",
+					"column": 38,
+					"summary": "#157 stage 4 gate: the Claude Code launch `entwurf claude`, driven through its public address against a FAKE VENDOR on a sandbox PATH. The verb dropped, the argv byte-identical with nothing injected, --help/-h reaching the vendor, the caller's cwd, the sentinel exported, an inherited PI_SESSION_ID/PI_AGENT_ID pair removed and no other environment change, the exit status, pid (exec) and signal passed through, and named refusals for an absent vendor, a non-regular PATH hit, the sentinel and a PATH claude that resolves to run.sh. Hermetic: no real Claude Code, no network, no model turn"
+				},
+				{
+					"synopsis": "check-copilot-statusline",
+					"column": 38,
+					"summary": "#82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn"
+				},
+				{
+					"synopsis": "check-entwurf-capabilities",
+					"column": 39,
+					"summary": "deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API"
+				},
+				{
+					"synopsis": "check-omp-fresh-preflight",
+					"column": 39,
+					"summary": "#87 C: the OMP fresh preflight reproduces omp_agent_dir and the tools.xdev read in TS (it runs from two emit depths and cannot call a sibling script). This drives the SHIPPED shell/python leaves over the same inputs — refusals included — and requires the TS half to agree, so the reproduction cannot silently drift from the installer's own oracle"
+				},
+				{
+					"synopsis": "check-codex-sender-identity",
+					"column": 39,
+					"summary": "Codex tools/call _meta triple agreement + addressable record join + cross-carrier conflict refusal"
+				},
+				{
+					"synopsis": "check-codex-bridge-identity",
+					"column": 39,
+					"summary": "real MCP bridge request identity for entwurf_self/v2/fresh; malformed or conflicting _meta fails loud"
+				},
+				{
+					"synopsis": "check-pi-mcp-register",
+					"column": 38,
+					"summary": "#125: mutant execution coordinate for pi-extensions/entwurf-control.test.ts — the real extension births through Pi's real loader and registers the compiled bridge after birth, before UI, direct with two hidden. Needs build-bridge"
+				},
+				{
+					"synopsis": "check-pi-mcp-bridge",
+					"column": 38,
+					"summary": "#125: a real Pi runtime (builtin MCP, default stdio, faux model only) spawns the COMPILED bridge as the born citizen — six prefixed verbs declared, hidden two absent, child env = record = entwurf_self, cwd = session cwd; newSession vendor conformance observed (old child gone, new record+child, old record kept). Needs build-bridge"
+				},
+				{
+					"synopsis": "check-pi-bridge-sender",
+					"column": 38,
+					"summary": "#125: real bridge pi-session carrier is served only when it names a readable pi RECORD; missing / foreign-backend / unreadable each refuse with their own cause; no socket = replyable:false, not refusal"
+				},
+				{
+					"synopsis": "check-codex-native-push",
+					"column": 38,
+					"summary": "app-server WebSocket-over-UDS probe + measured one-shot codex queue delivery; no replay"
+				},
+				{
+					"synopsis": "check-codex-birth-hook",
+					"column": 38,
+					"summary": "sandboxed payload + declaration: first-turn V3 birth, one record per thread, top-level event predicate, no markers"
+				},
+				{
+					"synopsis": "check-codex-fresh-preflight",
+					"column": 39,
+					"summary": "pre-mutation birth/MCP/thread-title/default-app-server readiness"
+				},
+				{
+					"synopsis": "smoke-codex-config-state",
+					"column": 38,
+					"summary": "sandboxed MCP + status-line ownership/install/doctor/inverse lifecycle"
+				},
+				{
+					"synopsis": "smoke-codex-birth",
+					"column": 38,
+					"summary": "sandboxed birth unit: exact trust identity, the vendor trust receipt read at our MEASURED index (never written), config.toml untouched, coexistence with a foreign SessionStart group in either ordering (joined not adopted, reported not certified, byte-preserved across install and inverse), own-declaration drift/duplication refusals, drift-refusing inverse"
+				},
+				{
+					"synopsis": "check-harness-admission-parity",
+					"column": 43,
+					"summary": "#87 C: the EDGE the two closed parity loops never had. Every citizen backend is fresh-openable or a declared pre-#82 legacy admission whose exception a reader finds in DELIVERY.md — so a post-contract harness that mints records but cannot be opened by entwurf_fresh_call blocks the release package instead of only carrying an `unsupported` note (docs/adding-a-harness.md step 9)"
+				},
+				{
+					"synopsis": "check-capability-bundle-reach",
+					"column": 41,
+					"summary": "deterministic gate (IN pnpm check): re-ask EVERY shipped copy of meta-session (source + bridge bundle emit) whether metaCapabilitiesFilePath() reaches the registry — the artifact-depth check the source-path gates cannot make; needs a built dist, missing dist FAILS"
+				},
+				{
+					"synopsis": "smoke-pi-attach",
+					"column": 38,
+					"summary": "deterministic gate (#50 C2 checkpoint + C3 ACP tail): a pi session attaches as a V3 meta-record citizen (backend:\"pi\"), the gardenId is the RECORD's not pi's session id, the control socket is keyed on it, a re-open ATTACHES to the same address (never a second mint), the BUILT DIST ENTRY driven over MCP stdio lists the citizen + delivers entwurf_v2 to that socket with an RPC ack, and the ACP identity chain lands a send AS the host record (enrichMcpServersWithEnvelope env → bridge sender = host gardenId). mkdtemp-isolated; the live store is never read"
+				},
+				{
+					"synopsis": "check-bridge-delivery",
+					"column": 38,
+					"summary": "deterministic gate (IN pnpm run check:full): demo scene 3 recovered — seed strict meta-sender + armed receiver citizens in an isolated temp world, scrub ambient pi/sender carriers, drive the BUILT DIST ENTRY over MCP stdio through a real tools/call entwurf_v2, assert the .msg landed under the seeded sender + doorbell poked. DELIVERS through the artifact, not from source. ENTWURF_DELIVERY_SUBJECT=<launcher> replays the same scene against another consumer artifact (check-pack-install passes the npm-installed bin). No model/network/cost; stale or missing dist FAILS"
+				},
+				{
+					"synopsis": "check-meta-mailbox-state-write",
+					"column": 42,
+					"summary": "deterministic gate (0.11 Stage 0 step 3D-4 commit2): post-cut receipt is state-only — meta-record file byte-identical across enqueue/read, state carries lastEnqueuedAt/lastReadAt (field isolation), empty inbox no-op on record+state, drift surfaces; no API"
+				},
+				{
+					"synopsis": "check-meta-receiver-marker",
+					"column": 38,
+					"summary": "deterministic gate (SE-2): receiver marker round-trip/start-key/provenance, UserPromptSubmit cannot mint presence, reader does not gate on record existence — marker SEMANTICS only; launch topology moved to check-hook-launch-topology"
+				},
+				{
+					"synopsis": "check-hook-launch-topology",
+					"column": 38,
+					"summary": "#51 gate 1: shipped hooks.json is exec form through hook-launch.sh, launcher is loud on an empty argv (older Claude's silent args drop), exec preserves the pid so the hook's parent is Claude, and a space/$/backtick plugin path survives as one argv element"
+				},
+				{
+					"synopsis": "check-meta-hook-session-switch",
+					"column": 42,
+					"summary": "#101 gate: ONE Claude pid, TWO SessionStarts (resume picker placeholder -> resumed id). The hook retires the marker of the garden it stopped serving (records untouched, same-garden re-registration retires nothing), the reader stays fail-closed on a re-planted stale marker (watchArmed measured against the owner's sender marker, never copied), production dispatch refuses the retired garden and NAMES the failing axis, and exactly one of the two gardens is deliverable. Sandboxed roots, no API"
+				},
+				{
+					"synopsis": "check-meta-identity-consumers",
+					"column": 41,
+					"summary": "deterministic gate: V3-only consumer seam — per-entry targeted read + addressable read snapshot uniqueness, non-regular rivals never read, drift/unparseable rivals unreachable, unreadable regular rivals fail loud; strict upsert refuses an unreadable store before any write, no API"
+				},
+				{
+					"synopsis": "check-meta-capability-source",
+					"column": 40,
+					"summary": "deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API"
+				},
+				{
+					"synopsis": "check-socket-probe",
+					"column": 39,
+					"summary": "deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API"
+				},
+				{
+					"synopsis": "check-project-trust-handler",
+					"column": 39,
+					"summary": "deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI"
+				},
+				{
+					"synopsis": "check-entwurf-v2-contract",
+					"column": 39,
+					"summary": "FROZEN entwurf_v2 contract — control-socket liveness domain is currently pi; self-fetch/native-push citizens are out of that domain, not globally unsupported; pure, no IO"
+				},
+				{
+					"synopsis": "check-compaction-send-guard",
+					"column": 39,
+					"summary": "deterministic gate (#111): control-socket send during Pi compaction — event-armed refuse compacting, quiet unknown non-idle refuse busy (ctx.signal is not isStreaming); no pi.sendMessage, no delivered:true; idle/live-run steer/followUp preserved; pure, no IO"
+				},
+				{
+					"synopsis": "check-mux-resume-call",
+					"column": 39,
+					"summary": "deterministic gate: S1 resume PLACEMENT composition (mux-resume-call.ts). No fake tmux. cwd rules are MEASURED tmux 3.6a behaviours, each a way a resume looks successful while being wrong: a nonexistent `-c` exits 0 and lands the child in $HOME (so it is refused HERE), `-c` is FORMAT-EXPANDED so `#{…}` silently rewrites the path and `#(…)` was observed running a command (so `#` is refused), and whitespace measured SAFE (so no escaping layer is owed). Also pins `-c` reaching tmux, runtime after `--`, carrier-free argv, zero identity in this module, and the surface seam that keeps the v2 composition from importing mux"
+				},
+				{
+					"synopsis": "check-mux-parent-artifact",
+					"column": 38,
+					"summary": "deterministic gate for the tracked scrubbed parent-transcript fixture — a version-pinned sample of the PARENT-SIDE shape (fresh_call toolResult + the later callback custom_message) so downstream never opens a private transcript. Pins event order, the toolCallId join on the RESULT (pi writes no separate toolCall row), the launch nonce reappearing verbatim in the callback body, the <sender_info> envelope field names, and the absence of operator paths / real garden ids / real uuids. NOT placement evidence"
+				},
+				{
+					"synopsis": "check-mux-launcher-fence",
+					"column": 38,
+					"summary": "deterministic gate for the shared operator-launcher fence (issue #67): scripts/lib/claude-launcher-fence.ts + its wiring into BOTH mux LIVE smokes. Replants the observed install-destruction shape (real HOME + fixture XDG_DATA_HOME → self-update retargets the real `claude` launcher into the fixture tree, teardown deletes it) wholly inside disposable mkdtemp roots — the real launcher is never inspected. Pins fail-closed preflight, retarget/content-change detection before cleanup, removal BLOCKED on fixture reference / unproven safety / surviving tracked panes, exact operator-parity XDG restore (absent = DELETED, not canonical defaults), the lifecycle cell-branch topology, and one shared helper consumed by both smokes"
+				},
+				{
+					"synopsis": "check-typing-call-fence",
+					"column": 38,
+					"summary": "deterministic gate for the boundary nobody has broken: this product composes ARGUMENTS and LETTERS, never keystrokes. Scans every tracked production source under pi-extensions/ and mcp/ — comments blanked, string literals kept — for tmux send-keys/paste-buffer/load-buffer and herdr's PTY verbs (agent.prompt, agent.send_keys, pane.send_text, pane.input.set). Prose is exempt on purpose: the sentence stating the rule names the very calls it forbids, and a scanner that read prose could be made green by deleting the law. Carries its own oracle — the detector is proven on planted code, proven blind to comments, and the scanned inventory is measured"
+				},
+				{
+					"synopsis": "check-resume-launch-identity",
+					"column": 40,
+					"summary": "deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers \"which being is this, and which conversation is theirs\"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not \"no recorded model\"); header↔gate SSOT. No spawn/socket/timer"
+				},
+				{
+					"synopsis": "smoke-entwurf-v2-matrix-live",
+					"column": 40,
+					"summary": "LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live"
+				},
+				{
+					"synopsis": "smoke-agy-native-push-live",
+					"column": 39,
+					"summary": "PAUSED (#152): exits 2 with [entwurf:paused] before it reads LIVE or AGY_CONVERSATION_ID — not a PASS and not a SKIP; OUT of pnpm check. Open no agy conversation for it while the pause holds. Its 봉인 8 native-push round trip (real antigravity adapter + register core + runEntwurfV2) runs only after a separate change lifts the pause."
+				},
+				{
+					"synopsis": "smoke-codex-native-push-live",
+					"column": 40,
+					"summary": "on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result"
+				},
+				{
+					"synopsis": "smoke-codex-fresh-live",
+					"column": 37,
+					"summary": "#95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \\$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids"
+				},
+				{
+					"synopsis": "smoke-mux-lifecycle-live",
+					"column": 37,
+					"summary": "RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call (the native pi cell names a caller-distinct seat and tmux is asked where the pane landed, #108) -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume of the still-live sibling refused target-live, no window opened and no lock residue (its dormant same-id resume is deterministic-only, #147 L2). LIVE=1 ./run.sh smoke-mux-lifecycle-live"
+				},
+				{
+					"synopsis": "check-meta-facts",
+					"column": 39,
+					"summary": "deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability"
+				},
+				{
+					"synopsis": "check-herdr-plugin",
+					"column": 39,
+					"summary": "deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one `herdr integration status` + one `entwurf peer-facts` + one `herdr agent list` per open, in that order (counted, not claimed), through ONE spawn call site; the four blocks each naming their own owner/observation time with no aggregate verdict; the D3=C fallback reading the activation ledger from the path its WRITER owns (XDG state, never the runtime's data root) and only when the phase is `active`, with ENTWURF_BIN and PATH still winning outright; the citizen axis alone skipping by name when no binary is reachable; every broken-evidence state a named red rather than a crash or an empty table, and a selected herdr atom that is `outdated`/`needs repair` as block [1]'s OWN red (`not installed` stays a reported skip); ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install"
+				},
+				{
+					"synopsis": "check-herdr-runtime-bootstrap",
+					"column": 41,
+					"summary": "deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install"
+				},
+				{
+					"synopsis": "check-herdr-activation",
+					"column": 39,
+					"summary": "deterministic gate for the #116 M3-b2 scoped activation: the pi user-scope-ONLY forward seam (no project write, OpenCode byte-untouched), the absolute command DERIVED from the runtime root for BOTH harnesses (relative/unnormalised refused), default bare/clone bytes unchanged when no mode is asked, the pi inverse refusing a drifted command instead of deleting an override, a certified activation ledger that can never name an atom outside {pi, claude-code}, add-only reinstall (a shrinking H retains, never removes), a roots-drift refusal before the first byte, the teardown order components->runtime->ledger LAST, one refused preflight leaving every byte untouched, and no deferred module load on the path that deletes its own runtime. Drives the REAL pi writers; the vendor `claude` CLI is NOT invoked and its acceptance of an absolute executable stays a named LIVE boundary"
+				},
+				{
+					"synopsis": "check-herdr-plugin-profile",
+					"column": 39,
+					"summary": "deterministic gate for the #116 M3-a PURE activation leaf (`plugins/herdr/lib/integration-profile.mjs`): the closed {pi→pi, claude→claude-code} table, exactly-one-row-or-named-refusal, the FRONT-ANCHORED state grammar (a `/srv/current (v9)/` directory name may not decide a verdict), no path in the plan, outdated/needs-repair as named FAILs, not-installed as a zero-write SKIP, `current` as herdr's admission with no floor of our own, OpenCode observed but never planned, and the leaf's purity. Listing strings only — no herdr binary, no install, no environment, no writes"
+				},
+				{
+					"synopsis": "check-herdr-plugin-build",
+					"column": 39,
+					"summary": "deterministic gate for the #116 M3-b3 build runner (`plugins/herdr/lib/build.mjs`): the ONE command Herdr's [[build]] calls, composing integration status -> pure profile -> runtime bootstrap -> activation THROUGH THE INSTALLED PACKAGE (never this checkout, which herdr deletes on uninstall with no cleanup hook). Pins one [[build]] with argv `node lib/build.mjs` and a runner npm does not ship, missing-herdr vs unanswerable-status as separate named refusals, a selected outdated/needs-repair/malformed/duplicate atom failing BEFORE any runtime work, A-empty as exit 0 with ZERO writes, absent/incapable activation entries as distinct refusals, the two-stage {pi} -> {pi, claude-code} composition with OpenCode never named, and the post-build herdr commit gap named rather than called atomic. Listing via the runner's own spawn seam (no fake herdr); one cell drives the REAL binary, named SKIP without it"
+				},
+				{
+					"synopsis": "check-peer-facts",
+					"column": 39,
+					"summary": "deterministic gate for the peer-facts projection (#116 M2-a): drives the REAL CLI with every ambient root sandboxed — placement crosses STRUCTURED (never the human `herdr <pane>` string), the peer keyset is exactly the provider's facts (no herdr agent_status may enter an entwurf payload), no socket coordinate is published (#50 C4), diagnostics in-band, the probed socket world is the one ENTWURF_DIR names (proved by a record-less socket surfacing — there is no field to echo), no observation budget, exit contract 0/2/3, dispatch+emit reachability. No herdr binary"
+				},
+				{
+					"synopsis": "check-meta-listing",
+					"column": 39,
+					"summary": "deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO"
+				},
+				{
+					"synopsis": "check-entwurf-fact-provider",
+					"column": 39,
+					"summary": "deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — full-store parse/probe/quarantine/resolve stays intact; #112 bounds expensive receiver/transcript observation to the newest 32 rendered rows while older machine rows say unobserved; Q112 pins full payload + exact observer budget; C-원칙 keeps corruption diagnostic and impossible wiring loud; deps injected, no IO"
+				},
+				{
+					"synopsis": "check-herdr-placement",
+					"column": 38,
+					"summary": "deterministic gate (#116 S1): the PURE placement-evidence axis — herdr `pane list` parse (unreadable payload → null → `unobserved`, never `none`), the two measured join rules (claude kind=id byte equality / pi kind=path uuid tail of a .jsonl basename, both strict), unmeasured kind → NO key, two panes on one key → `ambiguous` (never last-write-wins), provider reads the placement owner EXACTLY ONCE per listing (anti-watcher, docs/mux-launch-rail.md §7), and no entwurf_v2 dispatch module names or imports the axis (Hard Rule 16 — a pane is a view, not a rail). No fake herdr, no binary, no IO"
+				},
+				{
+					"synopsis": "check-entwurf-peers-surface",
+					"column": 39,
+					"summary": "deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO"
+				},
+				{
+					"synopsis": "check-entwurf-self-address",
+					"column": 38,
+					"summary": "deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta splits by RAIL: self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows), native-push ⟺ recordBacked ∧ probeAlive (separate axis — no mailbox fact may rescue or sink it), unsupplied rail fail-closed; SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected AND renders the meta rail per-rail (mailbox only inside the self-fetch branch; native-push denies an inbox and gates injection on the probe)"
+				},
+				{
+					"synopsis": "check-entwurf-deliverability",
+					"column": 40,
+					"summary": "deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom"
+				},
+				{
+					"synopsis": "check-native-push-adapter",
+					"column": 37,
+					"summary": "deterministic gate (봉인 3/8): native-push adapter leaf (antigravity) via a FAKE runner — FULL pid scan (not head -1), dead vs indeterminate, VOLATILE route re-discovery (no cache), send argv+ANTIGRAVITY_LS_ADDRESS env, non-zero exit throws, NO adapter-level retry (executor-owned), resolveNativePushAdapter fail-fast"
+				},
+				{
+					"synopsis": "check-native-push-register",
+					"column": 38,
+					"summary": "deterministic gate (봉인 5): registerNativeConversation (entwurf_register_native core) via fake adapter + isolated mkdtemp store — live probe→CREATE, re-register→ATTACH (same gid, cwd refreshed, no dup), not-live probe→REFUSE (throws, no record), receiver-marker abstinence (보정① source guard)"
+				},
+				{
+					"synopsis": "check-native-push-paused",
+					"column": 37,
+					"summary": "#152 mutant execution coordinate: run_vitest over paused.test.ts alone — dispatch, sender replyable and entwurf_register_native refuse a paused backend (antigravity) before any probe. Same file check-tests-beside-behavior already runs."
+				},
+				{
+					"synopsis": "check-chain-terminus-publication",
+					"column": 45,
+					"summary": "mutant execution coordinate: run_vitest over test/chain-terminus-publication.test.ts alone — smoke-entwurf-chain-live's terminus wait ends only on a body AND inbox.signal, inside the same deadline."
+				},
+				{
+					"synopsis": "check-agy-sender-identity",
+					"column": 37,
+					"summary": "deterministic gate (#46 sender lane): WHO is calling the bridge — real agy hook as a child process writes an antigravity sender marker keyed by its PARENT pid (never on upsert failure), and resolveTrustedMetaSenderIdentity over isolated stores yields 0→null / 1→identity on EITHER backend / two distinct live identities on one owner pid→THROW (never guess, never downgrade to anonymous). This is what turns an agy send from external-mcp/unknown-host into a replyable garden citizen"
+				},
+				{
+					"synopsis": "check-package-source-routing",
+					"column": 40,
+					"summary": "deterministic gate (#29): package-source -> install-root mapping + fail-fast routing (local/git/npm/missing/project/no-source × local+remote, self-root, resume), no backend"
+				},
+				{
+					"synopsis": "new-session-id",
+					"column": 38,
+					"summary": "print one fresh garden id from the generateSessionId SSOT (#50 C2: no launcher injection — the record layer is the consumer; pi mints its own session id)"
+				},
+				{
+					"synopsis": "smoke-resident-garden-guard",
+					"column": 39,
+					"summary": "live resident --entwurf-control garden guard (negative 0-token; SMOKE_RGG_POSITIVE=1 for positive)"
+				},
+				{
+					"synopsis": "smoke-meta-async-drift",
+					"column": 38,
+					"summary": "1.0.0 meta-bridge step 1: drift sentinel — version pins + Claude binary undocumented-behavior markers (LIVE=1 adds plugin watch-arm probe)"
+				},
+				{
+					"synopsis": "smoke-meta-honesty",
+					"column": 38,
+					"summary": "1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)"
+				},
+				{
+					"synopsis": "smoke-meta-install-state",
+					"column": 38,
+					"summary": "1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)"
+				},
+				{
+					"synopsis": "check-meta-doctor-oracle",
+					"column": 38,
+					"summary": "0.12.8 (#51): detection power of the release ORACLE — healthy fixture must reach `doctor: PASS`, then 21 planted defects (retired shell form, partial hand-patch, launcher bypass/repoint/provenance loss, malformed exec args, owner type drift, extra leaf/group, doorbell asyncRewake/path/timeout, no live bridge, stale receiver, ambiguous/missing cache, missing hook log/writer, failing CLI probes) must each turn it FAIL naming their own cause, plus a positive case pinning that a long-writing CLI is NOT a false negative. Offline/deterministic (deps: bash+node+python3)"
+				},
+				{
+					"synopsis": "smoke-agy-install-state",
+					"column": 38,
+					"summary": "agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, truthful setup outcomes. Offline/deterministic"
+				},
+				{
+					"synopsis": "smoke-setup-verdict",
+					"column": 38,
+					"summary": "#86 C1+C3b aggregate setup verdict fixture: all-absent SKIP/green, pi presence+floor, detected-FAIL nonzero, copilot four-unit composition (present=independent PASS/FAIL rows, absent=zero-state SKIP), installed-mode named branch, credential store untouched. Offline/deterministic"
+				},
+				{
+					"synopsis": "check-agy-permission-matrix",
+					"column": 39,
+					"summary": "AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)"
+				},
+				{
+					"synopsis": "smoke-omp-fresh-live",
+					"column": 39,
+					"summary": "#87 bundle C acceptance, RELEASE MUST: omp opened as ONE visible fresh sibling through the PUBLIC entwurf_fresh_call surface (never raw tmux), exact nonce callback -> garden id from the SENDER ENVELOPE -> record/backend identity -> addressed receive -> lastReadAt -> the drain visible in that same native session's own transcript. Needs LIVE=1 and spends real model turns. Self-deciding: omp outside FRESH_CALL_BACKENDS or without a mailbox rail is a protocol SKIP, which --cut reads as RED"
+				},
+				{
+					"synopsis": "smoke-pi-durable-fresh-live",
+					"column": 39,
+					"summary": "#129 first-admission acceptance, RELEASE MUST: real Pi opens pi-durable through entwurf_fresh_call (managed verb), exact-nonce callback into Pi, Pi→pd addressed receive drained by pd's live turn, pd→Pi dispatch relayed to the collector; pd's actual model + task-wide offering read from its native store (online sqlite backup). LIVE=1; models ENTWURF_PI_DURABLE_FRESH_MODEL / _PI_MODEL (default openai-codex/gpt-6.1-sol)"
+				},
+				{
+					"synopsis": "smoke-omp-receive-live",
+					"column": 39,
+					"summary": "#87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL"
+				},
+				{
+					"synopsis": "smoke-entwurf-chain-live",
+					"column": 39,
+					"summary": "LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass"
+				},
+				{
+					"synopsis": "check-release-gate-outcomes",
+					"column": 40,
+					"summary": "release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code"
+				},
+				{
+					"synopsis": "check-gate-manifests",
+					"column": 40,
+					"summary": "the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body runs only as the optional CI schedule/manual-dispatch drift diagnostic (#144) — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)"
+				},
+				{
+					"synopsis": "check-gate-qualification",
+					"column": 39,
+					"summary": "kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts. Bare = the whole body (the CI schedule/dispatch drift diagnostic, #144); `--group '<argv JSON>' --receipt <abs path outside the repo>` = one affected exact-argv group, a PARTIAL receipt (development's run, #133)"
+				},
+				{
+					"synopsis": "check-probe-ordering",
+					"column": 39,
+					"summary": "§11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts"
+				},
+				{
+					"synopsis": "check-probe-cli-shim",
+					"column": 39,
+					"summary": "§11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction"
+				},
+				{
+					"synopsis": "smoke-agy-statusline-state",
+					"column": 38,
+					"summary": "agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic"
+				},
+				{
+					"synopsis": "smoke-copilot-statusline-state",
+					"column": 42,
+					"summary": "Copilot custom-footer install/doctor/inverse regression. Offline/deterministic"
+				},
+				{
+					"synopsis": "smoke-copilot-mcp-state",
+					"column": 41,
+					"summary": "Copilot MCP install/doctor/inverse regression. Offline/deterministic"
+				},
+				{
+					"synopsis": "smoke-omp-bridge-state",
+					"column": 41,
+					"summary": "OMP birth-extension install/doctor/inverse regression: placement, stale-writer detection, honest inverse, no-state refusal (structurally VALID as well as foreign), symlink refusal, ambiguous-agent-dir refusal (ledger M6), and a poisoned PI_CODING_AGENT_DIR that attracts no artifact. Fully sandboxed HOME/PI/XDG. Offline/deterministic"
+				},
+				{
+					"synopsis": "smoke-agy-hooks-state",
+					"column": 38,
+					"summary": "agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic"
+				},
+				{
+					"synopsis": "smoke-user-scope-citizen",
+					"column": 38,
+					"summary": "0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + remove symmetry + fails loud, and the #86 C2 explicit ownership cells (project scope still normalizes ITS OWN stale entries; user scope refuses other owners and only takeover-user-scope moves the shared entry), plus the #110 self-checkout cells: the real `run.sh install <checkout>` drive leaves the tracked .pi/settings.json byte-identical, writes NO project-scope packages[] self-registration, and REPORTS the skip; cell 15 boots the pinned devDep pi against two stand-in checkouts and requires the --entwurf-control collision to APPEAR before asserting its absence. Offline/hermetic (deps: bash+python3+pinned pi)"
+				},
+				{
+					"synopsis": "smoke-meta-prune",
+					"column": 38,
+					"summary": "1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)"
+				},
+				{
+					"synopsis": "smoke-meta-keyset-guard",
+					"column": 38,
+					"summary": "0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)"
+				},
+				{
+					"synopsis": "check-meta-manifest-schema",
+					"column": 38,
+					"summary": "0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)"
+				},
+				{
+					"synopsis": "smoke-claude-native-resume-live",
+					"column": 43,
+					"summary": "LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path"
+				}
+			],
+			[
+				{
+					"synopsis": "install-meta-bridge",
+					"column": 38,
+					"summary": "INTERNAL wiring leaf: setup, the source-only developer menu and doctor recovery compose it; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)"
+				},
+				{
+					"synopsis": "uninstall-meta-bridge",
+					"column": 38,
+					"summary": "1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)"
+				},
+				{
+					"synopsis": "doctor-meta-bridge",
+					"column": 38,
+					"summary": "THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is NOT CERTIFIED and stays nonzero, on ONE narrowed reason — start-key and ppid are portable there (`ps` fallback, same string the TS core mints), so what holds the lane closed is per-process environment DISCOVERY alone, pending physical-host evidence. Detection power is held by check-meta-doctor-oracle"
+				},
+				{
+					"synopsis": "copilot [args...]",
+					"column": 38,
+					"summary": "#82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)"
+				},
+				{
+					"synopsis": "pi-durable [args...]",
+					"column": 38,
+					"summary": "#129/#130: the MANAGED durable launch. Verifies this package's pi-durable CARRIER (pi/pi-durable/carrier/, emitted deterministically from Entwurf's owned source pi/pi-durable/src) and the pi SDK set it resolves — every declared member/direct edge at exactly the pinned version — refusing by name (package-incomplete / carrier-drift / sdk-absent / sdk-mismatch, exit 3), then exec()s node under the carrier resolver with the packaged bootstrap (pi/pi-durable/bootstrap.mjs) in this terminal. A new session needs --provider <p> --model <exact catalog id> --width task-wide [--entwurf-bootstrap <{v:2,task}>]; --continue (this directory's newest session), --resume (choose one of its sessions), and --session <native id> (reopen exactly that session of this directory) take none of them and are mutually exclusive. Nothing outside the package is located, installed or repaired"
+				},
+				{
+					"synopsis": "pi [args...]",
+					"column": 38,
+					"summary": "#118: the MANAGED pi launch. exec()s the pi that `type -P` finds on PATH (a file, never a shell function or alias) in THIS terminal, with --entwurf-control added ahead of your argv, which passes through untouched. Refuses by name when ENTWURF_PI_LAUNCH_ACTIVE is non-empty (it exports that to the pi it starts), when no pi is on PATH (it launches the pi coding agent, it does not install one), or when that path is not an executable regular file"
+				},
+				{
+					"synopsis": "claude [args...]",
+					"column": 38,
+					"summary": "#157: the Claude Code launch. exec()s the claude that `type -P` finds on PATH (a file, never a shell function or alias) in THIS terminal and directory; your argv, --help included, reaches it untouched with nothing added, and its exit status and signals are its own. It sets ENTWURF_CLAUDE_LAUNCH_ACTIVE and removes an inherited PI_SESSION_ID/PI_AGENT_ID pair (another citizen's identity); no other variable is decided here. A garden citizen comes from the meta-bridge plugin and hooks setup installed, which this launch neither checks nor supplies: without them it is plain Claude Code. Refuses by name when ENTWURF_CLAUDE_LAUNCH_ACTIVE is non-empty, when no claude is on PATH (it launches Claude Code, it does not install one), when that path is not an executable regular file, or when it resolves to this run.sh"
+				},
+				{
+					"synopsis": "install-copilot-bridge",
+					"column": 38,
+					"summary": "#82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)"
+				},
+				{
+					"synopsis": "uninstall-copilot-bridge",
+					"column": 38,
+					"summary": "#86 C3a: honest inverse of install-copilot-bridge from the package-owned install-state (exact qualified id + exact marketplace name/path + recorded assembly only; state deleted LAST; a failing vendor list is UNKNOWN and refuses; never --force, never the stale Claude unit)"
+				},
+				{
+					"synopsis": "doctor-copilot-bridge",
+					"column": 38,
+					"summary": "#82/#86: fail-loud surface for that unit — runtime axis (red = a hook that RAN and failed, or a broken/unbaked artifact; \"installed with zero records\" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens, measured) + ownership axis (install-state shape/binding, marketplace path drift, UNKNOWN vendor lists; legacy no-state install = named non-green, repair = install-copilot-bridge adoption). Either axis red = red"
+				},
+				{
+					"synopsis": "install-copilot-statusline",
+					"column": 38,
+					"summary": "own Copilot statusLine + footer.showCustom with an install-state preimage"
+				},
+				{
+					"synopsis": "uninstall-copilot-statusline",
+					"column": 40,
+					"summary": "honest inverse of install-copilot-statusline"
+				},
+				{
+					"synopsis": "doctor-copilot-statusline",
+					"column": 38,
+					"summary": "static ownership/config/bin doctor; never claims a render receipt"
+				},
+				{
+					"synopsis": "install-copilot-mcp",
+					"column": 38,
+					"summary": "#82 RAIL 5: register ONE entwurf-bridge server in ~/.copilot/mcp-config.json (adopt / create / REFUSE symlink), type:local, install-state under $XDG_DATA_HOME/entwurf/copilot-mcp/"
+				},
+				{
+					"synopsis": "uninstall-copilot-mcp",
+					"column": 38,
+					"summary": "honest inverse of install-copilot-mcp from install-state"
+				},
+				{
+					"synopsis": "doctor-copilot-mcp",
+					"column": 38,
+					"summary": "static ownership/config/boot doctor; RED only when install-state exists"
+				},
+				{
+					"synopsis": "install-omp-config",
+					"column": 38,
+					"summary": "#87 follow-on: write the ONE operator setting omp's tool hand requires — `tools.xdev: false` in <omp agent dir>/config.yml. Owns exactly the line(s) it adds (recorded in install-state), refuses a symlinked config, refuses a config it cannot parse, and refuses an EXPLICIT operator `xdev: true` by name rather than overwriting a decision. Without it the vendor default wraps every MCP tool behind `xd://` and the doorbell announces a tool the model cannot call"
+				},
+				{
+					"synopsis": "uninstall-omp-config",
+					"column": 38,
+					"summary": "honest inverse from install-state: takes back exactly the recorded line(s), removes the file only when entwurf created it, REFUSES when the config changed since install"
+				},
+				{
+					"synopsis": "install-omp-bridge",
+					"column": 38,
+					"summary": "#87: install the OMP BIRTH extension into <omp agent dir>/extensions/entwurf-meta-omp (index.ts|js + lib + capability registry). No launcher and no bake — an omp hook is an in-process extension. Refuses when an inherited PI_CODING_AGENT_DIR/PI_CONFIG_DIR/PI_PROFILE makes the target agent dir ambiguous (ledger M6), and refuses ANY pre-existing artifact at the unit path that entwurf holds no ownership state for — a shape is not a proof of ownership"
+				},
+				{
+					"synopsis": "uninstall-omp-bridge",
+					"column": 38,
+					"summary": "honest inverse from install-state (exact unit dir + recorded entry; no-state host REFUSES; state deleted LAST). Records already minted are preserved"
+				},
+				{
+					"synopsis": "doctor-omp-bridge",
+					"column": 38,
+					"summary": "#87: runtime axis (importable unit, writer/registry parity, mint vs sender-marker errors on SEPARATE axes, scope-fence receipts, a root-grammar preflight that goes RED on a relative ENTWURF_META_* override instead of reporting on some other directory, CERTIFIED omp record count via meta-facts under the omp root policy — never a text grep, live omp processes carrying inherited PI_SESSION_ID/PI_AGENT_ID) + ownership axis. PI_CODING_AGENT_DIR is the vendor's own agent dir here and is reported as ignored, never as contamination. Zero records = NOT-YET, never red"
+				},
+				{
+					"synopsis": "install-omp-receive",
+					"column": 38,
+					"summary": "#87 bundle B: install the OMP RECEIVER extension into <omp agent dir>/extensions/entwurf-receive-omp. Own unit, own install-state, own doctor, own inverse. It joins the citizen BIRTH minted in the same process (sender marker for this pid + V3 record + the vendor's current session id, all three or refuse), holds an fs.watch on that citizen's mailbox signal, and rings an ANNOUNCE-ONLY doorbell via pi.sendUserMessage. It never assumes it loads after birth: extension handlers run in directory-name order and a before-sorting unit was MEASURED to see no marker, so the arm retries on a bounded ctx.setInterval cancelled with ctx.clearTimer (the vendor exposes no clearInterval)"
+				},
+				{
+					"synopsis": "uninstall-omp-receive",
+					"column": 38,
+					"summary": "honest inverse from install-state; records and sender identity untouched. A session that ALREADY armed keeps its marker until its process exits"
+				},
+				{
+					"synopsis": "doctor-omp-receive",
+					"column": 38,
+					"summary": "runtime axis (importable unit, writer parity, arm failures and doorbell failures on SEPARATE axes, who is armed RIGHT NOW through the production marker reader) + ownership axis. Zero armed receivers = NOT-YET, never red. Reports a marker for exactly what a marker proves — a live owner reached the arm emit — and never upgrades that into \"a wake will happen\""
+				},
+				{
+					"synopsis": "omp-receive-facts",
+					"column": 38,
+					"summary": "read-only JSON projection of the omp receive rail: every receiver marker through readMetaReceiverMarker in BOTH readings (live / as-written) plus mailbox counts. The shared oracle so no consumer answers \"is a doorbell held?\" from a filename"
+				},
+				{
+					"synopsis": "install-omp-mcp",
+					"column": 38,
+					"summary": "#87 step 5: write ONE omp-native entwurf-bridge server into <omp agent dir>/mcp.json with env ENTWURF_BRIDGE_EXTERNAL_AGENT_ID=external-mcp/omp. The server key is a PINNED LITERAL, byte-identical to the Claude import's — same-key first-wins at native=100 > claude=80 is what SHADOWS the import (never disabledServers, which kills both). Adopt / create / REFUSE symlink, preimage recorded"
+				},
+				{
+					"synopsis": "uninstall-omp-mcp",
+					"column": 38,
+					"summary": "honest inverse from install-state (restores the preimage, or removes a file we created); the Claude import becomes effective again"
+				},
+				{
+					"synopsis": "doctor-omp-mcp",
+					"column": 38,
+					"summary": "ownership + config + boot doctor, plus the EFFECTIVE-source read (native-wins / native-invalid / import-wins / both-suppressed) — a configuration read, never a runtime receipt. Runtime validity and ownership are SEPARATE axes: foreign provenance, a disabledServers denylist, and a malformed entry under our key are each RED even with no install-state. tools.xdev is a RUNTIME cell: absent file/key applies the vendor default (true, no inline allowlist) and is RED while the native hand is the effective source; xdev false is ok; a covering xdevInlineDevices glob is ok-with-note"
+				},
+				{
+					"synopsis": "smoke-omp-mcp-state",
+					"column": 38,
+					"summary": "OMP MCP install/doctor/inverse regression incl. shadowing, the denylist refusal, target confinement + retarget refusal, and a malformed entry going RED with zero install-state. Fully sandboxed HOME/PI/XDG. Offline/deterministic"
+				},
+				{
+					"synopsis": "install-copilot-receive",
+					"column": 38,
+					"summary": "#82 RAIL 5: install the RECEIVER extension (user scope ~/.copilot/extensions/entwurf-receive). Owns the artifact and CHECKS the launch flag; it never sets one (a launch does — see `./run.sh copilot`). Arms per session after birth"
+				},
+				{
+					"synopsis": "uninstall-copilot-receive",
+					"column": 38,
+					"summary": "honest inverse from install-state; never removes a unit it did not install"
+				},
+				{
+					"synopsis": "doctor-copilot-receive",
+					"column": 38,
+					"summary": "artifact + digest, COPILOT_CLI_ENABLED_FEATURE_FLAGS on the LIVE copilot processes (the silent failure), live receiver markers via the production reader, receiver log. RED only when install-state exists"
+				},
+				{
+					"synopsis": "install-agy-bridge",
+					"column": 38,
+					"summary": "봉인 7: agy MCP install adapter — register ONE entwurf-bridge server in the agy mcp_config (adopt file / create / REFUSE symlink), stable bin command, install-state under $XDG_DATA_HOME/entwurf/agy-bridge/"
+				},
+				{
+					"synopsis": "uninstall-agy-bridge",
+					"column": 38,
+					"summary": "봉인 7: honest inverse of install-agy-bridge from install-state (restore preimage / remove key; refuse if config became a symlink)"
+				},
+				{
+					"synopsis": "probe-bridge-command <cmd> [args...]",
+					"column": 49,
+					"summary": "#81: BOOT the given bridge invocation and require the entwurf MCP tool surface back. `--invocation-json '{\"command\":\"…\",\"args\":[],\"env\":{}}'` preserves a harness config exactly. It waits for a valid initialize response, then sends initialized + tools/list only (no tools/call, lock, record, or delivery). exit 0 = it serves the bridge; 1 = it does not. The pi/agy doctors use this leaf."
+				},
+				{
+					"synopsis": "doctor-agy-bridge",
+					"column": 38,
+					"summary": "fail-loud doctor: MCP config + exact permission rule + state + live probe label"
+				},
+				{
+					"synopsis": "install-codex-birth",
+					"column": 38,
+					"summary": "publish ONE SessionStart declaration inside $CODEX_HOME/hooks.json (a file it shares) + the helper closure; no root, and the operator trusts the declaration once in their own Codex"
+				},
+				{
+					"synopsis": "uninstall-codex-birth",
+					"column": 38,
+					"summary": "exact inverse from the install-state digest inventory; removes only entwurf's own declaration (foreign groups byte-for-byte) and refuses drifted bytes instead of deleting them"
+				},
+				{
+					"synopsis": "doctor-codex-birth",
+					"column": 38,
+					"summary": "RUNTIME + UNIT bytes/ownership + FOREIGN neighbours (reported, never certified) + the vendor TRUST receipt at this declaration's measured index (--unit-only skips the receipt; sandboxes only)"
+				},
+				{
+					"synopsis": "install-codex-mcp",
+					"column": 38,
+					"summary": "own only [mcp_servers.entwurf-bridge] in the user's Codex config"
+				},
+				{
+					"synopsis": "uninstall-codex-mcp",
+					"column": 38,
+					"summary": "remove/restore only the recorded MCP atom"
+				},
+				{
+					"synopsis": "doctor-codex-mcp",
+					"column": 38,
+					"summary": "effective config + ownership + actual bridge boot"
+				},
+				{
+					"synopsis": "install-codex-statusline",
+					"column": 38,
+					"summary": "add thread-title to tui.status_line for visible garden ids"
+				},
+				{
+					"synopsis": "uninstall-codex-statusline",
+					"column": 38,
+					"summary": "remove only the recorded status-line atom"
+				},
+				{
+					"synopsis": "doctor-codex-statusline",
+					"column": 38,
+					"summary": "effective visible-identity config + ownership verdict"
+				},
+				{
+					"synopsis": "install-codex-terminal-title",
+					"column": 42,
+					"summary": "add thread-id to tui.terminal_title so the multiplexer reports the caller's thread in #{pane_title} (#95 placement input, never an address)"
+				},
+				{
+					"synopsis": "uninstall-codex-terminal-title",
+					"column": 42,
+					"summary": "remove only the recorded terminal-title atom"
+				},
+				{
+					"synopsis": "doctor-codex-terminal-title",
+					"column": 42,
+					"summary": "effective caller-seat config + ownership verdict"
+				},
+				{
+					"synopsis": "codex-socket-path",
+					"column": 42,
+					"summary": "#95 INTERNAL (the launcher asks this; you do not need it): print the Codex app-server default control-socket path for this environment, from the SAME resolver delivery and preflight read"
+				},
+				{
+					"synopsis": "codex-app-server [args...]",
+					"column": 42,
+					"summary": "#95: the ONE COMMAND that starts the operator's Codex app-server. exec()s `codex app-server --listen \"unix://$CODEX_HOME/app-server-control/app-server-control.sock\"` in THIS terminal (cwd/pid/exit are the vendor's, Ctrl-C is yours) — entwurf owns the SPELLING of that address, never the process's lifecycle: no supervisor, no restart, no daemon, no pid file. It does no path arithmetic: the address comes from `codex-socket-path`, the one leaf every other Codex surface reads, and a resolved address that is not absolute or carries a control character is refused before anything is created. Your arguments are forwarded byte-identical after it; a second --listen is refused by name. Refuses on a live socket (names the /proc owner it can read) or an indeterminate one, and reports which tmux server this seat gives caller-seat lookups. Run it in a DETACHED tmux session other than the one you work in"
+				},
+				{
+					"synopsis": "install-agy-statusline",
+					"column": 38,
+					"summary": "own the agy statusLine subtree with bare entwurf-agy-statusline; preserve unrelated settings"
+				},
+				{
+					"synopsis": "uninstall-agy-statusline",
+					"column": 38,
+					"summary": "honest inverse from statusline install-state"
+				},
+				{
+					"synopsis": "doctor-agy-statusline",
+					"column": 38,
+					"summary": "fail-loud statusLine config/bin/state doctor + honest live SKIP"
+				},
+				{
+					"synopsis": "install-agy-hooks",
+					"column": 38,
+					"summary": "#46 agy birth imprint hook — named PreInvocation hook running bare entwurf-agy-imprint, preserving other hooks"
+				},
+				{
+					"synopsis": "uninstall-agy-hooks",
+					"column": 38,
+					"summary": "honest inverse of install-agy-hooks from install-state"
+				},
+				{
+					"synopsis": "doctor-agy-hooks",
+					"column": 38,
+					"summary": "fail-loud doctor for agy hooks.json imprint wiring"
+				},
+				{
+					"synopsis": "meta-bridge-prune",
+					"column": 38,
+					"summary": "1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])"
+				},
+				{
+					"synopsis": "meta-bridge-fresh-cut",
+					"column": 38,
+					"summary": "the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only. EXIT CONTRACT (#54, `--help` prints it): 0 complete / 1 NOTHING MOVED (re-run, do not setup) / 2 usage / 3 cut transition incomplete (inspect) / 4 cut complete but residue cleanup failed (`setup` may run; re-run only before new citizen birth, otherwise remove residue manually)",
+					"details": [
+						"  Open a fresh meta-bridge generation: quiesce-check every live surface, then",
+						"  archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<timestamp>` siblings,",
+						"  clear dead sender/receiver markers and dead control sockets, and open empty",
+						"  live dirs. No migration, no restore: the archive is forensic bytes only.",
+						"",
+						"store   = ENTWURF_META_SESSIONS_DIR || <PI_CODING_AGENT_DIR|~/.pi/agent>/meta-sessions",
+						"mailbox = ENTWURF_META_MAILBOX_DIR  || <PI_CODING_AGENT_DIR|~/.pi/agent>/meta-mailbox",
+						"sockets = ENTWURF_DIR               || ~/.pi/entwurf-control",
+						"",
+						"EXIT CONTRACT (#54) — what already moved, not how bad it was:",
+						"  0  cut complete: generation archived (or none existed), fresh v3 store open,",
+						"     residue cleared. `&& setup` is correct here.",
+						"  1  NOTHING MOVED: a live/unprovable surface, an occupied archive destination,",
+						"     an unreadable surface, or a first rename that failed. The host is unchanged —",
+						"     fix the named cause and re-run. Do NOT run setup: the store it refused is still there.",
+						"  2  usage.",
+						"  3  CUT TRANSITION INCOMPLETE: at least one archive move happened,",
+						"     but the fresh generation is not confirmed open. Inspect, or re-run to finish under a new stamp.",
+						"  4  CUT COMPLETE, CLEANUP INCOMPLETE: the generation IS archived and the fresh",
+						"     generation IS open — install and citizen birth are unblocked, so setup may run —",
+						"     but marker/socket residue survived. Prefer fixing it and re-running BEFORE setup; after new citizen birth,",
+						"     remove the named residue manually instead of archiving the new generation with another cut."
+					]
+				},
+				{
+					"synopsis": "meta-facts",
+					"column": 38,
+					"summary": "#65 owner-normalized READ-ONLY store projection: deterministic JSON {schemaVersion:1, storeDir, citizens: full v3 records sorted by gardenId, defects: {filename,message}} — THE listing contract emitted by the owner so consumers stop copying the certification. No liveness/sockets/transcript contents. EXIT: 0 readable (defects in-band; missing store = empty), 2 usage, 3 unreadable ([dir])"
+				},
+				{
+					"synopsis": "check-remote-pair-installed",
+					"column": 39,
+					"summary": "#107 rail 3, CHECKOUT-ONLY: install a caller-supplied candidate tarball (--tgz <abs>) into a sandboxed consumer prefix, check its compiled remote-pair surface, run the installed `entwurf remote-pair-receive` (usage exit 2 = twin reached), run the T2 roundtrip cells against the installed bridge+entry, and audit that the subject processes resolve every module inside the consumer prefix (with a checkout control). Never repacks; no real ssh, no model"
+				},
+				{
+					"synopsis": "check-remote-pair-installed-audit",
+					"column": 45,
+					"summary": "#107 rail 3: the deterministic counterpart of check-remote-pair-installed — its checkout-invisibility acceptance primitive proven on synthetic logs (real path, root boundary). In check:vitest"
+				},
+				{
+					"synopsis": "remote-pair-receive",
+					"column": 38,
+					"summary": "#107 rail 1: the RECEIVING half of one operator-declared remote pair. Reads ONE JSON claim {from,fromAgentId,fromCwd,target,message,wantsReply} on stdin, refuses a from/target outside the declared pair before any mutation (a scope limit under the same-operator SSH account trust model, not authentication), then hands a match to the existing v2 dispatch. Ambient sender carriers are never read. Installed, run_ts runs its compiled twin (dist/scripts/remote-pair-receive.js). EXIT: 0 dispatched / 4 dispatched, the dispatch reported an error (delivery not inferred) / 3 pair refused / 2 invalid claim or declaration (JSON receipt) or wrong argv (usage on stderr, no receipt) / 1 uncaught dispatch or store throw (no receipt; the sender reads it as indeterminate) (--pair <absolute declaration file>)"
+				},
+				{
+					"synopsis": "peer-facts",
+					"column": 38,
+					"summary": "#116 M2-a owner-normalized READ-ONLY peer projection: the same listEntwurfFacts provider through the same renderer entwurf_peers uses, emitted as deterministic JSON {schemaVersion:1, storeDir, peers, diagnostics} so a consumer never re-implements the placement join (whose pi half is a measured vendor floor). NOT the same bytes as an entwurf_peers call and deliberately so: that surface is a human listing (observationLimit, text over the wire), this is a machine projection with UNBOUNDED observation, because a rationed row says `unobserved` and a machine cannot tell that from \"nobody could look\". `placement` stays a STRUCTURED tagged union ({kind:\"herdr-pane\",paneId} / unobserved / none / ambiguous) — never the human `herdr <pane>` string. Publishes NO socket coordinate (ENTWURF_DIR selects what is PROBED, #50 C4) and NO herdr agent_status / interactive_ready / screen text. One placement read per listing, no watcher. EXIT: 0 readable (diagnostics in-band; missing store = empty), 2 usage, 3 unreadable ([dir])"
+				},
+				{
+					"synopsis": "meta-bridge-managed-keys",
+					"column": 38,
+					"summary": "0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)"
+				},
+				{
+					"synopsis": "check-keyset-overlap <fragment.json...>",
+					"column": 52,
+					"summary": "0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)"
+				},
+				{
+					"synopsis": "check-dep-versions",
+					"column": 38,
+					"summary": "local deterministic check that the pi pin agrees across the durable pin's SDK set, package.json (exact production dependencies, no Earendil dev/peer duplicate), run.sh (install pins), the workspace closure and the baseline docs (README/ROADMAP/setup-clean-host/demo/VERIFY/herdr/acp)"
+				},
+				{
+					"synopsis": "check-node-floor-coherence",
+					"column": 38,
+					"summary": "binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration"
+				},
+				{
+					"synopsis": "check-pack",
+					"column": 38,
+					"summary": "publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)"
+				},
+				{
+					"synopsis": "check-pack-pin-matcher",
+					"column": 38,
+					"summary": "pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (a prefix-extended @0.86.0-beta.1 and an off-pin @0.85.1 must leak, @0.86.0 bare or with any measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install"
+				},
+				{
+					"synopsis": "check-pack-argv-matcher",
+					"column": 38,
+					"summary": "pure self-test of check-pack-install's dispatcher-verb leak refusal (the copilot and codex-app-server cells): a front-loaded or trailing leak in ~260 KB is refused where the retired printf | grep -qF shape misses it (teeth control measured each run), clean output passes silently, a failing grep is refused by name, and both cells still return through it; snapshot-safe qualification oracle, also run first inside check-pack-install"
+				},
+				{
+					"synopsis": "check-pack-consumer-roots",
+					"column": 38,
+					"summary": "pure self-test of check-pack-install's consumer sandbox: under a poisoned inherited HOME/XDG/PI_CODING_AGENT_DIR every writable root a consumer subcall sees resolves inside its own consumer home; snapshot-safe qualification oracle, also run first inside check-pack-install"
+				},
+				{
+					"synopsis": "check-fresh-cut-gate",
+					"column": 38,
+					"summary": "SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost"
+				},
+				{
+					"synopsis": "check-pack-install",
+					"column": 38,
+					"summary": "heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi SDK (pins derived from the package.json exact production dependency; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for) + the INSTALLED #129 durable bootstrap (pi/pi-durable/bootstrap.mjs) imported from node_modules: main/openDurableCitizen exported and PACKAGED_BRIDGE_ENTRY = the installed package's own dist entry — import only, no runtime/TUI/birth/bridge started + the #130 pi-durable CARRIER on actual npm consumers (Entwurf-only / aligned host / isolated global): the installed verifier, a consumer-contained resolution oracle with a same-sandbox neighbour control, every physical SDK edge at the pin, a mixed tree refused as pi-durable-sdk-mismatch though it still imports, and the public `entwurf pi-durable` reaching the app's own explicit-model refusal before any birth, also with one explicit `--native-module` (the synthetic fixture, initialized first; a reserved extension name refused before anything opens) (offline, sandbox HOME)"
+				},
+				{
+					"synopsis": "check-install-container",
+					"column": 38,
+					"summary": "0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)"
+				},
+				{
+					"synopsis": "install [project-dir]",
+					"column": 38,
+					"summary": "INTERNAL wiring leaf: setup/npm-consumer entry and the source-only developer menu compose it; prefer those owning procedures"
+				},
+				{
+					"synopsis": "remove [project-dir]",
+					"column": 38,
+					"summary": "remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)"
+				},
+				{
+					"synopsis": "install-user-scope [--plugin-runtime <root>]",
+					"column": 57,
+					"summary": "#116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope"
+				},
+				{
+					"synopsis": "herdr-plugin-activate <backend...>",
+					"column": 47,
+					"summary": "#116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status"
+				},
+				{
+					"synopsis": "herdr-plugin-deactivate",
+					"column": 37,
+					"summary": "#116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots, BOTH component inverses and the operator link (#153) read-only first; mutates only when every preflight is green; then the operator link -> Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. With NO ledger it removes nothing: a clean host exits 0, and anything found at the plugin's journal/runtime/cache addresses or its operator-link receipt is named with a non-zero exit (#135). Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails"
+				},
+				{
+					"synopsis": "herdr-plugin-expose-operator --bin-dir <abs>",
+					"column": 56,
+					"summary": "#153 the ONE explicit operator link: creates exactly <abs>/entwurf -> the Herdr runtime's own node_modules/.bin/entwurf, recorded by a receipt beside the activation ledger (raised to schema 3 first, so an artifact that cannot undo the link refuses the host). Runs only as the active runtime's package, only from a settled runtime with an active ledger, only into a physical directory that is an entry of the caller's PATH with no earlier entwurf on it; an existing file there without a receipt is someone else's and is refused. Never edits a profile or picks a directory"
+				},
+				{
+					"synopsis": "herdr-plugin-withdraw-operator",
+					"column": 42,
+					"summary": "#153 the opt-out of herdr-plugin-expose-operator: removes exactly the receipt's link — only while it is still that link — and then the receipt; the ledger stays at schema 3. Runs only as the active runtime's package. herdr-plugin-deactivate removes the same link first, before any component"
+				},
+				{
+					"synopsis": "remove-user-scope",
+					"column": 38,
+					"summary": "explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)"
+				},
+				{
+					"synopsis": "takeover-user-scope",
+					"column": 38,
+					"summary": "#86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists"
+				},
+				{
+					"synopsis": "doctor-pi-package",
+					"column": 38,
+					"summary": "#86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider"
+				}
+			]
+		],
+		"notes": {
+			"title": "Notes:",
+			"lines": [
+				"project-dir defaults to current directory",
+				"Claude Code login should already exist (e.g. ~/.claude.json)",
+				"setup's runtime verification is the v2 install smoke (entwurf-bridge); the v2 dispatch substrate is proven live by release-gate",
+				"API key is optional; this bridge is intended to work with Claude Code auth"
+			]
+		}
+	}
+}