diff --git a/Launcher.Next.App/PilotCli.cs b/Launcher.Next.App/PilotCli.cs
index 3523fcf..cc908ee 100644
--- a/Launcher.Next.App/PilotCli.cs
+++ b/Launcher.Next.App/PilotCli.cs
@@ -32,6 +32,10 @@ internal static class PilotCli
             if (!TryResolvePaths(config, out var paths, out error)) return Fail(Blocked, error!);
             if (!string.Equals(paths.LocalLauncherRoot, root, StringComparison.OrdinalIgnoreCase) || !string.Equals(config.PilotRoot, root, StringComparison.OrdinalIgnoreCase)) return Fail(Blocked, "PILOT_ROOT_CONFIGURATION_MISMATCH");
             if (!TryBuildManifest(options.PackageSource!, options.EntryAssembly!, out var manifest, out var manifestHash, out error)) return Fail(Blocked, error!);
+            var startupRoster = StartupRosterPreflight.Inspect(options.PackageSource!, manifest!);
+            Directory.CreateDirectory(Path.Combine(root, "evidence"));
+            StartupRosterPreflight.Write(Path.Combine(root, "evidence", "startup-roster-preflight.json"), startupRoster);
+            if (!startupRoster.IsSafe) return Fail(Blocked, "CANDIDATE_ISOLATION_" + startupRoster.Status.ToString().ToUpperInvariant());
             Directory.CreateDirectory(Path.Combine(root, "catalog"));
             await File.WriteAllTextAsync(Path.Combine(root, "catalog", "P_Rec_Annot.manifest.json"), JsonSerializer.Serialize(manifest));
             if (!File.Exists(paths.AcadExecutable)) return Fail(DiscoveryFailed, "PLANT3D_2026_NOT_FOUND");