@junghanacs/entwurf 0.12.8-repair.0 → 0.12.8

package/AGENTS.md

@@ -83,7 +83,7 @@ Warnings make agents blame themselves and flail. Broken tool state must surface
 2. **Dispatch is a function of liveness, not session type.** `entwurf_v2` never asks "is this a resume or a send" up front — it probes the target on its own rail and routes: live pi→control-socket, dormant pi→spawn-bg resume, active self-fetch→meta-mailbox, live native conversation→native-push. State is computed, never stored (a stored liveness bit is a lie).
 3. **A reject is honest, never cosmetic.** When a target cannot receive (dead, drifted identity, wrong state×intent), the decider returns a reject — no `✓ delivered`, no `.msg` written, no signal poke. Silent degraded "delivery" is forbidden.
 4. **MCP injection**: only via explicit `mcpServers` wiring. No ambient `~/.mcp.json` scanning, no automatic retrieval.
-5. **Meta-record authority is the record body, never the filename.** `scanByNativeId` scans `.meta.json` bodies, throws on duplicate `nativeSessionId` (authority ambiguity is fail-fast), and never derives identity from a filename. A meta-record is nullable-at-birth (`model`/`transcriptPath` null until known); a backend↔wakeMode contradiction is corrupt-and-crash.
+5. **Meta-record authority is the record body, never the filename — and the ACTIVE store is certified as a whole, by one contract.** Identity comes from the `.meta.json` body; no filename is ever parsed for authority. `certifyActiveStore` is the single contract the install doctor and all four identity writers (pi birth, Claude hook, agy imprint, `entwurf_register_native`) share: every `.meta.json` entry is a **regular file** (a symlink is refused, never followed — its bytes live where this store has no ownership), **readable by the live schema**, **named by its own body**, and the **unique holder of its `nativeSessionId`**. Body-is-authority and name-must-agree are not in tension: the body decides *what a record says*, while a record parked under the wrong name is unreachable by garden id and so corrupts the *active store*. Any defect fails the whole write BEFORE it happens, naming the fresh-cut verb — including a defect involving neither of the writer's own ids, because a narrow "is there a record for MY native id" scan is how a store ends up certified by the doctor and written to by the runtime under two different contracts (the weaker one always wins at runtime). **The contract binds both directions, at the granularity each surface can afford:** the store-WIDE scan runs on identity writes and in the doctor, while every TARGETED read (`readMetaIdentityByGardenId`, and so v2 dispatch / `entwurf_self` / sender-marker trust) holds the per-entry half — a non-regular-file record is refused and never followed, and body/filename drift fails loud, both naming the verb. Certifying only on write while the read followed a symlink made the rule true exactly where nobody was addressed. Store-wide *uniqueness* is still not proven per read, so a store that would fail certification can still surface a duplicate `nativeSessionId` to `entwurf_peers` and to dispatch — a known open gap, tracked separately, never described as guarded. A meta-record is nullable-at-birth (`model`/`transcriptPath` null until known). Production reads schemaVersion-3 records only, and the repo carries NO legacy reader or migrator: a record the live schema cannot read fails loud naming the fresh-cut verb (`entwurf meta-bridge-fresh-cut` — archive the whole generation, open an empty one). The active store provides no cross-generation address or resume continuity; sessions flow, and memory lives in the native transcripts and the embedding axes, never in the bridge.
 6. **GC reclaims process resources only — never data.** meta-records and transcripts (the denote-id memory layer) are preserved; dormant/stale entries are archived/TTL'd, not deleted.
 7. **This is not a second harness**: no prompt reconstruction, no transcript hydration, no tool result ledger, no harness emulation. Native bridges front only a garden id plus their narrow delivery rail (Claude mailbox or agy native-push); they do not scrape transcripts or run a replacement control daemon.
 8. **Auth boundary is deployment-surface-agnostic**. This repo does not provide, copy, proxy, decrypt, or mediate any backend's credentials. Native-harness sessions read whatever auth state is visible in their own process filesystem; nothing here moves that.
@@ -127,7 +127,7 @@ pnpm typecheck                              # 3-config tsc fence (root + mcp + s
 pnpm check                                  # full static floor: lint + typecheck + every check-*/smoke-* below
 ./run.sh check-entwurf-v2-matrix            # the decider's state×intent table, read as an SSOT (REAL decideDispatch)
 ./run.sh check-entwurf-v2-decider           # + -contract / -lock / -release / -send / -send-fallback / -mailbox / -runner / -production / -surface / -spawn / -spawn-production
-./run.sh check-meta-session                 # + -record-v2 / -dual-read / -migration / -mailbox-state-write / -receiver-marker / -capability-source / -dual-consumers / -listing
+./run.sh check-meta-session                 # + -v3-record / -mailbox-state-write / -receiver-marker / -capability-source / -identity-consumers / -listing (one live schema; no legacy readers — see check-fresh-cut-gate for the generation boundary)
 ./run.sh check-meta-doctor-oracle           # detection power of the release oracle: healthy fixture reaches `doctor: PASS`, 21 planted defects each turn it FAIL naming their own cause
 ./run.sh check-native-push-adapter          # agy probe/route leaf; separate from pi socket and mailbox liveness
 ./run.sh check-agy-sender-identity          # record-backed pid/start-key sender resolution + ambiguity refusal
@@ -164,26 +164,49 @@ If a gate fails or a claim drops below its needed evidence level, do not commit.
 
 Uses `entwurf` instead of `delegate` to avoid ecosystem collisions. spawn-bg resume creates a sibling, not a worker.
 
-- **Surface** — MCP `entwurf-bridge`: `entwurf_v2`, `entwurf_self`, `entwurf_peers`, `entwurf_inbox_read`, `entwurf_register_native` (explicit/manual fallback for an already-running native conversation). pi-native (`pi-extensions/entwurf-control.ts`): `entwurf_v2`, `entwurf_peers` tools + `/entwurf-sessions`, `/gnew` (`/garden-new`) commands. The v1 `entwurf` / `entwurf_resume` / `entwurf_send` tools and the `/entwurf` / `/entwurf-send` / `/entwurf-status` commands are **removed**.
+- **Surface** — MCP `entwurf-bridge`: `entwurf_v2`, `entwurf_self`, `entwurf_peers`, `entwurf_inbox_read`, `entwurf_register_native` (explicit/manual fallback for an already-running native conversation). pi-native (`pi-extensions/entwurf-control.ts`): `entwurf_v2`, `entwurf_peers` tools (#50 C4 removed the socket-scan `/entwurf-sessions` command). The v1 `entwurf` / `entwurf_resume` / `entwurf_send` tools and the `/entwurf` / `/entwurf-send` / `/entwurf-status` commands are **removed**.
 - **`entwurf_v2` is the one delivery verb.** Given a garden id, it classifies the target (live pi vs. dormant pi vs. mailbox meta-session vs. native-push citizen — a bare garden id does not reveal this) and routes correctly. It does **not** mint a fresh sibling: spawn-bg resumes an *already-identified* citizen, while native-register binds an *already-running* conversation. Fresh creation was the v1 `entwurf` verb and remains deferred.
 - **`entwurf_peers`** is a read-only fact surface (liveness / capability / identity / cwd-history). Do not bake verb-routing (`resumable`/`sendable`) into the fact layer; routing is the decider's job.
-- **`entwurf_self`** returns the authoritative identity envelope (pi-session env, or a trusted meta-session sender marker) and is identity-required.
-- Target registry: `pi/entwurf-targets.json` (spawn-bg resume allowlist). Identity Preservation Rule: no model override on resume.
+- **`entwurf_self`** returns the authoritative identity envelope (pi-session env, or a trusted meta-session sender marker) and is identity-required. Its socketPath/mailboxPath lines are the CALLER's own transport diagnostics, not an identity surface — that is why they survive #50 C4 while `entwurf_peers` forbids every socket-shaped key/path (the peers listing points at OTHER citizens, where a socket path is an address claim).
+- The target registry (`pi/entwurf-targets.json` + `setup:links`) is **gone** (#50 C3): v2 never spawns from a model tuple — `entwurf_v2` resumes an already-identified record-backed citizen, and dormant-resume authorization is record existence + the transcript-header ↔ `record.nativeSessionId` integrity check (the old `requireEntwurf` name-tag and resume-marker env are deleted). Bridge-extension routing survives as `getRegistryRouting` (caller-supplied tuple, ← resolve-acp-bridge). Identity Preservation Rule: no model override on resume.
 - `PI_SHELL_ACP_V2_ONLY=1` was the v1-refusal flag; with v1 removed on this branch its guard (`entwurf-v2-only.ts`) is gone too. `runEntwurfV2` was always flag-clean.
 
 > **Source-agnostic does not mean harness-agnostic.** 어디서 던지든 — GLG / sibling / external MCP host — entwurf 의 *target* 은 garden citizen 이다. spawn-bg resume 의 spawn surface 는 pi 자식 프로세스만 띄운다 (`pi --entwurf-control` keep-alive resident). 외부 MCP host 가 닿을 때도 target 은 이미 식별된 citizen 이어야 한다. *Model* 은 free axis (어느 형제 학교 모델이든), *spawn target* 은 harness 정합 axis.
 
 > **Naming pair.** *Entwurf* (기투, projection-of-self) — a resident agent throws siblings forward (resume / messaging). The resident-side counterpart is *Mitsein* (공존, being-with), defined in the resident's own knowledge base (cwd-scoped, not a global persona). This repo owns the entwurf substrate; resident-side conventions live where the resident wakes.
 
-### Garden launcher — the resident session is garden-native or it blows up (0.9.0)
-
-Garden identity covers the operator's OWN `--entwurf-control` session, not just spawned children. A `--entwurf-control` session's header `id` MUST be a garden sessionId (`YYYYMMDDTHHMMSS-[0-9a-f]{6}`); pi assigns a `uuidv7` when `--session-id` is absent, so the launcher injects it and `entwurf-control` only enforces.
-
-- **Launch:** `pi --session-id "$(run.sh new-session-id)" --entwurf-control …` (operator alias). The id is fixed at launch — an extension cannot change it after pi's `newSession`. `run.sh new-session-id` is the `generateSessionId` SSOT; never reimplement the format in the shell.
-- **In-process new:** builtin `/new` stays blocked under `--entwurf-control` because it mints a uuid before extensions can inject an id. Use `/gnew` (alias `/garden-new`) for a same-terminal fresh garden session; it pre-creates a valid garden JSONL header and `switchSession()`es into it, so no uuid moment exists. A `/gnew` session quit before the first turn may appear in resume lists with message count 0; that is intentional, not an orphan. (`/gnew` births a fresh *operator* session in the same terminal — it is not the deferred programmatic fresh-sibling-minting capability.)
-- **Enforcement:** non-garden id under `--entwurf-control` → loud stderr + notify + `process.exit(1)` at `session_start`, **before any model turn**. A bare `throw` / `ctx.shutdown()` there is swallowed by pi's runner (verified: the turn ran, 26k tokens leaked), so the guard hard-exits. No uuid / back-compat path — "보이면 바로 터진다".
-- **Status label = 🪛 (the forged screwdriver, the North Star), NOT the word "entwurf".** `🪛 ready` before the first assistant turn (file not on disk → model changeable), `🪛 <gardenId>` after (file written → model locked). The id's presence is the model-lock lifecycle signal.
-- **Resident name is lazy + `control`-tagged, never `entwurf` — with one sessionId-bound exception.** Set on the first turn via `pi.setSessionName(buildGardenSessionName(...))`. `buildGardenSessionName` is registry-FREE and FORBIDS the `entwurf` tag — the `entwurf` tag is the v2 resume resident marker, so an **operator** resident must never carry it (else a general operator session becomes resumable as a child). The narrow exception: a **v2 spawn-bg authorized Entwurf child** — marked by env `ENTWURF_V2_RESUME_RESIDENT_SESSION_ID` (sessionId-bound) — **keeps** its `entwurf`-tagged name and stays re-resumable when it dies. Only that marker-authorized child is exempt. Gates: `check-entwurf-session-identity` (deterministic) + the v2 child exception via `check-entwurf-v2-spawn-production` + `smoke-entwurf-v2-spawn-resume-live`.
+### Resident identity — the record is the address (#50 C2)
+
+A `--entwurf-control` session is a garden citizen because it has a **meta-record**, not
+because its session id has a particular shape. pi mints its own id (a uuidv7 is normal);
+`birthPiCitizen` upserts `(backend:"pi", nativeSessionId)` at `session_start`, the record
+mints the `gardenId`, and everything addressable hangs off that one string.
+
+- **Launch:** `pi --entwurf-control …`. No `--session-id` injection — that was the old
+  launcher's job and it is gone, together with `run.sh new-session-id`'s role in launching
+  (the generator itself stays; the record uses it to mint garden ids).
+- **In-process new/resume:** pi's own. `/new`, `/fork`, `/clone` and RPC session replacement
+  all just fire `session_start`, which attaches the new session as its own citizen and
+  rebinds the socket to its address. The `/gnew` command, the pre-switch cancels and the
+  garden-format hard exit are deleted — there is no id to police (LOCKED PROTOCOL 2).
+- **Socket:** `~/.pi/entwurf-control/<gardenId>.sock`, keyed on the RECORD's id. A socket
+  carrying pi's session id is the pre-cut address and a gate failure.
+- **`PI_SESSION_ID`** carries the gardenId, so every child MCP process reads back a
+  routable address (`entwurf_self`), never pi's internal id.
+- **Failure is loud, not cosmetic:** if the record cannot be written (unreadable store,
+  duplicate native id, an unreadable store naming the fresh-cut verb) the control server is
+  refused, `PI_SESSION_ID` stays unset, and the reason is on stderr. An unaddressable
+  resident must not survive quietly — that is the guard's surviving purpose.
+- **Status label = 🪛 (the forged screwdriver, the North Star), NOT the word "entwurf".**
+  `🪛 ready` before the first assistant turn (session file not on disk → model changeable),
+  `🪛 <gardenId>` after (file written → model locked).
+- **The resident session NAME is pi's.** The `control`-tagged garden name mirror, its
+  `entwurf`-tag refusal and the sessionId-bound resume-marker exemption are gone with the id
+  they mirrored. Dormant-resume authorization is record existence (LOCKED PROTOCOL 6) plus
+  the transcript-header ↔ `record.nativeSessionId` integrity check (#50 C3).
+- Gates: `smoke-pi-attach` (deterministic, in `pnpm check`: record birth · record-keyed
+  socket · attach-on-reopen · artifact delivers to the socket) + `smoke-resident-garden-guard`
+  (LIVE, the same contract driven through a real `pi` process).
 
 ### Send-is-throw
 
@@ -199,18 +222,18 @@ Messages are thrown, not awaited.
 |------|---------|
 | `pi-extensions/acp-provider.ts` | ACP plugin entry: registers the package provider `entwurf` + curated Claude model surface; wires `streamSimple` to the real ACP backend |
 | `pi-extensions/lib/acp/*.ts` | ACP plugin internals: curated Claude surface + no-auth sentinel (`models.ts`), Claude config overlay (`overlay.ts`), tool surface + exclude-tools preflight (`tool-surface.ts`), ACP→pi event mapper (`event-mapper.ts`), pi Context→ACP prompt (`context.ts`), spawn-per-turn `streamSimple` backend (`backend.ts`) |
-| `pi-extensions/entwurf-control.ts` | control plane: `--entwurf-control` socket, RPC, `entwurf_v2` / `entwurf_peers` tools, `/entwurf-sessions` / `/gnew` |
+| `pi-extensions/entwurf-control.ts` | control plane: record attach at session_start, `--entwurf-control` socket (keyed on the record gardenId), RPC, `entwurf_v2` / `entwurf_peers` tools |
+| `pi-extensions/lib/pi-citizen-birth.ts` | the #50 C2 attach seam: pi session → meta-record upsert → control-socket address |
 | `pi-extensions/model-lock.ts` | package-provider model lock (pi.extension) |
 | `pi-extensions/meta-bridge-hook.ts` | Claude Code `SessionStart` hook: register a mailbox-backed garden meta-session |
-| `pi-extensions/lib/entwurf-v2-*.ts` | v2 substrate: contract / lock / decider / matrix / release / send / mailbox / native-push / runner / production / surface / spawn(+production) + resume-marker |
+| `pi-extensions/lib/entwurf-v2-*.ts` | v2 substrate: contract / lock / decider / matrix / release / send / mailbox / native-push / runner / production / surface / spawn(+production) |
 | `pi-extensions/lib/native-push/` | Antigravity adapter probe/route, direct-inject hand, explicit native registration core |
-| `pi-extensions/lib/meta-*.ts` | meta-record authority, mailbox state, dual-read/migration, receiver/sender identity |
+| `pi-extensions/lib/meta-*.ts` | V3-only meta-record authority (`meta-session.ts`), mailbox state, receiver/sender identity — one live schema, no legacy readers |
 | `scripts/agy-{bridge,statusline-bridge,hooks-bridge}.*` | three state-backed agy install/doctor/inverse surfaces |
 | `scripts/agy-imprint.ts` | agy `PreInvocation` automatic birth + record-backed sender marker |
 | `pi-extensions/lib/entwurf-core.ts` | shared core (session-file lookup, identity read, explicit-extension args); some v1 exports now dead pending routing cleanup |
 | `protocol.js` | dependency-free shared wire constants (`<project-context` marker); single source for tsc emit + strip-types MCP paths |
 | `run.sh` | install (incl. `install-meta-bridge`), check-*/smoke-* gates, release-gate |
-| `pi/entwurf-targets.json` | spawn-bg resume target allowlist |
 | `mcp/entwurf-bridge/` | MCP server exposing `entwurf_v2`, `entwurf_self`, `entwurf_peers`, `entwurf_inbox_read` |
 
 ## Typecheck Boundary
@@ -234,14 +257,19 @@ Code-level invariants pinned at the same time:
 
 ## Runtime Dependencies
 
-- `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.54.1`), `@agentclientprotocol/sdk` (`1.1.0`), `@anthropic-ai/sdk` (`0.100.1`). Codex/Gemini ACP packages stay out of scope; Codex is native/probe, agy is the shipped native-push Google lane, and Gemini ACP remains compatibility history rather than a current target.
-- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.80.7 < 0.81` — devDep exact `0.80.7` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT the 0.80 provider-factory `providers/anthropic` subpath: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only the bare root, `/compat`, and `/oauth` for extensions — a `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.81` ceiling guards it; when 0.81 changes `compat` or the loader alias map, re-evaluate against whatever root/loader surface 0.81 then exposes.
+- `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.61.0`), `@agentclientprotocol/sdk` (`1.3.0`), `@anthropic-ai/sdk` (`0.100.1` — kept: `claude-agent-sdk@0.3.217`'s peer floor is `>=0.93.0`, so 0.100.1 satisfies it and a mechanical rise to the newest SDK is NOT taken). Codex/Gemini ACP packages stay out of scope; Codex is native/probe, agy is the shipped native-push Google lane, and Gemini ACP remains compatibility history rather than a current target.
+- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.82.0 < 0.83` — devDep exact `0.82.0` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT a provider-factory subpath such as `providers/anthropic`: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only FOUR pi-ai specifiers for extensions — the bare root, `/compat`, `/oauth`, and (added in 0.81) `/providers/all` — so any other `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.83` ceiling guards it.
+  - **The re-evaluation this line demanded has been done (2026-07-24, pi `v0.80.7..v0.82.0` source-diffed + both versions installed and `getModels("anthropic")` compared).** The shim holds: root / `/compat` / `/oauth` are untouched in the alias map, `getModels` is still exported from `/compat` (as `getBuiltinModels`, deprecation text now pointing at `/providers/all`), and the curated anchors are byte-identical across the bump (14 models, `claude-opus-4-8` + `claude-sonnet-5`, same `cost` / `contextWindow` / `maxTokens` / `reasoning`). What 0.81 ADDED — the `/providers/all` alias and native `registerProvider(provider)` registration — is a new surface, not a replacement forced on us; migrating the curated read off deprecated `/compat` onto it is a **separate cut**, deliberately kept out of the version bump. Re-evaluate again at the `<0.83` ceiling.
 
 ## Working Style
 
 - Surgical changes. One thing at a time.
 - Ask: does this belong in pi? In the resident's own repo? Or here?
 - Removal on this branch is gate-verified: subtract source AND its gate/case/script together (the 결합 규칙) so `pnpm check` stays green and never goes silently red.
+- **Every repair/removal commit hunts the sentences it invalidated** — adding the new fact without deleting the old claim has now shipped **eight** times (dead registry link → stale NEXT diagnosis → A1/launcher prose surviving C4 → `docs/setup-clean-host.md` teaching the deleted `--session-id` launcher *and a hard-exit guard that no longer exists* → the `shouldListAsLive` removal leaving its own policy sentences behind → the store-doctor claiming dual-read three cuts after V3-only · a gate header claiming v2 writes → **the schema module itself: `MetaIdentity`/serializer/minter/`decideUpsert` doc comments calling the live v3 shape "v2", one of them defaulting a field #50 deleted, while the same function's body comment was already correct**). **Stop extending the directory list — that is what failed three rounds running (`docs/`, then `scripts/`, then the lib the cut actually rewrote).** The unit is the REPO, and the sweep is a method, two axes:
+  1. **Retired vocabulary → repo-wide grep.** Before committing, write down what the cut retired: deleted symbol names, the schema/authority words it demoted (`dual-read`, `v2 identity`, `socketOnly`), the command form it replaced. `grep -rn` each across the whole tree (not only touched files — a schema cut invalidates prose in consumers it never edits), then judge every hit: a *tombstone* ("`X` is GONE since #50") is the goal, a *live claim* ("`X` reads v1 AND v2") is the defect.
+  2. **Landed plans → future-tense grep.** A cut that LANDS invalidates its own plan sentences: `yet` · `not here` · `Today …` · `does NOT yet` · `lands in step N` · `will land`. Staged-build headers are written in future tense and nobody returns to them when the step ships.
+  Surfaces to cover at minimum: README · AGENTS · DELIVERY · VERIFY · ROADMAP · `docs/**` (an install walkthrough is a new host's first surface, so a stale command there costs more than a stale README line) · run.sh usage lines AND dispatch/function comments · `scripts/**` operator & gate scripts · **the module the cut rewrote, all of it — being the file you edited is not evidence its other 40 comments were read**. A deleted symbol's *prose* is not deleted by the compiler or by biome — only by this sweep.
 - Keep docs calibrated: strong language is fine; unbacked language is not.
 - Resist the urge to make the substrate more magical than necessary.
 

package/BASELINE.md

@@ -24,8 +24,8 @@ host into a certified one.
 | Node 24 Linux package consumer | Required `artifact-consumer` CI: read-only candidate `.tgz`, checkout-invisible, non-root global install, PATH shims, frozen package root, path+sha256 regular-file fence, strict doctor fixture | None required for the package layout itself | Package-consumer shape verified. The planted Claude cache/owner/bridge are synthetic and prove no real Claude lifecycle. |
 | Claude Code 2.1.217 exec form | `check-hook-launch-topology` + `check-claude-floor-coherence`; doctor oracle healthy fixture + 21 defect mutations | B2 actual Claude session on NixOS: args per element, literal `${HOME}`, direct parent, FileChanged exit 2 → idle wake | Runtime behavior verified at 2.1.217 on one host; this is the supported floor. |
 | Claude Code 2.1.138 negative | Launcher empty-argv refusal + installer/doctor floor checks | B actual Claude session on NixOS: args discarded while runtime reported success | Unsupported; no shell-form fallback. |
-| Maintainer NixOS installed package | Gates and B/B2 are green, but the installed artifact is intentionally stale before release | Post-release clean reinstall → new Claude session → installed doctor exit 0 **pending** | Not yet host-certified for the repair artifact. |
-| hejdev6 Ubuntu installed package | Linux artifact-consumer gate models the package shape, not this machine | Post-release clean reinstall → new Claude session → installed doctor exit 0 **pending** | Recovery remains open; hand-patched hooks and validate output are not acceptance. |
+| Maintainer NixOS installed package | Gates and B/B2 are green; the published `0.12.8-repair.1` artifact was installed from the registry for acceptance, then the V3 development wiring was restored | 2026-07-25: registry install → installed `install-meta-bridge` → NEW Claude session with a live MCP child → installed doctor **exit 0** (HISTORY) | Host-certified for the published repair artifact, including physical `entwurf_v2` delivery and the live owner join. The doctor first went RED on a managed dev-bin shadowing the registry bridge. This host now runs dev wiring again; stable `0.12.8` earns its own host proof. |
+| Secondary Ubuntu Linux installed package | Linux artifact-consumer gate models the package shape, not this machine | 2026-07-25: same registry artifact, isolated clean `PI_CODING_AGENT_DIR`, NEW Claude session with a live MCP child → installed doctor **exit 0** (HISTORY) | Recovery closed for `0.12.8-repair.1`. Hand-patched hooks and validate output remain non-acceptance; a stable artifact is a separate proof. |
 | macOS Claude meta-bridge | No artifact-consumer job and no `/proc` live join | None | **Not yet verified/certified for this repair cut.** Installer refuses Darwin and doctor remains nonzero; uninstall permits Darwin to remove older managed state. This is not permanent—future native validation may reopen it, and package-level `os` stays unrestricted. |
 | WSL2 / Windows | None | None | Unverified / outside this repair cut. |
 
@@ -274,6 +274,89 @@ prompt, and if so quote the visible text exactly:
 
 # HISTORY (pointer)
 
+2026-07-25 repair.1 installed-native host acceptance (stable-promotion prerequisite):
+the published registry artifact `@junghanacs/entwurf@0.12.8-repair.1` was installed
+fresh on two Linux hosts (maintainer + secondary) through the package's stable bins.
+Each host ran installed `entwurf install-meta-bridge`, opened a NEW real Claude Code
+session with a live MCP child, and ran the installed `entwurf doctor-meta-bridge`
+against an isolated clean `PI_CODING_AGENT_DIR`; both doctors reached **PASS**, including
+the live MCP owner join and a physical `entwurf_v2` delivery. The maintainer host first
+proved the oracle's value by failing when its managed dev-bin shadowed the registry
+`entwurf-bridge`: the installed v2 hook wrote a v2 record while the checkout's v3 bridge
+refused it. Removing the managed dev bin made PATH resolve the registry bridge, after
+which the same native proof passed. The test-created v2 record from that failed mixed-path
+attempt was preserved under `meta-sessions.proof-failed-20260725T165227/`; the maintainer's
+V3 development wiring was restored after acceptance. This closes VERIFY's two-host
+repair.1 prerequisite for a separately authorized stable `0.12.8`; it is host
+corroboration of the published repair artifact, not evidence for the future stable
+candidate, which still earns exact-SHA CI, LIVE, and preserved-artifact acceptance.
+Exact pre-version closure checkpoint `28a52fe2d6e9ca29b657a33e5c80ff4debda2f0f`
+passed GitHub Actions run [30149759311](https://github.com/junghan0611/entwurf/actions/runs/30149759311):
+`check`, `install-surface`, and `artifact-consumer` all success. The host proof then found
+a one-line `remove-dev-bin` dispatch defect, so the eventual stable landing HEAD must earn
+a fresh exact-SHA run; this checkpoint is not reused as that acceptance.
+
+2026-07-24 (night) upgrade-harness + review acceptance at exact HEAD
+`cbda097` (branch `repair/v2-core-debt`, merged to main the same night — the
+hard-cut branch chronicle lives in issue #50): the three-cell harness gained
+the UPGRADE axis — `setup` / `install` / `install-meta-bridge` refuse a
+pre-cut (v1/v2) meta-record store BEFORE their first write, prescribe on
+three axes (pre-cut → migrate; problems → repair first; both → repair FIRST,
+then migrate), and the proof seeds every host state from frozen fixture bytes
+(`fixtures/meta-store`, sha256-manifested, excluded from the tarball).
+Deterministic cells at this HEAD: `pnpm check` EXIT=0 (source cell
+`check-upgrade-gate` 57/0), `check-pack-install` EXIT=0,
+`ENTWURF_REQUIRE_DOCKER=1 check-install-container` EXIT=0 — candidate
+`junghanacs-entwurf-0.12.8-repair.1.tgz` **sha256
+`db17165f962c938d71ef97cb7a86252549dc91b00d5ec67f63ec65b41039e6dc`**,
+11413738 bytes, image `sha256:f1158c7f34cf35a047bf0513c38282bb2fa253529e5ae404b32c6d93697410be`.
+Live at this HEAD: `LIVE=1 release-gate` **MUST 16/1/0 + BEHAVIOR 1/0,
+EXIT=1** — the single FAIL is `smoke-acp-bundled-mcp-live`, the known
+bundled-MCP readiness race (ROADMAP 「🔴 OPEN」, GLG: observe, don't fix;
+sample recorded with transcript; isolated re-run PASS 4/4). Every other MUST
+passed at this HEAD, including `smoke-acp-v2-send-live` (send identity /
+replyability) and the matrix honest-reject. **A release cut stays blocked on
+that red by the gate's own words; the merge to main was GLG's explicit call
+with the race documented as an open observation item.**
+
+2026-07-24 dependency-uplift acceptance at exact HEAD
+`7cbeb29b6afcfbaf4fc28da3b7929037c339113d` (branch `repair/v2-core-debt`): pi
+runtime **0.80.7 → 0.82.0** and Claude ACP **claude-agent-acp 0.54.1 → 0.61.0 /
+ACP SDK 1.1.0 → 1.3.0** as two separate cuts, with `@anthropic-ai/sdk` held at
+**0.100.1** (measured through the real module graph: claude-agent-sdk 0.3.217's
+`>=0.93.0` peer resolves to 0.100.1 there; dropping the direct pin under this
+repo's `autoInstallPeers:false` leaves only 0.91.1 and the peer goes unmet).
+Deterministic 3 cells all EXIT=0 on Node 24 Linux — checkout (`pnpm
+build-bridge && pnpm check`), installed tree (`check-pack-install`: resolved
+tree holds only `@earendil-works@0.82.0`, loader drove the pinned pi, installed
+bin delivered a `.msg`), clean consumer (`ENTWURF_REQUIRE_DOCKER=1
+check-install-container`, candidate `junghanacs-entwurf-0.12.8-repair.1.tgz`
+**sha256 `ab5dee07585c8d7a4f8f174cedea0051489ae1a26766ff1baf8edd7377d5bac7`**,
+11391060 bytes, image `sha256:f1158c7f34cf35a047bf0513c38282bb2fa253529e5ae404b32c6d93697410be`).
+Live: `LIVE=1 ./run.sh release-gate` measured **MUST 17/0/0 + BEHAVIOR 1/0,
+EXIT=0** at this HEAD — the first aggregate to include
+`smoke-acp-v2-send-live`, which closes the SEND half of ACP citizenship (an ACP
+model calls `entwurf_v2` and the `.msg` lands carrying the resident's own garden
+id, `entwurf/<model>`, replyable — a gid never present in the prompt). Two
+stale claims were retired against measurement rather than argument: the
+extension-loader `/compat` shim survives 0.82.0 (root / `/compat` / `/oauth`
+untouched; `/providers/all` is an addition, and the curated Claude anchors are
+byte-identical across the bump), and the "one-shot bundled-MCP teardown hang"
+that a gate comment used as its rationale does not reproduce on this
+combination. What a plain `pi -p` genuinely lacks is garden identity, and only
+without `--entwurf-control` — now documented as a provider/citizen boundary
+instead of read as a defect.
+
+2026-07-24 record-era aggregate floor: `LIVE=1 ./run.sh release-gate` measured
+**MUST 16/0/0 + BEHAVIOR 1/0, EXIT=0** on the `repair/v2-core-debt` branch after
+the #50 C1–C3 cuts and the observability repair — the first aggregate run since
+2026-06-27 (every individual smoke had been green, but the two-tier summary and
+exit code of the aggregate command itself had gone unverified for the whole
+hard-cut window; three MUST live smokes were found dead on the pre-C2 address
+contract and re-authored in the same pass). The step count moved 17→16 with the
+v2-cutover smoke retirements. Evidence log: `/tmp/pi-tmux-release-gate.log`
+(scratch `/tmp/entwurf-rg-scratch-20260724`).
+
 2026-07-22 repair evidence: Linux artifact-consumer C is committed locally as
 `328c66e` (not yet pushed at the time of this baseline update); B/B2 direct-native
 observations and the exec-only production cut are documented in issue #51 and
@@ -287,9 +370,14 @@ inode/size/mtime/sha tuple was unchanged across acceptance. Evidence logs:
 `/tmp/pi-tmux-entwurf-exact-final.log` and
 `/tmp/pi-tmux-entwurf-default-final.log`; the digest belongs in the external cut log,
 not inside this shipped file (embedding it would mutate the tarball it names).
-This was the current `0.12.7-1` gate candidate, **not** the approved release artifact;
-repeat exact mode after the separate `0.12.8-repair.0` version commit. Maintainer/
-hejdev6 installed doctor GREEN remains deliberately pending until after release.
+This was the `0.12.7-1` gate candidate, **not** the approved release artifact. Exact
+mode was later repeated for `0.12.8-repair.0`, and those accepted bytes were published
+under `repair` on 2026-07-22. Field evidence then invalidated that release: its installed
+MCP dist omitted `entwurf-capabilities.json`, so tools/list and the old doctor stayed
+green while every `entwurf_v2` send died ENOENT. The repaired candidate must be
+`0.12.8-repair.1` and must earn fresh exact-SHA CI, LIVE-gate, preserved-artifact, and
+container evidence; none of repair.0's release evidence transfers. Maintainer/secondary-host
+installed doctor GREEN remains deliberately pending until after repair.1 publication.
 
 
 Per-release baselines — the 0.9.0 garden-native identity cut (17 PASS / 0 FAIL /
@@ -298,4 +386,4 @@ baselines — live in **CHANGELOG.md and git history**, including the gate names
 their era (several of which, e.g. `smoke-all` / `smoke-async-resume` /
 `smoke-compaction-policy` / `sentinel` / `xt-tool-surface`, were retired in the
 v2 cutover). The live calibration reference is the current release floor in
-[VERIFY.md](./VERIFY.md) §0A — most recent: **2026-06-27 MUST 17/0/0 + BEHAVIOR 1/0**.
+[VERIFY.md](./VERIFY.md) §0A — most recent: **2026-07-24 MUST 16/0/0 + BEHAVIOR 1/0**.

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.8 — 2026-07-25
+
+### Changed
+
+- **ACTION REQUIRED — hosts carrying a pre-v3 meta-record store refuse install and every identity write until an explicit generation cut.** The active citizen store is v3-only and carries no cross-generation address or resume continuity: sessions flow; memory lives in native transcripts and the embedding axes, never in the bridge. `install` / `setup` / citizen birth / `entwurf_register_native` refuse before writing when the store cannot certify and name the one repair verb: quiesce sessions, run `entwurf meta-bridge-fresh-cut` (dev clone: `./run.sh meta-bridge-fresh-cut`), then retry. The cut archives `meta-sessions/` + `meta-mailbox/` as forensic siblings and opens an empty v3 generation; no runtime reads the archive and no restore verb exists.
+- **#50 hard cut: the meta-record is the only address authority.** V3 drops `parentGardenId` + `isEntwurf`, removes the v1 `entwurf` / `entwurf_resume` / `entwurf_send` tools and `/entwurf*` commands, deletes `pi/entwurf-targets.json` + `setup:links`, and authorizes dormant resume through record existence plus transcript-header ↔ `record.nativeSessionId` integrity. A call is not parentage and there is no species boolean.
+- **The migration lane is deleted, not deprecated.** `meta-migration.ts`, the M1 backup/migrate/restore command, three gates (`check-meta-migrate-v3`, `check-meta-migration-readers`, `check-upgrade-gate`), and the frozen byte fixtures — 2,404 lines of deleted files, for continuity the substrate does not promise — are replaced by one generation verb (`meta-bridge-fresh-cut`) and one writer/doctor contract (`certifyActiveStore`). The whole upgrade story is quiesce → fresh-cut → go.
+- **The runtime pins move together.** Pi rises 0.80.7 → 0.82.0 under the closed peer range and doc gates; Claude ACP rises to `@agentclientprotocol/claude-agent-acp 0.61.0` + `@agentclientprotocol/sdk 1.3.0`, with `@anthropic-ai/sdk 0.100.1` retained. The ACP send gate proves a provider model can send as its host socket-citizen.
+
+### Fixed
+
+- **One active-store contract is shared by the doctor and every identity writer.** `certifyActiveStore` requires each `.meta.json` to be a regular file, readable by the live schema, named by its own body, and the unique holder of its `nativeSessionId`; it runs store-wide before every identity write. Targeted reads enforce the per-entry half and never follow a symlink. Duplicate uniqueness on read/discovery remains tracked separately in #52.
+- **Unknown is never silently converted to absent or dead on the fresh-cut path.** ENOENT alone means absence across record, store, directory and socket-entry inspection; EACCES/ENOTDIR/ELOOP and symlink/non-directory surfaces refuse as UNCERTAIN. The quiesce gate also probes marker-less native-push citizens through the same adapter dispatch uses, and `pgrep` exit 1 alone means no host while scan failures stay indeterminate. Five directory inputs across four code paths and the socket-entry layer are covered by F12–F18.
+- **The archive plan refuses common half-cut causes before moving and reports every partial move honestly.** Store and mailbox may have different parents, so each planned rename preflights parent writability and every destination is inspected with ENOENT-only absence before the first move. No permission probe can promise a rename (sticky bit, immutable attributes, read-only mounts and LSMs remain possible); if a rename fails, the loop prints each `archived so far:` path, calls the generation HALF-CUT, and gives the exact retry/manual-inspection prescription.
+- **Only a doctor verdict earns a destructive prescription.** Both store-doctor callers map exit 1 to certification defects → fresh-cut and exit 3 to access repair; usage, crash and unknown exits are doctor/runtime failures and prescribe no cut. `run.sh` also guards the actual doctor entry selected by its mode (source `.ts` vs installed compiled `.js`), so a missing artifact cannot collide with the doctor's defect exit. I7–I9 drive both callers and the installed-artifact seam.
+- **The installed-host acceptance closed two operator/test seams.** `./run.sh remove-dev-bin` now shifts its own command name before invoking the honest inverse. Stable-bin smokes remove every pre-existing provider/statusline bin directory from their sandbox PATH, so a maintainer carrying both dev links and registry shims cannot mask a dangling-command negative.
+
+### Carried from the repair line
+
+- Exec-form Claude hooks + the enforced Claude Code `>=2.1.217` floor (repair.0), and the capability registry beside the emitted MCP bridge with live-command physical delivery in `doctor-meta-bridge` (repair.1), are promoted to `latest`. After publication the required registry shape is `latest=0.12.8`, `repair=0.12.8-repair.1`.
+
+### Verification
+
+- Pre-version landing HEAD `1345688001ed6629bd0f58996a36134e7b7874bc` passed exact-SHA GitHub Actions run [30150824225](https://github.com/junghan0611/entwurf/actions/runs/30150824225): `check`, `install-surface`, and `artifact-consumer` all success.
+- Published `0.12.8-repair.1` passed installed `doctor-meta-bridge` on maintainer + secondary Linux hosts after a new real Claude session opened with a live MCP child; both runs included physical `entwurf_v2` delivery and live owner join (BASELINE HISTORY).
+- On the stable prepared tree, `LIVE=1 ./run.sh release-gate` is all green — **MUST PASS=17 FAIL=0 SKIP=0** (its first step is the full `pnpm check`; the run includes `smoke-acp-bundled-mcp-live` and `smoke-acp-v2-send-live`) and **BEHAVIOR PASS=1 FAIL=0**, EXIT=0 — at scratch `/tmp/entwurf-release-gate-0.12.8.u9y9IX`, complete log `/tmp/entwurf-release-gate-0.12.8.u9y9IX/release-gate.log`, per-step artifact paths printed inside it. The static gate judges the **candidate index**, so the release-prep bytes were staged before the run, not merely present in the working tree.
+- The prepared-HEAD exact-SHA CI, the preserved candidate and its container acceptance, the tag, the GitHub release, and `latest` publication remain deliberately deferred to `make` / `publish`.
+
+## 0.12.8-repair.1 — 2026-07-22
+
+### Fixed
+
+- **ACTION REQUIRED — `0.12.8-repair.0` is published but cannot deliver to mailbox-backed garden citizens.** Its npm tarball contains the source capability registry but omits the copy beside the emitted MCP bridge, so the installed `entwurf-bridge` boots and answers `tools/list` while a real `entwurf_v2` delivery dies `ENOENT …/entwurf-capabilities.json`. The same omission exists in `latest=0.12.7`; this cut deliberately moves only the `repair` dist-tag, leaving stable promotion for a separately authorized `0.12.8` after post-publish host proof. Install this exact repair, rerun `entwurf install-meta-bridge`, restart every already-open Claude Code session, open a new session with its live MCP child, and require the installed `entwurf doctor-meta-bridge` to exit 0. The doctor now proves delivery, not merely configuration shape.
+- **The shipped MCP dist now carries the capability registry at the location its emitted `meta-session.js` actually resolves.** `build-bridge.sh` copies `pi/entwurf-capabilities.json` to `mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json`; this is the bundle-root contract already used by the Claude meta-bridge plugin. `check-capability-bundle-reach` discovers every shipped `meta-session` copy, asks each copy from its real location, requires byte agreement with the source registry, and drives `metaCapabilityFor()` for all four registered backends. `check-bridge-delivery` then seeds isolated sender/receiver citizens, starts the built dist entry as a separate MCP stdio process, calls `entwurf_v2`, and requires one `.msg`, the doorbell, the seeded sender envelope, and no capability ENOENT. The same scene is replayed against `check-pack-install`'s project-local npm-installed bin and the clean Linux consumer's non-root global PATH shim, so source, dist, installed tree, and checkout-invisible consumer no longer split “boots” from “delivers.” This restores the fire-and-forget mailbox lane; it does not claim the separate neutral-install dormant-pi `owned-outcome` follow-up is solved.
+- **`doctor-meta-bridge` now drives the live MCP command Claude is configured to execute and requires a physical delivery in a throwaway world.** Ownership and behavior remain separate verdicts: the live `~/.claude.json` entry must equal `desired_mcp()`, and that exact live command—not a recomputed healthy command—must land one message and poke its doorbell. The probe redirects `PI_CODING_AGENT_DIR`, every meta store, and the socket root; no model, network, API cost, or operator mailbox is involved. Oracle mutations cover an absent live entry and a registry-less bundle that still answers `tools/list`, while the container mutation removes the registry only from the global install and proves every other doctor claim stays green as delivery alone turns red.
+- **Delivery verification no longer changes identity depending on which harness runs it.** A pi-launched doctor inherited `PI_SESSION_ID` plus `PI_AGENT_ID`; the bridge chooses that pair before meta-sender discovery, so the message still landed while the claimed seeded Claude sender-marker join was silently bypassed. The doctor and deterministic delivery gate now scrub both pi carriers plus `ENTWURF_META_SENDER_MARKER`, require `ENTWURF_BRIDGE_REQUIRE_META_SENDER=1`, and inspect the landed body for the seeded `meta-session/claude-code` garden id. A planted ambient pi pair and explicit marker carrier are part of the control; deleting the scrub leaves physical delivery green but turns the sender assertion red.
+- **The repair publication check is bound to the requested version instead of the already-published repair.0 literal.** The shared release skill now compares the registry's `repair` tag with `$VERSION`, while preserving the current contract that `latest` stays `0.12.7`; without this correction a successful repair.1 `npm publish` would have been followed by a false post-publish failure. The S7 install-surface gate binds the skill to SemVer prerelease syntax rather than to one obsolete example version.
+
+### Verification
+
+- Pre-version landing HEAD `4ae5aa874886fc889c0525369b5290066b6f96af` passed exact-SHA GitHub Actions run [29919713499](https://github.com/junghan0611/entwurf/actions/runs/29919713499): `check`, `install-surface`, and `artifact-consumer` all concluded success.
+- On the repair.1 prepared working tree, `pnpm check` passed and `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.12.8-repair.1.81GJe3` completed with `MUST: PASS=17 FAIL=0 SKIP=0` and advisory `BEHAVIOR: PASS=1 FAIL=0`; full log: `/tmp/entwurf-release-gate-0.12.8-repair.1.81GJe3/release-gate.log`. The final preserved tarball, prepared-HEAD exact-SHA CI, container acceptance, tag, and GitHub release remain deliberately deferred to `make`; no candidate was created in prepare.
+
 ## 0.12.8-repair.0 — 2026-07-22
 
 ### Fixed
@@ -99,7 +142,7 @@ All notable changes to this project will be documented here. Format follows [Kee
 - `pnpm check` passed on 2026-07-01 after the doctor/install-floor fix.
 - `./run.sh check-pack-install` passed with the new installed store-doctor scan and doctor-dispatch lock assertions.
 - Release-gate prep evidence: `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.4.PliLsd` passed on 2026-07-01; log `/tmp/pi-tmux-entwurf-release-gate-0124.log`; summary `MUST: PASS=17 FAIL=0 SKIP=0`, advisory `BEHAVIOR: PASS=0 FAIL=1` (`smoke-resident-garden-guard` post-`/gnew` autonomous `entwurf_self` identity turn; non-blocking).
-- `hejdev6` real floor host reproduced the pre-fix strip-types failure from an installed package and passed after installing the patched tarball: compiled store-doctor scanned `1 record(s)` with plain `node`, and installed `doctor-meta-bridge` reported store-scan ok plus v2-surface deferred.
+- `target Linux host` real floor host reproduced the pre-fix strip-types failure from an installed package and passed after installing the patched tarball: compiled store-doctor scanned `1 record(s)` with plain `node`, and installed `doctor-meta-bridge` reported store-scan ok plus v2-surface deferred.
 
 ## 0.12.3 — 2026-07-01
 
@@ -141,7 +184,7 @@ All notable changes to this project will be documented here. Format follows [Kee
 - `pnpm check` passes with the new `check-meta-manifest-schema` static guard included.
 - `./run.sh smoke-meta-install-state` passes, proving the state manager/doctor consumers still follow `desired_mcp()` without drift.
 - Installed-location regression probe passes: running `scripts/check-meta-manifest-schema.py` from a synthetic `node_modules/@junghanacs/entwurf` package no longer self-fails.
-- Claude Code 2.1.97 floor validation passed on `hejdev6` after removing the root marketplace `description`; current Claude 2.1.195 validation also passes with warnings only.
+- Claude Code 2.1.97 floor validation passed on `target Linux host` after removing the root marketplace `description`; current Claude 2.1.195 validation also passes with warnings only.
 - `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.2.NLGhet` passed on 2026-06-29 with `MUST: PASS=17 FAIL=0 SKIP=0` and `BEHAVIOR: PASS=1 FAIL=0`; log `/tmp/entwurf-release-gate-0.12.2-20260629T205339.log`.
 
 ## 0.12.1 — 2026-06-29
@@ -162,7 +205,7 @@ All notable changes to this project will be documented here. Format follows [Kee
 ### Verification
 
 - `./run.sh check-pack-install` passes with the neutral npm install regression: package bins present, optional pi peers absent, installed dist bridge answers `tools/list`, and pi-loader registration still passes on the explicit pi-peer lane.
-- Remote `hejdev6` real-install probe from the packed tarball passed: local npm install, package bins, optional pi peers absent, installed `entwurf-bridge` `tools/list`, `entwurf install` with isolated HOME, and `entwurf check-bridge`. The host's real HOME also exposed a pre-existing stale `~/.pi/agent/entwurf-targets.json` symlink to `pi-shell-acp`; fix with `entwurf setup:links --force` or an explicit `ENTWURF_TARGETS_PATH` if that old registry is intentional.
+- Remote `target Linux host` real-install probe from the packed tarball passed: local npm install, package bins, optional pi peers absent, installed `entwurf-bridge` `tools/list`, `entwurf install` with isolated HOME, and `entwurf check-bridge`. The host's real HOME also exposed a pre-existing stale `~/.pi/agent/entwurf-targets.json` symlink to `pi-shell-acp`; fix with `entwurf setup:links --force` or an explicit `ENTWURF_TARGETS_PATH` if that old registry is intentional.
 - `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.1.GUFDUb` tiers `MUST: PASS=17 FAIL=0 SKIP=0` with `BEHAVIOR: PASS=1 FAIL=0` on 2026-06-29; log `/tmp/entwurf-release-gate-0.12.1-20260629T191543.log` (the two live-smoke observation fixes above were what moved the gate from `MUST FAIL=1` to green; the install change is harness-neutral and touches no ACP code path).
 
 ## 0.12.0 — 2026-06-29

package/DELIVERY.md

@@ -109,8 +109,8 @@ the `D0–D8` capability level:
 
 | Harness / surface | Status | Highest current level | Transport | Notes |
 |---|---|---:|---|---|
-| **pi native Entwurf** | shipped | D7+ | Unix control socket + pi followUp/custom messages | Replyable pi session. This is the resident baseline, not an external meta-session. `entwurf_v2` treats a record-less but live pi control socket as a socket-only `fire-and-forget` target; record-less *dormant* resume is intentionally not claimed. |
-| **Claude Code interactive >=2.1.217** | shipped *(Linux is the only certified axis in this repair cut)* | D6, D7 partial, D8 partial | Exec-form global plugin: `SessionStart` arms `watchPaths`; external write triggers exec-form `FileChanged`; `asyncRewake` wakes idle session | B2 direct-native at 2.1.217 on one NixOS host proved per-element argv, no shell expansion, parent join, and exit-2 idle wake. B at 2.1.138 proved the negative: `args` discarded while Claude reported success, so installer/doctor enforce 2.1.217 and there is no shell fallback. The launcher provenance token keeps an old cached command fail-closed. Active idle wake is D6; D7/D8 remain partial as before. The Linux container's planted cache/owner/bridge are fixtures, not a second native-host proof. |
+| **pi native Entwurf** | shipped | D7+ | Unix control socket + pi followUp/custom messages | Replyable pi session. This is the resident baseline, not an external meta-session. The meta-record is the sole address authority (#50 C4): a record-less control socket — live or not — is refused as `record-less-socket` (diagnostic state), never dispatched. |
+| **Claude Code interactive >=2.1.217** | shipped *(Linux is the only certified axis)* | D6, D7 partial, D8 partial | Exec-form global plugin: `SessionStart` arms `watchPaths`; external write triggers exec-form `FileChanged`; `asyncRewake` wakes idle session | B2 direct-native at 2.1.217 on one NixOS host proved per-element argv, no shell expansion, parent join, and exit-2 idle wake. B at 2.1.138 proved the negative: `args` discarded while Claude reported success, so installer/doctor enforce 2.1.217 and there is no shell fallback. The launcher provenance token keeps an old cached command fail-closed. Active idle wake is D6; D7/D8 remain partial as before. The Linux container's planted cache/owner/bridge are fixtures, not a second native-host proof. |
 | **Antigravity / agy** | shipped | D6, D7 partial | Native LS gRPC `agentapi send-message` (native-push) | `PreInvocation` automatically births/attaches by native `conversationId` and writes the record-backed pid/start-key sender marker; `entwurf_v2` fire-and-forget probes and direct-injects through the antigravity adapter with a one-shot re-probe retry. Three managed adapters own MCP+one exact permission, statusline, and hook separately. `entwurf_register_native` remains an explicit/manual fallback, not the normal birth path. Live sender→sibling→same-gid reply passed on 2026-07-13, re-verified at **agy 1.1.0** on 2026-07-14 (13/13 LIVE checks); D7 stays partial because there is no canonical transcript/content receipt owned by the smoke. |
 | **Codex app-server-backed TUI 0.136.0** | verified-probe | D6, D7 (status) | WebSocket-over-UDS `turn/start` into the live `threadId` | **Demonstrated, no managed standalone, no cloud.** `codex app-server --listen unix://<owned 0700 dir>` + plain `codex` auto-attach (or `--remote unix://`). Full message injection (agy-like, not a doorbell); `thread/status/changed` gives completion observation. D8 robustness (dedupe / crash recovery / ordering policy) is not tested. `turn/steer` is active-turn steering, not idle wake. |
 | **Codex embedded TUI 0.136.0** | deferred | D0 partial | Native state DB / rollout transcript only | Standalone Embedded TUI binds no socket; no `FileChanged`/`asyncRewake` in Codex hooks; not retrofittable. Identify-only via state DB / rollout. |