@junghanacs/entwurf 0.12.8 → 0.12.10

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.10 — 2026-07-27
+
+### Changed
+
+- **The Claude ACP dependency rail moves to `@agentclientprotocol/claude-agent-acp` 0.62.0.** The paired SDK surface fence now covers Claude Agent SDK 0.3.219; this is a dependency refresh, not a claim that MCP readiness timing changed.
+- **The ACP rail document now names its unresolved readiness question precisely.** The ordered probe records wire availability, `newSession`, model enforcement, and prompt boundaries before any adapter remedy or Cortex work is considered.
+- **Gate qualification is part of the deterministic floor.** Committed defect mutants run in an isolated snapshot and must fail their named `[QK:<claim>]` oracle; the agy permission contract is likewise covered by an independent literal matrix.
+
+### Fixed
+
+- **All citizen rails now share the same record authority without inventing pi privilege.** Control-socket, self-fetch, and native-push capability differences remain explicit while stale pi-special address and transport prose is removed.
+- **The shipped pi and MCP tool descriptions tell the complete v2 dispatch truth.** Native-push direct injection, its three-valued probe rejects, mailbox deliverability, control-socket lock scope, and spawn-bg's separate relaunch transport are described and regression-fenced on both surfaces.
+- **Native-push self-awareness and agy permissions follow their actual rail.** Native-push never advertises an inbox; normal-path agy approval covers `entwurf_v2`, `entwurf_peers`, and `entwurf_self` with per-rule ownership, strict state migration, and separate runtime/ownership doctor verdicts.
+
+### Verification
+
+- Pre-version landing HEAD `9a501b30f0e7d82307d885f1a1eb9d91c79c5f16` passed exact-SHA GitHub Actions run [30252596435](https://github.com/junghan0611/entwurf/actions/runs/30252596435): `check`, `install-surface`, and `artifact-consumer` all success.
+- The prepared tree passed `pnpm check`; `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.12.10.d4gC9v` completed all green: **MUST PASS=17 FAIL=0 SKIP=0** and **BEHAVIOR PASS=1 FAIL=0**, EXIT=0. Full log: `/tmp/entwurf-release-gate-0.12.10.d4gC9v/release-gate.log`; per-step artifacts are preserved in that log. Prepared-HEAD exact-SHA CI and preserved-candidate acceptance remain deliberately deferred to `make`.
+
+## 0.12.9 — 2026-07-26
+
+### Changed
+
+- **The curated ACP surface adopts Claude Opus 5 on pi 0.82.1.** The deliberately narrow two-model surface keeps Sonnet 5 and replaces the Opus 4.8 anchor with Opus 5 (1M context, 128K max output, reasoning enabled). The pi runtime pin, closed peer range, lockfile, install gates, and current-version docs move together; source review of pi 0.82.1 confirmed the extension-loader aliases and `/compat` catalog seam are unchanged.
+- **`meta-bridge-fresh-cut` now reports the transition that actually occurred.** Exit 0 means the cut completed, 1 means nothing moved, 2 is usage, 3 means the cut transition is incomplete, and 4 means the generation was archived and the fresh v3 store opened but residue cleanup is incomplete. The command help, `run.sh` usage, operator docs, and deterministic decision/source-fence cells carry the same contract; exit 4 may proceed to `setup`, while rerunning after a new citizen is born would archive the new generation too.
+
+### Fixed
+
+- **A marker that cannot plausibly own a session no longer blocks the only repair verb or grants identity indefinitely.** The Claude hook, agy imprint, marker write boundary, all sender/receiver readers, fresh-cut inspection, and sender-candidate filtering share one `isPlausibleOwnerPid` policy. On the currently certified Linux desktop/workstation axis, pid 1 is refuted by construction and reported separately from a proven-dead owner; the cut clears that residue instead of waiting forever on init. A container running the harness as pid 1 remains unsupported and fails closed rather than quietly widening the evidence boundary.
+- **`setup` preserves the repository's tracked pi settings across the full install path.** Both writers of `.pi/settings.json` now share one serializer, recognize the portable relative package entry as the same checkout, and leave already-satisfied bytes untouched. The end-to-end gate plants the candidate-index settings in a stand-in checkout, drives the real `run.sh install`, and requires byte and mtime identity, covering both writers and user-scope side effects rather than only a helper.
+- **Duplicate `nativeSessionId` claims are quarantined on discovery and refused wherever a record becomes an address.** `entwurf_peers` lists neither rival while preserving unrelated citizens and naming diagnostics; canonical `entwurf_v2` dispatch checks the store before choosing any transport, and dormant pi resume uses the same addressable read. A regular unreadable rival fails loud because it might be the duplicate, while symlinked, drifted, or unparseable neighbours remain certification/listing defects without being promoted into addressable rivals. The deliberately narrower raw mailbox and marker paths retain the per-entry half of the contract; that boundary and its promotion rule remain tracked in #55.
+- **Record bytes now come from the same opened file description that proves their kind.** `readStoreRecordFile` opens with `O_NOFOLLOW` so a final-component regular-to-symlink swap fails before a byte is read, uses `fstat` on that fd, reads through the fd, and closes in a `finally`. `O_NONBLOCK` prevents the fd-classification repair from introducing a FIFO hang. The preceding `lstat` classification remains a separate policy layer so settled sockets, devices, and mode-000 directories receive the certification contract's non-regular verdict instead of leaking `ENXIO`/`EACCES` as a second vocabulary.
+
+### Verification
+
+- Pre-version landing HEAD `aaab00fbd293300d25c294580bb19bd3a88ad757` passed exact-SHA GitHub Actions run [30186472796](https://github.com/junghan0611/entwurf/actions/runs/30186472796): `check`, `install-surface`, and `artifact-consumer` all success.
+- The prepared tree passed an independent `pnpm check`, then `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.12.9.8NSzz7` completed all green: **MUST PASS=17 FAIL=0 SKIP=0** and **BEHAVIOR PASS=1 FAIL=0**, EXIT=0. Full log: `/tmp/entwurf-release-gate-0.12.9.8NSzz7/release-gate.log`; per-step artifact paths are preserved inside it. Prepared-HEAD exact-SHA CI and preserved-candidate acceptance remain deliberately deferred to `make`.
+
 ## 0.12.8 — 2026-07-25
 
 ### Changed
@@ -30,7 +68,7 @@ All notable changes to this project will be documented here. Format follows [Kee
 - Pre-version landing HEAD `1345688001ed6629bd0f58996a36134e7b7874bc` passed exact-SHA GitHub Actions run [30150824225](https://github.com/junghan0611/entwurf/actions/runs/30150824225): `check`, `install-surface`, and `artifact-consumer` all success.
 - Published `0.12.8-repair.1` passed installed `doctor-meta-bridge` on maintainer + secondary Linux hosts after a new real Claude session opened with a live MCP child; both runs included physical `entwurf_v2` delivery and live owner join (BASELINE HISTORY).
 - On the stable prepared tree, `LIVE=1 ./run.sh release-gate` is all green — **MUST PASS=17 FAIL=0 SKIP=0** (its first step is the full `pnpm check`; the run includes `smoke-acp-bundled-mcp-live` and `smoke-acp-v2-send-live`) and **BEHAVIOR PASS=1 FAIL=0**, EXIT=0 — at scratch `/tmp/entwurf-release-gate-0.12.8.u9y9IX`, complete log `/tmp/entwurf-release-gate-0.12.8.u9y9IX/release-gate.log`, per-step artifact paths printed inside it. The static gate judges the **candidate index**, so the release-prep bytes were staged before the run, not merely present in the working tree.
-- The prepared-HEAD exact-SHA CI, the preserved candidate and its container acceptance, the tag, the GitHub release, and `latest` publication remain deliberately deferred to `make` / `publish`.
+- Prepared HEAD `e31c28f` passed exact-SHA GitHub Actions run [30152323861](https://github.com/junghan0611/entwurf/actions/runs/30152323861) with `check`, `install-surface`, and `artifact-consumer` all successful. The preserved candidate `junghanacs-entwurf-0.12.8.tgz` (sha256 `7c7e8985823391ec6dfae918e08c4aed1fafd06b7415806b2d591b0cb95891f3`) passed the checkout-invisible container consumer, was tagged as `v0.12.8`, released on GitHub, and published as `latest=0.12.8` while `repair=0.12.8-repair.1` remained unchanged.
 
 ## 0.12.8-repair.1 — 2026-07-22
 

package/DELIVERY.md

@@ -86,7 +86,7 @@ D2 receiver_armed: pass
 D3 addressed_enqueue: pass
 D4 idle_active_wake: pass
 D5 context_injection: pass token=AGY-PARITY-3399
-D6 continuity: pass session_id=<native-id> model=claude-opus-4-8
+D6 continuity: pass session_id=<native-id> model=claude-opus-5
 D7 completion_reply: partial reason="no garden outbox yet"
 D8 robustness: partial reason="loop guard present; crash recovery not tested"
 ```
@@ -213,11 +213,12 @@ three markers) but **not** simultaneous model invocation by two conversations
 under one agy pid: one marker file would be last-writer-wins, so that concurrency
 is explicitly unsupported.
 
-Current deterministic floor: `smoke-agy-install-state` 140 checks,
+Current deterministic floor: `smoke-agy-install-state` 167 checks,
 `smoke-agy-statusline-state` 69, `smoke-agy-hooks-state` 44,
 `check-agy-sender-identity` 28, plus the shared self-address/native-push gates.
-The bridge installer owns only `mcp(entwurf-bridge/entwurf_v2)` in
-`permissions.allow`; broad YOLO policy stays operator-owned. Live 2026-07-13
+The bridge installer owns one narrow rule per normal-path tool
+(`entwurf_v2`, `entwurf_peers`, `entwurf_self`) in `permissions.allow`;
+broad YOLO policy stays operator-owned. Live 2026-07-13
 (agy 1.0.x): automatic birth → gid/statusline → record-backed sender → sibling
 delivery → same-gid native-push reply passed. Live 2026-07-14 (**agy 1.1.0**):
 re-verified on the new minor — `entwurf_self` answered without a permission

package/README.md

@@ -159,7 +159,7 @@ because Node refuses to strip `.ts` files under `node_modules`.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.82.0 <0.83`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.82.1 <0.83`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -261,15 +261,82 @@ Only that accepted file may be published under the explicitly authorized lane:
 > there is nothing to diagnose or branch on.
 >
 > Note the deliberate scope, stated as it actually is. A **store-wide** scan runs on
-> **identity writes** and in the doctor — not on every mailbox poke; a call-relay does
-> not re-scan the whole store per message. What every **targeted read** does hold is
-> the per-entry half of the same contract: `readMetaIdentityByGardenId` refuses a
-> record that is not a regular file (a symlink is never followed, in *either*
-> direction) and one whose body disagrees with its name, naming the verb. What it
-> does **not** do is prove store-wide uniqueness on the read path, so on a store that
-> would fail certification two records can still claim one `nativeSessionId` and
-> `entwurf_peers` will list both as citizens. That is a **known open gap**, not a
-> promise: closing it on the dispatch path is [#52](https://github.com/junghan0611/entwurf/issues/52).
+> **identity writes**, in the doctor, and on the two read surfaces below — not on every
+> mailbox poke; a call-relay does not re-scan the whole store per message. What every
+> **targeted read** holds is the per-entry half of the same contract:
+> `readMetaIdentityByGardenId` refuses a record that is not a regular file (a symlink is
+> never followed, in *either* direction) and one whose body disagrees with its name,
+> naming the verb. That is what the mailbox poke, the sender-marker trust and
+> `entwurf_self` use, and it is all they need.
+>
+> Store-wide **uniqueness** is checked on the read snapshot at the two places where it
+> is both affordable and load-bearing ([#52](https://github.com/junghan0611/entwurf/issues/52),
+> 0.12.9):
+>
+> - **Discovery** — `listAllMetaIdentities`, and so `entwurf_peers`, already reads the
+>   whole store, so the check is free. Two records claiming one `nativeSessionId` are
+>   **not** two citizens: *neither* is listed (the store cannot say which one owns that
+>   session, and a facts surface may not mint an authority the certification refuses),
+>   both become diagnostics naming each other, and every unrelated citizen keeps listing.
+> - **Dispatch** — `readAddressableMetaIdentity`, used by v2 `resolveTarget` and by the
+>   pi resume path. Those are the moments a record stops being data and becomes an
+>   **address**, they happen once per dispatch next to a socket connect and a spawn, and
+>   a duplicate there means direct-injecting one live conversation under two garden ids,
+>   or resuming one transcript twice under two per-garden-id locks. It fails **loud**; a
+>   soft `bad-target` is reserved for a record that is genuinely absent.
+>
+> **A rival is a record that could be addressed instead** — narrower than "a file whose
+> bytes mention the same id". A **symlinked** entry is not a candidate and is *never
+> read* (rule 1 again: following it to see whether it counts would break the rule in the
+> act of enforcing it, and let planted foreign bytes quarantine a healthy citizen); a
+> **drifted** or **unparseable** neighbour is not a candidate either, because no garden
+> id can reach it. All three remain certification defects and the listing reports them as
+> diagnostics — they just may not blind a healthy record. The opposite case is a
+> **regular `.meta.json` this process cannot read**: that one might BE the duplicate, so
+> it fails loud rather than being skipped, because "holds it alone" from a scan that
+> never asked is the same vacuous pass in miniature. (`ENOENT` alone is the exception —
+> a file that vanished mid-scan is not in the store.)
+>
+> Both store-wide read scans take entries **with their kind** from one shared
+> `readActiveStoreEntries`, rather than each binding doing its own name-only `readdir`.
+> That is what makes rule 1 structural: a scan handed bare names has no choice but to
+> read the path, which is how both `entwurf_peers` bindings came to follow a symlinked
+> record while the doctor refused the very same entry.
+>
+> A kind carried alongside a **name** is still only half of it, because a name can stop
+> meaning what it meant. `lstat`-then-`readFileSync(path)` classifies one entry and reads
+> another: replace the final path component with a symlink in between, and the read
+> follows it into foreign bytes while every test on a settled store stays green. So the
+> bytes of a record come from exactly one place — `readStoreRecordFile`, shared by the
+> store-wide reader and by `readMetaIdentityByGardenId` — which opens with `O_NOFOLLOW`
+> (a symlink fails the **open**, before a byte is read), decides the kind by `fstat` on
+> **that file description** rather than on a name, and closes it in a `finally`. It also
+> opens `O_NONBLOCK`, because classify-then-open never had to care that `open(fifo,
+> O_RDONLY)` blocks until a writer appears, and deciding on the fd does. The reader does
+> not flatten errno: callers still separate a record that raced away (`ENOENT`, skipped)
+> from one that cannot be read (`EACCES`, loud) from one that was swapped (`ELOOP`,
+> refused) — and the rival scan's raced-away skip depends on exactly that.
+>
+> That reader does not replace the `lstat` classification in front of the targeted read;
+> the two hold **different** things, and collapsing them into "one enforcement point"
+> was itself a regression (caught in review before shipping). The classification decides
+> POLICY on a settled store **without opening anything**, which is what lets a socket, a
+> device or a mode-000 directory earn the certification's own sentence — an `open` would
+> answer `ENXIO` or `EACCES` there, errnos that say nothing about regularity, and the
+> targeted read would start calling the host unreadable where the doctor calls the entry
+> non-regular. Two contracts for one store is precisely the defect rule 1 exists to
+> prevent. The fd layer decides the RACE: after a regular snapshot, its errno verdicts
+> (`ELOOP`, `ENXIO`, a non-regular `fstat`) collapse back onto the settled sentences
+> through one pure classifier, so a race never teaches the operator a second vocabulary
+> for one state of the world. Because the classification answers first, those branches
+> are unreachable from any settled store — which is why the classifier is pure and pinned
+> with synthetic errnos rather than by a store on disk.
+>
+> This is not only a defence against external corruption. `upsertMetaSession` certifies
+> and then writes, which is **not a transaction**, so two concurrent births — two
+> `SessionStart` hooks, an `entwurf_register_native` racing an agy imprint — can both
+> observe one clean store and mint different garden ids for one native session. A
+> duplicate can therefore appear on a host where nothing was ever corrupted.
 >
 > There is **no migrator and no legacy reader anywhere in this repo** — carrying
 > old records forward would serve a continuity the system deliberately does not
@@ -290,6 +357,23 @@ Only that accepted file may be published under the explicitly authorized lane:
 > entwurf meta-bridge-fresh-cut   # quiesce-checked: archive the old generation, open an empty one
 > ```
 >
+> **Read its exit status, don't just chain it.** The cut answers with a contract
+> ([#54](https://github.com/junghan0611/entwurf/issues/54), `--help` prints it), because
+> "it failed" is not one world-state:
+>
+> | exit | what already moved | what to do |
+> |---|---|---|
+> | `0` | the cut is complete | run `setup` |
+> | `1` | **nothing** — a live/unprovable surface, an occupied archive destination, an unreadable surface | fix the named cause, re-run. **Do not** run `setup`: the store it refused is still there |
+> | `2` | nothing — usage error | fix the command |
+> | `3` | the cut transition is **incomplete** after at least one archive move; the fresh generation is not confirmed open | inspect, or re-run to finish under a new stamp |
+> | `4` | the cut is **complete**; marker/socket residue could not be unlinked | `setup` may run. Prefer repairing the named residue before `setup`; if new citizens have already been born, remove it manually — another fresh-cut would archive their generation too |
+>
+> Only `0` is success — a failed sweep never becomes a pass. `fresh-cut && setup` is
+> still the right chain for the common path; the codes are there so a runbook, CI or an
+> agent can tell a refusal that changed nothing from a cut that already unblocked the
+> install. An exit-4 re-run is safe only before `setup` or any new citizen birth.
+>
 > The refusal is a **preflight, not a lock**: it certifies the store as it stands
 > at that moment. On a host whose pi/Claude settings point straight at a checkout,
 > a `git pull` can put the new code in front of live sessions before you run
@@ -304,6 +388,34 @@ Only that accepted file may be published under the explicitly authorized lane:
 > refuses the cut before anything moves. Cutting needs proof of death, not absence
 > of proof of life.
 >
+> **One marker is cleared without proving death, and it is the exception that keeps
+> this path open.** A marker whose recorded `ownerPid` cannot own anything — `1`
+> (init), `0`, a negative or non-integer — is *refuted by construction*: no writer in
+> this tree can mint one any more, so on a current install it is **legacy or corrupt
+> residue** — a pre-fix writer whose parent had been reparented to init (the retired
+> shell-form Claude hook; the agy imprint, which asked only `> 0` until this repair),
+> or a foreign/damaged marker, the only way a non-integer pid appears at all. The one
+> file actually observed was a shell-form hook reparented to init. Honoring it was not
+> merely wrong, it was a trap: init runs for the whole boot and its start-key does not
+> change while it does, so the owner verdict is `live` and **the very action this
+> refusal prescribes cannot change that** — you quiesce every session, exactly as
+> told, and the cut refuses again. (Deleting the marker removes the claim rather than
+> refuting the verdict; a reboot recomputes the key with no contract either way.)
+> Meanwhile the one repair this page names could not run: on the affected host the cut
+> stayed blocked until the marker file was removed by hand (#53 A, measured on a second
+> Linux host 2026-07-25). Such a marker is now swept as residue and **reported apart
+> from the dead ones** (`refuted:`), because a proof of invalidity is a different
+> finding from a proof of death — and a stronger one.
+>
+> **Scope of that rule.** "A native session is never owned by init" is a property of the
+> axis entwurf certifies — a Linux desktop/workstation host, where init is the service
+> manager and every harness descends from a login session. A container that runs the
+> harness **as pid 1** is a real shape, and there the marker would name a genuine owner.
+> That host is **unsupported and fails closed**: the writers refuse the marker, so the
+> session still gets its meta-record but never claims reply-addressability — a lost
+> capability rather than a false identity. Reopening that lane needs new evidence and a
+> new contract, not a looser predicate.
+>
 > That agy row is not symmetry for its own sake: `entwurf_register_native` writes a
 > record and **no marker at all**, and `entwurf_v2` dispatches to such a citizen
 > straight off the record, so marker absence is the *normal* state of a live,
@@ -420,12 +532,12 @@ Reference shape lives in [`pi/settings.reference.json`](./pi/settings.reference.
 
 **Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Fresh sibling creation from nothing is a deferred lane. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
-Observed: Claude Code, Codex CLI, and Antigravity CLI all reach the fact surfaces (`entwurf_peers`, inbox) through this MCP bridge from a plain external host; **sending** needs an identity lane. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
+Observed: Claude Code, Codex CLI, and Antigravity CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 
 Prerequisites on the host running the external MCP client:
 
 - `pi` on PATH (for the `owned-outcome` spawn-bg resume path).
-- A live pi session launched with `--entwurf-control` populates `~/.pi/entwurf-control/<sessionId>.sock`; required for `entwurf_v2` control-socket dispatch and `entwurf_peers`.
+- A live pi session launched with `--entwurf-control` populates `~/.pi/entwurf-control/<gardenId>.sock` — the key is the **record's** garden id, never a transcript/session id (`PI_SESSION_ID` only carries the id record birth already established). Required for `entwurf_v2` control-socket dispatch and `entwurf_peers`.
 
 > **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. If `pi` works in your terminal but an external-host `entwurf_v2` spawn-bg resume fails with `spawn pi ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find `pi`. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
 
@@ -454,7 +566,7 @@ Emergency/manual workaround when the MCP server environment is wrong but an exis
 External/meta-session semantics:
 
 - `entwurf_v2` from a plain external host is **refused by default** (no authoritative sender — #50 C4). With the explicit `ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1` hatch it delivers with `origin: "external-mcp"` / `replyable: false`; there is still no reply address.
-- `entwurf_v2` from a trusted meta-session delivers with `origin: "meta-session"` / `replyable: true`; `wants_reply: true` is allowed and the receiver can reply to the sender's garden id.
+- `entwurf_v2` from a trusted meta-session delivers with `origin: "meta-session"`, and `replyable` is **derived from that sender's own rail — not granted by being trusted**: a self-fetch sender (Claude Code) is replyable only while its receiver is live and armed, and a native-push sender (Antigravity) only while its adapter probe finds the live conversation. Identity survives either way; only `replyable` drops to `false`. When it is `true`, `wants_reply: true` is allowed and the receiver can reply to the sender's garden id.
 - `entwurf_v2` with `intent: "owned-outcome"` to a dormant pi target needs `pi` on PATH (it spawns a `pi --entwurf-control` resume child); async completion followUp requires a replyable pi control-socket caller.
 - `entwurf_self` returns the same authoritative identity for pi sessions **and** trusted meta-sessions. A plain external host with no pi env and no trusted sender marker still fails because there is no reply address to report.
 
@@ -519,7 +631,7 @@ entwurf doctor-agy-hooks
 
 The three adapters deliberately own different atoms:
 
-- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus exactly one permission string — `mcp(entwurf-bridge/entwurf_v2)` — in `~/.gemini/antigravity-cli/settings.json`;
+- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox) and neither is the manual `entwurf_register_native` fallback;
 - statusline: the complete `statusLine` subtree pointing at the bare stable bin `entwurf-agy-statusline`;
 - hooks: one named `PreInvocation` hook pointing at the bare stable bin `entwurf-agy-imprint`.
 
@@ -543,17 +655,22 @@ The Claude ACP backend keeps its native model / API / tools; entwurf shapes only
 
 Antigravity is also not an ACP backend. It is a native-push citizen: `PreInvocation` supplies birth/sender identity, `entwurf_v2` probes and direct-injects replies into the live conversation, and no mailbox/receiver marker is involved.
 
-Pi is the canonical memory authority (semantic-memory + Denote llmlog); Claude's native memory layer is pinned off.
+entwurf owns **no** memory layer at all — the ACP plugin's boundary explicitly excludes a memory DB (see `AGENTS.md` §ACP Plugin Boundary), and no backend is a memory authority for another. What this overlay does is narrower: Claude's native memory layer is pinned off so operator memory, project state, and history never leak into an ACP session. Whatever semantic-memory / Denote tooling an operator runs is their own skill surface on whichever harness hosts it — deliberately kept out of the MCP bridge, and not a pi privilege.
 
 ## Smoke commands
 
 ```bash
 pnpm check                              # full deterministic floor (all check-* gates, incl. check-acp-*)
 ./run.sh check-bridge                   # entwurf-bridge direct MCP smoke (no backend auth)
-./run.sh smoke-agy-install-state        # agy MCP + exact permission ownership (120 checks)
-./run.sh smoke-agy-statusline-state     # agy ambient garden-id install surface (62 checks)
-./run.sh smoke-agy-hooks-state          # agy PreInvocation birth hook (37 checks)
-./run.sh check-agy-sender-identity      # record-backed pid/start-key sender identity (28 checks)
+./run.sh smoke-agy-install-state        # agy MCP + exact permission ownership lifecycle (install/uninstall/doctor/inverse)
+./run.sh smoke-agy-statusline-state     # agy ambient garden-id install surface
+./run.sh smoke-agy-hooks-state          # agy PreInvocation birth hook
+./run.sh check-agy-sender-identity      # record-backed pid/start-key sender identity
+
+# source-maintainer only — qualification snapshots the git work surface, and both
+# commands are source-contract gates rather than installed operator checks:
+./run.sh check-agy-permission-matrix    # AGY permission contract space as a literal table (declared cells + stated exclusions)
+./run.sh check-gate-qualification       # kill-proof: committed defect mutants must turn their gates red for the claimed reason
 
 # agy LIVE acceptance — requires an already-running conversation:
 LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
@@ -569,6 +686,14 @@ LIVE=1 ./run.sh smoke-acp-carrier-augment-live  # augment delivery + empty-carri
 LIVE=1 ./run.sh release-gate /tmp/scratch       # the single cut gate (MUST + BEHAVIOR, SKIP=0 for a real cut)
 ```
 
+`pnpm check` already includes the two maintainer gates: the AGY permission contract
+matrix and the full committed-mutant gate qualification run on every pass. A gate a
+release touches must kill its known defect for the claimed `[QK:<claim>]` reason —
+the descriptions above name what each smoke covers, and no check count is quality
+evidence on its own. Gate qualification needs the git work surface, while the matrix
+is the source permission-contract gate; both run from a clone, never as a post-install
+operator step.
+
 ## Custom skills
 
 Claude sessions accept custom skills through `skillPlugins` — an array of absolute paths to directories matching the Claude Agent SDK plugin layout:
@@ -604,7 +729,7 @@ For a real consumer arranging many skills, see [agent-config](https://github.com
 
 **Entwurf is one dispatch capability with native-pi and MCP surfaces.** Native pi exposes it directly as extension tools; ACP-backed and external native-harness sessions reach it through `entwurf-bridge`. The purpose is not to invent a different sub-agent system, but to preserve the same sibling-based model across harnesses.
 
-A sibling has its own runtime boundary and its own provider/model identity — not a worker, delegate, or sub-agent. Minting a brand-new sibling from nothing is a deferred v2 lane (`spawn-fresh`); today every transport targets an *existing* garden citizen. `entwurf_v2` routes from rail-specific liveness + intent: live pi fire-and-forget → control socket; dormant pi owned-outcome → spawn-bg resume; active self-fetch → meta-mailbox; probe-alive agy → native-push. Pi paths use the per-target lock; mailbox/native-push use their own deliverability evidence and remain lock-free.
+A sibling has its own runtime boundary and its own provider/model identity — not a worker, delegate, or sub-agent. Minting a brand-new sibling from nothing is a deferred v2 lane (`spawn-fresh`); today every transport targets an *existing* garden citizen. `entwurf_v2` routes from rail-specific liveness + intent: live pi fire-and-forget → control socket; dormant pi owned-outcome → spawn-bg resume; active self-fetch → meta-mailbox; probe-alive agy → native-push. A **control-socket-domain** dispatch takes the per-target lock — both the live send and the dormant cell's spawn-bg resume; mailbox and native-push use their own deliverability evidence and remain lock-free.
 
 A two-pane recording covers the surface end-to-end — sibling resume, cross-process MCP dispatch across a different cwd, and a live peer greeting:
 
@@ -615,13 +740,13 @@ A two-pane recording covers the surface end-to-end — sibling resume, cross-pro
 
 </details>
 
-Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable; garden-native meta-sessions carry a trusted `meta-session` envelope and are replyable by garden id. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling — and is rejected only from non-replyable external senders.
+Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
 In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes five tools: `entwurf_v2`, `entwurf_peers`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / dormant-resume / Claude-Code-meta-mailbox / Antigravity-native-push. Fresh sibling creation from nothing is a deferred lane. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` resumes an already-identified record-backed citizen, never a model tuple from a file.
 
 ### `entwurf_v2` — canonical dispatch verb
 
-`entwurf_v2` / `runEntwurfV2` is the canonical v2 dispatch verb over **existing** garden targets — record-backed citizens only (#50 C4: the record is the sole address authority; a record-less control socket rejects pre-probe as `record-less-socket`, a diagnostic state, never a delivery target). You give a target garden id plus an intent (`fire-and-forget` or `owned-outcome`); one decider reads the target's liveness as a fact and picks the transport from a frozen table keyed on **both** the target's state **and** the intent — never on state alone — then reports one outcome under the v2 lock policy. Pi control-socket and spawn-bg paths take a per-target lock; mailbox and native-push are lock-free, with deliverability guarded by their own receiver/probe evidence:
+`entwurf_v2` / `runEntwurfV2` is the canonical v2 dispatch verb over **existing** garden targets — record-backed citizens only (#50 C4: the record is the sole address authority; a record-less control socket rejects pre-probe as `record-less-socket`, a diagnostic state, never a delivery target). You give a target garden id plus an intent (`fire-and-forget` or `owned-outcome`); one decider reads the target's liveness as a fact and picks the transport from a frozen table keyed on **both** the target's state **and** the intent — never on state alone — then reports one outcome under the v2 lock policy. A **control-socket-domain** dispatch takes a per-target lock — the live control-socket send and the dormant cell's spawn-bg resume alike, even though spawn-bg is a separate relaunch transport; mailbox and native-push are lock-free, with deliverability guarded by their own receiver/probe evidence:
 
 | target state | intent | transport |
 |---|---|---|
@@ -683,7 +808,7 @@ This repo also doubles as the maintainer's working laboratory for agent-harness
 
 ## Verification surfaces
 
-- **[VERIFY.md](./VERIFY.md)** — agent-driven. One ACP-bridged identity runs the script against another and records what it sees. Carries the Evidence Levels L0–L5 rung ladder and the Claims Ledger so each claim is parked at the rung it has actually reached.
+- **[VERIFY.md](./VERIFY.md)** — agent-driven. One ACP-bridged identity runs the script against another and records what it sees. Carries the Evidence Levels L0–L5 rung ladder and the Claims Ledger so each claim is parked at the rung it has actually reached, and owns the deterministic-floor kill-proof protocol (gate qualification and its `[QK:<claim>]` coordinates).
 - **[BASELINE.md](./BASELINE.md)** — operator-driven. The maintainer runs the interview directly (no agent in the verifier seat) and the result is recorded.
 - **[DELIVERY.md](./DELIVERY.md)** — capability-coordinate. The cross-harness yardstick for one question: can an already-running native session receive an async message without pretending pi owns the backend transcript? Records the per-backend async-delivery level (`D0–D8`) each harness actually reaches instead of collapsing into works/doesn't.
 

package/VERIFY.md

@@ -33,7 +33,8 @@ Verification here is not a benchmark. In production we exchange short turns and
 
 ### The canonical floor — two entry points
 
-- **Deterministic floor:** `pnpm check` — the full `check-*` gate set (~60 gates). Run first; it is the cheap, machine-checkable layer.
+- **Deterministic floor:** `pnpm check` — the full `check-*` gate set (the `check` script in `package.json` is the SSOT for what runs). Run first; it is the offline, machine-checkable layer.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (inside `pnpm check`) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir>` — `pnpm check` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm check`, `smoke-entwurf-v2-spawn-resume-live`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), and the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
@@ -109,7 +110,7 @@ GLG decisions.
 
 ### Verifying the two capabilities a gate cannot fully judge
 
-- **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for live pi, mailbox-backed meta, or native-push targets; `owned-outcome` only to wake a dormant record-backed pi citizen. Picking the wrong intent is rejected, never auto-fixed.
+- **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for live pi, mailbox-backed meta, or native-push targets; `owned-outcome` only on a dormant target in the control-socket liveness domain (currently backend `pi`), where it selects **spawn-bg — a relaunch transport, not the control-socket rail that carries live sends**; the launch leaf checks backend authority. Picking the wrong intent is rejected, never auto-fixed.
 - **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
 - **agy citizenship:** in a fresh agy conversation, the first `PreInvocation` must yield a garden id, `entwurf_self` must report `agentId=meta-session/antigravity` and `replyable:true` only while the native probe is alive, and a reply to that same garden id must direct-inject into the same conversation. No mailbox/receiver-marker evidence counts on this rail.
 

package/demo/README.md

@@ -113,7 +113,7 @@ The demo launch lines correspond to your shell aliases:
 
 | Alias | Model id | Use as |
 |---|---|---|
-| `piao` | `entwurf/claude-opus-4-8` | `SENDER_MODEL` (precision scenes) |
+| `piao` | `entwurf/claude-opus-5` | `SENDER_MODEL` (precision scenes) |
 | `pias` | `entwurf/claude-sonnet-5` | `SENDER_MODEL` (default) |
 | `piat` | `entwurf/gpt-5.4` | `PEER_MODEL` (default) |
 | `piat5` | `entwurf/gpt-5.5` | either |
@@ -137,7 +137,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.82.0)
+- `pi` on PATH (current floor 0.82.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/demo/demo.sh

@@ -1,5 +1,11 @@
 #!/usr/bin/env bash
-# entwurf-demo.sh — one-shot recorded demo of entwurf entwurf flow.
+# entwurf-demo.sh — one-shot recorded demo of the entwurf flow.
+#
+# ARCHIVED pre-0.12 evidence — NOT a runnable recipe. The scenes below drive the
+# retired v1 verbs (`entwurf` / `entwurf_resume` / `entwurf_send`), which the 0.12
+# cutover removed; a run would fail at scene 1. Kept for historical comparison only.
+# See demo/README.md. Scene 3's delivery proof was recovered as a deterministic gate
+# (scripts/check-bridge-delivery.ts); the v2-native retake is a post-0.12 follow-up.
 #
 # Layout (tmux, 220x50):
 #   pane 0 (top)    — peer pi (codex, gpt-5.4)       — idle, waits for greeting

package/docs/setup-clean-host.md

@@ -65,7 +65,7 @@ exit 0.
 | Claude Code | **`>=2.1.217`** — the exec-form hook floor; an older Claude drops the hook's `args` silently and still reports success, so there is no fallback lane | `entwurf.claudeCodeFloor` (bound by `check-claude-floor-coherence`) |
 | npm | bundled with Node 24 | public package install path |
 | entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf`, `entwurf-bridge`, `entwurf-statusline`, `entwurf-agy-statusline`, and `entwurf-agy-imprint` bins |
-| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.82.0 <0.83` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
+| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.82.1 <0.83` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
 | Antigravity `agy` | **optional**, operator-installed/authenticated native CLI | needed only for the shipped native-push citizen lane; entwurf never moves its auth |
 
 ## Stage 0 — Node 24 via nvm
@@ -155,7 +155,7 @@ If the host will run pi sessions or the Claude ACP provider through pi, install
 a compatible pi binary separately and wire the target project.
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.82.0
+npm install -g @earendil-works/pi-coding-agent@0.82.1
 pi --version
 
 mkdir -p ~/entwurf-smoke
@@ -172,7 +172,7 @@ Drift points:
   `entwurf-bridge`. (The `entwurf-targets.json` link is gone — #50 C3 removed the
   target registry; a leftover operator link is inert.)
 - Older pi versions may silently miss the provider/extension surface. Use the
-  pinned floor (`>=0.82.0 <0.83`) for release verification.
+  pinned floor (`>=0.82.1 <0.83`) for release verification.
 - A host that only uses the external MCP bridge can skip this stage until it
   needs `owned-outcome` spawn-bg resume or pi-native control sockets.
 
@@ -235,6 +235,17 @@ host has nothing to cut and can ignore this paragraph. The refusal is a
 preflight, not a lock: for checkout-backed installs, quiesce sessions before
 pull, then fresh-cut, setup, and reopen.
 
+Read the cut's exit status rather than only chaining it (#54; `--help` prints the
+contract): `0` complete → run `setup`; `1` NOTHING MOVED — a live/unprovable
+surface, an occupied archive destination, an unreadable surface — fix the named
+cause and re-run, and do not run `setup`, because the store it refused is still
+there; `2` usage; `3` CUT TRANSITION INCOMPLETE — at least one archive move
+happened but the fresh generation is not confirmed open — inspect, or re-run to
+finish under a new stamp; `4` the cut is COMPLETE but marker/socket residue could
+not be unlinked — `setup` may run. Prefer fixing the named residue and re-running
+before `setup`; if new citizens have already been born, remove it manually rather
+than fresh-cutting their new generation. Only `0` is success.
+
 Upgrade invariant: every global npm/pnpm package upgrade must be followed by
 `entwurf install-meta-bridge` from that same installed binary and then
 `entwurf doctor-meta-bridge`. Installed statusline/MCP entries use stable bin
@@ -252,9 +263,13 @@ A plain external MCP host can call the read surfaces (`entwurf_peers`,
 A deliberately-anonymous host may wire the explicit
 `ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1` hatch and then delivers external and
 non-replyable; see README §"Wiring `entwurf-bridge` into an external MCP host".
-A garden-native meta-session has a garden id, a mailbox, and a trusted sender
-marker; it can call `entwurf_self`, receive mailbox wakeups, and be replied to by
-garden id.
+A garden-native meta-session has a garden id and a trusted sender marker, so it can
+call `entwurf_self` and be addressed by garden id. **Whether it has a mailbox depends
+on its rail**: a self-fetch backend (Claude Code) has a drainable inbox and receives
+mailbox wakeups, while a native-push backend (Antigravity) has **no mailbox and no
+idle-wake watch at all** — a reply is injected straight into its live conversation, and
+it is reachable only while the adapter probe finds that conversation. Do not assume a
+mailbox from "garden-native meta-session".
 
 ## Stage 5 — Antigravity native citizen (optional)
 
@@ -276,7 +291,9 @@ entwurf doctor-agy-hooks
 What these commands own:
 
 - `install-agy-bridge`: one MCP server in `~/.gemini/config/mcp_config.json`
-  and exactly `mcp(entwurf-bridge/entwurf_v2)` in
+  and one narrow rule per tool the normal agy workflow calls —
+  `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`,
+  `mcp(entwurf-bridge/entwurf_self)` — in
   `~/.gemini/antigravity-cli/settings.json`'s permission allow-list;
 - `install-agy-statusline`: the `statusLine` subtree only, pointing at
   `entwurf-agy-statusline`;