@junghanacs/entwurf 0.12.9 → 0.12.10

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-core.js

@@ -1,14 +1,29 @@
 /**
  * entwurf-core — sync entwurf execution, host-agnostic.
  *
- * Single implementation shared by:
- *   - pi-extensions/entwurf.ts (pi native tool surface)
- *   - mcp/entwurf-bridge/src/index.ts (MCP tool surface for ACP hosts)
+ * DIRECT importers, MEASURED from the import graph (2026-07-27) — not from memory:
+ *   - pi-extensions/entwurf-control.ts (the pi adapter)
+ *   - pi-extensions/lib/entwurf-v2-spawn-production.ts (v2 spawn-bg launch identity)
+ *   - pi-extensions/lib/project-trust-handler.ts · lib/acp/augment.ts ·
+ *     lib/native-push/adapter.ts
+ *   - plus gates/smokes (check-shell-quote, check-package-source-routing, …)
+ *
+ * The MCP bridge is a TRANSITIVE consumer, not a direct one, and the distinction is the
+ * whole point: `mcp/entwurf-bridge/src/index.ts → entwurf-v2-surface.ts →
+ * entwurf-v2-production.ts → entwurf-v2-spawn-production.ts → entwurf-core.ts`. So the old
+ * header's claim — that the bridge imports this shared implementation the way a v1 tool
+ * surface did — was false, but so is "the bridge does not reach it": it reaches it at
+ * runtime, only for spawn-bg production.
+ *
+ * NOT consumers on any path: `pi-extensions/entwurf.ts` (the v1 pi native tool surface) and
+ * `pi-extensions/lib/entwurf-async.ts` were REMOVED in the 0.12 cutover. Do not reintroduce
+ * either as a live consumer.
  *
  * This module MUST NOT import anything from @earendil-works/pi-coding-agent or any
- * other pi runtime API. It is pure Node + @sinclair/typebox-free.  Anything that
- * requires pi's ExtensionAPI (sendMessage, appendEntry, sessionManager) belongs
- * in the async entwurf path, which stays in pi-extensions/entwurf.ts for now.
+ * other pi runtime API. It is pure Node + @sinclair/typebox-free. Anything that
+ * requires pi's ExtensionAPI (sendMessage, appendEntry, sessionManager) belongs to a
+ * pi-adapter surface, never here — the v1 async entwurf path that used to hold that
+ * work went away with `pi-extensions/entwurf.ts`.
  *
  * Scope:
  *   - sync execution (spawn pi, collect message_end events, return summary)
@@ -63,9 +78,11 @@ const PI_SETTINGS_PATH = process.env.PI_SETTINGS_PATH
     ? expandTilde(process.env.PI_SETTINGS_PATH)
     : path.join(AGENT_DIR, "settings.json");
 export const ENTWURF_CODEX_ACP_ENV = "ENTWURF_ACP_FOR_CODEX";
-// Currently unused: remote/SSH entwurf is fail-fast in 0.9.0 (garden-native
-// identity is local-FS only). Retained for #11 remote revival; parity-gated by
-// scripts/check-shell-quote.ts across entwurf.ts / entwurf-core.ts / entwurf-async.ts.
+// Currently unused: remote/SSH entwurf is fail-fast (garden-native identity is
+// local-FS only). Retained for #11 remote revival and pinned by
+// scripts/check-shell-quote.ts, whose SOURCE_SITES is now THIS FILE ALONE — the
+// entwurf.ts / entwurf-async.ts halves of that former parity check were removed
+// with those files, so there is no cross-file parity left to assert.
 // biome-ignore lint/correctness/noUnusedVariables: retained for #11 remote revival; parity-gated.
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-deliverability.js

@@ -18,9 +18,10 @@
  *    drains its own inbox on wake. A DIRECT-INJECT backend (pi / codex / antigravity)
  *    has no mailbox drain at all — enqueuing for it is the SE-1 false success
  *    ("✓ delivered" into a void). So deliverable = wakeMode === "self-fetch" AND the
- *    receiver is active. This is the guard that the v1 fallback, MCP v1, pi-native v1,
- *    and the v2 decider/send-fallback enqueue sites must all pass before writing a
- *    .msg (slice 2d).
+ *    receiver is active. Every enqueue site must pass this guard before writing a .msg
+ *    (slice 2d). The shipped sites are the v2 decider and its send-fallback re-resolve;
+ *    the v1 fallback / MCP v1 / pi-native v1 sites this once also listed were removed in
+ *    the 0.12 cutover — do not read them as live.
  *
  *  - nativePushDeliverable(facts): the SEPARATE deliverability predicate for a
  *    NATIVE-PUSH backend (antigravity). A native-push citizen has no mailbox and no
@@ -58,9 +59,12 @@ export function computeMetaReceiverActive(facts) {
  * Does this presence marker actually belong to the target identity? A marker that is
  * absent, or whose garden id / backend / native session id has drifted from the record,
  * is NOT this receiver — fail-closed (a stale/foreign marker must never raise a dead
- * target to "active"). The single source of truth for "marker ↔ identity match" shared
- * by the v1 mailbox guard (gatherMailboxDeliverabilityFacts) and the v2 production
- * `mailboxDeliverabilityFor` seam, so the two paths cannot drift to different meanings.
+ * target to "active"). The single source of truth for "marker ↔ identity match". Its
+ * PRODUCTION consumers are the v2 `mailboxDeliverabilityFor` seam and the MCP bridge's
+ * `entwurf_self`. There is no second implementation: `entwurf-mailbox-guard.ts` used to
+ * wrap this atom with its own enqueue orchestration, had ZERO production importers (import
+ * graph measured 2026-07-27), and was DELETED rather than left as a green gate proving only
+ * retired behaviour. A new enqueue site consults this predicate through that seam.
  */
 export function receiverMarkerMatchesIdentity(marker, identity) {
     return (!!marker &&

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-fact-provider.js

@@ -5,8 +5,8 @@
  * (one-way: provider → facts / socket-discovery / meta-session) — no import cycle
  * with `entwurf-facts.ts` (which owns `SocketProbe`/`resolveFactList`).
  *
- *   listAllMetaIdentities → pi gid 추출 → scanSocketProbes(piGids)
- *     → pre-quarantine non-pi/socket conflicts → resolveFactList(clean)
+ *   listAllMetaIdentities → socket-domain gid extraction → scanSocketProbes
+ *     → pre-quarantine out-of-domain/socket conflicts → resolveFactList(clean)
  *     → { facts, diagnostics }
  *
  * Two throw-vs-diagnostics policies, kept distinct (GPT힣 C-원칙):
@@ -20,13 +20,13 @@
  *     — that is not a re-implementation of the collision rule, it is input
  *     sanitation that leaves the pure-core invariant intact.
  *
- * The non-pi+socket collision quarantines BOTH sides (the PeerFact AND the
- * socket): gardenId is the universal address and a send path reads the socket
+ * An out-of-socket-domain record/socket collision quarantines BOTH sides (the
+ * PeerFact AND the socket): gardenId is the universal address and a send path
  * first, so surfacing the record alone (as a clean `unsupported` PeerFact) while
  * a same-gid socket exists would be half a lie. Both leave the normal output;
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
-import { isNonPiGardenIdSocketConflict, resolveFactList } from "./entwurf-facts.js";
+import { isOutOfSocketDomainGardenIdConflict, resolveFactList } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, } from "./meta-session.js";
 import { scanSocketProbes } from "./socket-discovery.js";
@@ -80,8 +80,8 @@ export async function listEntwurfFacts(deps) {
     // 2. socket axis — probe (dir sockets) ∪ (in-domain citizen canonical paths).
     //    Its three hazards (symlink forgery / malformed name / dir-read error) are
     //    folded into diagnostics here so the listing survives but never lies.
-    const piGids = identities.filter((i) => isLivenessSupported(i.backend)).map((i) => i.gardenId);
-    const scan = await scanSocketProbes(piGids, deps.socket ?? {});
+    const socketDomainGids = identities.filter((i) => isLivenessSupported(i.backend)).map((i) => i.gardenId);
+    const scan = await scanSocketProbes(socketDomainGids, deps.socket ?? {});
     const probes = scan.probes;
     const socketGids = new Set(probes.map((p) => p.gardenId));
     const symlinkedGids = new Set(scan.symlinkedGardenIds);
@@ -106,23 +106,21 @@ export async function listEntwurfFacts(deps) {
             message: `control-socket directory unreadable (socket axis incomplete; meta-record citizens still listed): ${scan.dirError}`,
         });
     }
-    // 3. pre-quarantine non-pi citizens that collide with a control socket. The
-    //    predicate is SHARED with the v2 decider (isNonPiGardenIdSocketConflict) so
-    //    listing and dispatch cannot drift, and it unions socketGids with the
-    //    symlinkedGids: a symlinked socket is never probed (absent from socketGids),
-    //    so the old socketGids-only check let a non-pi citizen with a forged
-    //    (symlinked) socket survive as a clean PeerFact while the legacy send path
-    //    still followed the symlink — the gap this closes.
+    // 3. Pre-quarantine citizens outside the control-socket capability domain that
+    //    collide with a control socket. The predicate is SHARED with v2 dispatch so
+    //    listing and dispatch cannot drift. It unions real and symlinked socket gids:
+    //    the earlier real-socket-only check let an out-of-domain record survive as a
+    //    clean PeerFact beside a forged symlink receiver.
     const conflictGids = new Set();
     for (const id of identities) {
-        if (isNonPiGardenIdSocketConflict(id.backend, id.gardenId, socketGids, symlinkedGids)) {
+        if (isOutOfSocketDomainGardenIdConflict(id.backend, id.gardenId, socketGids, symlinkedGids)) {
             conflictGids.add(id.gardenId);
             diagnostics.push({
                 kind: "garden-id-socket-conflict",
                 gardenId: id.gardenId,
                 backend: id.backend,
-                message: `non-pi citizen (${id.backend}) shares its gardenId with a control socket (real or symlinked) — address ` +
-                    "ambiguity; both the citizen and the socket are quarantined from the listing.",
+                message: `out-of-socket-domain citizen (${id.backend}) shares its gardenId with a control socket ` +
+                    "(real or symlinked) — address ambiguity; both sides are quarantined from the listing.",
             });
         }
     }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-facts.js

@@ -52,27 +52,27 @@ export function resolvePeerFact(identity, socket) {
     };
 }
 /**
- * A non-pi RECORD whose gardenId collides with a control socket — a real (probed)
- * one OR a symlinked/forged one. The gardenId is the universal address (동결결정3),
- * so a non-pi citizen sharing it with a socket means a send-path that reaches the
- * socket first hits a DIFFERENT receiver than the record names — an address split.
+ * An OUT-OF-SOCKET-DOMAIN record whose gardenId collides with a control socket —
+ * a real (probed) one OR a symlinked/forged one. The gardenId is the universal
+ * address, so a citizen without socket capability sharing it with a socket means
+ * the socket reaches a DIFFERENT receiver than the record names — an address split.
  * Both the citizen and the socket are quarantined from the facts listing.
  *
  * The union `socketGids ∪ symlinkedGardenIds` is load-bearing: `socketGids` are
  * gids with a real probed `*.sock`, but `symlinkedGardenIds` are NEVER probed (P1)
  * and so are absent from `socketGids`. Looking at `socketGids` alone (the
- * fact-provider:125 gap this closes) let a non-pi citizen with a *symlinked* socket
+ * fact-provider:125 gap this closes) let an out-of-domain citizen with a *symlinked* socket
  * survive as a clean PeerFact while the legacy send path still followed the symlink
  * to a forged receiver. Both axes claim the gid → both must quarantine it.
  *
- * SCOPE: this is the RECORD-side, non-pi conflict only — shared by the fact-provider
- * (listing) and the v2 decider (dispatch) so the two cannot drift (4c "재유도 금지"
- * 동형; only the observation-bit source is parameterized). A pi citizen whose own
- * canonical socket is a symlink is NOT this predicate's concern — that is a
+ * SCOPE: this is the record-side, out-of-socket-domain conflict only — shared by
+ * listing and dispatch so they cannot drift; only the observation-bit source is
+ * parameterized. A citizen IN the socket domain whose own canonical socket is a
+ * symlink is NOT this predicate's concern — that is a
  * target-specific lstat conflict the decider's `inspectTargetControlSocket` raises
  * as `address-conflict`, kept deliberately separate (GPT 1차 검수 C).
  */
-export function isNonPiGardenIdSocketConflict(backend, gardenId, socketGids, symlinkedGardenIds) {
+export function isOutOfSocketDomainGardenIdConflict(backend, gardenId, socketGids, symlinkedGardenIds) {
     return !isLivenessSupported(backend) && (socketGids.has(gardenId) || symlinkedGardenIds.has(gardenId));
 }
 /**
@@ -89,8 +89,8 @@ export function isNonPiGardenIdSocketConflict(backend, gardenId, socketGids, sym
  *     `indeterminate` and strand a dormant citizen as un-resumable); a dormant
  *     citizen's absent socket file is probed to `dead` (ENOENT) by the wiring and
  *     arrives here AS `dead` → dormant → resumable.
- *   - out-of-domain citizen WITH a control socket at its gardenId → fail-loud
- *     (address ambiguity; a non-pi citizen must not own a pi control socket).
+ *   - out-of-socket-domain citizen WITH a control socket at its gardenId → fail-loud
+ *     (address ambiguity; a backend without socket capability cannot own that rail).
  *   - out-of-domain citizen without a socket → `unsupported` (via resolvePeerFact).
  *   - a probed gardenId with NO citizen → `RecordLessSocketFact` (#50 C4: a
  *     diagnostic subject the provider folds into a `record-less-socket`
@@ -125,7 +125,7 @@ export function resolveFactList(identities, socketProbes) {
         else {
             if (probeMap.has(gid)) {
                 throw new Error(`resolveFactList: out-of-domain citizen ${gid} (${identity.backend}) has a control socket — ` +
-                    "address ambiguity (a non-pi citizen must not own a pi control socket)");
+                    "address ambiguity (an out-of-socket-domain citizen cannot own a control socket)");
             }
             socket = null;
         }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-resume-args.js

@@ -1,59 +1,49 @@
 /**
  * entwurf-resume-args — the SINGLE source of truth for the `pi` argv a resume spawn is
- * launched with (0.11 Stage 0 step 5c-3b). Two variants share this builder so the legacy
- * async-entwurf worker and the v2 spawn-bg resident citizen can NEVER drift in their launch
- * shape — the one place the `--no-extensions` / `--entwurf-control` decision lives.
+ * launched with (0.11 Stage 0 step 5c-3b). One place owns the
+ * `--no-extensions` / `--entwurf-control` decision so the launch shape cannot drift.
  *
- * The load-bearing difference (A1):
- *   - legacy — a one-shot async worker. `pi -p <prompt>` runs the resume turn and EXITS;
- *     `proc.on('close')` then delivers the followUp. It is launched `--no-extensions` AND
- *     WITHOUT `--entwurf-control` precisely BECAUSE a control-socket server would keep
- *     `pi -p` from exiting (entwurf.ts:22 — that keep-alive was a bug for a one-shot worker).
- *   - v2-control — a RESIDENT, addressable garden citizen. The resume turn STILL runs via
- *     `-p <prompt>` (the prompt-as-turn authority is unchanged), but the child is launched
- *     WITH `--entwurf-control` and WITHOUT `--no-extensions`, so the very keep-alive legacy
- *     avoided is now the GOAL: the resumed session stands its control socket up and stays
- *     live. The 5c-3a watcher's `socket-alive` is exactly that "resumed citizen is up and
- *     addressable" observation (→ release the per-gid lock, child lives on); `child-exited`
- *     is the early-exit/failure observation. `plan.launchArgs` (`--approve` or empty, from
- *     the decider's preflight) rides along as pi flags before the prompt.
+ * The shipped posture (A1): a RESIDENT, addressable garden citizen. The resume turn runs via
+ * `-p <prompt>` (the prompt-as-turn authority), and the child is launched WITH
+ * `--entwurf-control` and WITHOUT `--no-extensions` — the keep-alive is the GOAL here: the
+ * resumed session stands its control socket up and stays addressable. The 5c-3a watcher's
+ * `socket-alive` is exactly that "resumed citizen is up" observation (→ release the per-gid
+ * lock, child lives on); `child-exited` is the early-exit/failure observation.
+ * `plan.launchArgs` (`--approve` or empty, from the decider's preflight) rides along as pi
+ * flags before the prompt.
+ *
+ * A second `legacy` one-shot posture (`--no-extensions`, no control socket, so `pi -p` could
+ * exit) lived here until 2026-07-27 and was removed with its launcher and the v1 verbs.
  *
  * Provider/model identity is the caller's existing authority (readSessionIdentity /
  * getEntwurfExplicitExtensions) — this builder only LAYS OUT argv, it never resolves
- * identity. `explicitExtensionArgs` is preserved verbatim in BOTH variants: a recorded
- * `provider=entwurf` resume needs the bridge re-injected to resolve the provider, and
- * dropping it when `--no-extensions` is removed would re-introduce the "Unknown provider"
- * footgun (#29). (A future slice may dedup against settings-loaded extensions; not here.)
+ * identity. `explicitExtensionArgs` is preserved verbatim: a recorded `provider=entwurf`
+ * resume needs the bridge re-injected to resolve the provider, and dropping it would
+ * re-introduce the "Unknown provider" footgun (#29). (A future slice may dedup against
+ * settings-loaded extensions; not here.)
  *
- * This module is import-free on purpose: the legacy launcher (entwurf-async.ts) is
- * root-typechecked and imports it as `./entwurf-resume-args.js`, while the v2 adapter and
- * the gate import the same source — a self-contained string builder keeps both configs happy.
+ * This module is import-free on purpose: the v2 adapter and the gate import the same source,
+ * and a self-contained string builder keeps both tsconfigs happy.
  */
 /**
- * Build the `pi` argv for a resume spawn. The SHARED prefix is `--mode json -p` (headless
- * JSON child, prompt-as-turn); the variant then chooses the extension/socket posture; the
- * SHARED suffix is `[…ext args] --session <file> [--provider <p>] --model <m> <prompt>`.
+ * Build the `pi` argv for a resume spawn. The prefix is `--mode json -p` (headless JSON
+ * child, prompt-as-turn); then the resident posture; then
+ * `[…ext args] --session <file> [--provider <p>] --model <m> <prompt>`.
  *
  * Invariants the gate pins:
- *   - legacy  carries `--no-extensions` and NO `--entwurf-control`.
  *   - v2-control carries `--entwurf-control` and NO `--no-extensions`, plus `-p` + prompt.
- *   - `explicitExtensionArgs` appears exactly once in both.
- *   - `launchArgs` is included for v2-control (before the suffix) and ignored for legacy.
- *   - provider/model/prompt identity is laid out identically in both.
+ *   - `explicitExtensionArgs` appears exactly once.
+ *   - `launchArgs` is included before the suffix.
+ *   - provider/model/prompt identity layout is fixed.
  */
 export function buildResumePiArgs(input) {
     const args = ["--mode", "json", "-p"];
-    if (input.variant === "legacy") {
-        // One-shot worker: no extensions, no control socket (so `pi -p` can exit).
-        args.push("--no-extensions");
-    }
-    else {
-        // Resident citizen: stand the control socket up (A1) and keep extensions loaded.
-        // The keep-alive legacy avoided is the goal here. `--approve`/launchArgs ride along.
-        args.push("--entwurf-control");
-        args.push(...(input.launchArgs ?? []));
-    }
-    // Shared suffix — identical identity layout in both variants.
+    // Resident citizen: stand the control socket up (A1) and keep extensions loaded. The
+    // keep-alive the removed one-shot launcher had to avoid is precisely the goal here —
+    // the resumed session must stay addressable. `--approve`/launchArgs ride along.
+    args.push("--entwurf-control");
+    args.push(...(input.launchArgs ?? []));
+    // Suffix — the fixed identity layout.
     args.push(...input.explicitExtensionArgs);
     args.push("--session", input.sessionFile);
     if (input.provider)

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -3,14 +3,13 @@
  *
  * "Can a reply to THIS session actually land where its model will see it?"
  *
- * Today both the MCP bridge (buildStrictPiSenderEnvelope /
- * buildTrustedMetaSenderEnvelope / entwurf_self) and pi-native answer that from env
- * presence alone and hardcode `replyable: true`: a pi session with no
- * --entwurf-control socket, or a meta citizen whose owner has exited / whose
- * idle-watch was never armed, all claim replyable while delivery silently fails
- * (SE-1: "all layers say yes, only delivery says no" = a Crash-Don't-Warn
- * violation). This module is the single truth-table both surfaces compute from,
- * with every fact INJECTED (no IO) so the gate can pin each row.
+ * This module closed the former split where the MCP and native pi surfaces inferred
+ * `replyable: true` from identity-carrier presence alone. Identity and reachability
+ * are separate: pi's env carries the garden id established by record birth, while
+ * replyability requires its control socket; a native marker must be record-backed,
+ * while replyability additionally requires its own rail's live facts. This is the
+ * single truth-table both surfaces compute from, with every fact INJECTED (no IO) so
+ * the gate can pin each row.
  *
  * Axes by origin:
  *  - pi-session:  replyable ⟺ a live control socket exists at the canonical path.
@@ -33,7 +32,7 @@
  *                 — which never arms a watch — would report replyable:false forever.
  *  - external-mcp: never replyable — no authoritative reply address.
  *
- * `origin` stays identity PROVENANCE (where the sender identity came from), never a rail.
+ * `origin` stays sender-carrier PROVENANCE, never the citizen identity authority and never a rail.
  * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`, derived
  * by the caller from `nativePushSupported(backend)`, not from `wakeMode` (direct-inject also
  * covers codex/pi, which have no native-push adapter). Fail-closed: an unsupplied domain is

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-contract.js

@@ -7,25 +7,28 @@
  * `entwurf-v2-contract-schema.ts` (0.12.1 B-1) so this module — which the
  * harness-neutral MCP bridge reaches at boot — carries no pi dependency.
  *
- * Why a frozen contract BEFORE the fact-provider (step 4): with the legacy
- * 3-verb surface (`entwurf`/`entwurf_resume`/`entwurf_send`) still live, building
- * discovery first bakes verb-routing into the fact layer and `entwurf_peers`
- * goes wrong (동결결정 10 순서 근거). So the SHAPE is locked here; the facts read
- * it; dispatch computes from facts at call time (step 5). The legacy 3-verb
- * surface is untouched — this is purely additive (동결결정 10 scope A).
+ * Why a frozen contract BEFORE the fact-provider (step 4): the legacy 3-verb
+ * surface (`entwurf`/`entwurf_resume`/`entwurf_send`) was still live when this
+ * was written, and building discovery first would have baked verb-routing into
+ * the fact layer, taking `entwurf_peers` wrong (동결결정 10 순서 근거). So the
+ * SHAPE is locked here; the facts read it; dispatch computes from facts at call
+ * time (step 5). Those v1 verbs were REMOVED in the 0.12 cutover — the ordering
+ * argument is history, but the layering it produced is the live design.
  *
  * Source-verified invariants folded in (Opus 실측 + GPT 보정 + Fable R1-R5, 2026-06-11):
  *  - F1: caller intent is DECLARED in the input, so the contract a caller
  *    receives is deterministic — never computed from liveness at call time.
  *    `owned-outcome` (caller owns completion) ≠ `fire-and-forget` (ack only).
- *  - R1: the liveness predicate is defined PER-BACKEND. Only pi (direct-inject,
- *    control-socket) has one initially; claude-code is self-fetch with no socket,
- *    so its liveness is `unsupported`, NOT folded into dead/indeterminate — that
- *    fold is the identity-split trap. `unsupported` is a 4th FACT value, not a
- *    4th dispatch column: an out-of-domain backend rejects before the table.
+ *  - R1: liveness is defined PER CAPABILITY DOMAIN. The control-socket domain
+ *    currently contains backend `pi`; claude-code is self-fetch with no socket,
+ *    so its socket liveness is `unsupported`, NOT folded into dead/indeterminate.
+ *    This is transport capability, not identity rank: every target is first a
+ *    record citizen. `unsupported` is a 4th FACT value, not a 4th table column.
  *  - R2: `target` is the garden-id of an EXISTING citizen. spawn-new is out of
- *    v2 scope (legacy `entwurf` keeps it; additive later). Absent/typo gid =
- *    `bad-target` (so F6 "오타 gid가 신규 spawn 사고 막기" holds automatically).
+ *    v2 scope — it was the legacy `entwurf` verb's, and since that verb's removal
+ *    fresh creation is a deferred capability with NO surface, not a fallback that
+ *    still exists elsewhere. Absent/typo gid = `bad-target` (so F6 "오타 gid가
+ *    신규 spawn 사고 막기" holds automatically).
  *  - N1/F3: an `indeterminate` target never spawns. N2: `fire-and-forget` to a
  *    `dormant` target is "reject for now" (mailbox-wake lacks a reply-correlation
  *    id in the substrate; an additive extension later, not a permanent no).
@@ -58,16 +61,16 @@ export const FACT_LIVENESSES = ["alive", "dead", "indeterminate", "unsupported"]
 // handled by the domain guard before the table is consulted.
 export const DISPATCH_LIVENESSES = ["live", "dormant", "indeterminate"];
 // ── Backend liveness domain (R1 + F4) ──────────────────────────────────────
-// Backends whose SOCKET liveness predicate is DEFINED — the pi control-socket
-// domain ONLY (connect + RPC `get_info`, entwurf-control.ts). It stays ["pi"].
+// Backends whose SOCKET liveness predicate is DEFINED. The control-socket
+// capability domain currently contains `pi` (connect + RPC `get_info`).
 // claude-code (self-fetch, no socket) has no liveness predicate at all → `unsupported`.
 // codex/antigravity are direct-inject; antigravity's liveness IS measured, but by the
 // SEPARATE native-push adapter rail (a live app-server conversation probe), NOT this
 // pi-socket domain — so it must NEVER be added here. Adding it would pull agy into the
-// pi socket table (inspectSocket/probeSocket are socket-only); the fact layer keeps
-// reporting agy `unsupported` = "outside the pi-socket liveness domain", NOT
+// control-socket table (inspectSocket/probeSocket are socket-only); the fact layer keeps
+// reporting agy `unsupported` = "outside the control-socket liveness domain", NOT
 // unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
-// THIS set is a deliberate future decision (Stage 1+), gated by a REAL pi-shaped
+// THIS set is a deliberate future decision, gated by a real compatible
 // control-socket predicate — never by silently mapping sessions to dead/indeterminate
 // (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
 // domain is disjoint from it.
@@ -77,12 +80,12 @@ export function isLivenessSupported(backend) {
 }
 // ── Native-push backend domain (봉인 2/4) ───────────────────────────────────
 // A backend whose liveness is measured by the SEPARATE native-push adapter rail (a
-// live app-server conversation probe — antigravity's LS gRPC), NOT the pi control
-// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS (pi socket): an agy
-// session is `unsupported` at the pi-socket FACT level (entwurf_peers) yet fully
+// live app-server conversation probe — antigravity's LS gRPC), NOT a control
+// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS: an agy session
+// is `unsupported` on the socket FACT axis (entwurf_peers) yet fully
 // measured + deliverable on the native-push axis. The two are separate rails on
 // purpose — check-entwurf-facts pins both sets and asserts their intersection is ∅
-// (a backend can never be in both a socket-liveness domain and a native-push domain).
+// (a backend can never be in both domains).
 export const NATIVE_PUSH_BACKENDS = ["antigravity"];
 export function nativePushSupported(backend) {
     return NATIVE_PUSH_BACKENDS.includes(backend);
@@ -202,14 +205,18 @@ export const ENTWURF_V2_ACTIONS = ["send", "resume"];
 export const ENTWURF_V2_OWNERSHIPS = ["ack-only", "owned"];
 // Delivery mode of the message to the target (how it is injected) — steer =
 // interrupt the current turn, follow_up = queue after it. A SEPARATE axis from
-// both the intent/ownership axis (F1) and the liveness-routing axis; the legacy
-// entwurf_send carries the same steer|follow_up surface.
+// both the intent/ownership axis (F1) and the liveness-routing axis. The removed
+// v1 `entwurf_send` carried the same steer|follow_up surface, so this axis is
+// inherited vocabulary, not a second live delivery verb.
 export const ENTWURF_V2_MODES = ["steer", "follow_up"];
 // ── The FROZEN decision table ──────────────────────────────────────────────
 // intent × dispatch-liveness → exactly one verdict (Q2). v2-initial ALLOWS
 // exactly two cells (fire-and-forget+live = send; owned-outcome+dormant =
 // resume); the other four reject. The reject cells are honest "지금은 없음"
-// locks (N2) — the legacy 3-verb surface still covers those flows unchanged.
+// locks (N2). They were written while the legacy 3-verb surface still covered
+// those flows; that surface is GONE, so a reject cell is now a real absence with
+// no fallback verb behind it — reopening one takes a new contract, never a
+// quiet re-admission.
 export const DISPATCH_TABLE = {
     "fire-and-forget": {
         live: { action: "send", transport: "control-socket", ownership: "ack-only" },

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -26,7 +26,7 @@
  *      MCP-schema bypass for pi-native/internal callers).
  *   2. resolveTarget     — no citizen → bad-target; a record-less control socket →
  *      record-less-socket (#50 C4: the record is the sole address authority);
- *      quarantined (non-pi gid sharing a socket/symlink) → target-address-conflict.
+ *      quarantined (out-of-socket-domain record sharing a socket/symlink) → target-address-conflict.
  *      PROBE-FREE.
  *   3. backend           → isLivenessSupported.
  *   4. acquireLock       — IN-DOMAIN ONLY (？7), BEFORE lstat/connect, so the probe
@@ -45,14 +45,14 @@
  * never hand-assembles a `{ok:false, …}` literal, so the pre-probe-null rule cannot
  * be bypassed.
  */
-import { isNonPiGardenIdSocketConflict } from "./entwurf-facts.js";
+import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
 import { isLivenessSupported, makeRejectReceipt, nativePushSupported, resolveDispatch, resolveNativePushDispatch, } from "./entwurf-v2-contract.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, metaCapabilityFor, } from "./meta-session.js";
 import { isValidSessionId } from "./session-id.js";
 import { controlSocketPath, mapInspectionToLiveness } from "./socket-discovery.js";
 // Re-export the shared conflict predicate so producers of a TargetResolution have a
 // single import site for it (it is the SAME fn the fact-provider listing uses).
-export { isNonPiGardenIdSocketConflict };
+export { isOutOfSocketDomainGardenIdConflict };
 // ── observe timeout (？3) ───────────────────────────────────────────────────
 // The bounded wait 5c's release-watcher gives a spawned child to surface its
 // control socket / exit. Planted into the resume plan so the hand does not invent
@@ -178,7 +178,7 @@ export async function decideDispatch(input, deps) {
         };
         return { kind: "execute", receipt, plan, lock: null };
     }
-    // 4-5. in-domain (record-backed pi): lock → inspect → route (cwd from the record).
+    // 4-5. control-socket domain (currently backend pi): lock → inspect → route.
     return decideInDomain(gardenId, input, deps, ctx, identity.cwd);
 }
 async function decideInDomain(gardenId, input, deps, ctx, cwd) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-lock.js

@@ -2,10 +2,11 @@
  * entwurf-v2-lock — the per-gid dispatch lock primitive (0.11 Stage 0 step 5a,
  * 버킷 B F2). LOAD-BEARING: the guard against a double-spawn of the same dormant
  * target by two V2 dispatchers that share the substrate through different entry
- * points. SCOPE (honest): this protects v2/v2 only. The legacy `entwurf_resume`
- * is unchanged (동결결정 10 scope A) and does NOT take this lock, so v2/legacy
- * concurrent resume is a KNOWN residual gap (rare — single-orchestrator practice),
- * closed only at full cut-over. Do not read this header as "v2/legacy is guarded".
+ * points. SCOPE (honest): this protects v2/v2 only. It was written while the legacy
+ * `entwurf_resume` still ran unchanged (동결결정 10 scope A) without taking this
+ * lock, which left a v2/legacy concurrent-resume gap. That verb was REMOVED in the
+ * 0.12 cutover, so the gap is closed by subtraction — not by this lock growing to
+ * cover it. Any NEW resume entry point must take this lock or the gap reopens.
  *
  * ENVIRONMENT ASSUMPTION (stale reclaim): `hostname` equality is used as the
  * proxy for "same machine", so a holder pid is reclaim-probed with kill(0) only

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -30,7 +30,7 @@
  */
 import { formatSenderInfoBlock, sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
 import { mailboxConversationalDeliverable, receiverMarkerMatchesIdentity, } from "./entwurf-deliverability.js";
-import { isNonPiGardenIdSocketConflict } from "./entwurf-facts.js";
+import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { decideDispatch, } from "./entwurf-v2-decider.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
@@ -68,7 +68,7 @@ async function lazyProductionPreflight(input) {
     return preflight(input);
 }
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
- * `isNonPiGardenIdSocketConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
+ * `isOutOfSocketDomainGardenIdConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
  * unsupported-backend mailbox send onto a quarantined address. */
 function conflictSetsFor(gid, inspection) {
@@ -162,20 +162,18 @@ export function makeProductionEntwurfV2Deps(opts) {
             };
         }
         const identity = io.readIdentity(gid, sessionsDir);
-        // `preProbeAddressConflict` is the record-side NON-PI conflict ONLY (B1). An in-domain
-        // (pi) target's socket lstat/connect MUST run UNDER the lock in the decider's later
-        // `inspectSocket` step (1C: lock BEFORE lstat/connect) — so a pi target short-circuits
-        // here with NO pre-lock lstat. Doing the lstat here would (a) be a needless pre-lock IO
-        // and (b) turn a pi target's `indeterminate` lstat into a top-level throw, stealing it
-        // from the under-lock `inspectSocket → indeterminate → indeterminate-no-spawn` path.
+        // This pre-probe conflict applies only OUTSIDE the control-socket capability domain.
+        // An in-domain target's lstat/connect MUST run under the later per-target lock, so it
+        // short-circuits here with no pre-lock IO. Otherwise an indeterminate lstat would be
+        // stolen from the under-lock `inspectSocket → indeterminate-no-spawn` path.
         if (isLivenessSupported(identity.backend)) {
             return { identity, preProbeAddressConflict: false };
         }
-        // Only an unsupported (non-pi) citizen reaches the record-side lstat: a single lstat (no
-        // connect) of the canonical path; `indeterminate` fails loud (QB2 — never "no conflict").
+        // Only a citizen outside the control-socket domain reaches this record-side lstat;
+        // `indeterminate` fails loud (QB2 — never silently "no conflict").
         const inspection = await io.inspectPath(controlSocketPath(gid, controlSocketDir));
         const { socketGids, symlinkedGids } = conflictSetsFor(gid, inspection);
-        const preProbeAddressConflict = isNonPiGardenIdSocketConflict(identity.backend, gid, socketGids, symlinkedGids);
+        const preProbeAddressConflict = isOutOfSocketDomainGardenIdConflict(identity.backend, gid, socketGids, symlinkedGids);
         return { identity, preProbeAddressConflict };
     };
     const inspectSocket = (gid) => io.inspectSocket(gid, controlSocketDir);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-spawn-production.js

@@ -90,7 +90,9 @@ function requireProductionChild(child) {
 export function resolveResumeLaunchIdentity(plan) {
     const record = readAddressableMetaIdentity(plan.sessionId);
     if (record.backend !== "pi") {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — spawn-bg resume is the pi rail.`);
+        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — ` +
+            `spawn-bg resume is a host-adapter capability, and its domain currently contains backend pi only. ` +
+            `This is a relaunch capability, not the control-socket rail and not citizen rank.`);
     }
     const sessionFile = record.transcriptPath;
     if (!sessionFile) {