@junghanacs/entwurf 0.12.9 → 0.12.10

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -7,25 +7,28 @@
  * `entwurf-v2-contract-schema.ts` (0.12.1 B-1) so this module — which the
  * harness-neutral MCP bridge reaches at boot — carries no pi dependency.
  *
- * Why a frozen contract BEFORE the fact-provider (step 4): with the legacy
- * 3-verb surface (`entwurf`/`entwurf_resume`/`entwurf_send`) still live, building
- * discovery first bakes verb-routing into the fact layer and `entwurf_peers`
- * goes wrong (동결결정 10 순서 근거). So the SHAPE is locked here; the facts read
- * it; dispatch computes from facts at call time (step 5). The legacy 3-verb
- * surface is untouched — this is purely additive (동결결정 10 scope A).
+ * Why a frozen contract BEFORE the fact-provider (step 4): the legacy 3-verb
+ * surface (`entwurf`/`entwurf_resume`/`entwurf_send`) was still live when this
+ * was written, and building discovery first would have baked verb-routing into
+ * the fact layer, taking `entwurf_peers` wrong (동결결정 10 순서 근거). So the
+ * SHAPE is locked here; the facts read it; dispatch computes from facts at call
+ * time (step 5). Those v1 verbs were REMOVED in the 0.12 cutover — the ordering
+ * argument is history, but the layering it produced is the live design.
  *
  * Source-verified invariants folded in (Opus 실측 + GPT 보정 + Fable R1-R5, 2026-06-11):
  *  - F1: caller intent is DECLARED in the input, so the contract a caller
  *    receives is deterministic — never computed from liveness at call time.
  *    `owned-outcome` (caller owns completion) ≠ `fire-and-forget` (ack only).
- *  - R1: the liveness predicate is defined PER-BACKEND. Only pi (direct-inject,
- *    control-socket) has one initially; claude-code is self-fetch with no socket,
- *    so its liveness is `unsupported`, NOT folded into dead/indeterminate — that
- *    fold is the identity-split trap. `unsupported` is a 4th FACT value, not a
- *    4th dispatch column: an out-of-domain backend rejects before the table.
+ *  - R1: liveness is defined PER CAPABILITY DOMAIN. The control-socket domain
+ *    currently contains backend `pi`; claude-code is self-fetch with no socket,
+ *    so its socket liveness is `unsupported`, NOT folded into dead/indeterminate.
+ *    This is transport capability, not identity rank: every target is first a
+ *    record citizen. `unsupported` is a 4th FACT value, not a 4th table column.
  *  - R2: `target` is the garden-id of an EXISTING citizen. spawn-new is out of
- *    v2 scope (legacy `entwurf` keeps it; additive later). Absent/typo gid =
- *    `bad-target` (so F6 "오타 gid가 신규 spawn 사고 막기" holds automatically).
+ *    v2 scope — it was the legacy `entwurf` verb's, and since that verb's removal
+ *    fresh creation is a deferred capability with NO surface, not a fallback that
+ *    still exists elsewhere. Absent/typo gid = `bad-target` (so F6 "오타 gid가
+ *    신규 spawn 사고 막기" holds automatically).
  *  - N1/F3: an `indeterminate` target never spawns. N2: `fire-and-forget` to a
  *    `dormant` target is "reject for now" (mailbox-wake lacks a reply-correlation
  *    id in the substrate; an additive extension later, not a permanent no).
@@ -67,16 +70,16 @@ export const DISPATCH_LIVENESSES = ["live", "dormant", "indeterminate"] as const
 export type DispatchLiveness = (typeof DISPATCH_LIVENESSES)[number];
 
 // ── Backend liveness domain (R1 + F4) ──────────────────────────────────────
-// Backends whose SOCKET liveness predicate is DEFINED — the pi control-socket
-// domain ONLY (connect + RPC `get_info`, entwurf-control.ts). It stays ["pi"].
+// Backends whose SOCKET liveness predicate is DEFINED. The control-socket
+// capability domain currently contains `pi` (connect + RPC `get_info`).
 // claude-code (self-fetch, no socket) has no liveness predicate at all → `unsupported`.
 // codex/antigravity are direct-inject; antigravity's liveness IS measured, but by the
 // SEPARATE native-push adapter rail (a live app-server conversation probe), NOT this
 // pi-socket domain — so it must NEVER be added here. Adding it would pull agy into the
-// pi socket table (inspectSocket/probeSocket are socket-only); the fact layer keeps
-// reporting agy `unsupported` = "outside the pi-socket liveness domain", NOT
+// control-socket table (inspectSocket/probeSocket are socket-only); the fact layer keeps
+// reporting agy `unsupported` = "outside the control-socket liveness domain", NOT
 // unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
-// THIS set is a deliberate future decision (Stage 1+), gated by a REAL pi-shaped
+// THIS set is a deliberate future decision, gated by a real compatible
 // control-socket predicate — never by silently mapping sessions to dead/indeterminate
 // (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
 // domain is disjoint from it.
@@ -89,12 +92,12 @@ export function isLivenessSupported(backend: string): boolean {
 
 // ── Native-push backend domain (봉인 2/4) ───────────────────────────────────
 // A backend whose liveness is measured by the SEPARATE native-push adapter rail (a
-// live app-server conversation probe — antigravity's LS gRPC), NOT the pi control
-// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS (pi socket): an agy
-// session is `unsupported` at the pi-socket FACT level (entwurf_peers) yet fully
+// live app-server conversation probe — antigravity's LS gRPC), NOT a control
+// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS: an agy session
+// is `unsupported` on the socket FACT axis (entwurf_peers) yet fully
 // measured + deliverable on the native-push axis. The two are separate rails on
 // purpose — check-entwurf-facts pins both sets and asserts their intersection is ∅
-// (a backend can never be in both a socket-liveness domain and a native-push domain).
+// (a backend can never be in both domains).
 export const NATIVE_PUSH_BACKENDS = ["antigravity"] as const;
 export type NativePushBackend = (typeof NATIVE_PUSH_BACKENDS)[number];
 
@@ -239,8 +242,9 @@ export const ENTWURF_V2_ACTIONS = ["send", "resume"] as const;
 export const ENTWURF_V2_OWNERSHIPS = ["ack-only", "owned"] as const;
 // Delivery mode of the message to the target (how it is injected) — steer =
 // interrupt the current turn, follow_up = queue after it. A SEPARATE axis from
-// both the intent/ownership axis (F1) and the liveness-routing axis; the legacy
-// entwurf_send carries the same steer|follow_up surface.
+// both the intent/ownership axis (F1) and the liveness-routing axis. The removed
+// v1 `entwurf_send` carried the same steer|follow_up surface, so this axis is
+// inherited vocabulary, not a second live delivery verb.
 export const ENTWURF_V2_MODES = ["steer", "follow_up"] as const;
 
 export type DispatchVerdict =
@@ -252,7 +256,10 @@ export type DispatchVerdict =
 // intent × dispatch-liveness → exactly one verdict (Q2). v2-initial ALLOWS
 // exactly two cells (fire-and-forget+live = send; owned-outcome+dormant =
 // resume); the other four reject. The reject cells are honest "지금은 없음"
-// locks (N2) — the legacy 3-verb surface still covers those flows unchanged.
+// locks (N2). They were written while the legacy 3-verb surface still covered
+// those flows; that surface is GONE, so a reject cell is now a real absence with
+// no fallback verb behind it — reopening one takes a new contract, never a
+// quiet re-admission.
 export const DISPATCH_TABLE: Record<EntwurfIntent, Record<DispatchLiveness, DispatchVerdict>> = {
 	"fire-and-forget": {
 		live: { action: "send", transport: "control-socket", ownership: "ack-only" },

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -26,7 +26,7 @@
  *      MCP-schema bypass for pi-native/internal callers).
  *   2. resolveTarget     — no citizen → bad-target; a record-less control socket →
  *      record-less-socket (#50 C4: the record is the sole address authority);
- *      quarantined (non-pi gid sharing a socket/symlink) → target-address-conflict.
+ *      quarantined (out-of-socket-domain record sharing a socket/symlink) → target-address-conflict.
  *      PROBE-FREE.
  *   3. backend           → isLivenessSupported.
  *   4. acquireLock       — IN-DOMAIN ONLY (？7), BEFORE lstat/connect, so the probe
@@ -47,7 +47,7 @@
  */
 
 import type { MailboxDeliverabilityResult } from "./entwurf-deliverability.ts";
-import { isNonPiGardenIdSocketConflict } from "./entwurf-facts.ts";
+import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
 import type { PreflightOutcome } from "./entwurf-preflight.ts";
 import {
 	type EntwurfIntent,
@@ -75,7 +75,7 @@ import type { SocketLiveness } from "./socket-probe.ts";
 
 // Re-export the shared conflict predicate so producers of a TargetResolution have a
 // single import site for it (it is the SAME fn the fact-provider listing uses).
-export { isNonPiGardenIdSocketConflict };
+export { isOutOfSocketDomainGardenIdConflict };
 
 // ── observe timeout (？3) ───────────────────────────────────────────────────
 // The bounded wait 5c's release-watcher gives a spawned child to surface its
@@ -172,8 +172,8 @@ export type DispatchDecision =
 
 // ── target resolution (E: single-target, not a whole-store scan) ────────────
 // A non-null identity is an existing citizen. `preProbeAddressConflict` is the
-// PROBE-FREE, record-side conflict (non-pi gid sharing a real/symlinked socket —
-// isNonPiGardenIdSocketConflict). The production wrapper computes it with a single
+// PROBE-FREE record-side conflict: a backend outside the control-socket domain
+// sharing a real/symlinked socket (`isOutOfSocketDomainGardenIdConflict`). Production uses one
 // readMetaIdentityByGardenId + a target socket/symlink check; the gate injects it.
 // Do NOT call listEntwurfFacts here to find the target — its socket probe would run
 // before the lock (the 1C TOCTOU). The shared predicate is the only thing the
@@ -377,12 +377,12 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 		return { kind: "execute", receipt, plan, lock: null };
 	}
 
-	// 4-5. in-domain (record-backed pi): lock → inspect → route (cwd from the record).
+	// 4-5. control-socket domain (currently backend pi): lock → inspect → route.
 	return decideInDomain(gardenId, input, deps, ctx, identity.cwd);
 }
 
-// ── in-domain probe (steps 4-5) — record-backed pi ONLY (#50 C4: a record-less
-// socket rejects pre-probe and never reaches here) ──────────────────────────────
+// ── control-socket-domain probe (steps 4-5; currently backend pi). Every target
+// is record-backed; a record-less socket rejects before this branch. ────────────
 // The lock lifecycle (B2) lives here: acquire BEFORE lstat/connect, every reject path
 // releases explicitly (rejectAfterRelease), every execute path that keeps the lock sets
 // retainLock=true, and a thrown IO error releases the still-held lock before rethrowing so

package/pi-extensions/lib/entwurf-v2-lock.ts

@@ -2,10 +2,11 @@
  * entwurf-v2-lock — the per-gid dispatch lock primitive (0.11 Stage 0 step 5a,
  * 버킷 B F2). LOAD-BEARING: the guard against a double-spawn of the same dormant
  * target by two V2 dispatchers that share the substrate through different entry
- * points. SCOPE (honest): this protects v2/v2 only. The legacy `entwurf_resume`
- * is unchanged (동결결정 10 scope A) and does NOT take this lock, so v2/legacy
- * concurrent resume is a KNOWN residual gap (rare — single-orchestrator practice),
- * closed only at full cut-over. Do not read this header as "v2/legacy is guarded".
+ * points. SCOPE (honest): this protects v2/v2 only. It was written while the legacy
+ * `entwurf_resume` still ran unchanged (동결결정 10 scope A) without taking this
+ * lock, which left a v2/legacy concurrent-resume gap. That verb was REMOVED in the
+ * 0.12 cutover, so the gap is closed by subtraction — not by this lock growing to
+ * cover it. Any NEW resume entry point must take this lock or the gap reopens.
  *
  * ENVIRONMENT ASSUMPTION (stale reclaim): `hostname` equality is used as the
  * proxy for "same machine", so a holder pid is reclaim-probed with kill(0) only

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -42,7 +42,7 @@ import {
 	mailboxConversationalDeliverable,
 	receiverMarkerMatchesIdentity,
 } from "./entwurf-deliverability.ts";
-import { isNonPiGardenIdSocketConflict } from "./entwurf-facts.ts";
+import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
 // 0.12.1 B-2: TYPE-ONLY import — `entwurf-preflight.ts` value-imports
 // `@earendil-works/pi-coding-agent` (ProjectTrustStore), so a static value-import
 // here would re-couple the harness-neutral MCP bridge to pi at boot
@@ -189,7 +189,7 @@ async function lazyProductionPreflight(input: PreflightInput): Promise<Preflight
 }
 
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
- * `isNonPiGardenIdSocketConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
+ * `isOutOfSocketDomainGardenIdConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
  * unsupported-backend mailbox send onto a quarantined address. */
 function conflictSetsFor(
@@ -294,20 +294,23 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 			};
 		}
 		const identity = io.readIdentity(gid, sessionsDir);
-		// `preProbeAddressConflict` is the record-side NON-PI conflict ONLY (B1). An in-domain
-		// (pi) target's socket lstat/connect MUST run UNDER the lock in the decider's later
-		// `inspectSocket` step (1C: lock BEFORE lstat/connect) — so a pi target short-circuits
-		// here with NO pre-lock lstat. Doing the lstat here would (a) be a needless pre-lock IO
-		// and (b) turn a pi target's `indeterminate` lstat into a top-level throw, stealing it
-		// from the under-lock `inspectSocket → indeterminate → indeterminate-no-spawn` path.
+		// This pre-probe conflict applies only OUTSIDE the control-socket capability domain.
+		// An in-domain target's lstat/connect MUST run under the later per-target lock, so it
+		// short-circuits here with no pre-lock IO. Otherwise an indeterminate lstat would be
+		// stolen from the under-lock `inspectSocket → indeterminate-no-spawn` path.
 		if (isLivenessSupported(identity.backend)) {
 			return { identity, preProbeAddressConflict: false };
 		}
-		// Only an unsupported (non-pi) citizen reaches the record-side lstat: a single lstat (no
-		// connect) of the canonical path; `indeterminate` fails loud (QB2 — never "no conflict").
+		// Only a citizen outside the control-socket domain reaches this record-side lstat;
+		// `indeterminate` fails loud (QB2 — never silently "no conflict").
 		const inspection = await io.inspectPath(controlSocketPath(gid, controlSocketDir));
 		const { socketGids, symlinkedGids } = conflictSetsFor(gid, inspection);
-		const preProbeAddressConflict = isNonPiGardenIdSocketConflict(identity.backend, gid, socketGids, symlinkedGids);
+		const preProbeAddressConflict = isOutOfSocketDomainGardenIdConflict(
+			identity.backend,
+			gid,
+			socketGids,
+			symlinkedGids,
+		);
 		return { identity, preProbeAddressConflict };
 	};
 

package/pi-extensions/lib/entwurf-v2-spawn-production.ts

@@ -135,7 +135,9 @@ export function resolveResumeLaunchIdentity(plan: SpawnBgPlan): LaunchIdentity {
 	const record = readAddressableMetaIdentity(plan.sessionId);
 	if (record.backend !== "pi") {
 		throw new Error(
-			`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — spawn-bg resume is the pi rail.`,
+			`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — ` +
+				`spawn-bg resume is a host-adapter capability, and its domain currently contains backend pi only. ` +
+				`This is a relaunch capability, not the control-socket rail and not citizen rank.`,
 		);
 	}
 	const sessionFile = record.transcriptPath;

package/pi-extensions/lib/meta-session.ts

@@ -1,12 +1,12 @@
 /**
- * meta-session — 1.0.0 garden-native meta-bridge, step 2: the RECORD AUTHORITY.
+ * meta-session — the shared V3 garden-citizen RECORD AUTHORITY.
  *
- * Backend-agnostic garden layer (#30). A *meta-session* is the bib card for a
- * native backend session (Claude Code / Antigravity / Codex) that has NO pi
- * JSONL of its own: an opaque pointer record that makes the native session a
- * garden citizen — addressable + wakeable by a garden id — WITHOUT pretending pi
- * owns its transcript (Hard Rule #8: reference the backend transcript, never
- * hydrate or replay it).
+ * This module entered through the native meta-bridge (#30), then became the one
+ * identity store for every addressable citizen, including `backend:"pi"` (#50).
+ * A record is a backend-owned-session bib card: it binds the backend's native id
+ * and transcript pointer to a garden id without taking over that backend's runtime,
+ * auth, or transcript. The module name is history; the live identity schema is not
+ * a native-only or pi-exception axis.
  *
  * Two layers, clearly sectioned:
  *   1. RECORD functions + types (mint / serialize / parse / certifyActiveStore /
@@ -61,7 +61,7 @@ import { generateSessionId, SESSION_ID_RE } from "./session-id.js";
 // Errors
 // ---------------------------------------------------------------------------
 
-/** A meta-record is malformed, or an input violates the record contract. */
+/** A garden-citizen record is malformed, or an input violates the record contract. */
 export class MetaRecordError extends Error {
 	constructor(message: string) {
 		super(message);
@@ -142,8 +142,9 @@ export function requireNonEmptyString(value: unknown, field: string): string {
 
 /** Validate the 3-backend NATIVE bridge axis (sender/receiver markers, capability
  * drift guard). Not a record-schema validator: identity records take
- * `requireCitizenBackend` (which admits `pi`); markers stay native-3 because a pi
- * session's sender identity is env-authored, never marker-authored. */
+ * `requireCitizenBackend` (which admits `pi`). Markers stay native-3 because the
+ * pi adapter carries its record-established garden id into children via env rather
+ * than using the native-hook pid marker rail. */
 export function requireBackend(value: unknown): MetaBackend {
 	if (typeof value !== "string" || !META_BACKENDS.includes(value as MetaBackend)) {
 		throw new MetaRecordError(
@@ -208,7 +209,7 @@ function isoNow(now: Date): string {
 /** The one live identity schema number. */
 export const META_SCHEMA_VERSION_V3 = 3 as const;
 
-/** The 4 record-citizen backends: the three native backends + `pi` itself. */
+/** Every backend admitted by the one V3 record-citizen schema. */
 export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "pi"] as const;
 export type MetaCitizenBackend = (typeof META_CITIZEN_BACKENDS)[number];
 
@@ -510,15 +511,11 @@ export function parseMetaIdentity(json: string): MetaIdentity {
 // const for the three existing backends (the drift guard) and COVERS exactly
 // META_CITIZEN_BACKENDS (pi included).
 //
-// pi's wakeMode = direct-inject (NOT self-fetch): pi's live wake path is the
-// entwurf-control socket — `pi.sendMessage(... triggerTurn ...)` injects the
-// body straight into the model-visible turn, which is direct-inject by the
-// WakeMode definition (the last-1cm: who puts the body in front of the model).
-// self-fetch is Claude's mailbox path (the model must call its inbox-read MCP).
-// pi's dormant→resume→mailbox path is self-fetch-shaped, so pi is really
-// BIMODAL; a single wakeMode field cannot express both. Splitting it
-// (mailboxWakeMode vs controlSocketWakeMode) is out of 3C scope — for now the
-// single field reports pi's primary live capability (direct-inject) honestly.
+// `wakeMode` describes the last centimetre, not citizen rank. The control-socket
+// adapter injects the body into a pi turn, so backend `pi` is `direct-inject`;
+// Claude's mailbox is `self-fetch`; native-push adapters are direct injection.
+// Dormant spawn-bg resume is a separate transport/ownership decision and does not
+// turn the pi record into a mailbox citizen.
 // ---------------------------------------------------------------------------
 
 /** Bump only on a breaking capability-registry shape change; the parser refuses other versions. */

package/run.sh

@@ -94,7 +94,7 @@ Usage:
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
-  ./run.sh check-entwurf-v2-contract   # deterministic gate (0.11 Stage 0 step 4-pre, 동결결정 10 + Fable R1-R5): FROZEN entwurf_v2 contract — R1 backend liveness domain (pi only; claude/codex/agy=unsupported, not folded), 6-cell intent×liveness table (single verdict, 2 allow/4 reject), N1 indeterminate-no-spawn, Q2 owned-live-no-autosend, R3 table↔receipt round-trip, R5 taxonomy, schema↔types drift; pure, no API
+  ./run.sh check-entwurf-v2-contract   # deterministic gate (0.11 Stage 0 step 4-pre, 동결결정 10 + Fable R1-R5): FROZEN entwurf_v2 contract — R1 control-socket domain (currently pi; claude/codex/agy=unsupported, not folded), 6-cell intent×liveness table (single verdict, 2 allow/4 reject), N1 indeterminate-no-spawn, Q2 owned-live-no-autosend, R3 table↔receipt round-trip, R5 taxonomy, schema↔types drift; pure, no API
   ./run.sh check-entwurf-v2-lock       # deterministic gate (0.11 Stage 0 step 5a, 버킷 B F2): per-gid dispatch LOCK primitive — openSync wx atomic acquire, second-acquire=target-locked conflict (holder JSON for human cleanup), nonce-owned release (successor survives late release), stale reclaim same-host+ESRCH-only (EPERM/remote/alive/unknown fail-closed), empty/corrupt=conflict not auto-deleted, F2-P1 malformed gid throws; real temp dir, deps injected
   ./run.sh check-entwurf-v2-decider    # deterministic gate (0.11 Stage 0 step 5b): PURE dispatch decider decideDispatch — frozen 7-step order over injected fakes, lock acquire+release tracked so reject⇒no-plan-no-lock proven; pre-probe rejects observedLiveness=null, send/resume execute keep lock + mailbox no-lock (？7), resume plan no mode/provider/model, invalid gid throws (F2-P1); pure, no IO
   ./run.sh check-entwurf-v2-matrix     # deterministic gate (0.11 Stage 0 step 5d-5 a): REACHABILITY + LOCK SSOT table — drives REAL decideDispatch over fakes, fixes every (target kind → transport → lock class) cell as one table (control-socket/meta-mailbox/spawn-bg + bad-target/conflict/locked/undeliverable/owned-live/dormant/indeterminate rejects), coverage pass fails on a dropped cell; thin coverage not a decider re-impl; pure, no IO
@@ -104,20 +104,19 @@ Usage:
   ./run.sh check-entwurf-v2-runner     # deterministic gate (0.11 Stage 0 step 5d-1): execute-router (executeDispatch) routing an already-decided DispatchDecision to its 5c transport hand → one outcome-rich EntwurfV2RunResult. reject→rejected (no hand) / control/spawn/mailbox→matching hand with decision.lock verbatim / spawn lock-retained rides executed (fail-closed) / N3 rejectReason carried / N1 SendDeliveredReleaseFailedError→execution-failed{finalizedOutcome,releaseFailed,retrySafe:false}; fake hands, no IO
   ./run.sh check-entwurf-v2-mailbox    # deterministic gate (0.11 Stage 0 step 5c-4, LAST 5c transport slice): ENQUEUE-ONLY meta-mailbox SEND body (executeMetaMailboxSend) + production sendViaMailbox adapter — sender→formatMetaMailboxBody with plan.wantsReply threaded (divergence from legacy hard false), sender absent→raw plan.message, enqueue opts EXACTLY {gardenId,body,sessionsDir,mailboxDir}, enqueue throw PROPAGATES (no success:false fold — mailbox has no in-band refuse); adapter NEVER touches lock (release is the hand's job); source guard: no release/routing seam
   ./run.sh check-entwurf-v2-spawn      # deterministic gate (0.11 Stage 0 step 5c-3a): spawn-bg RESUME watcher hand (executeSpawnBgResume) wiring spawn + socket-observe IO onto the 5c-1 reducer — Fable-3: TIMEOUT IS NOT A RELEASE (bare observeTimeout→killChild, release 0; bounded killGrace then real socket-alive ∨ child-exited releases ×1); spawnChild throw→spawn-start-failed; no observation obtainable (grace elapses / post-spawn watch dep throws)→lock-retained fail-closed (released:false, evidence surfaced), NO direct-release hatch; IO-via-dep, controlled promises
-  ./run.sh check-entwurf-resume-args   # deterministic gate (0.11 Stage 0 step 5c-3b): resume-argv SSOT (buildResumePiArgs) shared by the legacy async worker and the v2 spawn-bg resident citizen — A1: legacy=--no-extensions + no --entwurf-control (one-shot pi -p exits), v2-control=--entwurf-control + no --no-extensions (keep-alive is the goal, resumed session stays addressable); BOTH keep --mode json -p + prompt-as-turn (-p NOT dropped in v2); explicitExtensionArgs preserved once (#29); v2 includes plan.launchArgs (--approve); null provider→no --provider; no cross-contamination
+  ./run.sh check-entwurf-resume-args   # deterministic gate (0.11 Stage 0 step 5c-3b): resume-argv SSOT (buildResumePiArgs) for the v2 spawn-bg RESIDENT citizen — the `legacy` one-shot variant and its async worker were removed 2026-07-27, so the shipped posture is the only one the gate drives: v2-control=--entwurf-control + no --no-extensions (keep-alive is the goal, resumed session stays addressable); keeps --mode json -p + prompt-as-turn (-p NOT dropped); explicitExtensionArgs preserved exactly once (#29); plan.launchArgs (--approve) ride before the prompt; null provider→no --provider
   ./run.sh check-entwurf-v2-spawn-production # deterministic gate (0.11 Stage 0 step 5c-3c): production SpawnBgResumeDeps factory (makeProductionSpawnBgResumeDeps) wiring the 5c-3a watcher's 6 IO seams — no real pi/socket/timer (that=opt-in smoke-entwurf-v2-spawn-live, OUT of pnpm check). socketWatchVerdict: address-conflict→forged (reject, never wait)/alive→alive/dead·indeterminate→wait; spawnChild builds v2-control argv (--entwurf-control, no --no-extensions, -p+prompt, --approve, cwd authority); awaitSocketAlive connectable→resolve / symlink→reject without connect / dead→wait→alive / abort-clears; awaitChildExit code + listener cleanup; awaitTimeout schedule + abort-clear; killChild=SIGTERM; proc-less child fails loud
   ./run.sh smoke-entwurf-v2-spawn-live # LIVE phase gate (0.11 Stage 0 step 5c-3c, D5) — OUT of pnpm check, needs LIVE=1. Exercises the production SpawnBgResumeDeps against REAL OS objects: S1 real unix socket → awaitSocketAlive resolves (real lstat+probe), symlink→forged, absent→abort settles; S2 real child → spawn-event resolve + SIGTERM kill + exit-code capture; S3 watcher integration → real timeout→kill→child-exited→release ×1. Does NOT spawn a real pi resume (that=5d matrix). Run before 5d: LIVE=1 ./run.sh smoke-entwurf-v2-spawn-live
   ./run.sh smoke-entwurf-v2-spawn-resume-live # 0.11.0 (A) ACCEPTANCE gate — OUT of pnpm check, needs LIVE=1. The FULL spawn-bg resident lifecycle: mint backend=pi identity → seed a REAL dormant pi session (one-shot into ~/.pi/agent/sessions) → runEntwurfV2(owned-outcome) routes dormant→spawn-bg resume → a REAL detached pi --entwurf-control child stands its socket up, resumes, DOES a model turn. Asserts executed/spawn-bg/socket-alive/released + lock released ×1 + no lock file + pid alive + socket connectable + resume USER & assistant OK nonces in the session JSONL. Model-in-loop IN. The gate v1 deprecation (0.12) is predicated on. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-spawn-resume-live
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.4). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), owned-outcome→native-push-no-resume-authority, bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
-  ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b pi 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, non-pi+socket fail-loud; pure, no IO
+  ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
   ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
-  ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — listAllMetaIdentities→scanSocketProbes→pre-quarantine non-pi/socket conflicts→resolveFactList(clean)→{facts,diagnostics}; C-원칙: expected corruption (parse/collision)→diagnostics (listing survives), impossible invariant (dup/unprobed)→throw; collision quarantines BOTH PeerFact+socket; deps injected, no IO
+  ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — listAllMetaIdentities→scanSocketProbes→pre-quarantine out-of-socket-domain/socket conflicts→resolveFactList(clean)→{facts,diagnostics}; C-원칙: expected corruption (parse/collision)→diagnostics (listing survives), impossible invariant (dup/unprobed)→throw; collision quarantines BOTH PeerFact+socket; deps injected, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
-  ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows); SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected. meta watchArmed wired in slice 2 (same release block)
+  ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta splits by RAIL: self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows), native-push ⟺ recordBacked ∧ probeAlive (separate axis — no mailbox fact may rescue or sink it), unsupplied rail fail-closed; SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected AND renders the meta rail per-rail (mailbox only inside the self-fetch branch; native-push denies an inbox and gates injection on the probe)
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
-  ./run.sh check-entwurf-mailbox-guard # deterministic gate (SE-1/SE-2 slice 2d): guarded mailbox enqueue — PURE 0-call (undeliverable target leaves injected enqueue uncalled) + TMPDIR snapshot (refused send leaves mailbox byte-identical, accepted writes one .msg) + fact gathering from record/capability/receiver-marker
   ./run.sh check-native-push-adapter # deterministic gate (봉인 3/8): native-push adapter leaf (antigravity) via a FAKE runner — FULL pid scan (not head -1), dead vs indeterminate, VOLATILE route re-discovery (no cache), send argv+ANTIGRAVITY_LS_ADDRESS env, non-zero exit throws, NO adapter-level retry (executor-owned), resolveNativePushAdapter fail-fast
   ./run.sh check-native-push-register # deterministic gate (봉인 5): registerNativeConversation (entwurf_register_native core) via fake adapter + isolated mkdtemp store — live probe→CREATE, re-register→ATTACH (same gid, cwd refreshed, no dup), not-live probe→REFUSE (throws, no record), receiver-marker abstinence (보정① source guard)
   ./run.sh check-agy-sender-identity # deterministic gate (#46 sender lane): WHO is calling the bridge — real agy hook as a child process writes an antigravity sender marker keyed by its PARENT pid (never on upsert failure), and resolveTrustedMetaSenderIdentity over isolated stores yields 0→null / 1→identity on EITHER backend / two distinct live identities on one owner pid→THROW (never guess, never downgrade to anonymous). This is what turns an agy send from external-mcp/unknown-host into a replyable garden citizen
@@ -128,9 +127,11 @@ Usage:
   ./run.sh smoke-meta-honesty         # 1.0.0 meta-bridge: honesty regression gate (#30 blockers) — doorbell counts ALL msgs honestly + hook logs failures as ERROR (best-effort, no scream). Offline/deterministic (deps: bash+node+python3)
   ./run.sh smoke-meta-install-state   # 1.0.0 meta-bridge Phase 2: stateful install/uninstall + store-doctor regression gate. Offline/deterministic (deps: bash+node+python3)
   ./run.sh check-meta-doctor-oracle   # 0.12.8 (#51): detection power of the release ORACLE — healthy fixture must reach `doctor: PASS`, then 21 planted defects (retired shell form, partial hand-patch, launcher bypass/repoint/provenance loss, malformed exec args, owner type drift, extra leaf/group, doorbell asyncRewake/path/timeout, no live bridge, stale receiver, ambiguous/missing cache, missing hook log/writer, failing CLI probes) must each turn it FAIL naming their own cause, plus a positive case pinning that a long-writing CLI is NOT a false negative. Offline/deterministic (deps: bash+node+python3)
-  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression (120): isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
-  ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression (62). Offline/deterministic
-  ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression (37). Offline/deterministic
+  ./run.sh smoke-agy-install-state    # agy MCP + exact permission ownership regression: isolated HOME+XDG, adopt/state/inverse, symlink refuse, setup degrade. Offline/deterministic
+  ./run.sh check-agy-permission-matrix # AGY permission CONTRACT SPACE as a literal table (55 cells): parser-state × operation × settings × ownership × precedence with stated exclusion rules; expectations are hand-written literals, never read from the SUT. Offline/deterministic (deps: python3)
+  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
+  ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
+  ./run.sh smoke-agy-hooks-state      # agy PreInvocation birth/sender hook install/doctor/inverse + direct stdin→meta-record regression. Offline/deterministic
   ./run.sh smoke-user-scope-citizen   # 0.12.6 install-boundary: pi packages[] registration SSOT (register-pi-package.py) — idempotent + preserves unrelated + normalizes stale + remove symmetry + fails loud. Offline/hermetic (deps: bash+python3)
   ./run.sh smoke-meta-prune           # 1.0.0 meta-bridge Phase 4: listing-only store janitor regression gate — classify keep/orphan/stale/ambiguous, delete nothing. Offline/deterministic (deps: bash+node)
   ./run.sh smoke-meta-keyset-guard    # 0.10.0 meta-bridge: keyset-owner guard regression — check-keyset-overlap + managed-keys SSOT (disjoint passes, collisions fail). Offline/hermetic (deps: bash+python3)
@@ -745,7 +746,7 @@ check_entwurf_v2_contract() {
   # contract (동결결정 10 + 버킷 B F1/F4/F6 + Fable R1-R5). The intent×liveness
   # decision table is a constant; the "table cell ↔ dispatch receipt" round-trip
   # is asserted exhaustively — THE executable proof F6 demands ("산문 금지").
-  # R1 backend liveness domain (pi only; claude-code/codex/antigravity =
+  # R1 control-socket capability domain (currently pi; claude-code/codex/antigravity =
   # unsupported, never folded into dead/indeterminate). 6-cell table, single
   # verdict per cell (Q2), 2 allow / 4 reject. N1 indeterminate never spawns;
   # Q2 owned-outcome+live never auto-sends. R5 taxonomy covers table reasons +
@@ -948,14 +949,13 @@ check_entwurf_v2_spawn() {
 
 check_entwurf_resume_args() {
   # Deterministic gate for 0.11 Stage 0 step 5c-3b: the resume-argv SSOT
-  # (buildResumePiArgs) that the legacy async worker AND the v2 spawn-bg resident citizen
-  # share so their launch shapes never drift. Pins the load-bearing A1 difference: legacy =
-  # `--no-extensions` + NO `--entwurf-control` (one-shot `pi -p` can exit); v2-control =
-  # `--entwurf-control` + NO `--no-extensions` (the keep-alive legacy avoided is the goal —
-  # resumed session stands its socket up and stays addressable). BOTH keep `--mode json -p`
-  # and the prompt-as-turn positional (`-p` NOT dropped in v2); explicitExtensionArgs
-  # preserved exactly once (provider-resolution footgun #29); v2 includes plan.launchArgs
-  # (--approve) before the prompt; null provider emits no --provider; no cross-contamination.
+  # (buildResumePiArgs). v2-control is the only shipped shape (the legacy one-shot variant and
+  # its launcher were removed 2026-07-27). Pins the resident posture: `--entwurf-control`
+  # present + `--no-extensions` never (the keep-alive is the goal — a resumed session stands
+  # its socket up and stays addressable), the headless `--mode json -p` prefix and the
+  # prompt-as-turn positional (`-p` NOT dropped), explicitExtensionArgs preserved exactly once
+  # (provider-resolution footgun #29), plan.launchArgs (--approve) before the prompt, and a
+  # null provider emitting no --provider.
   run_ts scripts/check-entwurf-resume-args.ts
 }
 
@@ -1266,7 +1266,7 @@ check_meta_listing() {
 check_entwurf_fact_provider() {
   # Deterministic gate for 0.11 Stage 0 step 4 (fact-provider slice 4b): the
   # ASSEMBLY layer listEntwurfFacts. listAllMetaIdentities → scanSocketProbes →
-  # pre-quarantine non-pi/socket conflicts → resolveFactList(clean) →
+  # pre-quarantine out-of-socket-domain/socket conflicts → resolveFactList(clean) →
   # {facts, diagnostics}. Throw-vs-diagnostics policy (GPT힣 C-원칙): expected
   # corruption (parse failure / gardenId↔socket collision) → diagnostics, listing
   # survives; impossible wiring invariant (resolveFactList duplicate/unprobed) →
@@ -1297,7 +1297,8 @@ check_entwurf_self_address() {
   # from env presence alone: a socketless pi session, or a meta citizen whose owner
   # exited / whose idle-watch was never armed, all advertised replyable while
   # delivery silently failed (SE-1). Asserts: PURE truth table (pi replyable ⟺
-  # socketAlive; meta ⟺ recordBacked ∧ ownerAlive ∧ watchArmed; external never),
+  # socketAlive; external never; meta BY RAIL — self-fetch ⟺ recordBacked ∧ ownerAlive ∧
+  # watchArmed, native-push ⟺ recordBacked ∧ probeAlive, unsupplied rail fail-closed),
   # incl. the two regression-proof rows (record-present + owner-dead / watch-unarmed)
   # that stay meaningful after slice 3 mints records; SOURCE GUARD that
   # buildStrictPiSenderEnvelope drops the hardcoded `replyable: true` and existsSync-
@@ -1319,17 +1320,6 @@ check_entwurf_deliverability() {
   run_ts scripts/check-entwurf-deliverability.ts
 }
 
-check_entwurf_mailbox_guard() {
-  # Deterministic gate for the guarded mailbox enqueue (SE-1/SE-2 slice 2d) — the IO
-  # orchestration conversational-reply sites use instead of enqueueMetaMessage directly.
-  # Asserts (GPT Q5, both axes): PURE 0-call — an undeliverable target (dead receiver /
-  # direct-inject pi / absent record) leaves the injected enqueue UNCALLED, a deliverable
-  # one calls it exactly once; TMPDIR SNAPSHOT with the real enqueueMetaMessage — a refused
-  # send leaves the mailbox tree byte-identical (file list + content hash, not just mtime),
-  # an accepted send writes exactly one .msg; plus fact gathering from record/capability/marker.
-  run_ts scripts/check-entwurf-mailbox-guard.ts
-}
-
 check_native_push_adapter() {
   # Deterministic gate for the native-push adapter LEAF (봉인 3/8). Drives
   # createAntigravityAdapter with a FAKE runner (no real agy/ss/pgrep). Asserts: FULL pid
@@ -1695,7 +1685,7 @@ const SITES = [
   ['pi/meta-bridge/entwurf-meta-receive/scripts/hook-launch.sh', /Claude Code >= (\d+\.\d+\.\d+)/g, 1, 'launcher refusal message'],
   ['scripts/meta-bridge-claude-floor.sh', /THE FLOOR IS (\d+\.\d+\.\d+)/g, 1, 'floor helper rationale header'],
   ['docs/setup-clean-host.md', /`>=(\d+\.\d+\.\d+)`\*\* — the exec-form hook floor/g, 1, 'clean-host pin matrix'],
-  ['AGENTS.md', /Claude Code `>=(\d+\.\d+\.\d+)`/g, 1, 'AGENTS rule 13'],
+  ['AGENTS.md', /Claude Code `>=(\d+\.\d+\.\d+)`/g, 1, 'AGENTS rule 14'],
   ['README.md', /supported floor `>=(\d+\.\d+\.\d+)`/g, 1, 'README doctor description'],
   ['scripts/check-hook-launch-topology.ts', /\/(\d+)\\\.(\d+)\\\.(\d+)\//g, 1, 'topology gate floor assertion'],
 ];
@@ -2233,7 +2223,7 @@ check_acp_provider_surface() {
 check_acp_sdk_surface() {
   # Deterministic gate for the S2a ACP SDK dependency surface. Pins the three
   # ACP runtime deps to the current oracle versions (@agentclientprotocol/sdk
-  # 1.3.0 + claude-agent-acp 0.61.0 + @anthropic-ai/sdk 0.100.1), locks the
+  # 1.3.0 + claude-agent-acp 0.62.0 + @anthropic-ai/sdk 0.100.1), locks the
   # peer-resolution that keeps claude-agent-sdk satisfiable (0.100.1, not the
   # stale 0.91.1), asserts the wire SDK still value-exports the symbols the raw
   # turn needs (silent-rename gate), and forbids any source-level anthropic SDK
@@ -3757,12 +3747,13 @@ wire_agy_bridge() {
   # reported as an mcp_config problem and sends the operator to repair the wrong file.
   case "$out" in
     *"permission refused (symlink)"*|*"permission invalid JSON"*|*"permission could not be granted"*)
-      # The MCP server IS registered — only the allow rule failed. agy defaults every mcp action to
-      # Ask, so the bridge works but stops for a y/n on EVERY entwurf_v2 call. Half-wired, and said
+      # The MCP server IS registered — only the allow rules failed. agy defaults every mcp action to
+      # Ask, so the bridge works but stops for a y/n on EVERY entwurf tool call. Half-wired, and said
       # so: the explicit installer fails loud on this; setup only degrades it, never hides it.
-      echo "[setup] WARN: agy settings.json could not take our permission rule — bridge REGISTERED but NOT GRANTED." >&2
-      echo "[setup]       agy will prompt on every entwurf_v2 call until 'mcp(entwurf-bridge/entwurf_v2)'" >&2
-      echo "[setup]       is in its permissions.allow (see the line above for why). setup continues." >&2
+      echo "[setup] WARN: agy settings.json could not take our permission rules — bridge REGISTERED but NOT GRANTED." >&2
+      echo "[setup]       agy will prompt on every entwurf tool call until our narrow rules" >&2
+      echo "[setup]       ($(python3 "$REPO_DIR/scripts/agy-bridge-config.py" permission-rules 2>/dev/null || echo 'mcp(entwurf-bridge/<tool>)'))" >&2
+      echo "[setup]       are in its permissions.allow (see the line above for why). setup continues." >&2
       ;;
     *"refused (symlink)"*)
       echo "[setup] WARN: agy mcp_config is a symlink — someone else's SSOT (transitional)." >&2
@@ -4356,9 +4347,6 @@ case "$cmd" in
   check-entwurf-deliverability)
     check_entwurf_deliverability
     ;;
-  check-entwurf-mailbox-guard)
-    check_entwurf_mailbox_guard
-    ;;
   check-native-push-adapter)
     check_native_push_adapter
     ;;
@@ -4445,6 +4433,25 @@ case "$cmd" in
     # Offline + deterministic (deps: bash+python3).
     (cd "$REPO_DIR" && bash scripts/smoke-agy-install-state.sh)
     ;;
+  check-agy-permission-matrix)
+    # The agy permission engine's CONTRACT SPACE as a literal table (55 cells + stated
+    # exclusions R2/R4-R7): parser-state × operation × settings × ownership × precedence.
+    # Every recent permission defect was an unenumerated cell of this matrix; this gate
+    # states the axes and exhausts the meaningful product, with hand-written literal
+    # expectations (oracle independence — nothing is read back from the SUT). Sandbox
+    # per cell; offline + deterministic (deps: python3).
+    (cd "$REPO_DIR" && python3 scripts/check-agy-permission-matrix.py)
+    ;;
+  check-gate-qualification)
+    # Kill-proof qualification — the gate-of-gates. Proves the committed defect mutants
+    # (scripts/mutants/*.json) make their gates fail BOUNDED and FOR THE CLAIMED REASON
+    # ([QK:<claim>] token on a failure line), inside an isolated snapshot repo under the
+    # control→mutant→restore→control state machine; the real checkout is never written
+    # (HEAD + work-surface content hash asserted identical before/after). The runner is negative-controlled
+    # first: zero-match/multi-match/survived/wrong-reason/hang(+pgroup grandchild kill)/
+    # control-red/impurity all must classify red before any real manifest counts.
+    run_ts scripts/check-gate-qualification.ts
+    ;;
   smoke-agy-statusline-state)
     # #46 Task 1 regression gate for the agy statusLine install adapter: install→doctor→uninstall
     # in an ISOLATED HOME+XDG with a fake stable bin (entwurf-agy-statusline) + fake pgrep —