@junghanacs/entwurf 0.13.0 → 0.14.0

package/AGENTS.md

@@ -2,7 +2,7 @@
 
 For agents that own this repo: invariant principles and reproducible verification, not release-story archaeology.
 
-> **Direction.** This repo is the **entwurf capability package**: a v2 garden-citizen dispatch substrate, native-harness bridges, an ACP plugin, and the pi adapter that hosts that plugin today. `entwurf` is the subject; pi is one harness adapter. ACP is a plugin, not the boundary (#38). V1 verbs are gone. V2 addresses existing citizens; fresh sibling creation remains deferred. Current work and ordering live in [NEXT.md](./NEXT.md).
+> **Direction.** This repo is the **entwurf capability package**: a v2 garden-citizen dispatch substrate, native-harness bridges, an ACP plugin, and the pi adapter that hosts that plugin today. `entwurf` is the subject; pi is one harness adapter. ACP is a plugin, not the boundary (#38). V1 verbs are gone. V2 addresses existing citizens; fresh sibling creation is the separate `entwurf_fresh_call` capability. Current work and ordering live in [NEXT.md](./NEXT.md).
 
 ## North Star — One Forged Screwdriver
 
@@ -26,11 +26,12 @@ For agents that own this repo: invariant principles and reproducible verificatio
 ## Architecture
 
 - **entwurf-core (v2)** owns garden-id addressing, peer facts, liveness interfaces, dispatch decisions, rail choice, and delivery evidence.
-- **Record authority** owns citizen identity. Every addressable pi, Claude Code, Antigravity, or future Codex citizen uses the same V3 `MetaIdentity` schema. `backend` selects capability/rail behavior; it does not create an identity hierarchy.
+- **Record authority** owns citizen identity. Every addressable citizen uses the same V3 `MetaIdentity` schema. `backend` selects capability/rail behavior; it does not create an identity hierarchy.
 - **pi adapter** attaches a pi session to a record at `session_start`, hosts the record-keyed control socket, and exposes the native pi tool surface.
-- **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code is mailbox/self-fetch; Antigravity is probe-backed native-push; Codex has probe evidence but no shipped managed citizen lane.
+- **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code is mailbox/self-fetch; Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
 - **ACP plugin** registers provider `entwurf` inside a pi host session and drives a backend under an isolated overlay. The host pi session is already a record-backed socket citizen; the plugin does not mint another citizen/socket/peer layer.
-- **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, dormant spawn-bg resume, active self-fetch mailbox enqueue, and probe-alive native-push. Complementary state×intent pairs reject honestly. Fresh creation is a separate future capability.
+- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`); resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/cwd/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
+- **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, active self-fetch mailbox enqueue, and probe-alive native-push. NO route starts a process: the hidden background resume for a dormant citizen was withdrawn under the visible-first rule, so a dormant in-domain citizen rejects as `dormant-fire-forget-unsupported` and the intent axis is single-valued. Every other complementary state pair rejects honestly too. Fresh creation is a separate verb — `entwurf_fresh_call` — and it returns a launch receipt only; the new sibling's address arrives asynchronously as the sender envelope of its nonce callback.
 
 ## Hard Rules
 
@@ -49,6 +50,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 13. **Doctors report runtime truth and ownership truth separately.** Runtime coverage does not prove entwurf owns the configuration; broken ownership does not erase visibly working runtime configuration. Final verdict remains red when either required axis fails.
 14. **Native hook ownership is structural.** Claude hooks use the shipped exec-form launcher and provenance token; marker writers/readers share `isPlausibleOwnerPid`; no shell-form fallback, ancestry guess, or retired pid carrier. entwurf requires Claude Code `>=2.1.217` and enforces that floor itself because upstream gives no fail-loud — an older Claude validates the exec manifest, then drops `args` at runtime and reports success. The number is derived from `package.json` `entwurf.claudeCodeFloor`, never retyped as a second source. Currently certified axis is Linux desktop/workstation. Source/gates: `hook-launch.sh`, `meta-session.ts`, `check-hook-launch-topology`, `check-claude-floor-coherence`, `check-meta-doctor-oracle`.
 15. **Crash, don't warn.** Bad config/path/model/store state throws. Empty catches are only for bounded environment probing; operator diagnostics go to stderr.
+16. **mux is launch, never delivery.** A tmux window/pane handle is an ephemeral operator view, not an address: it mints no garden id, stores no record, and reports no liveness. Screen text and keystrokes are never an `entwurf_v2` receipt. Mux owns only placement and fixed-runtime launch; fresh identity correlation stays in callback envelopes, while same-id resume identity/liveness/locking stays on the v2 side of an injected launch seam.
 
 Detailed incident histories belong in CHANGELOG/issues/BASELINE and source-adjacent comments, not in this prompt. When a concise rule and old archaeology disagree, verify source + gate and repair the stale prose.
 
@@ -64,7 +66,9 @@ Detailed incident histories belong in CHANGELOG/issues/BASELINE and source-adjac
 - The common turn sequence stays backend-invariant: spawn → initialize → newSession → enforceModel → prompt → event map.
 - Rich operator/project context rides the **first user message augment**, not a large system prompt. The actual callable schema is the tool truth; prose never grants a tool.
 - A backend may have no carrier or use launch-time model pinning; those asymmetries stay inside its adapter.
-- Claude is the reference adapter. Cortex is the second landed adapter (0.13.0): session-scoped dual-HOME containment, overlay-private `mcp.json` projection (its ACP server ignores the wire `mcpServers` param), `CORTEX_HOME` presence refusal, per-turn set-model. Audit record and contract: `docs/acp-backend-rail.md` §11-8.
+- A streaming assistant message starts `pending`. ACP terminal reasons are mapped explicitly; refusal, exhausted turn budget, unknown, or absent reasons end as errors, and the raw reason is preserved. Never restore a default-to-success branch.
+- Bootstrap steps carry wall-clock bounds; a running prompt does not. A turn ends only when the agent answers, the operator aborts (ACP `session/cancel` first, bounded cleanup after), or the child dies. Elapsed time is not evidence, and a prompt-phase failure we author must never read as transient to pi's retry classifier — a cutoff plus blind retry replays the whole prompt from cold.
+- Claude is the reference adapter. Cortex is the second landed adapter (0.13.0): session-scoped dual-HOME containment, overlay-private `mcp.json` projection (its ACP server ignores the wire `mcpServers` param), `CORTEX_HOME` presence refusal, per-turn set-model. Current contract: `docs/acp-backend-rail.md` “Cortex Code audit (D1–D10)”.
 - entwurf never supplies, copies, proxies, decrypts, or bypasses vendor credentials/subscriptions. It uses the operator's existing local authenticated backend.
 
 ## Citizen Identity and Dispatch
@@ -79,14 +83,14 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 - `PI_SESSION_ID` and `PI_AGENT_ID` propagate the record-established identity to child MCP processes. They are carriers, not a second authority.
 - If record birth fails, no socket starts and no `PI_SESSION_ID` is exported.
 - Reopening the same pi native session attaches to the same record; in-process replacement creates/attaches the replacement's own record.
-- Dormant resume requires record existence, transcript-header ↔ `record.nativeSessionId` integrity, and model preservation.
+- Resume is shipped as its OWN verb, `entwurf_resume_call {target}` — never as an intent on delivery. It reopens a DORMANT pi citizen under the same garden id in a visible window, and it runs no turn: the window comes back with the conversation and waits. The record supplies transcript, model, provider and cwd, so there is no prompt, no task and no model override. The record-authoritative preconditions live in `resume-launch-identity.ts` / `check-resume-launch-identity` (record existence, transcript-header ↔ `record.nativeSessionId` integrity, addressable-read uniqueness, an absolute recorded transcript, model preservation) and now have a consumer.
 
 ### Capability domains, not rank
 
-- **control-socket domain (currently `pi`)**: socket liveness, per-target lock, live send, and the dormant cell that selects spawn-bg.
-- **spawn-bg resume** is a **separate relaunch transport**, not the control-socket rail: the dormant socket-liveness branch selects it, and the launch leaf (`resolveResumeLaunchIdentity`) is what checks backend authority. There is no separate spawn-domain predicate today — do not describe it as its own domain until one exists.
-- **self-fetch domain (currently Claude Code)**: active receiver + mailbox deliverability; no owned resume.
-- **native-push domain (currently Antigravity)**: adapter probe + direct injection; no mailbox or owned resume.
+- **control-socket domain (currently `pi`)**: socket liveness, per-target lock, live send, and a dormant cell that rejects.
+- **No relaunch transport exists inside delivery.** `spawn-bg` — a detached, window-less resume child — was removed under the visible-first rule, not deprecated behind a reject, and `entwurf_v2` still starts no process: a dormant socket-domain citizen is refused as `dormant-fire-forget-unsupported`. Reopening one is the separate lifecycle verb `entwurf_resume_call`, which is pi-only (`target-not-pi` otherwise), returns a LAUNCH receipt and an OBSERVATION receipt that are never merged, releases its per-gid lock on every path, and on an unobserved socket leaves the visible window open rather than retrying. No watcher, no retry, no supervisor. Do not re-route it through `entwurf_v2` and do not describe a spawn domain that does not exist.
+- **self-fetch domain (currently Claude Code)**: active receiver + mailbox deliverability; no resume authority.
+- **native-push domain (currently Antigravity)**: adapter probe + direct injection; no mailbox and no resume authority.
 - `origin: "pi-session" | "meta-session" | "external-mcp"` records sender provenance. It is not the citizen identity schema and not a hierarchy.
 - `entwurf_peers` reports record citizens and liveness facts only. It never embeds routing verbs or socket addresses for peers.
 - `entwurf_self` is identity-required. For pi, its env carrier must have been planted from record birth; native marker identity must be backed by the matching record. Replyability is derived from the active rail, never hardcoded.
@@ -103,28 +107,46 @@ Two axes are required: deterministic/package gates and opt-in LIVE evidence.
 
 ```bash
 pnpm typecheck
-pnpm check
+pnpm check              # everyday core — prints total wall time; ≤60s on oracle
+pnpm run check:full     # full deterministic floor — core + hermetic/package tiers
 ./run.sh check-entwurf-v2-matrix
 ./run.sh check-meta-session
 ./run.sh check-entwurf-bridge-boot
 ./run.sh check-install-surface
 ./run.sh check-install-container       # require Docker in release acceptance
 
-LIVE=1 ./run.sh release-gate /path/to/scratch
+LIVE=1 ./run.sh release-gate /path/to/scratch --cut
 LIVE=1 ./run.sh smoke-acp-socket-citizen-live
 LIVE=1 ./run.sh smoke-acp-bundled-mcp-live
 LIVE=1 ./run.sh smoke-acp-v2-send-live
+LIVE=1 ./run.sh smoke-mux-lifecycle-live
 LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live   # on-demand; outside the claude release floor
 LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 ```
 
-- `pnpm check` is the static floor and includes the detailed `check-*`/offline smoke matrix.
+- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. Neither tier includes `check-gate-qualification`, which is scheduled separately (below).
 - **Kill-proof discipline (gate qualification).** A gate is a test only if re-planting a closed defect turns it red for the claimed reason. `check-gate-qualification` proves that automatically: committed mutants in `scripts/mutants/` must be KILLED at their `[QK:<claim>]` signature inside an isolated snapshot repo (control→mutant→restore→control; the real checkout is never written). Gates a release touches carry such manifests; assertion counts are never evidence — claim IDs + killed mutant IDs are. `check-agy-permission-matrix` holds the enumerated permission contract space; matrix cells change by axis/rule edits, never by appending cases.
-- **When changing a contract/gate:** name the production subject and an oracle independent of it; give the failing assertion a stable `[QK:<claim>]` label and add/update the exact-once mutant in `scripts/mutants/*.json`; if the contract is combinatorial, update the literal matrix axes/cells/exclusions together with their declared counts; then verify focused gate → `check-gate-qualification` → `pnpm check`, in that order. `MUTANT-STALE`/`SURVIVED`/`WRONG-REASON`/`CONTROL-RED`/`HANG`/`IMPURE` are red — never substitute an assertion count for a kill.
+- **When changing a contract/gate:** name the production subject and an oracle independent of it; give the failing assertion a stable `[QK:<claim>]` label and add/update the exact-once mutant in `scripts/mutants/*.json`; if the contract is combinatorial, update the literal matrix axes/cells/exclusions together with their declared counts; then verify the focused gate, and let qualification and the full floor follow the scheduling contract below — once on the frozen candidate, not once per amendment. `MUTANT-STALE`/`SURVIVED`/`WRONG-REASON`/`CONTROL-RED`/`HANG`/`IMPURE` are red — never substitute an assertion count for a kill.
 - Run LIVE gates with `PWD` in scratch so session artifacts do not land in the repo.
 - Release acceptance and evidence levels are defined in [VERIFY.md](./VERIFY.md); recorded host evidence is in [BASELINE.md](./BASELINE.md).
 - A failed gate or evidence downgrade blocks commit/release. Pipes can be connected and the water can still taste wrong.
 
+### Verification scheduling — when the floor runs
+
+Gate quality and gate scheduling are different axes: the gates above define *what* green means; this contract owns *when* each layer runs. It exists because repeating the full floor around every review amendment once cost more than the work it verified (history: CHANGELOG/git).
+
+```text
+implement → affected focused gates → independent review → one amendment bundle
+          → [gate/mutant changed? check-gate-qualification once] → pnpm run check:full once on the frozen candidate → commit
+```
+
+- **Inner loop:** run only the gates whose subject changed. Do not open the full floor to learn what a focused gate already answers.
+- **Review before floor:** independent review and its corrections close as one bundle before the full floor runs.
+- **Qualification is scheduled, not ambient.** `check-gate-qualification` is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every push, and release-gate carries it as a MUST step.
+- **Full floor once** (`pnpm run check:full`), on the frozen commit candidate. While it runs, nothing edits the worktree or index — including the NEXT boot sectors; a moved candidate voids the run's evidence.
+- **pre-commit is not the floor.** `.husky/pre-commit` carries only fast static checks (whitespace, lint, typecheck); the full floor is owned by this protocol, not by the hook. Do not grow the hook back, and do not build receipt/cache machinery to prove the protocol was followed.
+- **Release/LIVE acceptance is untouched.** VERIFY.md floors keep full strength; a shorter inner loop never lowers release evidence.
+
 ## Repository Map
 
 | Path | Purpose |
@@ -132,12 +154,13 @@ LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 | `pi-extensions/entwurf-control.ts` | pi adapter: record attach, record-keyed socket, RPC, native tools |
 | `pi-extensions/lib/pi-citizen-birth.ts` | pi native session → shared V3 record → socket address |
 | `pi-extensions/lib/meta-session.ts` | shared V3 record/store authority plus native marker/mailbox primitives |
-| `pi-extensions/lib/entwurf-v2-*.ts` | v2 contract, decider, transports, runner, production wiring |
+| `pi-extensions/lib/entwurf-v2-*.ts` | v2 contract, decider, transports, runner, production wiring; visible resume keeps launch injected |
+| `pi-extensions/lib/mux-*.ts` | same-tmux placement plus narrow fresh-call and visible-resume launch compositions |
 | `pi-extensions/lib/entwurf-fact*.ts` | record citizens + transport-specific liveness facts |
 | `pi-extensions/lib/native-push/` | native-push adapter/probe/register leaf |
 | `pi-extensions/acp-provider.ts` | `entwurf` provider registration |
 | `pi-extensions/lib/acp/` | ACP adapter rail, config/overlay, augment, turn loop, event mapping |
-| `mcp/entwurf-bridge/` | MCP surface for v2/self/peers/inbox/native-register |
+| `mcp/entwurf-bridge/` | MCP surface for v2/self/peers/inbox/native-register/fresh-call/resume-call |
 | `scripts/` | deterministic gates, LIVE smokes, install/doctor surfaces |
 | `run.sh` | installed command and gate dispatcher |
 
@@ -146,7 +169,7 @@ LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.82.1 <0.83` with devDep exact `0.82.1`; re-evaluate loader aliases and `/compat` at the minor ceiling.
+- pi runtime range is `>=0.84.1 <0.85` with devDep exact `0.84.1`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
 - ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style
@@ -162,6 +185,18 @@ LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 - Use tabs unless the existing file/linter requires otherwise.
 - GLG decides commit, push, and release gates. Never infer push from a commit request.
 
+### Review triage and lane discipline
+
+An overgrowth is built from locally correct steps; what fails is the absence of a budget and a stop rule. These are that budget.
+
+- **Reproduce one manual operator action per step.** Measure → narrow leaf → visible composition → observe real pain → next step. Never pre-build the general future (orchestrator, watcher, manager, backlog, role system) ahead of an observed bottleneck, and never build structure to compensate for a current model's habits — both burn with the next model or billing change.
+- **Triage review findings into three grades.** *Blocker* (false success, data loss, authority violation): fix in the current lane. *Defect* (real mismatch against the current explicit contract): fix in the amendment bundle. *Observation* (future risk, stronger-proof possibility): record it — it does not open work in the current lane.
+- **One amendment bundle per review.** If the bundle itself surfaces two or more new architecture blockers, stop repairing and go back to the design.
+- **Unrelated meta-infra never rides a capability lane.** The source-adjacent gate/mutant that proves a capability's contract belongs in the same change as that capability — the removal/repair rule above is untouched. What stays out of a feature commit candidate is unrelated verification machinery: scheduling rework, selectors, caches, receipts, floor restructuring. That pain is recorded and handled in its own subtraction lane later.
+- **Stop signal — evidence outgrowing the product.** When verification/meta-tool changes grow larger than the capability change they serve, stop and report to GLG. This is an operator-judgment trigger, deliberately not a mechanized ratio gate.
+- **Claim only what the evidence carries.** "The full floor was green once on the declared candidate" is strong enough; a stronger sentence mints proof obligations, and those obligations mint subsystems.
+- **Risk classes are not equal.** Data loss, identity authority, false delivery success, install destruction, and secrets get fail-closed strength. Doc tense, future possibility, and total environment-byte binding get repaired when seen — they do not justify new gate machinery.
+
 ## Next and References
 
 - [NEXT.md](./NEXT.md) — current priority and exact next move; branch work uses disposable `NEXT--<branch>.md`.

package/BASELINE.md

@@ -6,32 +6,43 @@ silently drifted into a different identity / context surface. Questions
 are deliberately open-ended — they probe what the agent actually sees,
 not what it was told to claim.
 
-The released 0.12 ACP backend is **Claude**, and the main question bank below is the
-Claude ACP baseline. The prepared **0.13.0** cut adds **Snowflake Cortex Code** as a
-second ACP backend; it has no question bank of its own yet (deferred to 0.13.1), and the
-Claude bank must not be run against it verbatim — cortex is
-system-prompt-carrier-less and runs its own native tool surface, so the overlay/engraving
-questions below would grade it against a surface it does not have. Antigravity (`agy`)
-is also shipped, but as a native-push garden citizen rather than an ACP backend, so it
-has a separate citizen/round-trip baseline below instead of being forced into Claude's
-overlay questions. Codex (pi-native / delivery probe) and Gemini (historical non-goal
-ACP probe) remain reference axes, not a shipped ACP baseline.
-
-## Release-host baseline — #51 repair cut
+Claude is the reference ACP backend. Cortex Code has a separate compact baseline
+because it has no system-prompt carrier and keeps its own native tool surface.
+Antigravity (`agy`) is a native-push citizen rather than an ACP backend and therefore
+has a separate citizen/round-trip baseline. Historical Codex/Gemini probes are not
+part of this operator interview.
+
+## Release-host baseline
 
 This table is the operator-facing support/certification view. It complements the
 model interview below; a persuasive answer from the model cannot turn an unmeasured
-host into a certified one.
-
-| Surface | Automated artifact evidence | Direct/native evidence | Current verdict |
-|---|---|---|---|
-| Node 24 Linux package consumer | Required `artifact-consumer` CI: read-only candidate `.tgz`, checkout-invisible, non-root global install, PATH shims, frozen package root, path+sha256 regular-file fence, strict doctor fixture | None required for the package layout itself | Package-consumer shape verified. The planted Claude cache/owner/bridge are synthetic and prove no real Claude lifecycle. |
-| Claude Code 2.1.217 exec form | `check-hook-launch-topology` + `check-claude-floor-coherence`; doctor oracle healthy fixture + 21 defect mutations | B2 actual Claude session on NixOS: args per element, literal `${HOME}`, direct parent, FileChanged exit 2 → idle wake | Runtime behavior verified at 2.1.217 on one host; this is the supported floor. |
-| Claude Code 2.1.138 negative | Launcher empty-argv refusal + installer/doctor floor checks | B actual Claude session on NixOS: args discarded while runtime reported success | Unsupported; no shell-form fallback. |
-| Maintainer NixOS installed package | Gates and B/B2 are green; the published `0.12.8-repair.1` artifact was installed from the registry for acceptance, then the V3 development wiring was restored | 2026-07-25: registry install → installed `install-meta-bridge` → NEW Claude session with a live MCP child → installed doctor **exit 0** (HISTORY) | Host-certified for the published repair artifact, including physical `entwurf_v2` delivery and the live owner join. The doctor first went RED on a managed dev-bin shadowing the registry bridge. This host now runs dev wiring again; stable `0.12.8` earns its own host proof. |
-| Secondary Ubuntu Linux installed package | Linux artifact-consumer gate models the package shape, not this machine | 2026-07-25: same registry artifact, isolated clean `PI_CODING_AGENT_DIR`, NEW Claude session with a live MCP child → installed doctor **exit 0** (HISTORY) | Recovery closed for `0.12.8-repair.1`. Hand-patched hooks and validate output remain non-acceptance; a stable artifact is a separate proof. |
-| macOS Claude meta-bridge | No artifact-consumer job and no `/proc` live join | None | **Not yet verified/certified for this repair cut.** Installer refuses Darwin and doctor remains nonzero; uninstall permits Darwin to remove older managed state. This is not permanent—future native validation may reopen it, and package-level `os` stays unrestricted. |
-| WSL2 / Windows | None | None | Unverified / outside this repair cut. |
+host into a certified one. Verdicts are one of **certified** (a real host ran the
+installed doctor green), **shape-only** (gates model the package, no live host),
+or **unverified**.
+
+| Surface | Verdict | Evidence |
+|---|---|---|
+| Node 24 Linux package consumer | shape-only | Required `artifact-consumer` CI |
+| Claude Code >=2.1.217 exec form | **certified** — supported floor | Topology + floor gates, doctor oracle; B2 live NixOS session |
+| Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
+| Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
+| Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
+| macOS Claude meta-bridge | unverified | Installer refuses Darwin; no `/proc` live join |
+| WSL2 / Windows | unverified | None |
+
+Notes the table cannot carry without becoming prose again:
+
+- **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
+  candidate `.tgz`, checkout-invisible non-root global install, PATH shims, a frozen
+  package root, the path+sha256 regular-file fence, and a strict doctor fixture. Its
+  planted Claude cache/owner/bridge are synthetic — no real Claude lifecycle runs there.
+- **Both certified hosts are certified for the published repair artifact only**, including
+  physical `entwurf_v2` delivery and the live owner join. Stable cuts earn their own host
+  proof; hand-patched hooks and `plugin validate` output are never acceptance.
+- **The maintainer host first went doctor-RED** on a managed dev-bin shadowing the registry
+  bridge, and now runs dev wiring again.
+- **macOS is not permanently excluded.** Future native validation may reopen it, and the
+  package-level `os` field stays unrestricted.
 
 **Operator acceptance rule:** on a claimed Claude host, reinstall from the released
 artifact, restart every old Claude process, open a new session, and run the doctor
@@ -76,20 +87,16 @@ expected isolation-closed response, **FAIL** = listed failure mode,
 > `check-acp-carrier-augment`) and the live `smoke-acp-memory-containment-live`;
 > this document records the model-side observation.
 
-## Per-ACP-backend specifics
+## Claude-specific surface
 
-Pick the active **ACP backend's** column before pasting a question block. Claude
-is the 0.12 shipped ACP baseline; Codex/Gemini are historical probe reference.
-Do not replace the Gemini column with agy: agy does not use this overlay/carrier
-contract at all, and its shipped baseline is the native-citizen section below.
+The two-round question bank below is the Claude reference baseline.
 
-| Slot | Claude *(shipped)* | Codex *(probe)* | Gemini *(probe)* |
-|---|---|---|---|
-| Config-dir env (Q-L2) | `CLAUDE_CONFIG_DIR` | `CODEX_HOME` / `CODEX_SQLITE_HOME` | `GEMINI_CLI_HOME` |
-| Native dir to compare | `~/.claude/` | `~/.codex/` | `~/.gemini/` |
-| Read-class native tools (Q-L3) | `Read`, `Bash` (ls/find/grep) | `exec_command` | `read_file`, `list_directory`, `glob`, `grep_search` |
-| Project memory file (Q-L4) | `CLAUDE.md` / `.claude/` | `~/.codex/AGENTS.md` | `GEMINI.md` |
-| Memory write target (Q-L5W) | `CLAUDE.md`, hooks, agents | `~/.codex/memories`, AGENTS.md | `GEMINI.md`, `MEMORY.md`, autoMemory inbox |
+| Slot | Expected Claude surface |
+|---|---|
+| Config dir (Q-L2) | `CLAUDE_CONFIG_DIR`, pointing at the entwurf overlay rather than `~/.claude/` |
+| Read-class tools (Q-L3) | `Read`, `Bash` (ls/find/grep) |
+| Project memory (Q-L4) | `CLAUDE.md` / `.claude/`, not inherited through the overlay |
+| Native memory write (Q-L5W) | none; do not create `CLAUDE.md`, hooks, or agents as a memory substitute |
 
 ---
 
@@ -216,7 +223,7 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 ### Q-MCP — MCP enumerate
 - **PASS** — Exactly one: `entwurf-bridge`.
 - **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes five tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale four-tool count.
+- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes seven tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
 
 ---
 
@@ -238,8 +245,8 @@ the same conversation must have a garden id.
 | Q-AGY-CONCURRENCY | Evidence boundary | Separate agy processes have separate pid/start-key markers; same-pid concurrent model invocation is explicitly reported unsupported. | Claims that one pid can safely identify two simultaneously invoking conversations. |
 
 The replyability formula is **record-backed identity AND live native-push probe**.
-There is intentionally no receiver marker, `watchArmed`, mailbox, or owned-outcome
-resume authority. The model field may exist in the meta-record/status display,
+There is intentionally no receiver marker, `watchArmed`, mailbox, or resume
+authority (no rail has one since the visible-first cut). The model field may exist in the meta-record/status display,
 but `agentId=meta-session/antigravity` is the stable sender contract.
 
 Recorded operator evidence (2026-07-13): automatic birth → gid/statusline → MCP
@@ -250,179 +257,26 @@ same-process concurrency.
 
 ---
 
-## Probe appendix — Gemini engraving substitution (`Q-H`, not 0.12 baseline)
-
-Historical Gemini probe, retained for the probe lane only — **not** part of
-the shipped Claude baseline. Gemini's `applySubstitutions` rewrites unknown
-`${name}` tokens; the bridge inserts a U+200B between `$` and `{` in operator
-engraving body so the regex misses while the visual text stays stable. The
-former carrier-isolation canary literal is a doc-era artifact with **no code
-surface on 0.12** — do not assert it as a current expectation.
+## Cortex baseline
 
-Setup (operator side): author a test engraving with literal `${AvailableTools}` /
-`${SubAgents}` / `${arbitrary_unknown_key}` tokens, plumb it through the Gemini
-overlay, open a fresh Gemini ACP session, then ask `Q-H`:
+Run these checks in a fresh `entwurf/cortex-*` session. Do not grade Cortex against
+Claude's overlay or system-prompt carrier.
 
-~~~
-[Q-H] Verify whether these three lines are visually present in your system
-prompt, and if so quote the visible text exactly:
-- TOKEN_A = ${AvailableTools}
-- TOKEN_B = ${SubAgents}
-- TOKEN_C = ${arbitrary_unknown_key}
-~~~
+| ID | Check | PASS | FAIL |
+|---|---|---|---|
+| Q-CX-ID | Backend identity | Identifies Cortex and the selected enforced model; does not claim to be Claude Code. | Reports the Claude backend or an unenforced/default model. |
+| Q-CX-TOOLS | Native surface | Reports Cortex-native tools; garden tools arrive only through `entwurf-bridge`. | Lists Claude's `Read/Bash/Edit/Write` allowlist as its native surface. |
+| Q-CX-MCP | Bridge projection | `entwurf-bridge` is reachable through the overlay-private `cortex/mcp.json`; no ambient operator MCP catalog appears. | Bridge absent, or unrelated operator MCP servers leak in. |
+| Q-CX-CARRIER | Context carrier | Says Cortex has no system-prompt engraving carrier; engraving/context arrived in the first-user augment. | Claims `_meta.systemPrompt` delivered the engraving. |
+| Q-CX-HOME | Containment | Distinguishes isolated HOME from the real operator HOME restored only for the bridge; `CORTEX_HOME` is absent. | Claims broad operator home/config inheritance or a present `CORTEX_HOME`. |
 
-- **PASS** — All three quoted with `${...}` visually preserved (the ZWSP is invisible; a PASS looks identical to the input).
-- **FAIL** — TOKEN_A shows a tool list in place of `${AvailableTools}`; any token mutated, dropped, or interpolated.
+The live `smoke-acp-cortex-live` and deterministic `check-acp-cortex` remain the
+oracles. This interview tests whether the model describes that surface honestly.
 
 ---
 
 # HISTORY (pointer)
 
-2026-07-30 Cortex 0.13.0 acceptance + landing checkpoint (Linux/thinkpad, Cortex Code
-v1.1.52). Pre-version landing HEAD `9f1c7dc9e1fa77103e29a6f1884af7759e1595eb` passed
-exact-SHA GitHub Actions run [30505001694](https://github.com/junghan0611/entwurf/actions/runs/30505001694):
-`check`, `install-surface`, and `artifact-consumer` all success. The non-interference reading rests on what the
-sources prove, not on an inspection of the runner image: the external Cortex CLI is not an npm
-dependency, nothing in install or provider registration looks for the executable,
-`.github/workflows/ci.yml` provisions only checkout, pnpm, and Node 24 (no Cortex install step,
-no Snowflake auth), and the required Linux `artifact-consumer` job ran the candidate inside a
-clean `node:24-bookworm` container and passed. Cells at that tree: `ENTWURF_REQUIRE_DOCKER=1 ./run.sh
-check-install-container` EXIT=0 (40 ok) — candidate `junghanacs-entwurf-0.12.10.tgz`
-**sha256=63342aa8a144011dee86ebea8f0b778c7860e54dc0f1c710438983c679e8af87**, image
-`node:24-bookworm` `id=sha256:fcd0f74fb415c752…`,
-`repoDigest=node@sha256:5711a0d445a1af54…`; `./run.sh check-pack-install` EXIT=0 with the
-installed package's own model list enumerating the **exact six curated rows (claude 2 +
-cortex 4)**; `LIVE=1 ./run.sh smoke-acp-cortex-live` **PASS 23/23**, deliberately rerun
-after the `resolveSessionKey` overlay-scope repair so the claim does not rest on the earlier
-CP2 code — overlay scope dir + `autoUpdate:false` + overlay-private `mcp.json` projection +
-real-operator-HOME restore on the bridge entry, the model's own `entwurf_v2` landing exactly
-one `.msg` on a seeded peer with the gid only in the envelope, and process-group teardown
-leaving nothing alive in that run's overlay. `pnpm check` on the prepared tree includes
-`check-gate-qualification` **111/111 killed** (lane `acp-cortex` twelve), and
-`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.13.0.drnRyR` was all green —
-**MUST PASS=17 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0**, EXIT=0. Operator-session (not
-gate) evidence from 2026-07-29 on the same implementation set: a Cortex resident used the
-host pi citizen's garden id instead of inventing one (`agentId=entwurf/cortex-claude-sonnet-5`,
-`backend=pi`, `origin=pi-session`, `replyable=true`) and exchanged real turns across three
-rails — native Claude Code mailbox drain, pi native control socket, and pi ACP Claude Sonnet
-control socket; record `20260729T204101-7aaa6f` remains on disk. **Still pending as a
-release-blocking `make` tag gate:** the preserved exact 0.13.0 candidate installed into a
-fresh temporary root must drive one cold `entwurf/cortex-claude-sonnet-5` turn from those
-installed bytes (unique nonce, exit 0, candidate sha256 unchanged before/after, resolved
-installed root recorded). Installed-artifact evidence and real-Cortex evidence have not yet
-met in one execution; a RED there stops the cut before the tag. Second machine, macOS, and
-WSL2 remain unclaimed for this cut.
-
-2026-07-25 repair.1 installed-native host acceptance (stable-promotion prerequisite):
-the published registry artifact `@junghanacs/entwurf@0.12.8-repair.1` was installed
-fresh on two Linux hosts (maintainer + secondary) through the package's stable bins.
-Each host ran installed `entwurf install-meta-bridge`, opened a NEW real Claude Code
-session with a live MCP child, and ran the installed `entwurf doctor-meta-bridge`
-against an isolated clean `PI_CODING_AGENT_DIR`; both doctors reached **PASS**, including
-the live MCP owner join and a physical `entwurf_v2` delivery. The maintainer host first
-proved the oracle's value by failing when its managed dev-bin shadowed the registry
-`entwurf-bridge`: the installed v2 hook wrote a v2 record while the checkout's v3 bridge
-refused it. Removing the managed dev bin made PATH resolve the registry bridge, after
-which the same native proof passed. The test-created v2 record from that failed mixed-path
-attempt was preserved under `meta-sessions.proof-failed-20260725T165227/`; the maintainer's
-V3 development wiring was restored after acceptance. This closes VERIFY's two-host
-repair.1 prerequisite for a separately authorized stable `0.12.8`; it is host
-corroboration of the published repair artifact, not evidence for the future stable
-candidate, which still earns exact-SHA CI, LIVE, and preserved-artifact acceptance.
-Exact pre-version closure checkpoint `28a52fe2d6e9ca29b657a33e5c80ff4debda2f0f`
-passed GitHub Actions run [30149759311](https://github.com/junghan0611/entwurf/actions/runs/30149759311):
-`check`, `install-surface`, and `artifact-consumer` all success. The host proof then found
-a one-line `remove-dev-bin` dispatch defect, so the eventual stable landing HEAD must earn
-a fresh exact-SHA run; this checkpoint is not reused as that acceptance.
-
-2026-07-24 (night) upgrade-harness + review acceptance at exact HEAD
-`cbda097` (branch `repair/v2-core-debt`, merged to main the same night — the
-hard-cut branch chronicle lives in issue #50): the three-cell harness gained
-the UPGRADE axis — `setup` / `install` / `install-meta-bridge` refuse a
-pre-cut (v1/v2) meta-record store BEFORE their first write, prescribe on
-three axes (pre-cut → migrate; problems → repair first; both → repair FIRST,
-then migrate), and the proof seeds every host state from frozen fixture bytes
-(`fixtures/meta-store`, sha256-manifested, excluded from the tarball).
-Deterministic cells at this HEAD: `pnpm check` EXIT=0 (source cell
-`check-upgrade-gate` 57/0), `check-pack-install` EXIT=0,
-`ENTWURF_REQUIRE_DOCKER=1 check-install-container` EXIT=0 — candidate
-`junghanacs-entwurf-0.12.8-repair.1.tgz` **sha256
-`db17165f962c938d71ef97cb7a86252549dc91b00d5ec67f63ec65b41039e6dc`**,
-11413738 bytes, image `sha256:f1158c7f34cf35a047bf0513c38282bb2fa253529e5ae404b32c6d93697410be`.
-Live at this HEAD: `LIVE=1 release-gate` **MUST 16/1/0 + BEHAVIOR 1/0,
-EXIT=1** — the single FAIL is `smoke-acp-bundled-mcp-live`, the known
-bundled-MCP readiness race (ROADMAP 「🔴 OPEN」, GLG: observe, don't fix;
-sample recorded with transcript; isolated re-run PASS 4/4). Every other MUST
-passed at this HEAD, including `smoke-acp-v2-send-live` (send identity /
-replyability) and the matrix honest-reject. **A release cut stays blocked on
-that red by the gate's own words; the merge to main was GLG's explicit call
-with the race documented as an open observation item.**
-
-2026-07-24 dependency-uplift acceptance at exact HEAD
-`7cbeb29b6afcfbaf4fc28da3b7929037c339113d` (branch `repair/v2-core-debt`): pi
-runtime **0.80.7 → 0.82.0** and Claude ACP **claude-agent-acp 0.54.1 → 0.61.0 /
-ACP SDK 1.1.0 → 1.3.0** as two separate cuts, with `@anthropic-ai/sdk` held at
-**0.100.1** (measured through the real module graph: claude-agent-sdk 0.3.217's
-`>=0.93.0` peer resolves to 0.100.1 there; dropping the direct pin under this
-repo's `autoInstallPeers:false` leaves only 0.91.1 and the peer goes unmet).
-Deterministic 3 cells all EXIT=0 on Node 24 Linux — checkout (`pnpm
-build-bridge && pnpm check`), installed tree (`check-pack-install`: resolved
-tree holds only `@earendil-works@0.82.0`, loader drove the pinned pi, installed
-bin delivered a `.msg`), clean consumer (`ENTWURF_REQUIRE_DOCKER=1
-check-install-container`, candidate `junghanacs-entwurf-0.12.8-repair.1.tgz`
-**sha256 `ab5dee07585c8d7a4f8f174cedea0051489ae1a26766ff1baf8edd7377d5bac7`**,
-11391060 bytes, image `sha256:f1158c7f34cf35a047bf0513c38282bb2fa253529e5ae404b32c6d93697410be`).
-Live: `LIVE=1 ./run.sh release-gate` measured **MUST 17/0/0 + BEHAVIOR 1/0,
-EXIT=0** at this HEAD — the first aggregate to include
-`smoke-acp-v2-send-live`, which closes the SEND half of ACP citizenship (an ACP
-model calls `entwurf_v2` and the `.msg` lands carrying the resident's own garden
-id, `entwurf/<model>`, replyable — a gid never present in the prompt). Two
-stale claims were retired against measurement rather than argument: the
-extension-loader `/compat` shim survives 0.82.0 (root / `/compat` / `/oauth`
-untouched; `/providers/all` is an addition, and the curated Claude anchors are
-byte-identical across the bump), and the "one-shot bundled-MCP teardown hang"
-that a gate comment used as its rationale does not reproduce on this
-combination. What a plain `pi -p` genuinely lacks is garden identity, and only
-without `--entwurf-control` — now documented as a provider/citizen boundary
-instead of read as a defect.
-
-2026-07-24 record-era aggregate floor: `LIVE=1 ./run.sh release-gate` measured
-**MUST 16/0/0 + BEHAVIOR 1/0, EXIT=0** on the `repair/v2-core-debt` branch after
-the #50 C1–C3 cuts and the observability repair — the first aggregate run since
-2026-06-27 (every individual smoke had been green, but the two-tier summary and
-exit code of the aggregate command itself had gone unverified for the whole
-hard-cut window; three MUST live smokes were found dead on the pre-C2 address
-contract and re-authored in the same pass). The step count moved 17→16 with the
-v2-cutover smoke retirements. Evidence log: `/tmp/pi-tmux-release-gate.log`
-(scratch `/tmp/entwurf-rg-scratch-20260724`).
-
-2026-07-22 repair evidence: Linux artifact-consumer C is committed locally as
-`328c66e` (not yet pushed at the time of this baseline update); B/B2 direct-native
-observations and the exec-only production cut are documented in issue #51 and
-VERIFY's host matrix. **Post-provenance C was re-proven rather than inheriting the
-earlier green:** the first rerun correctly went RED because its stand-in Claude was
-container PID 1, which the product rejects as an impossible/reparented owner. The
-fixture now keeps an outer PID-1 shell and runs the consumer as pid 8; both default
-pack-once and caller-preserved exact-tgz modes reached doctor PASS with marker
-`ownerPid=8 (>1)` and identical artifact sha256. The preserved file's
-inode/size/mtime/sha tuple was unchanged across acceptance. Evidence logs:
-`/tmp/pi-tmux-entwurf-exact-final.log` and
-`/tmp/pi-tmux-entwurf-default-final.log`; the digest belongs in the external cut log,
-not inside this shipped file (embedding it would mutate the tarball it names).
-This was the `0.12.7-1` gate candidate, **not** the approved release artifact. Exact
-mode was later repeated for `0.12.8-repair.0`, and those accepted bytes were published
-under `repair` on 2026-07-22. Field evidence then invalidated that release: its installed
-MCP dist omitted `entwurf-capabilities.json`, so tools/list and the old doctor stayed
-green while every `entwurf_v2` send died ENOENT. The repaired candidate must be
-`0.12.8-repair.1` and must earn fresh exact-SHA CI, LIVE-gate, preserved-artifact, and
-container evidence; none of repair.0's release evidence transfers. Maintainer/secondary-host
-installed doctor GREEN remains deliberately pending until after repair.1 publication.
-
-
-Per-release baselines — the 0.9.0 garden-native identity cut (17 PASS / 0 FAIL /
-0 SKIP `/gnew`-inclusive gate, #28), and the older 0.8.x / 0.5.0 context-pressure
-baselines — live in **CHANGELOG.md and git history**, including the gate names of
-their era (several of which, e.g. `smoke-all` / `smoke-async-resume` /
-`smoke-compaction-policy` / `sentinel` / `xt-tool-surface`, were retired in the
-v2 cutover). The live calibration reference is the current release floor in
-[VERIFY.md](./VERIFY.md) §0A — most recent: **2026-07-24 MUST 16/0/0 + BEHAVIOR 1/0**.
+Per-release counts, digests, host observations, and incident chronology live in
+[CHANGELOG.md](./CHANGELOG.md), release artifacts, issues, and git history. This
+file keeps only the current operator interview and support verdicts.

package/CHANGELOG.md

@@ -4,6 +4,70 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.14.0 — 2026-08-08
+
+Two arcs meet in this release. The product arc makes sibling sessions **visible**: opening and resuming a garden citizen is now an explicit, observable act, and the hidden alternatives were removed rather than kept as compatibility surface. The verification arc keeps the product from being swallowed by its own test cost: the everyday gate now runs in under a minute while the release floor stays strict. Claude Code native + pi + the meta-record store remain the main rail; the ACP backends (Claude ACP, Cortex) are optional service adapters on top of it.
+
+### Changed
+
+- **ACTION REQUIRED — the Pi runtime floor is now 0.84.1.** Installing this release upgrades a 0.82.x/0.83.x host rather than leaving it in place: the peer range is `>=0.84.1 <0.85`, the development pin is exactly 0.84.1, and installed-package acceptance pins the expanded Pi package constellation. Claude ACP moves to 0.66.0: the 0.65.0 permission metadata reaches the wire but is label-independent, the steered-turn change stays structurally unreachable because entwurf does not send `session/steer`, and 0.66.0's new goal extension changes no entwurf behavior — entwurf never sends `_session/goal`, does not consume the initialize advert, a `/goal` prompt still reaches the model unchanged (the adapter only adds a goal notification), and that inbound `session_info_update` can reach the wire but falls inert to the event mapper's ignore path.
+- **Delivery is visible-first and single-verb.** `entwurf_v2 fire-and-forget` never starts a process; a dormant control-socket citizen rejects as `dormant-fire-forget-unsupported`, and the reject hint now points at the visible resume verb instead of a manual workaround. The hidden `spawn-bg`/`owned-outcome` resume path and its gates were removed rather than retained as dead compatibility surface.
+- **ACP `streamSimple` honors Pi's request hook contract without fabricating HTTP evidence.** `onPayload` receives and may replace the exact ACP `{sessionId,prompt}` request on new and reused turns under fail-closed validation and abort ordering; `onResponse` is an explicit zero-call exemption because ACP has no truthful HTTP status/header boundary.
+- **Visible team formation and role authority are separate operating phases.** Fresh tasks form exact callback-correlated citizens and stop; the operator's later direct visible grant supplies coordinator/implementer/reviewer authority. No role database, watcher, retry loop, or orchestrator was added.
+- **Verification is tiered by meaning, not by elapsed time.** `pnpm check` is the everyday core — it completes in under 60 seconds on the reference host (36s measured on this candidate) and prints its own wall time; `pnpm run check:full` is the deterministic candidate floor that push CI, the release gate, and `prepublishOnly` all agree on by name. `check-gate-qualification` runs once per frozen candidate, in every push CI check job, and as a release-gate MUST step — never inside the inner loop. The subtraction behind this was loud, not silent: the `probe-ordering` mutant lane's 84 infrastructure replants were succeeded 1:1 by direct assertions with an 84-entry ledger (#70), bringing qualification to 165 mutants across 22 lanes with the infrastructure-subject share down from 111 of 247 to 27 of 165. What did *not* happen is also part of the record: the hand-built surface shrank by only ~1.6% in lines — the cost shape changed, not the mass. Gates move tier only by semantic-class decision.
+
+### Added
+
+- **Visible mux lifecycle verbs now cover both creation and same-id Pi resume.** `entwurf_fresh_call` opens one visible Pi or Claude Code sibling with an explicit runtime model and learns its garden id only from the sibling's exact nonce callback envelope. `entwurf_resume_call` reopens a dormant Pi citizen in the operator's tmux session under its existing garden id, keeps LAUNCH and OBSERVATION receipts separate, and runs no turn; Claude Code honestly refuses same-id resume as `target-not-pi`.
+- **Owner-normalized local identity facts are available through `entwurf meta-facts`.** The deterministic JSON projection exposes the strict V3 garden/native/transcript join and in-band defects by reusing the record owner's parser and store authority, so same-user consumers no longer need to maintain a weaker copy of the certification contract.
+- **Vitest 4.1.9 enters as the standard test runner — a beachhead, not an occupation.** The fresh-call surface/provider lane boots the real bridge, captures native registration and the Anthropic provider conversion path, and validates host-regex patterns against a Rust-family engine; a second lane moves the ACP SDK dependency/resolver contract behind the same stable `run.sh` shim. Two hand-built gates migrated; new contracts now default to being born in the framework, and further migration stays deliberate and lane-by-lane.
+- **An `entwurf-dev` operator skill rides in the repository (not in the npm package).** It is a development/verification tour tool: it lets the operator drive the current surface — list citizens, open a fresh visible sibling, correlate its nonce callback, send, resume — in natural language without memorizing tool calls.
+
+### Fixed
+
+- **Garden-id creation is exclusive across the certified active store.** CREATE writes the record bytes to a same-directory temp file first and publishes with an exclusive `link(2)`; an occupied final path fails loud with a named `MetaRecordError` — the refusal is occupancy-based, there is no retry, no check-then-write TOCTOU window exists, and the occupying record's bytes stay untouched. ATTACH keeps atomic in-place replacement of its own record; a collision surfaces as an error, never as an overwrite.
+- **Mux LIVE smokes cannot delete a retargeted real Claude launcher.** A shared fail-closed fence pins the PATH-selected launcher, link, resolved target, and content before launch; both smokes restore the operator's exact XDG presence/value and verify launcher integrity before conditional fixture cleanup on success and failure paths.
+- **Fresh-call verification now observes the host boundaries that source-text checks missed.** The escaped schema defect is replanted against Rust-family regex compilation and actual provider request bytes, and the session-identity generator oracle no longer relies on a probabilistic collision-free sample.
+- **The install surfaces hold the public MCP tool set as an exact seven — and the shipped protocol suite's tool assertion runs at all.** Three independent installed-consumer gates required only the five pre-0.14 verbs: `entwurf check-bridge` (which under `node_modules` is the prebuilt-dist branch of `start.sh`), the packed-install boot inside `check-pack-install`, and the checkout-invisible `check-install-container` that release acceptance hands the preserved candidate. An artifact that booted and answered `tools/list` without `entwurf_fresh_call` / `entwurf_resume_call` therefore passed the very gates that exist to catch "green clone, dead consumer" — the two verbs this release ships were covered by no installed-surface assertion at all. All three now compare the whole set and refuse a missing, extra, or duplicated verb. Underneath them sat something worse: the tarball-shipped `mcp/entwurf-bridge/test.sh` wrote its tool check as `python3 - <<'PY' <<<"$TOOLS_JSON"`, two redirections onto one stdin, so Python executed the JSON payload as its program while the here-doc assertions never ran once and the `ok:` line printed unconditionally. That block is live for the first time, with duplicate detection and the v1-verb negative kept as its own named diagnosis. `check-entwurf-bridge-boot` gains the same equality as `G1f` under `[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET]` with its own exact-once mutant, because every assertion before it was existential and `entwurf_fresh_call` was named by none of them. Stale enumerations that drifted when 0.14 added the two verbs were repaired with the gates: the bridge module header, the agy auto-grant exclusion list (two named exclusions, now four — the mux verbs launch into the caller's own tmux session, which an agy conversation is not), the external-MCP-host and mux-rail docs, and the `check-bridge` progress line that named only the dev strip-types branch to an operator reading it from an npm install.
+
+### Removed
+
+- **The unimplemented `tmux-live` receipt transport has been removed from the v2 contract.** A mux window is an operator view — it may later expose a runtime, but it is never address authority or delivery evidence.
+- **Injected session ids and hidden background resume are no longer launch substrates.** Fresh identity comes from the callback sender envelope; dormant lifecycle is the explicit visible resume verb.
+
+### Verification
+
+- Pre-version landing HEAD `9e14df518fb33bad59be14af31c64d71107b558d` passed exact-SHA GitHub Actions run [31258659484](https://github.com/junghan0611/entwurf/actions/runs/31258659484): `check`, `install-surface`, and `artifact-consumer` all success.
+- The 0.14.0 prepared tree passed `pnpm run check:full` (full deterministic floor, 303s, exit 0); `check-pack` counted **342 files**.
+- The initial prepared tree's `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.0.r8r31u --cut` completed **MUST PASS=20 FAIL=0 SKIP=0** (including the `check-gate-qualification` MUST step at **165/165 killed across 22 lanes**), **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Full log: `/tmp/entwurf-release-gate-0.14.0.r8r31u/release-gate.log`; per-step scratch/artifact paths are preserved in that log. The active LIVE set is native Claude Code, native pi, and pi+ACP; Cortex stays the documented on-demand host-auth axis, and no model-in-loop AGY step is in the aggregate.
+- Closing verification-surface inventory (the #70 after-picture, measured by `scripts/inventory-verification-surface.ts`): **203 files / 58,893 lines** combined, against the #62/#70 baseline of 201 files / 59,775 lines — lines below baseline (**−882**) with the file count reported transparently (**+2**). The prepared tree measured 58,845 before the install-surface repair below added 48 lines of gate text; the shipping number is the one stated here, so an independent recount lands on it.
+- **Install-surface repair and amended-tree re-acceptance.** The whole deterministic and installed-consumer set was re-taken on one frozen amended tree: `pnpm run check:full` **299s exit 0** with `check-pack` at **342 files**, `./run.sh check-gate-qualification` **166/166 killed across 22 lanes** (the +1 is the new `BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET`), `./run.sh check-pack-install` exit 0 with the installed boot listing all seven verbs, and `ENTWURF_REQUIRE_DOCKER=1 ./run.sh check-install-container` reaching `container-consumer: PASS` with the same seven from a frozen non-root global install. A project-local npm install under a sandboxed HOME was additionally driven through the operator-facing first command, `entwurf check-bridge`: exit 0, seven verbs, from the dist branch. The aggregate was then re-run against that amended tree on 2026-08-09 (oracle): `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.0-is.52cPh0 --cut` — **MUST PASS=20 FAIL=0 SKIP=0** (qualification MUST at **166/166 across 22 lanes**), **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`, exit 0. HEAD, porcelain, and the repo-root work-surface hash were identical before and after; the complete 3,943-line log is `/tmp/claude-1000/-home-junghan-repos-gh-entwurf/4a6914ab-d9da-4f67-9db2-5bf20f0ed168/scratchpad/p5-live.log` (SHA-256 `0e0f7f6168fa7484aed9db1b42a7b8945e9bcfcdb5745a23c9615992275efb7c`).
+- Exact prepared-HEAD CI and the preserved-candidate container acceptance remain `make` responsibilities.
+
+### Notes
+
+- **Known open issues shipped with eyes open:** #60 (native-push drops `wants_reply`/caller envelope), #68 (naming the valid no-transcript resume refusal), #71 (`skipDangerousModePermissionPrompt` pinned while `defaultMode` stays operator-owned), and an observed long-turn error pattern on the optional Claude ACP rail that a post-release audit will reproduce and classify. None of these gates this release; all are tracked.
+- **Ecosystem:** the `agent-config` repository's `entwurf-peek` skill was reworked against this release as its baseline — an advanced-operator density tool, not a requirement.
+
+## 0.13.1 — 2026-07-31
+
+### Changed
+
+- **ACP prompt lifecycle no longer applies a 600-second wall-clock cutoff to a running turn.** Bootstrap remains bounded; user abort sends ACP cancellation before bounded teardown, and child exit/stdio failure now preserves lifecycle phase, exit/signal, and stderr evidence without automatic cold replay.
+- **The release gate now makes actual invocation auditable.** Every MUST step reports PASS, protocol SKIP, or FAIL; `--cut` refuses a MUST SKIP without misreporting it as a failed call. The aggregate includes the native resume, spawn substrate, and authenticated cross-harness delivery chain; Cortex remains an explicitly documented on-demand host-auth axis.
+
+### Fixed
+
+- **Claude's tiny non-empty engraving carrier owns its leading boundary.** The SDK fixed identity sentence and `# Engraving Here` now occupy separate blocks while preserving auto-memory containment, deterministic signature bytes, and the empty override opt-out.
+- **The ACP provenance and v2 dispatch surfaces state their real boundaries.** First-user augment versus system carrier is rail-specific, and the `entwurf_v2` description fits the host tool-description cap.
+
+### Verification
+
+- The versioned release tree passed `pnpm check`, including **144/144** kill-qualified mutants across 10 lanes and `check-pack` at **309 files**.
+- `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.13.1.LeOQDB --cut` passed: **MUST PASS=20 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Full log: `/tmp/entwurf-release-gate-0.13.1.LeOQDB/release-gate.log`.
+- On-demand lifecycle acceptance `LIVE=1 ./run.sh smoke-acp-long-turn-live` passed on the final source set: a **733,635ms** turn exceeded the retired 600s cutoff with exactly one cold ACP bootstrap and no replay. Cortex is deliberately aggregate-excluded for this cut because the oracle has no Snowflake connection; its 0.13.0 thinkpad LIVE evidence is carry-forward, not a fresh 0.13.1 host certification.
+- `check-pack-install` packed and installed `0.13.1` into a fresh consumer, proving the installed bridge boot/delivery and previous-generation lifecycle without touching the real data tree. The preserved exact candidate's checkout-invisible Docker consumer acceptance remains a `make` responsibility.
+
 ## 0.13.0 — 2026-07-30
 
 ### Added