@junghanacs/entwurf 0.13.0 → 0.14.0

package/pi-extensions/lib/entwurf-v2-lock.ts

@@ -1,12 +1,21 @@
 /**
  * entwurf-v2-lock — the per-gid dispatch lock primitive (0.11 Stage 0 step 5a,
- * 버킷 B F2). LOAD-BEARING: the guard against a double-spawn of the same dormant
- * target by two V2 dispatchers that share the substrate through different entry
- * points. SCOPE (honest): this protects v2/v2 only. It was written while the legacy
- * `entwurf_resume` still ran unchanged (동결결정 10 scope A) without taking this
- * lock, which left a v2/legacy concurrent-resume gap. That verb was REMOVED in the
- * 0.12 cutover, so the gap is closed by subtraction — not by this lock growing to
- * cover it. Any NEW resume entry point must take this lock or the gap reopens.
+ * 버킷 B F2). LOAD-BEARING, and its SHIPPED ROLE HAS NARROWED: today it serializes
+ * concurrent in-domain dispatch at one garden id, so two V2 dispatchers entering
+ * the substrate through different entry points cannot interleave against the same
+ * control socket.
+ *
+ * It was BORN as a double-spawn guard: the dormant cell's `spawn-bg` resume ran
+ * under this same lock, and "two dispatchers resume one citizen twice" was the
+ * failure it was designed against. That transport was withdrawn under the
+ * visible-first rule, so no shipped path can double-launch anything — the
+ * mechanism below is unchanged, the threat model it currently answers is smaller.
+ * Read every "double-spawn" note in this file as the ORIGINAL motivation, kept
+ * because it explains why the reclaim rules are as strict as they are.
+ *
+ * SCOPE (honest): this protects v2/v2 only. Any NEW resume entry point — the
+ * visible same-id resume, when it lands — MUST take this lock, or the original
+ * concurrent-resume gap reopens the day a relaunch path exists again.
  *
  * ENVIRONMENT ASSUMPTION (stale reclaim): `hostname` equality is used as the
  * proxy for "same machine", so a holder pid is reclaim-probed with kill(0) only

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -8,10 +8,10 @@
  *
  * Three invariants this factory exists to guarantee (each gate-proven):
  *   - ONE lock domain (Q2/QB3). A single `release` closure bound to `lockDir` is the lock
- *     authority for EVERY hand: the decider's `releaseLock`, the control-send hand's
- *     `releaseLock`, AND the spawn watcher's `releaseFn`. The spawn factory's default
- *     `releaseFn` ignores `lockDir` (it would release into the DEFAULT lock dir) — passing
- *     `release` explicitly is what closes that split-brain.
+ *     authority for EVERY hand: the decider's `releaseLock` and the control-send hand's
+ *     `releaseLock`. (A third hand used to share it — the spawn watcher's `releaseFn`,
+ *     whose own default would have released into the DEFAULT lock dir; that split-brain
+ *     went with the transport, the single-authority rule did not.)
  *   - ONE mailbox sender (Q3). A single `makeProductionSendViaMailbox` instance is the
  *     top-level meta-mailbox hand AND the control-send dead-fallback's mailbox enqueue, so a
  *     direct send and a fallback send never drift in sender envelope / dirs.
@@ -30,7 +30,6 @@
  */
 
 import {
-	formatSenderInfoBlock,
 	type RpcClientOptions,
 	type RpcCommand,
 	type RpcResponse,
@@ -43,12 +42,6 @@ import {
 	receiverMarkerMatchesIdentity,
 } from "./entwurf-deliverability.ts";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
-// 0.12.1 B-2: TYPE-ONLY import — `entwurf-preflight.ts` value-imports
-// `@earendil-works/pi-coding-agent` (ProjectTrustStore), so a static value-import
-// here would re-couple the harness-neutral MCP bridge to pi at boot
-// (check-entwurf-bridge-pi-free). The real preflight is reached ONLY via the lazy
-// `await import()` in `lazyProductionPreflight`, on the owned-outcome resume branch.
-import type { PreflightInput, PreflightOutcome } from "./entwurf-preflight.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
 import {
 	type DispatchDeciderDeps,
@@ -74,9 +67,6 @@ import {
 	type RpcSendResult,
 } from "./entwurf-v2-send.ts";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.ts";
-import type { SpawnBgPlan } from "./entwurf-v2-spawn.ts";
-import { executeSpawnBgResume } from "./entwurf-v2-spawn.ts";
-import { makeProductionSpawnBgResumeDeps, type ProductionSpawnOpts } from "./entwurf-v2-spawn-production.ts";
 import {
 	defaultMetaMailboxDir,
 	defaultMetaSessionsDir,
@@ -127,10 +117,6 @@ export interface ProductionEntwurfV2Seams {
 	releaseLock: (claim: LockClaim, deps: { dir?: string }) => unknown;
 	inspectSocket: (gid: string, dir: string) => Promise<TargetSocketInspection>;
 	probeSocket: (socketPath: string) => Promise<SocketLiveness>;
-	// MaybePromise (0.12.1 B-2): the production default is the lazy wrapper, which
-	// `await import()`s the pi-coding-agent-backed preflight only on a resume verdict.
-	// A deterministic gate may still inject a sync spy returning a plain PreflightOutcome.
-	preflight: (input: PreflightInput) => PreflightOutcome | Promise<PreflightOutcome>;
 	classifyConnect: (code: string | undefined) => "dead" | "indeterminate";
 	sendRpc: (socketPath: string, command: RpcCommand, options?: RpcClientOptions) => Promise<{ response: RpcResponse }>;
 	enqueue: (opts: EnqueueMetaMessageOptions) => EnqueueMetaMessageResult;
@@ -139,9 +125,6 @@ export interface ProductionEntwurfV2Seams {
 	 * fake adapter drives both the probe (routing decision) and the send (delivery + retry).
 	 * Default: the real registry resolver. */
 	resolveNativePushAdapter: (backend: string) => NativePushAdapter;
-	/** Extra spawn-factory overrides (timers/spawnChild/probe) for a deterministic spawn gate.
-	 * `releaseFn` is NOT overridable here — the factory injects the shared `release` (QB3). */
-	spawnOverrides: Omit<ProductionSpawnOpts, "releaseFn">;
 }
 
 export interface ProductionEntwurfV2Opts {
@@ -150,44 +133,14 @@ export interface ProductionEntwurfV2Opts {
 	 * control socket actually exists, not a hardcoded true). ONE provider feeds the
 	 * control-socket RPC sender AND the meta-mailbox body sender (they share the envelope). */
 	senderProvider: () => SenderEnvelope | undefined;
-	/** pi agent dir holding `trust.json` (preflight). Omit → preflight's own default. */
-	agentDir?: string;
-	/** Operator-policy auto-approve roots (preflight prefix promotion). No package default. */
-	prefixRoots?: readonly string[];
 	lockDir?: string;
 	sessionsDir?: string;
 	mailboxDir?: string;
 	controlSocketDir?: string;
-	observeTimeoutMs?: number;
-	killGraceMs?: number;
 	/** Gate/smoke seam overrides — defaults are the real IO. */
 	seams?: Partial<ProductionEntwurfV2Seams>;
 }
 
-/**
- * 0.12.1 B-2: the production `preflight` seam default. preflight value-imports
- * `@earendil-works/pi-coding-agent` (ProjectTrustStore), so importing it eagerly
- * would pull pi into the harness-neutral MCP bridge's boot closure. This wrapper
- * defers that to a lazy `await import()` reached ONLY on the owned-outcome resume
- * branch (the decider awaits it). peers/self/list/mailbox-deliver therefore boot
- * with no pi package present.
- *
- * WHAT THIS DEFERRAL DOES NOT DO — corrected 0.12.8. The old sentence framed the
- * pi-less case as an edge ("a pi-less environment that DOES hit a spawn-bg resume
- * surfaces an honest module-not-found"). In a published consumer tree that is not an
- * edge, it is the DEFAULT: `@earendil-works/pi-coding-agent` is an optional peer that
- * a neutral `npm install` does not resolve (entwurf-preflight.ts:51), so this import
- * throws for every installed user and the owned-outcome lane has never lived in any
- * published version. The deferral still buys what it claims — a pi-free boot — and
- * "module-not-found" is still honest, but it is a permanent floor on the install path,
- * not a rare condition. Reviving that lane (declared dep / pi CLI subprocess / PATH
- * resolution) is a separate decision; nothing here should read as if it works today.
- */
-async function lazyProductionPreflight(input: PreflightInput): Promise<PreflightOutcome> {
-	const { preflight } = await import("./entwurf-preflight.ts");
-	return preflight(input);
-}
-
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
  * `isOutOfSocketDomainGardenIdConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
@@ -235,12 +188,10 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		releaseLock: s.releaseLock ?? realReleaseLock,
 		inspectSocket: s.inspectSocket ?? inspectTargetControlSocket,
 		probeSocket: s.probeSocket ?? probeSocketLiveness,
-		preflight: s.preflight ?? lazyProductionPreflight,
 		classifyConnect: s.classifyConnect ?? classifyConnectError,
 		sendRpc: s.sendRpc ?? realSendRpc,
 		enqueue: s.enqueue ?? enqueueMetaMessage,
 		resolveNativePushAdapter: s.resolveNativePushAdapter ?? realResolveNativePushAdapter,
-		spawnOverrides: s.spawnOverrides ?? {},
 	};
 
 	// ── ONE lock domain (Q2/QB3): a single lockDir-bound release for ALL hands ─
@@ -324,8 +275,6 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		releaseLock: release,
 		inspectSocket,
 		probeSocket,
-		preflightForCwd: (cwd: string): PreflightOutcome | Promise<PreflightOutcome> =>
-			io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
 		mailboxDeliverabilityFor,
 		// 봉인 4: resolve the native-push adapter for this backend + probe the conversation.
 		// Only reached on a nativePushSupported backend (the decider gates it), so the resolver
@@ -334,7 +283,6 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 			Promise.resolve(io.resolveNativePushAdapter(identity.backend).probe(identity.nativeSessionId)),
 		mailboxDir,
 		sessionsDir,
-		observeTimeoutMs: opts.observeTimeoutMs,
 	};
 
 	// ── control-send hand deps (5c-2): the dead-fallback shares resolveTarget /
@@ -368,28 +316,6 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 	// ── executor: the three transport hands, each pre-bound ───────────────────
 	const executor: DispatchExecutorDeps = {
 		sendControl: (plan, lock) => executeControlSocketSend(plan as ControlSocketPlan, lock, controlSendDeps),
-		resumeSpawnBg: (plan, lock) => {
-			const spawnPlan = plan as SpawnBgPlan;
-			// Caller-edge preservation (#50 C3): the dormant rail delivers the SAME
-			// structured <sender_info> the live socket rail synthesizes at its
-			// receiver — one formatter (entwurf-control-rpc SSOT), appended after the
-			// task text exactly as a live delivery would render it. Without this, a
-			// resumed citizen woke with an anonymous prompt while every other rail
-			// carried the sender envelope.
-			const sender = opts.senderProvider();
-			const prompt = sender ? spawnPlan.prompt + formatSenderInfoBlock(sender, spawnPlan.wantsReply) : spawnPlan.prompt;
-			return executeSpawnBgResume(
-				{ ...spawnPlan, prompt },
-				lock,
-				// QB3: inject the shared lockDir-bound `release` — never the spawn factory's
-				// default releaseFn (which would release into the DEFAULT lock dir).
-				makeProductionSpawnBgResumeDeps({
-					...io.spawnOverrides,
-					killGraceMs: opts.killGraceMs ?? io.spawnOverrides.killGraceMs,
-					releaseFn: release,
-				}),
-			);
-		},
 		sendMailbox: (plan, _lock) => sendViaMailbox(plan as MetaMailboxPlan, _lock as LockClaim),
 		// native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
 		// so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).

package/pi-extensions/lib/entwurf-v2-release.ts

@@ -6,24 +6,25 @@
  * AT MOST ONCE.
  *
  * Why a pure reducer before any transport IO (5b discipline = gate-first →
- * pure-before-IO → wire): the load-bearing risk of 5c is NOT the spawn/send IO, it
- * is the RELEASE TIMING (Fable 3, "release-after-observation"). A spawn-bg dispatch
- * that releases its lock too early — on spawn-started/ack instead of on an observed
- * liveness transition — reopens the exact double-spawn window 5a's per-gid lock
- * exists to close. So the timing logic is isolated here as a pure state machine the
- * gate drives over every event order, and 5c-2/5c-3/5c-4 only WIRE the real
- * send/spawn/mailbox IO onto it. The hand feeds events; this module decides release.
+ * pure-before-IO → wire): the load-bearing risk of 5c is NOT the send IO, it is the
+ * RELEASE TIMING. A dispatch that releases its lock too early — on an ack instead of
+ * on a final outcome — reopens the window 5a's per-gid lock exists to close. So the
+ * timing logic is isolated here as a pure state machine the gate drives over every
+ * event order, and 5c-2/5c-4 only WIRE the real send/mailbox IO onto it. The hand
+ * feeds events; this module decides release.
  *
- * The three policies (one per ExecutionPlan transport):
- *   - no-lock                       — meta-mailbox (？7: no lock was ever held).
- *     Nothing to release on any event.
+ * The two policies (one per ExecutionPlan transport):
+ *   - no-lock                       — meta-mailbox and native-push (？7 / 봉인 4: no
+ *     lock was ever held). Nothing to release on any event.
  *   - release-after-send-final      — control-socket send. The lock is held only for
  *     the at-most-once re-resolve; release once the send reaches a FINAL outcome.
- *   - release-after-spawn-observation — spawn-bg resume. The lock is held until the
- *     FIRST observable transition: socket-alive OR child-exited (any code). A
- *     spawn-started event is explicitly NOT a release trigger (that is the whole
- *     point). A spawn that never started (spawn-start-failed) has no child to watch,
- *     so it releases to free the gid — keeping the lock would pin it forever.
+ *
+ * There was a third, `release-after-spawn-observation`, for the spawn-bg resume: hold
+ * the lock until an OBSERVED liveness transition (socket-alive / child-exited), never
+ * on spawn-started. It went with that transport in the visible-first cut, and with it
+ * the spawn event vocabulary. The rule it encoded — a launch is finalized by an
+ * observation, not by having started — is the one a visible resume will have to
+ * restate for itself; it is not inherited by anything shipped here.
  *
  * The release authority is ALWAYS the LockClaim the decider handed over (5c wires it
  * through). This module never re-derives a lock by gid, never re-resolves a path —
@@ -34,24 +35,15 @@ import type { ExecutionPlan } from "./entwurf-v2-decider.ts";
 import type { LockClaim } from "./entwurf-v2-lock.ts";
 
 // ── ReleasePolicy (derived once from the plan + held lock) ───────────────────
-export type ReleasePolicy =
-	| { kind: "no-lock" }
-	| { kind: "release-after-send-final" }
-	| { kind: "release-after-spawn-observation" };
+export type ReleasePolicy = { kind: "no-lock" } | { kind: "release-after-send-final" };
 
 // ── ReleaseEvent (the transport hand feeds these as execution proceeds) ──────
 // `send-final` carries the terminal send outcome (legacy parity: a fallback-sent is
-// a real final outcome, not a hidden retry). `child-exited` carries the code (null =
-// killed by signal) but the policy releases on ANY code. `mailbox-enqueued` is the
-// terminal ack on the lock-free path. `spawn-started`/`spawn-start-failed` bracket
-// the spawn attempt — only the FAILURE finalizes; a successful start must wait for an
-// observed transition.
+// a real final outcome, not a hidden retry). `mailbox-enqueued` is the terminal ack on
+// the lock-free path. The four spawn/observation events (spawn-started,
+// spawn-start-failed, socket-alive, child-exited) went with the spawn-bg transport.
 export type ReleaseEvent =
 	| { kind: "send-final"; outcome: "sent" | "fallback-sent" | "rejected" | "failed" }
-	| { kind: "spawn-started"; pid: number }
-	| { kind: "spawn-start-failed"; error: string }
-	| { kind: "socket-alive" }
-	| { kind: "child-exited"; code: number | null }
 	| { kind: "mailbox-enqueued" };
 
 // ── ReleaseState (single-release accumulator) ───────────────────────────────
@@ -64,7 +56,7 @@ export function initialReleaseState(): ReleaseState {
 }
 
 /**
- * An in-domain execute (control-socket / spawn-bg) must hold a lock whose gardenId
+ * An in-domain execute (control-socket) must hold a lock whose gardenId
  * IS the plan's target. Both halves are 5b decider-contract invariants, not runtime
  * conditions: a null lock or a lock paired with the WRONG plan are the same grade of
  * mis-wiring (a later release would free nothing, or free a DIFFERENT gid's lock), so
@@ -85,7 +77,7 @@ function assertInDomainLock(plan: ExecutionPlan, lock: LockClaim | null): assert
 /**
  * Derive the release policy from the plan, cross-checking the lock invariants the 5b
  * decider guarantees: meta-mailbox ⇒ lock null (？7); in-domain (control-socket /
- * spawn-bg) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
+ * control-socket) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
  * a decider contract violation, not a runtime condition — it throws so a mis-wired
  * hand fails loud instead of silently dropping or mis-releasing a lock.
  */
@@ -108,9 +100,6 @@ export function decideReleasePolicy(plan: ExecutionPlan, lock: LockClaim | null)
 		case "control-socket":
 			assertInDomainLock(plan, lock);
 			return { kind: "release-after-send-final" };
-		case "spawn-bg":
-			assertInDomainLock(plan, lock);
-			return { kind: "release-after-spawn-observation" };
 	}
 }
 
@@ -123,8 +112,9 @@ export interface ReduceReleaseResult {
  * Fold one execution event into the release decision. `shouldRelease` is true
  * EXACTLY ONCE — on the first event that satisfies the policy's release condition;
  * every later event (after `state.released`) returns false. The single-release
- * guarantee is what lets the spawn watcher race socket-alive against child-exit
- * without a double release: whichever fires first releases, the other is a no-op.
+ * guarantee is what let the retired spawn watcher race two observations without a
+ * double release, and it is why the control-socket hand can feed a final outcome more
+ * than once without paying for it twice.
  */
 export function reduceRelease(policy: ReleasePolicy, state: ReleaseState, event: ReleaseEvent): ReduceReleaseResult {
 	if (state.released) {
@@ -140,19 +130,5 @@ export function reduceRelease(policy: ReleasePolicy, state: ReleaseState, event:
 		case "release-after-send-final":
 			// Release once the send reaches a final outcome; hold before that.
 			return event.kind === "send-final" ? release() : hold();
-		case "release-after-spawn-observation":
-			// Fable 3: spawn-started is NOT a release event. Release on the first
-			// observed transition (socket-alive / child-exited, any code), or on a
-			// failed start (no child to watch).
-			switch (event.kind) {
-				case "socket-alive":
-				case "child-exited":
-				case "spawn-start-failed":
-					return release();
-				case "spawn-started":
-				case "send-final":
-				case "mailbox-enqueued":
-					return hold();
-			}
 	}
 }

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -6,9 +6,9 @@
  * to the right 5c transport hand, returning ONE outcome-rich `EntwurfV2RunResult`. It performs
  * ZERO IO of its own and makes ZERO routing decisions — `decideDispatch` chose the plan,
  * this only DISPATCHES it. Each hand is an injected dep (the gate fakes them; 5d-2 wires
- * the production `executeControlSocketSend` / `executeSpawnBgResume` / production
- * `sendViaMailbox`), so the routing + result mapping is gate-provable without a socket,
- * spawn, or timer — the same pure-before-IO, IO-via-dep discipline 5b/5c kept.
+ * the production `executeControlSocketSend` / `sendViaMailbox` / native-push sender), so
+ * the routing + result mapping is gate-provable without a socket — the same
+ * pure-before-IO, IO-via-dep discipline 5b/5c kept.
  *
  * Why a result type richer than the receipt: the carry-over contracts from 5c demand it.
  *   - N3 (5c-2b): a dead-path re-resolve `rejected` carries the resolver's `rejectReason`
@@ -19,8 +19,6 @@
  *     re-send would double-deliver. The runner surfaces this as `execution-failed` with
  *     `finalizedOutcome` + `releaseFailed` so the surface renders "delivered, lock dirty,
  *     do NOT retry", never "send failed".
- *   - spawn-bg `lock-retained` is a RETURNED result (fail-closed, not a throw): it rides
- *     the `executed` branch so 5d's surface can render the retained-lock diagnostic.
  *
  * `retrySafe` is conservatively `false` on EVERY `execution-failed`: a thrown send is
  * never confidently retry-safe (an `indeterminate` connect may have delivered to an
@@ -47,17 +45,15 @@ import {
 	SendDeliveredReleaseFailedError,
 	type SendFinalOutcome,
 } from "./entwurf-v2-send.ts";
-import type { SpawnBgPlan, SpawnBgResumeResult } from "./entwurf-v2-spawn.ts";
 
 /**
  * The three transport hands, each PRE-BOUND with its own deps (production or fake). Lock
  * is typed `LockClaim | null` to mirror the real hands EXACTLY — the runner passes
  * `decision.lock` straight through and the hand fails loud on a null/mis-paired lock
- * (control-socket / spawn-bg get a non-null claim; meta-mailbox gets null — ？7).
+ * (control-socket gets a non-null claim; meta-mailbox and native-push get null — ？7 / 봉인 4).
  */
 export interface DispatchExecutorDeps {
 	sendControl: (plan: ControlSocketPlan, lock: LockClaim | null) => Promise<ControlSocketSendResult>;
-	resumeSpawnBg: (plan: SpawnBgPlan, lock: LockClaim | null) => Promise<SpawnBgResumeResult>;
 	sendMailbox: (plan: MetaMailboxPlan, lock: LockClaim | null) => Promise<RpcSendResult>;
 	// native-push (봉인 4): lock-free like meta-mailbox — the runner passes the null lock
 	// verbatim and the hand ignores it. Owns the 1-shot re-probe→re-send retry internally.
@@ -66,12 +62,10 @@ export interface DispatchExecutorDeps {
 
 /** The per-transport success outcome, discriminated by transport so the surface renders
  * each without guessing. `control-socket` carries the optional N3 `rejectReason`;
- * `spawn-bg` carries the whole `SpawnBgResumeResult` (incl. the `lock-retained`
- * fail-closed diagnostic); `meta-mailbox` is always `success:true` (enqueue has no
- * in-band refuse — a failure is a throw, handled as `execution-failed`). */
+ * `meta-mailbox` is always `success:true` (enqueue has no in-band refuse — a failure is
+ * a throw, handled as `execution-failed`). */
 export type ExecutedOutcome =
 	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string }
-	| { transport: "spawn-bg"; result: SpawnBgResumeResult }
 	| { transport: "meta-mailbox"; success: true }
 	// native-push carries `retried` so the surface can note the 1-shot re-probe retry fired.
 	| { transport: "native-push"; success: true; retried: boolean };
@@ -143,15 +137,6 @@ export async function executeDispatch(
 				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
 			}
 		}
-		case "spawn-bg": {
-			try {
-				// `lock-retained` is a RETURNED result (fail-closed), not a throw — it rides `executed`.
-				const result = await deps.resumeSpawnBg(plan, lock);
-				return { kind: "executed", receipt, transport, outcome: { transport: "spawn-bg", result } };
-			} catch (err) {
-				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
-			}
-		}
 		case "meta-mailbox": {
 			try {
 				// lock is null here (？7) — passed verbatim; the production adapter ignores it.

package/pi-extensions/lib/entwurf-v2-send-fallback.ts

@@ -18,17 +18,18 @@
  * must read the same row. That pin is also what makes "no resume promotion" structural,
  * not just a 5c-2a guard: the `fire-and-forget` row has NO resume cell —
  *   live          → send / control-socket   (the retry)
- *   dormant(dead) → reject (dormant-fire-forget-unsupported)  ← NOT resume/spawn-bg
+ *   dormant(dead) → reject (dormant-fire-forget-unsupported)  ← nothing is launched
  *   indeterminate → reject (indeterminate-no-spawn)
- * Only `owned-outcome + dormant` is resume/spawn-bg, and an owned-outcome dispatch never
- * yields a control-socket send plan in the first place. So a dead re-resolve can only
- * retry (alive), reject (dead/indeterminate pi), or — on an UNSUPPORTED backend, via the
- * separate mailbox mini-table — enqueue to a deliverable citizen. It can never spawn.
+ * Since the visible-first cut there is no resume cell ANYWHERE — the intent that owned one
+ * is gone from the contract — so a dead re-resolve can only retry (alive), reject
+ * (dead/indeterminate pi), or — on an UNSUPPORTED backend, via the separate mailbox
+ * mini-table — enqueue to a deliverable citizen. It can never start a process.
  *
- * The N2 asymmetry (frozen in entwurf-v2-contract): in-domain `dormant` is a CONFIRMED
- * not-running pi → reject (enqueuing would be a silent pileup; resume is the honest
- * place, and resume is out of a SEND fallback's scope). `unsupported` is UNKNOWN liveness
- * with no socket axis → the mailbox is its honest channel when deliverable.
+ * The N2 asymmetry (frozen in entwurf-v2-contract) is a RECEIVER question, not a backend
+ * privilege: a mailbox is offered only where an active receiver actually drains it. An
+ * `unsupported` citizen gets one exactly while `mailboxDeliverable` holds, and is rejected as
+ * `mailbox-undeliverable` the moment it does not. An in-domain `dormant` pi is a CONFIRMED
+ * not-running session, so nothing would ever drain that enqueue — a silent pileup → reject.
  */
 
 import type { MailboxDeliverabilityResult } from "./entwurf-deliverability.ts";
@@ -143,8 +144,8 @@ export async function resolveDeadControlSendFallback(
 		return { kind: "reject", reason: receipt.reason };
 	}
 	// fire-and-forget + live is the ONLY in-domain allow cell → control-socket send. A
-	// resume/spawn-bg or meta-mailbox transport here would be a frozen-table drift, so
-	// fail loud rather than mis-route a SEND fallback into a child spawn.
+	// meta-mailbox transport here would be a frozen-table drift, so fail loud rather than
+	// mis-route a SEND fallback onto another rail.
 	if (receipt.transport !== "control-socket") {
 		throw new Error(
 			`entwurf-v2-send-fallback: in-domain fire-and-forget re-resolve yielded unexpected transport (${receipt.transport}) — table drift.`,

package/pi-extensions/lib/entwurf-v2-send.ts

@@ -127,7 +127,7 @@ export async function executeControlSocketSend(
 	const held = lock as LockClaim;
 
 	// Lock-leak backstop: once the lock is held, ANY throw out of the drive — a
-	// contract-violation guard (spawn-bg re-resolve), the mis-route assert, even a buggy
+	// contract-violation guard, the mis-route assert, even a buggy
 	// dep that throws where it should return — must still release the lock before it
 	// propagates. A leaked lock pins the gid forever (5a's worst failure). So convert any
 	// such throw into a `failed` final outcome, run finalizeRelease (which releases on
@@ -212,14 +212,9 @@ async function driveDeadFallback(
 			} catch (err) {
 				return { outcome: "failed", error: err };
 			}
-		case "spawn-bg":
-			// A SEND fallback must never re-resolve into a spawn — that is a decider
-			// contract violation (a send and a spawn are different actions), so fail loud
-			// rather than silently mis-execute.
-			throw new Error("entwurf-v2-send: re-resolve returned a spawn-bg plan for a send fallback (contract violation).");
 		case "native-push":
 			// The dead-control-socket fallback re-resolves only the pi socket domain
-			// (control-socket / mailbox / spawn); it never routes the native-push rail. A
+			// (control-socket / mailbox); it never routes the native-push rail. A
 			// native-push rePlan here is structurally impossible — fail loud.
 			throw new Error(
 				"entwurf-v2-send: re-resolve returned a native-push plan for a send fallback (contract violation).",