@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/check-entwurf-v2-decider.ts

@@ -7,11 +7,11 @@
  *   2. execute ⇒ plan present ∧ receipt.transport === plan.transport ∧
  *      (in-domain ⇒ lock non-null, mailbox ⇒ lock null).
  *   3. pre-probe rejects (bad-target / target-locked / target-address-conflict)
- *      carry observedLiveness=null; untrusted-fail-fast carries the measured
+ *      carry observedLiveness=null; every post-probe reject carries the measured
  *      `dead` (non-null), and the deny path releases the lock (nonce-owned).
- *   4. resume plan has NO mode, HAS wantsReply (#50 F2: the dormant rail's
- *      <sender_info> carries the etiquette marker) + expectedSocketPath/
- *      observeTimeoutMs/releaseWhen; meta-mailbox plan has NO mode.
+ *   4. meta-mailbox plan has NO mode. (The resume-plan cell — no mode, wantsReply,
+ *      expectedSocketPath/observeTimeoutMs/releaseWhen — went with the transport in
+ *      the visible-first cut; there is no plan variant left to hold those fields.)
  *   5. control-socket execute lock non-null; meta-mailbox execute lock null (？7).
  *   6. the unsupported (mailbox) path acquires NO lock (？7).
  *   7. a pre-probe address conflict rejects WITHOUT probing (inspectSocket unused).
@@ -21,8 +21,7 @@
  *      a self-fetch citizen with an INACTIVE receiver is refused (SE-2 2d-3), no plan,
  *      no lock, no probe; the seam is consulted exactly once on the resolved identity.
  *   9. an invalid garden id throws BEFORE any path/lock is built (F2-P1).
- *  10. no spawn-bg plan carries provider/model (D4: 5c-owned launch identity).
- *  11. (B2) a throw AFTER the lock is acquired (inspect/probe/preflight) releases
+ *  11. (B2) a throw AFTER the lock is acquired (inspect/probe) releases
  *      the held lock before the error propagates — no leak. A reject-path
  *      releaseLock that itself throws is RETRIED (the unlink never happened, so the
  *      lock is still ours) and the ORIGINAL error propagates — retry-pinned so a
@@ -31,18 +30,16 @@
  *      diagnostic (pid/lockPath/detail), including the corrupt null-holder case;
  *      no other reject carries one.
  *
- * No IO — the target lookup, lock, socket inspection/probe, and preflight are all
+ * No IO — the target lookup, lock, and socket inspection/probe are all
  * REQUIRED injected deps (the decider keeps NO live IO default); lock
  * acquire/release calls are tracked so "no-lock-retained" is proven, not assumed.
  */
 
 import assert from "node:assert/strict";
-import type { PreflightOutcome } from "../pi-extensions/lib/entwurf-preflight.ts";
 import {
 	type DispatchDeciderDeps,
 	type DispatchDecision,
 	decideDispatch,
-	ENTWURF_V2_OBSERVE_TIMEOUT_MS,
 	type ExecutionPlan,
 	resolveMailboxWakeModeCapability,
 	type TargetResolution,
@@ -89,34 +86,6 @@ function lockClaim(gardenId: string): LockClaim {
 	};
 }
 
-const APPROVE: PreflightOutcome = {
-	kind: "approve",
-	reason: "saved-true",
-	launchArgs: ["--approve"],
-	trustStoreDecision: true,
-	trustStoreInherited: false,
-	hasTrustInputs: true,
-	canonicalCwd: CWD,
-};
-const TRUSTED_NO_ARG: PreflightOutcome = {
-	kind: "trusted-no-arg",
-	reason: "no-trust-inputs",
-	launchArgs: [],
-	trustStoreDecision: null,
-	trustStoreInherited: false,
-	hasTrustInputs: false,
-	canonicalCwd: CWD,
-};
-const DENY: PreflightOutcome = {
-	kind: "deny",
-	reason: "fail-fast",
-	launchArgs: [],
-	trustStoreDecision: null,
-	trustStoreInherited: false,
-	hasTrustInputs: true,
-	canonicalCwd: CWD,
-};
-
 function capability(wakeMode: "self-fetch" | "direct-inject"): MetaCapability {
 	return { wakeMode, deliveryLevel: "D6", nativeIdLabel: "session" };
 }
@@ -126,7 +95,6 @@ interface ScenarioOpts {
 	lock?: "ok" | "conflict";
 	inspection?: TargetSocketInspection;
 	probe?: SocketLiveness;
-	preflight?: PreflightOutcome;
 	/** SE-2 2d-3: the verdict the injected mailboxDeliverabilityFor seam returns on the
 	 * unsupported path. Default false (fail-closed) — the decider trusts the seam, never
 	 * wake-mode alone, so this is how a test asserts both the deliverable and inactive cells. */
@@ -179,7 +147,6 @@ function mkDeps(opts: ScenarioOpts): Tracked {
 			return opts.inspection ?? { kind: "absent", socketPath: controlSocketPath(gardenId, "/fake/ctl") };
 		},
 		probeSocket: async (): Promise<SocketLiveness> => opts.probe ?? "dead",
-		preflightForCwd: () => opts.preflight ?? APPROVE,
 		mailboxDeliverabilityFor: (identity: MetaIdentity) => {
 			mailboxCalls.push(identity);
 			return { deliverable: opts.mailboxDeliverable ?? false, reason: "fake-deliverability" };
@@ -205,7 +172,7 @@ async function main(): Promise<void> {
 	// ── 1+3: bad-target — no citizen → reject, observedLiveness null, NO lock ────
 	{
 		const t = mkDeps({ resolution: { identity: null, preProbeAddressConflict: false } });
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "hi" }, t.deps);
+		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "hi" }, t.deps);
 		ok("bad-target: reject", d.kind === "reject");
 		ok("bad-target: no plan field", !("plan" in d));
 		ok("bad-target: observedLiveness null (pre-probe)", d.kind === "reject" && d.receipt.observedLiveness === null);
@@ -230,7 +197,7 @@ async function main(): Promise<void> {
 	// ── target-locked: acquire conflict → reject, null, nothing to release ───────
 	{
 		const t = mkDeps({ resolution: { identity: identity("pi"), preProbeAddressConflict: false }, lock: "conflict" });
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "hi" }, t.deps);
+		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "hi" }, t.deps);
 		ok("target-locked: reject", d.kind === "reject" && d.receipt.reason === "target-locked");
 		ok("target-locked: observedLiveness null (pre-probe)", d.kind === "reject" && d.receipt.observedLiveness === null);
 		ok("target-locked: lock acquire attempted", t.acquireCalls.length === 1);
@@ -253,7 +220,7 @@ async function main(): Promise<void> {
 	// empty/corrupt and there is no pid to show.
 	{
 		const d = await decideDispatch(
-			{ target: GID, intent: "owned-outcome", message: "hi" },
+			{ target: GID, intent: "fire-and-forget", message: "hi" },
 			{
 				resolveTarget: () => ({ identity: identity("pi"), preProbeAddressConflict: false }),
 				acquireLock: () => ({
@@ -270,7 +237,6 @@ async function main(): Promise<void> {
 					throw new Error("target-locked(corrupt): must not probe after a lock conflict");
 				},
 				probeSocket: async () => "dead",
-				preflightForCwd: () => APPROVE,
 				mailboxDeliverabilityFor: () => {
 					throw new Error("target-locked(corrupt): in-domain pi never consults the mailbox seam");
 				},
@@ -298,7 +264,7 @@ async function main(): Promise<void> {
 			lock: "ok",
 			inspection: { kind: "address-conflict", socketPath: "/fake/ctl/s.sock", reason: "symlink" },
 		});
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "hi" }, t.deps);
+		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "hi" }, t.deps);
 		ok(
 			"postlock-conflict: reject target-address-conflict",
 			d.kind === "reject" && d.receipt.reason === "target-address-conflict",
@@ -311,27 +277,6 @@ async function main(): Promise<void> {
 		ok("postlock-conflict: lock RELEASED (no-lock-retained)", t.releaseCalls.length === 1);
 	}
 
-	// ── owned-outcome + LIVE → owned-live-no-autosend, release ───────────────────
-	{
-		const t = mkDeps({
-			resolution: { identity: identity("pi"), preProbeAddressConflict: false },
-			lock: "ok",
-			inspection: { kind: "socket-file", socketPath: "/fake/ctl/s.sock" },
-			probe: "alive",
-		});
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "hi" }, t.deps);
-		ok(
-			"owned-live: reject owned-live-no-autosend",
-			d.kind === "reject" && d.receipt.reason === "owned-live-no-autosend",
-		);
-		ok(
-			"owned-live: observedLiveness alive (post-probe, non-null)",
-			d.kind === "reject" && d.receipt.observedLiveness === "alive",
-		);
-		ok("owned-live: lock released", t.releaseCalls.length === 1);
-		ok("owned-live: no plan", !("plan" in d));
-	}
-
 	// ── indeterminate → indeterminate-no-spawn, release ──────────────────────────
 	{
 		const t = mkDeps({
@@ -339,7 +284,7 @@ async function main(): Promise<void> {
 			lock: "ok",
 			inspection: { kind: "indeterminate", socketPath: "/fake/ctl/s.sock", error: "EACCES" },
 		});
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "hi" }, t.deps);
+		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "hi" }, t.deps);
 		ok(
 			"indeterminate: reject indeterminate-no-spawn",
 			d.kind === "reject" && d.receipt.reason === "indeterminate-no-spawn",
@@ -400,75 +345,6 @@ async function main(): Promise<void> {
 		}
 	}
 
-	// ── 2+4+10: spawn-bg RESUME execute (owned + dormant + preflight allow) ──────
-	for (const pf of [APPROVE, TRUSTED_NO_ARG]) {
-		const t = mkDeps({
-			resolution: { identity: identity("pi"), preProbeAddressConflict: false },
-			lock: "ok",
-			inspection: { kind: "absent", socketPath: "/fake/ctl/expected.sock" },
-			preflight: pf,
-		});
-		const d = await decideDispatch(
-			{ target: GID, intent: "owned-outcome", mode: "steer", wantsReply: true, message: "do X" },
-			t.deps,
-		);
-		ok(`resume-execute(${pf.kind}): kind execute`, isExecute(d));
-		if (isExecute(d) && d.plan.transport === "spawn-bg") {
-			ok(`resume-execute(${pf.kind}): receipt.transport === plan.transport`, d.receipt.transport === "spawn-bg");
-			ok(`resume-execute(${pf.kind}): lock RETAINED`, d.lock !== null);
-			ok(`resume-execute(${pf.kind}): NOT released`, t.releaseCalls.length === 0);
-			ok(`resume-execute(${pf.kind}): sessionId === gardenId (D3)`, d.plan.sessionId === GID);
-			ok(`resume-execute(${pf.kind}): prompt = message`, d.plan.prompt === "do X");
-			ok(`resume-execute(${pf.kind}): wantsReply carried (#50 F2)`, d.plan.wantsReply === true);
-			ok(`resume-execute(${pf.kind}): launchArgs from preflight`, d.plan.launchArgs === pf.launchArgs);
-			ok(
-				`resume-execute(${pf.kind}): expectedSocketPath planted`,
-				d.plan.expectedSocketPath === "/fake/ctl/expected.sock",
-			);
-			ok(
-				`resume-execute(${pf.kind}): observeTimeoutMs default`,
-				d.plan.observeTimeoutMs === ENTWURF_V2_OBSERVE_TIMEOUT_MS,
-			);
-			ok(`resume-execute(${pf.kind}): releaseWhen A2 predicate`, d.plan.releaseWhen === "socket-alive-or-child-exited");
-			assert.deepStrictEqual(
-				planKeys(d.plan),
-				[
-					"action",
-					"cwd",
-					"expectedSocketPath",
-					"launchArgs",
-					"observeTimeoutMs",
-					"prompt",
-					"releaseWhen",
-					"sessionId",
-					"targetGardenId",
-					"transport",
-					"wantsReply",
-				],
-				`spawn-bg plan keyset drift: ${planKeys(d.plan).join(",")}`,
-			);
-			ok(`resume-execute(${pf.kind}): NO mode/provider/model in plan`, true);
-		}
-	}
-
-	// ── 1+3: untrusted-fail-fast — resume verdict + preflight DENY → release ─────
-	{
-		const t = mkDeps({
-			resolution: { identity: identity("pi"), preProbeAddressConflict: false },
-			lock: "ok",
-			inspection: { kind: "absent", socketPath: "/fake/ctl/s.sock" },
-			preflight: DENY,
-		});
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "do X" }, t.deps);
-		ok("untrusted: reject untrusted-fail-fast", d.kind === "reject" && d.receipt.reason === "untrusted-fail-fast");
-		ok(
-			"untrusted: observedLiveness dead (measured, non-null)",
-			d.kind === "reject" && d.receipt.observedLiveness === "dead",
-		);
-		ok("untrusted: lock RELEASED (nonce-owned, no-lock-retained)", t.releaseCalls.length === 1);
-		ok("untrusted: no plan", !("plan" in d));
-	}
-
 	// ── 2+5+6: meta-mailbox SEND execute (unsupported claude + ff + deliverable) ─
 	// Deliverability comes from the required seam (active receiver), NOT wake-mode alone.
 	{
@@ -538,20 +414,6 @@ async function main(): Promise<void> {
 		ok("se2-inactive: deliverability seam consulted exactly once", t.mailboxCalls.length === 1);
 	}
 
-	// ── unsupported + owned-outcome → backend-liveness-unsupported, no lock ──────
-	{
-		const t = mkDeps({
-			resolution: { identity: identity("claude-code"), preProbeAddressConflict: false },
-			mailboxDeliverable: true,
-		});
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "x" }, t.deps);
-		ok(
-			"unsupported-owned: reject backend-liveness-unsupported",
-			d.kind === "reject" && d.receipt.reason === "backend-liveness-unsupported",
-		);
-		ok("unsupported-owned: acquireLock NOT called", t.acquireCalls.length === 0);
-	}
-
 	// ── #50 C4: record-less socket (identity null + recordLessSocket) ──────────
 	// The record is the sole address authority, so a bare control socket is NOT an
 	// addressable citizen — EVERY intent rejects pre-probe as `record-less-socket`
@@ -560,7 +422,7 @@ async function main(): Promise<void> {
 	// the gid — "absent" would hide the state). The retired A1 narrow used to accept
 	// ff sends into this socket; that acceptance must never come back.
 	const recordLess: TargetResolution = { identity: null, preProbeAddressConflict: false, recordLessSocket: true };
-	for (const intent of ["fire-and-forget", "owned-outcome"] as const) {
+	for (const intent of ["fire-and-forget"] as const) {
 		const t = mkDeps({ resolution: recordLess });
 		const d = await decideDispatch({ target: GID, intent, message: "ping" }, t.deps);
 		ok(
@@ -595,7 +457,7 @@ async function main(): Promise<void> {
 			let threw = false;
 			try {
 				await decideDispatch(
-					{ target: GID, intent: "owned-outcome", message: "x" },
+					{ target: GID, intent: "fire-and-forget", message: "x" },
 					{
 						resolveTarget: () => ({ identity: identity("pi"), preProbeAddressConflict: false }),
 						acquireLock: () => ({ ok: true, claim: lockClaim(GID) }),
@@ -604,7 +466,6 @@ async function main(): Promise<void> {
 						},
 						inspectSocket: async () => ({ kind: "absent", socketPath: "/fake/ctl/s.sock" }),
 						probeSocket: async () => "dead",
-						preflightForCwd: () => APPROVE,
 						mailboxDeliverabilityFor: () => ({ deliverable: false, reason: "in-domain pi: seam unused" }),
 						nativePushProbe: () => {
 							throw new Error("lock-leak: in-domain pi never consults the native-push seam");
@@ -631,12 +492,6 @@ async function main(): Promise<void> {
 				throw new Error("probe boom");
 			},
 		});
-		await runThrowing("preflight throw", {
-			// absent → dead → owned-outcome resume verdict → preflight is reached
-			preflightForCwd: () => {
-				throw new Error("preflight boom");
-			},
-		});
 	}
 
 	// ── B2 retry-pin (Fable 2차 권고): a reject-path releaseLock that THROWS is ──
@@ -650,7 +505,7 @@ async function main(): Promise<void> {
 		let caught: unknown = null;
 		try {
 			await decideDispatch(
-				{ target: GID, intent: "owned-outcome", message: "x" },
+				{ target: GID, intent: "fire-and-forget", message: "x" },
 				{
 					resolveTarget: () => ({ identity: identity("pi"), preProbeAddressConflict: false }),
 					acquireLock: () => ({ ok: true, claim: lockClaim(GID) }),
@@ -658,10 +513,9 @@ async function main(): Promise<void> {
 						released.push(c);
 						throw new Error(`release boom ${released.length}`);
 					},
-					// owned-outcome + LIVE → owned-live-no-autosend reject → rejectAfterRelease
+					// fire-and-forget + DORMANT → dormant-fire-forget-unsupported → rejectAfterRelease
 					inspectSocket: async () => ({ kind: "socket-file", socketPath: "/fake/ctl/s.sock" }),
-					probeSocket: async () => "alive",
-					preflightForCwd: () => APPROVE,
+					probeSocket: async () => "dead",
 					mailboxDeliverabilityFor: () => ({ deliverable: false, reason: "in-domain pi: seam unused" }),
 					nativePushProbe: () => {
 						throw new Error("reject-release-throw: in-domain pi never consults the native-push seam");
@@ -701,7 +555,6 @@ async function main(): Promise<void> {
 			probeSocket: async () => {
 				throw new Error("invalid-gid: probeSocket must not be reached");
 			},
-			preflightForCwd: () => APPROVE,
 			mailboxDeliverabilityFor: () => {
 				throw new Error("invalid-gid: mailboxDeliverabilityFor must not be reached");
 			},
@@ -710,7 +563,7 @@ async function main(): Promise<void> {
 			},
 		};
 		try {
-			await decideDispatch({ target: "../etc/passwd", intent: "owned-outcome", message: "x" }, deps);
+			await decideDispatch({ target: "../etc/passwd", intent: "fire-and-forget", message: "x" }, deps);
 		} catch {
 			threw = true;
 		}
@@ -775,19 +628,6 @@ async function main(): Promise<void> {
 			d.kind === "reject" && d.receipt.reason === "native-push-probe-indeterminate",
 		);
 	}
-	{
-		// owned × alive → reject native-push-no-resume-authority (state-independent), lock-free.
-		const t = mkDeps({
-			resolution: npResolution,
-			nativePush: { status: "alive", route: { lsAddress: "127.0.0.1:5599" } },
-		});
-		const d = await decideDispatch({ target: GID, intent: "owned-outcome", message: "yo" }, t.deps);
-		ok(
-			"native-push owned+alive: reject native-push-no-resume-authority",
-			d.kind === "reject" && d.receipt.reason === "native-push-no-resume-authority",
-		);
-		ok("native-push owned+alive: acquireLock NOT called (lock-free)", t.acquireCalls.length === 0);
-	}
 
 	// The wake-mode capability HELPER stays gate-pinned (renamed; the decider no longer
 	// calls it directly — deliverability flows through the required seam). It answers the

package/scripts/check-entwurf-v2-lock.ts

@@ -1,8 +1,11 @@
 /**
  * check-entwurf-v2-lock — deterministic gate for 0.11 Stage 0 step 5a (버킷 B F2):
- * the per-gid dispatch lock primitive. The lockfile is the ONLY guard against a
+ * the per-gid dispatch lock primitive. Its SHIPPED role is serializing concurrent
+ * in-domain dispatch at one garden id; it was BORN as the only guard against a
  * double-spawn of the same dormant target (pi self-guards CREATE but not RESUME,
- * 검증원장 F2), so this gate pins every invariant the ledger froze.
+ * 검증원장 F2) and that transport left under the visible-first rule. The mechanism
+ * and every invariant the ledger froze are unchanged, so this gate is too — see
+ * entwurf-v2-lock.ts's header for why the strict reclaim rules are kept.
  *
  * Real temp dir (not faked): the `openSync(lockPath,"wx")` OS-level atomicity is
  * the thing under test, so the directory is real; only the CONTENT-shaping deps

package/scripts/check-entwurf-v2-matrix.ts

@@ -32,7 +32,6 @@
  */
 
 import assert from "node:assert/strict";
-import type { PreflightOutcome } from "../pi-extensions/lib/entwurf-preflight.ts";
 import {
 	type EntwurfIntent,
 	type EntwurfV2Transport,
@@ -86,23 +85,12 @@ function lockClaim(gardenId: string): LockClaim {
 	};
 }
 
-const APPROVE: PreflightOutcome = {
-	kind: "approve",
-	reason: "saved-true",
-	launchArgs: ["--approve"],
-	trustStoreDecision: true,
-	trustStoreInherited: false,
-	hasTrustInputs: true,
-	canonicalCwd: CWD,
-};
-
 // ── injected fakes with call tracking (decider-gate shape, minimal copy) ─────
 interface ScenarioOpts {
 	resolution: TargetResolution;
 	lock?: "ok" | "conflict";
 	inspection?: TargetSocketInspection;
 	probe?: SocketLiveness;
-	preflight?: PreflightOutcome;
 	mailboxDeliverable?: boolean;
 }
 interface Tracked {
@@ -147,7 +135,6 @@ function mkDeps(opts: ScenarioOpts): Tracked {
 			probeCalls.push(socketPath);
 			return opts.probe ?? "dead";
 		},
-		preflightForCwd: () => opts.preflight ?? APPROVE,
 		mailboxDeliverabilityFor: (id: MetaIdentity) => {
 			mailboxCalls.push(id);
 			return { deliverable: opts.mailboxDeliverable ?? false, reason: "fake-deliverability" };
@@ -208,7 +195,7 @@ const ROWS: Row[] = [
 	{
 		name: "bad-target",
 		targetKind: "no citizen",
-		intent: "owned-outcome",
+		intent: "fire-and-forget",
 		scenario: { resolution: { identity: null, preProbeAddressConflict: false } },
 		expect: { decision: "reject", reason: "bad-target", lock: "none" },
 	},
@@ -246,16 +233,6 @@ const ROWS: Row[] = [
 		},
 		expect: { decision: "reject", reason: "mailbox-undeliverable", lock: "none" },
 	},
-	{
-		name: "unsupported owned-outcome → reject",
-		targetKind: "claude-code, owned intent",
-		intent: "owned-outcome",
-		scenario: {
-			resolution: { identity: identity("claude-code"), preProbeAddressConflict: false },
-			mailboxDeliverable: true,
-		},
-		expect: { decision: "reject", reason: "backend-liveness-unsupported", lock: "none" },
-	},
 	{
 		name: "in-domain live ff → control-socket",
 		targetKind: "pi, socket alive",
@@ -268,31 +245,6 @@ const ROWS: Row[] = [
 		},
 		expect: { decision: "execute", transport: "control-socket", lock: "held" },
 	},
-	{
-		name: "in-domain dormant owned → spawn-bg",
-		targetKind: "pi, socket absent (dormant)",
-		intent: "owned-outcome",
-		scenario: {
-			resolution: { identity: identity("pi"), preProbeAddressConflict: false },
-			lock: "ok",
-			inspection: present({ kind: "absent", socketPath: "/fake/ctl/expected.sock" }),
-			probe: "dead",
-			preflight: APPROVE,
-		},
-		expect: { decision: "execute", transport: "spawn-bg", lock: "held" },
-	},
-	{
-		name: "in-domain live owned → reject (no autosend)",
-		targetKind: "pi, socket alive, owned intent",
-		intent: "owned-outcome",
-		scenario: {
-			resolution: { identity: identity("pi"), preProbeAddressConflict: false },
-			lock: "ok",
-			inspection: present({ kind: "socket-file", socketPath: "/fake/ctl/s.sock" }),
-			probe: "alive",
-		},
-		expect: { decision: "reject", reason: "owned-live-no-autosend", lock: "released" },
-	},
 	{
 		name: "in-domain ff dormant → reject",
 		targetKind: "pi, confirmed dormant, ff intent",
@@ -308,7 +260,7 @@ const ROWS: Row[] = [
 	{
 		name: "in-domain indeterminate → reject",
 		targetKind: "pi, socket indeterminate (EACCES)",
-		intent: "owned-outcome",
+		intent: "fire-and-forget",
 		scenario: {
 			resolution: { identity: identity("pi"), preProbeAddressConflict: false },
 			lock: "ok",
@@ -418,7 +370,7 @@ async function main(): Promise<void> {
 		if (row.expect.decision === "execute") transports.add(row.expect.transport);
 		else rejectReasons.add(row.expect.reason);
 	}
-	for (const tr of ["control-socket", "meta-mailbox", "spawn-bg"]) {
+	for (const tr of ["control-socket", "meta-mailbox"]) {
 		ok(`coverage: transport "${tr}" exercised`, transports.has(tr));
 	}
 	for (const lc of ["none", "held", "mailbox-null", "released", "acquire-fail"] as LockClass[]) {
@@ -429,8 +381,6 @@ async function main(): Promise<void> {
 		"target-address-conflict",
 		"target-locked",
 		"mailbox-undeliverable",
-		"backend-liveness-unsupported",
-		"owned-live-no-autosend",
 		"dormant-fire-forget-unsupported",
 		"indeterminate-no-spawn",
 	]) {

package/scripts/check-entwurf-v2-production.ts

@@ -1,7 +1,7 @@
 /**
  * check-entwurf-v2-production — deterministic gate for the 5d-2b PRODUCTION deps assembly
  * (`makeProductionEntwurfV2Deps`). It proves the WIRING — which closure/instance/dir reaches
- * which hand — over fake leaf-IO spies, with NO real socket/lock/spawn/meta-record. Real
+ * which hand — over fake leaf-IO spies, with NO real socket/lock/meta-record. Real
  * transport behaviour is each hand's own gate + the 5d-5 matrix; this gate's job is the
  * three production invariants the factory exists to guarantee:
  *
@@ -9,9 +9,6 @@
  *      (a pi-alive citizen → control-socket execute; acquireLock spy saw {dir: lockDir}).
  *   B. control `sendOverSocket` builds the RpcSendCommand (type/message/mode/wants_reply/
  *      sender) and maps response.success→outcome; the hand releases under `lockDir`.
- *   C. QB3 split-brain — the spawn watcher releases via the SHARED lockDir-bound `release`,
- *      NOT the spawn factory's default releaseFn (which would hit the DEFAULT lock dir). A
- *      throwing spawnChild → spawn-start-failed (released) → releaseLock spy saw {dir:lockDir}.
  *   D. the meta-mailbox hand enqueues onto the wired sessionsDir/mailboxDir.
  *   E. Q3 + Q5 — a dead control send re-resolves (claude-code citizen) to the mailbox and
  *      enqueues through the SAME sendViaMailbox instance (same enqueue spy) on the SAME dirs
@@ -21,7 +18,6 @@
  */
 
 import assert from "node:assert/strict";
-import { formatSenderInfoBlock } from "../pi-extensions/lib/entwurf-control-rpc.ts";
 import type { DispatchInput } from "../pi-extensions/lib/entwurf-v2-decider.ts";
 import type { AcquireLockResult, LockClaim } from "../pi-extensions/lib/entwurf-v2-lock.ts";
 import {
@@ -30,7 +26,6 @@ import {
 } from "../pi-extensions/lib/entwurf-v2-production.ts";
 import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import type { ControlSocketPlan, MetaMailboxPlan } from "../pi-extensions/lib/entwurf-v2-send.ts";
-import type { SpawnBgPlan } from "../pi-extensions/lib/entwurf-v2-spawn.ts";
 import type { MetaIdentity, MetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
 import type { NativePushAdapter, NativePushProbeResult } from "../pi-extensions/lib/native-push/adapter.ts";
 import type { TargetSocketInspection } from "../pi-extensions/lib/socket-discovery.ts";
@@ -100,19 +95,6 @@ const CONTROL_PLAN: ControlSocketPlan = {
 	wantsReply: true,
 	message: "hello",
 };
-const SPAWN_PLAN: SpawnBgPlan = {
-	transport: "spawn-bg",
-	action: "resume",
-	targetGardenId: GID,
-	sessionId: GID,
-	cwd: "/home/junghan/repos/gh/entwurf",
-	prompt: "p",
-	wantsReply: true,
-	launchArgs: [],
-	expectedSocketPath: `${CONTROL_DIR}/${GID}.sock`,
-	observeTimeoutMs: 30_000,
-	releaseWhen: "socket-alive-or-child-exited",
-};
 const MAILBOX_PLAN: MetaMailboxPlan = {
 	transport: "meta-mailbox",
 	action: "send",
@@ -144,11 +126,6 @@ function makeSpiedFactory(over: {
 	probe?: "alive" | "dead" | "indeterminate";
 	rpc?: "success" | "dead-throw";
 	classifyDead?: boolean;
-	spawnChildThrows?: boolean;
-	/** #50 C3 — capture the plan reaching the spawn factory's resolveIdentity, then
-	 * stop the resume (throw → spawn-start-failed) so the prompt is observable
-	 * without a watcher. */
-	spawnResolveCapture?: (plan: SpawnBgPlan) => void;
 	/** #50 C3 — a caller with no authoritative sender (senderProvider → undefined). */
 	noSender?: boolean;
 	/** the native-push adapter probe result (only reached on a native-push backend). */
@@ -207,7 +184,6 @@ function makeSpiedFactory(over: {
 					socketPath: `${CONTROL_DIR}/${GID}.sock`,
 				}) as TargetSocketInspection,
 			probeSocket: async () => over.probe ?? "alive",
-			preflight: () => ({ kind: "approve" }) as never,
 			classifyConnect: () => (over.classifyDead ? "dead" : "indeterminate"),
 			sendRpc: async (socketPath, command) => {
 				spies.rpc.push({ socketPath, command: command as unknown as Record<string, unknown> });
@@ -239,19 +215,6 @@ function makeSpiedFactory(over: {
 					},
 				};
 			},
-			spawnOverrides: {
-				spawnChild: over.spawnChildThrows
-					? () => {
-							throw new Error("spawn boom");
-						}
-					: undefined,
-				resolveIdentity: over.spawnResolveCapture
-					? (plan) => {
-							over.spawnResolveCapture?.(plan);
-							throw new Error("capture stop");
-						}
-					: undefined,
-			},
 		},
 	};
 	return { deps: makeProductionEntwurfV2Deps(opts), spies };
@@ -349,59 +312,7 @@ async function main(): Promise<void> {
 		);
 	}
 
-	// ── C: QB3 — spawn release uses the SHARED lockDir release, not the default ─
-	{
-		const { deps, spies } = makeSpiedFactory({ spawnChildThrows: true });
-		const res = await deps.executor.resumeSpawnBg(SPAWN_PLAN, lockClaim());
-		ok(
-			"C: throwing spawnChild → spawn-start-failed (released)",
-			res.kind === "spawn-start-failed" && res.released === true,
-		);
-		ok(
-			"C: QB3 — spawn watcher released under the wired lockDir (not the default)",
-			spies.release.length === 1 && spies.release[0].dir === LOCK_DIR,
-		);
-	}
-
 	// ── C2: #50 C3 — the dormant rail carries the caller edge (<sender_info>) ──
-	{
-		// The spawn-bg prompt reaching the factory is the plan prompt PLUS the same
-		// <sender_info> block the live socket rail's receiver synthesizes — one
-		// formatter, one shape, so a resumed citizen never wakes to an anonymous task.
-		const cap: { prompt: string | null } = { prompt: null };
-		const { deps } = makeSpiedFactory({
-			spawnResolveCapture: (plan) => {
-				cap.prompt = plan.prompt;
-			},
-		});
-		const res = await deps.executor.resumeSpawnBg(SPAWN_PLAN, lockClaim());
-		ok("C2: capture-stop surfaced as spawn-start-failed (released)", res.kind === "spawn-start-failed");
-		// #50 F2: the plan's wantsReply threads into the SAME formatter call the live
-		// rail's receiver makes, so wants_reply:true survives the dormant rail.
-		const expected =
-			SPAWN_PLAN.prompt +
-			formatSenderInfoBlock(
-				{ sessionId: "self", agentId: "pi/x", cwd: "/cwd", timestamp: "2026-06-13T00:00:00.000Z" },
-				SPAWN_PLAN.wantsReply,
-			);
-		ok("C2: spawn-bg prompt = task + the SHARED <sender_info> block", cap.prompt === expected);
-		ok("C2: wants_reply rides the dormant <sender_info> (#50 F2)", cap.prompt?.includes('"wants_reply":true') === true);
-		ok("C2: the plan object handed to the executor is NOT mutated", SPAWN_PLAN.prompt === "p");
-	}
-	{
-		// No authoritative sender → the prompt goes out untouched (never a half-empty
-		// or fabricated envelope).
-		const cap: { prompt: string | null } = { prompt: null };
-		const { deps } = makeSpiedFactory({
-			noSender: true,
-			spawnResolveCapture: (plan) => {
-				cap.prompt = plan.prompt;
-			},
-		});
-		await deps.executor.resumeSpawnBg(SPAWN_PLAN, lockClaim());
-		ok("C2b: no sender → raw prompt (no fabricated envelope)", cap.prompt === "p");
-	}
-
 	// ── D: meta-mailbox hand enqueues onto the wired dirs ─────────────────────
 	{
 		const { deps, spies } = makeSpiedFactory({});
@@ -483,7 +394,7 @@ async function main(): Promise<void> {
 	// `record-less-socket` (a diagnostic state): no lock, no under-lock probe, no
 	// plan — the record is the sole address authority. The same presence hint with a
 	// symlink / absent socket stays plain bad-target (never trust a symlink).
-	for (const intent of ["fire-and-forget", "owned-outcome"] as const) {
+	for (const intent of ["fire-and-forget"] as const) {
 		const { deps, spies } = makeSpiedFactory({ recordExists: false, inspectKind: "socket-file", probe: "alive" });
 		const decision = await deps.decide({ target: GID, intent, message: "m" });
 		ok(