@junghanacs/entwurf 0.13.0 → 0.14.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -3,23 +3,22 @@
  * (0.11 Stage 0 step 5b). It turns a caller's (target, intent, …) request plus
  * already-resolvable facts into a single `DispatchDecision`: either a reject
  * receipt, or an execute receipt + an `ExecutionPlan` + (for in-domain backends) a
- * held `LockClaim`. It performs NO transport: no send, no enqueue, no spawn, no
- * release-watcher. Step 5c executes the chosen plan; step 5d registers the MCP
- * surface. The decider only DECIDES.
+ * held `LockClaim`. It performs NO transport: no send, no enqueue, no release-watcher.
+ * Step 5c executes the chosen plan; step 5d registers the MCP surface. The decider
+ * only DECIDES.
+ *
+ * Since the visible-first cut (contract header) this module also starts NO process:
+ * the resume verdict, its trust preflight, and the detached spawn-bg plan are gone.
+ * Every plan it can emit now targets a citizen that is already running.
  *
  * Why a separate pure module (step 4 discipline = gate-first → pure-before-IO →
  * wire): every IO surface the decision needs — the target lookup, the per-gid lock,
- * the lstat/connect socket inspection, the trust preflight, the mailbox-deliverability
- * seam — is INJECTED via `DispatchDeciderDeps`, so the gate drives every branch with
- * fakes and the live wrappers wire the real fns. The plan is shaped so 5c's
- * transport hand consumes it WITHOUT re-deriving any path/arg (socketPath,
- * mailboxDir, sessionsDir, launchArgs are all planted here once — 4c "재유도 금지"):
- * the hand is a plan-keyed dispatcher, never a second brain. The two deliberate
- * exceptions (GPT힣 1차 검수): the spawned child's runtime pid is NOT in the plan
- * (it is born during 5c execution → it is the watcher's release-context, not a plan
- * input), and the launch identity (provider/model) is read by the 5c launcher from
- * the saved session JSONL (its existing authority) — putting that read in the
- * decider would make it impure. So the plan carries no provider/model.
+ * the lstat/connect socket inspection, the mailbox-deliverability seam — is INJECTED
+ * via `DispatchDeciderDeps`, so the gate drives every branch with fakes and the live
+ * wrappers wire the real fns. The plan is shaped so 5c's transport hand consumes it
+ * WITHOUT re-deriving any path/arg (socketPath, mailboxDir, sessionsDir are all
+ * planted here once — 4c "재유도 금지"): the hand is a plan-keyed dispatcher, never a
+ * second brain.
  *
  * The frozen 7-step order (NEXT.md "통합 decider 순서"):
  *   1. requireGardenId   — runtime guard BEFORE any path is built (F2-P1; closes the
@@ -32,8 +31,7 @@
  *   4. acquireLock       — IN-DOMAIN ONLY (？7), BEFORE lstat/connect, so the probe
  *      happens under the lock (the TOCTOU 5a's lock closes).
  *   5. in-domain         — inspectTargetControlSocket (lstat-then-connect, ？2) →
- *      resolveDispatch → on a resume verdict, preflight the target cwd (1B: deny →
- *      nonce-owned release → untrusted-fail-fast) → plan.
+ *      resolveDispatch → control-socket send plan, or a reject that releases the lock.
  *   6. unsupported       — NO lock; deps.mailboxDeliverabilityFor (REQUIRED seam: wake-mode
  *      capability AND a live active-receiver, fail-closed) → resolveDispatch → meta-mailbox
  *      plan or reject. SE-2 2d-3: a terminated/drifted self-fetch citizen is refused, never
@@ -53,16 +51,6 @@ import { controlSocketPath, mapInspectionToLiveness } from "./socket-discovery.j
 // Re-export the shared conflict predicate so producers of a TargetResolution have a
 // single import site for it (it is the SAME fn the fact-provider listing uses).
 export { isOutOfSocketDomainGardenIdConflict };
-// ── observe timeout (？3) ───────────────────────────────────────────────────
-// The bounded wait 5c's release-watcher gives a spawned child to surface its
-// control socket / exit. Planted into the resume plan so the hand does not invent
-// a timeout. A standalone constant + env override (NOT a multiple of the probe
-// timeout — a different concern); 30s initial, tunable to 45s after live data.
-export const ENTWURF_V2_OBSERVE_TIMEOUT_MS = (() => {
-    const raw = process.env.ENTWURF_V2_OBSERVE_TIMEOUT_MS;
-    const n = raw !== undefined && raw !== "" ? Number(raw) : Number.NaN;
-    return Number.isFinite(n) && n > 0 ? n : 30_000;
-})();
 export const ENTWURF_V2_MODE_DEFAULT = "follow_up";
 /**
  * F2-P1 defense in depth: never build a lock/socket path from an unvalidated gid.
@@ -100,10 +88,9 @@ export function resolveMailboxWakeModeCapability(identity, capabilityFor = metaC
 export async function decideDispatch(input, deps) {
     const mailboxDir = deps.mailboxDir ?? defaultMetaMailboxDir();
     const sessionsDir = deps.sessionsDir ?? defaultMetaSessionsDir();
-    const observeTimeoutMs = deps.observeTimeoutMs ?? ENTWURF_V2_OBSERVE_TIMEOUT_MS;
     const mode = input.mode ?? ENTWURF_V2_MODE_DEFAULT;
     const wantsReply = input.wantsReply ?? false;
-    const ctx = { mode, wantsReply, observeTimeoutMs };
+    const ctx = { mode, wantsReply };
     const reject = (receipt, diagnostic) => diagnostic ? { kind: "reject", receipt, diagnostic } : { kind: "reject", receipt };
     // 1. requireGardenId — BEFORE any path is built.
     const gardenId = requireGardenId(input.target);
@@ -179,9 +166,9 @@ export async function decideDispatch(input, deps) {
         return { kind: "execute", receipt, plan, lock: null };
     }
     // 4-5. control-socket domain (currently backend pi): lock → inspect → route.
-    return decideInDomain(gardenId, input, deps, ctx, identity.cwd);
+    return decideInDomain(gardenId, input, deps, ctx);
 }
-async function decideInDomain(gardenId, input, deps, ctx, cwd) {
+async function decideInDomain(gardenId, input, deps, ctx) {
     const { acquireLock, releaseLock, inspectSocket, probeSocket } = deps;
     // 4. acquire the per-gid lock BEFORE lstat/connect.
     const acq = acquireLock(gardenId);
@@ -211,35 +198,14 @@ async function decideInDomain(gardenId, input, deps, ctx, cwd) {
         const { liveness, socketPath } = mapped;
         const receipt = resolveDispatch(input.intent, liveness, false);
         if (!receipt.ok) {
-            // resolver reject (owned-live-no-autosend / indeterminate-no-spawn / …) — the
-            // lock was for an in-domain probe that yielded no execute, so release it.
+            // resolver reject (dormant-fire-forget-unsupported / indeterminate-no-spawn) —
+            // the lock was for an in-domain probe that yielded no execute, so release it.
             return rejectAfterRelease(receipt);
         }
-        if (receipt.action === "resume") {
-            // 1B: preflight runs ONLY here (the sole branch that launches a child into a
-            // target cwd). deny → nonce-owned release → untrusted-fail-fast, with the
-            // honest measured liveness (dormant = the `dead` we just probed).
-            const outcome = await deps.preflightForCwd(cwd);
-            if (outcome.kind === "deny") {
-                return rejectAfterRelease(makeRejectReceipt("untrusted-fail-fast", liveness));
-            }
-            const plan = {
-                transport: "spawn-bg",
-                action: "resume",
-                targetGardenId: gardenId,
-                sessionId: gardenId, // D3: gid is the pi resume authority, not nativeSessionId.
-                cwd,
-                prompt: input.message,
-                wantsReply: ctx.wantsReply,
-                launchArgs: outcome.launchArgs,
-                expectedSocketPath: socketPath,
-                observeTimeoutMs: ctx.observeTimeoutMs,
-                releaseWhen: "socket-alive-or-child-exited",
-            };
-            retainLock = true;
-            return { kind: "execute", receipt, plan, lock };
-        }
-        // receipt.action === "send" → control-socket send (lock kept for 5c re-resolve).
+        // `send` is the only action this table can return since the visible-first cut, so
+        // there is exactly one execute shape here → control-socket send (lock kept for the
+        // 5c re-resolve). The resume branch that used to sit above this — preflight the
+        // target cwd, then plan a detached spawn-bg child — is gone with the transport.
         const plan = {
             transport: "control-socket",
             action: "send",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-lock.js

@@ -1,12 +1,21 @@
 /**
  * entwurf-v2-lock — the per-gid dispatch lock primitive (0.11 Stage 0 step 5a,
- * 버킷 B F2). LOAD-BEARING: the guard against a double-spawn of the same dormant
- * target by two V2 dispatchers that share the substrate through different entry
- * points. SCOPE (honest): this protects v2/v2 only. It was written while the legacy
- * `entwurf_resume` still ran unchanged (동결결정 10 scope A) without taking this
- * lock, which left a v2/legacy concurrent-resume gap. That verb was REMOVED in the
- * 0.12 cutover, so the gap is closed by subtraction — not by this lock growing to
- * cover it. Any NEW resume entry point must take this lock or the gap reopens.
+ * 버킷 B F2). LOAD-BEARING, and its SHIPPED ROLE HAS NARROWED: today it serializes
+ * concurrent in-domain dispatch at one garden id, so two V2 dispatchers entering
+ * the substrate through different entry points cannot interleave against the same
+ * control socket.
+ *
+ * It was BORN as a double-spawn guard: the dormant cell's `spawn-bg` resume ran
+ * under this same lock, and "two dispatchers resume one citizen twice" was the
+ * failure it was designed against. That transport was withdrawn under the
+ * visible-first rule, so no shipped path can double-launch anything — the
+ * mechanism below is unchanged, the threat model it currently answers is smaller.
+ * Read every "double-spawn" note in this file as the ORIGINAL motivation, kept
+ * because it explains why the reclaim rules are as strict as they are.
+ *
+ * SCOPE (honest): this protects v2/v2 only. Any NEW resume entry point — the
+ * visible same-id resume, when it lands — MUST take this lock, or the original
+ * concurrent-resume gap reopens the day a relaunch path exists again.
  *
  * ENVIRONMENT ASSUMPTION (stale reclaim): `hostname` equality is used as the
  * proxy for "same machine", so a holder pid is reclaim-probed with kill(0) only

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -8,10 +8,10 @@
  *
  * Three invariants this factory exists to guarantee (each gate-proven):
  *   - ONE lock domain (Q2/QB3). A single `release` closure bound to `lockDir` is the lock
- *     authority for EVERY hand: the decider's `releaseLock`, the control-send hand's
- *     `releaseLock`, AND the spawn watcher's `releaseFn`. The spawn factory's default
- *     `releaseFn` ignores `lockDir` (it would release into the DEFAULT lock dir) — passing
- *     `release` explicitly is what closes that split-brain.
+ *     authority for EVERY hand: the decider's `releaseLock` and the control-send hand's
+ *     `releaseLock`. (A third hand used to share it — the spawn watcher's `releaseFn`,
+ *     whose own default would have released into the DEFAULT lock dir; that split-brain
+ *     went with the transport, the single-authority rule did not.)
  *   - ONE mailbox sender (Q3). A single `makeProductionSendViaMailbox` instance is the
  *     top-level meta-mailbox hand AND the control-send dead-fallback's mailbox enqueue, so a
  *     direct send and a fallback send never drift in sender envelope / dirs.
@@ -28,7 +28,7 @@
  * canonical socket path; `indeterminate` (EACCES/unknown) fails loud rather than silently
  * claiming "no conflict". The decider's later `inspectSocket` probe is a SEPARATE step.
  */
-import { formatSenderInfoBlock, sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
+import { sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
 import { mailboxConversationalDeliverable, receiverMarkerMatchesIdentity, } from "./entwurf-deliverability.js";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
@@ -38,35 +38,10 @@ import { makeProductionSendViaMailbox } from "./entwurf-v2-mailbox.js";
 import { makeNativePushSend } from "./entwurf-v2-native-push.js";
 import { executeControlSocketSend, } from "./entwurf-v2-send.js";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.js";
-import { executeSpawnBgResume } from "./entwurf-v2-spawn.js";
-import { makeProductionSpawnBgResumeDeps } from "./entwurf-v2-spawn-production.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter as realResolveNativePushAdapter, } from "./native-push/adapter.js";
 import { CONTROL_SOCKET_DIR, controlSocketPath, inspectControlSocketPath, inspectTargetControlSocket, isRecordLessSocketCandidate, } from "./socket-discovery.js";
 import { classifyConnectError, probeSocketLiveness } from "./socket-probe.js";
-/**
- * 0.12.1 B-2: the production `preflight` seam default. preflight value-imports
- * `@earendil-works/pi-coding-agent` (ProjectTrustStore), so importing it eagerly
- * would pull pi into the harness-neutral MCP bridge's boot closure. This wrapper
- * defers that to a lazy `await import()` reached ONLY on the owned-outcome resume
- * branch (the decider awaits it). peers/self/list/mailbox-deliver therefore boot
- * with no pi package present.
- *
- * WHAT THIS DEFERRAL DOES NOT DO — corrected 0.12.8. The old sentence framed the
- * pi-less case as an edge ("a pi-less environment that DOES hit a spawn-bg resume
- * surfaces an honest module-not-found"). In a published consumer tree that is not an
- * edge, it is the DEFAULT: `@earendil-works/pi-coding-agent` is an optional peer that
- * a neutral `npm install` does not resolve (entwurf-preflight.ts:51), so this import
- * throws for every installed user and the owned-outcome lane has never lived in any
- * published version. The deferral still buys what it claims — a pi-free boot — and
- * "module-not-found" is still honest, but it is a permanent floor on the install path,
- * not a rare condition. Reviving that lane (declared dep / pi CLI subprocess / PATH
- * resolution) is a separate decision; nothing here should read as if it works today.
- */
-async function lazyProductionPreflight(input) {
-    const { preflight } = await import("./entwurf-preflight.js");
-    return preflight(input);
-}
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
  * `isOutOfSocketDomainGardenIdConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
@@ -107,12 +82,10 @@ export function makeProductionEntwurfV2Deps(opts) {
         releaseLock: s.releaseLock ?? realReleaseLock,
         inspectSocket: s.inspectSocket ?? inspectTargetControlSocket,
         probeSocket: s.probeSocket ?? probeSocketLiveness,
-        preflight: s.preflight ?? lazyProductionPreflight,
         classifyConnect: s.classifyConnect ?? classifyConnectError,
         sendRpc: s.sendRpc ?? realSendRpc,
         enqueue: s.enqueue ?? enqueueMetaMessage,
         resolveNativePushAdapter: s.resolveNativePushAdapter ?? realResolveNativePushAdapter,
-        spawnOverrides: s.spawnOverrides ?? {},
     };
     // ── ONE lock domain (Q2/QB3): a single lockDir-bound release for ALL hands ─
     const acquire = (gid) => io.acquireLock(gid, { dir: lockDir });
@@ -185,7 +158,6 @@ export function makeProductionEntwurfV2Deps(opts) {
         releaseLock: release,
         inspectSocket,
         probeSocket,
-        preflightForCwd: (cwd) => io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
         mailboxDeliverabilityFor,
         // 봉인 4: resolve the native-push adapter for this backend + probe the conversation.
         // Only reached on a nativePushSupported backend (the decider gates it), so the resolver
@@ -193,7 +165,6 @@ export function makeProductionEntwurfV2Deps(opts) {
         nativePushProbe: (identity) => Promise.resolve(io.resolveNativePushAdapter(identity.backend).probe(identity.nativeSessionId)),
         mailboxDir,
         sessionsDir,
-        observeTimeoutMs: opts.observeTimeoutMs,
     };
     // ── control-send hand deps (5c-2): the dead-fallback shares resolveTarget /
     // inspect / probe / dirs with the decider; the mailbox enqueue is the SAME
@@ -224,25 +195,6 @@ export function makeProductionEntwurfV2Deps(opts) {
     // ── executor: the three transport hands, each pre-bound ───────────────────
     const executor = {
         sendControl: (plan, lock) => executeControlSocketSend(plan, lock, controlSendDeps),
-        resumeSpawnBg: (plan, lock) => {
-            const spawnPlan = plan;
-            // Caller-edge preservation (#50 C3): the dormant rail delivers the SAME
-            // structured <sender_info> the live socket rail synthesizes at its
-            // receiver — one formatter (entwurf-control-rpc SSOT), appended after the
-            // task text exactly as a live delivery would render it. Without this, a
-            // resumed citizen woke with an anonymous prompt while every other rail
-            // carried the sender envelope.
-            const sender = opts.senderProvider();
-            const prompt = sender ? spawnPlan.prompt + formatSenderInfoBlock(sender, spawnPlan.wantsReply) : spawnPlan.prompt;
-            return executeSpawnBgResume({ ...spawnPlan, prompt }, lock, 
-            // QB3: inject the shared lockDir-bound `release` — never the spawn factory's
-            // default releaseFn (which would release into the DEFAULT lock dir).
-            makeProductionSpawnBgResumeDeps({
-                ...io.spawnOverrides,
-                killGraceMs: opts.killGraceMs ?? io.spawnOverrides.killGraceMs,
-                releaseFn: release,
-            }));
-        },
         sendMailbox: (plan, _lock) => sendViaMailbox(plan, _lock),
         // native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
         // so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-release.js

@@ -6,24 +6,25 @@
  * AT MOST ONCE.
  *
  * Why a pure reducer before any transport IO (5b discipline = gate-first →
- * pure-before-IO → wire): the load-bearing risk of 5c is NOT the spawn/send IO, it
- * is the RELEASE TIMING (Fable 3, "release-after-observation"). A spawn-bg dispatch
- * that releases its lock too early — on spawn-started/ack instead of on an observed
- * liveness transition — reopens the exact double-spawn window 5a's per-gid lock
- * exists to close. So the timing logic is isolated here as a pure state machine the
- * gate drives over every event order, and 5c-2/5c-3/5c-4 only WIRE the real
- * send/spawn/mailbox IO onto it. The hand feeds events; this module decides release.
+ * pure-before-IO → wire): the load-bearing risk of 5c is NOT the send IO, it is the
+ * RELEASE TIMING. A dispatch that releases its lock too early — on an ack instead of
+ * on a final outcome — reopens the window 5a's per-gid lock exists to close. So the
+ * timing logic is isolated here as a pure state machine the gate drives over every
+ * event order, and 5c-2/5c-4 only WIRE the real send/mailbox IO onto it. The hand
+ * feeds events; this module decides release.
  *
- * The three policies (one per ExecutionPlan transport):
- *   - no-lock                       — meta-mailbox (？7: no lock was ever held).
- *     Nothing to release on any event.
+ * The two policies (one per ExecutionPlan transport):
+ *   - no-lock                       — meta-mailbox and native-push (？7 / 봉인 4: no
+ *     lock was ever held). Nothing to release on any event.
  *   - release-after-send-final      — control-socket send. The lock is held only for
  *     the at-most-once re-resolve; release once the send reaches a FINAL outcome.
- *   - release-after-spawn-observation — spawn-bg resume. The lock is held until the
- *     FIRST observable transition: socket-alive OR child-exited (any code). A
- *     spawn-started event is explicitly NOT a release trigger (that is the whole
- *     point). A spawn that never started (spawn-start-failed) has no child to watch,
- *     so it releases to free the gid — keeping the lock would pin it forever.
+ *
+ * There was a third, `release-after-spawn-observation`, for the spawn-bg resume: hold
+ * the lock until an OBSERVED liveness transition (socket-alive / child-exited), never
+ * on spawn-started. It went with that transport in the visible-first cut, and with it
+ * the spawn event vocabulary. The rule it encoded — a launch is finalized by an
+ * observation, not by having started — is the one a visible resume will have to
+ * restate for itself; it is not inherited by anything shipped here.
  *
  * The release authority is ALWAYS the LockClaim the decider handed over (5c wires it
  * through). This module never re-derives a lock by gid, never re-resolves a path —
@@ -33,7 +34,7 @@ export function initialReleaseState() {
     return { released: false };
 }
 /**
- * An in-domain execute (control-socket / spawn-bg) must hold a lock whose gardenId
+ * An in-domain execute (control-socket) must hold a lock whose gardenId
  * IS the plan's target. Both halves are 5b decider-contract invariants, not runtime
  * conditions: a null lock or a lock paired with the WRONG plan are the same grade of
  * mis-wiring (a later release would free nothing, or free a DIFFERENT gid's lock), so
@@ -51,7 +52,7 @@ function assertInDomainLock(plan, lock) {
 /**
  * Derive the release policy from the plan, cross-checking the lock invariants the 5b
  * decider guarantees: meta-mailbox ⇒ lock null (？7); in-domain (control-socket /
- * spawn-bg) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
+ * control-socket) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
  * a decider contract violation, not a runtime condition — it throws so a mis-wired
  * hand fails loud instead of silently dropping or mis-releasing a lock.
  */
@@ -74,17 +75,15 @@ export function decideReleasePolicy(plan, lock) {
         case "control-socket":
             assertInDomainLock(plan, lock);
             return { kind: "release-after-send-final" };
-        case "spawn-bg":
-            assertInDomainLock(plan, lock);
-            return { kind: "release-after-spawn-observation" };
     }
 }
 /**
  * Fold one execution event into the release decision. `shouldRelease` is true
  * EXACTLY ONCE — on the first event that satisfies the policy's release condition;
  * every later event (after `state.released`) returns false. The single-release
- * guarantee is what lets the spawn watcher race socket-alive against child-exit
- * without a double release: whichever fires first releases, the other is a no-op.
+ * guarantee is what let the retired spawn watcher race two observations without a
+ * double release, and it is why the control-socket hand can feed a final outcome more
+ * than once without paying for it twice.
  */
 export function reduceRelease(policy, state, event) {
     if (state.released) {
@@ -99,19 +98,5 @@ export function reduceRelease(policy, state, event) {
         case "release-after-send-final":
             // Release once the send reaches a final outcome; hold before that.
             return event.kind === "send-final" ? release() : hold();
-        case "release-after-spawn-observation":
-            // Fable 3: spawn-started is NOT a release event. Release on the first
-            // observed transition (socket-alive / child-exited, any code), or on a
-            // failed start (no child to watch).
-            switch (event.kind) {
-                case "socket-alive":
-                case "child-exited":
-                case "spawn-start-failed":
-                    return release();
-                case "spawn-started":
-                case "send-final":
-                case "mailbox-enqueued":
-                    return hold();
-            }
     }
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -6,9 +6,9 @@
  * to the right 5c transport hand, returning ONE outcome-rich `EntwurfV2RunResult`. It performs
  * ZERO IO of its own and makes ZERO routing decisions — `decideDispatch` chose the plan,
  * this only DISPATCHES it. Each hand is an injected dep (the gate fakes them; 5d-2 wires
- * the production `executeControlSocketSend` / `executeSpawnBgResume` / production
- * `sendViaMailbox`), so the routing + result mapping is gate-provable without a socket,
- * spawn, or timer — the same pure-before-IO, IO-via-dep discipline 5b/5c kept.
+ * the production `executeControlSocketSend` / `sendViaMailbox` / native-push sender), so
+ * the routing + result mapping is gate-provable without a socket — the same
+ * pure-before-IO, IO-via-dep discipline 5b/5c kept.
  *
  * Why a result type richer than the receipt: the carry-over contracts from 5c demand it.
  *   - N3 (5c-2b): a dead-path re-resolve `rejected` carries the resolver's `rejectReason`
@@ -19,8 +19,6 @@
  *     re-send would double-deliver. The runner surfaces this as `execution-failed` with
  *     `finalizedOutcome` + `releaseFailed` so the surface renders "delivered, lock dirty,
  *     do NOT retry", never "send failed".
- *   - spawn-bg `lock-retained` is a RETURNED result (fail-closed, not a throw): it rides
- *     the `executed` branch so 5d's surface can render the retained-lock diagnostic.
  *
  * `retrySafe` is conservatively `false` on EVERY `execution-failed`: a thrown send is
  * never confidently retry-safe (an `indeterminate` connect may have delivered to an
@@ -71,16 +69,6 @@ export async function executeDispatch(decision, deps) {
                 return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
             }
         }
-        case "spawn-bg": {
-            try {
-                // `lock-retained` is a RETURNED result (fail-closed), not a throw — it rides `executed`.
-                const result = await deps.resumeSpawnBg(plan, lock);
-                return { kind: "executed", receipt, transport, outcome: { transport: "spawn-bg", result } };
-            }
-            catch (err) {
-                return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
-            }
-        }
         case "meta-mailbox": {
             try {
                 // lock is null here (？7) — passed verbatim; the production adapter ignores it.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send-fallback.js

@@ -18,17 +18,18 @@
  * must read the same row. That pin is also what makes "no resume promotion" structural,
  * not just a 5c-2a guard: the `fire-and-forget` row has NO resume cell —
  *   live          → send / control-socket   (the retry)
- *   dormant(dead) → reject (dormant-fire-forget-unsupported)  ← NOT resume/spawn-bg
+ *   dormant(dead) → reject (dormant-fire-forget-unsupported)  ← nothing is launched
  *   indeterminate → reject (indeterminate-no-spawn)
- * Only `owned-outcome + dormant` is resume/spawn-bg, and an owned-outcome dispatch never
- * yields a control-socket send plan in the first place. So a dead re-resolve can only
- * retry (alive), reject (dead/indeterminate pi), or — on an UNSUPPORTED backend, via the
- * separate mailbox mini-table — enqueue to a deliverable citizen. It can never spawn.
+ * Since the visible-first cut there is no resume cell ANYWHERE — the intent that owned one
+ * is gone from the contract — so a dead re-resolve can only retry (alive), reject
+ * (dead/indeterminate pi), or — on an UNSUPPORTED backend, via the separate mailbox
+ * mini-table — enqueue to a deliverable citizen. It can never start a process.
  *
- * The N2 asymmetry (frozen in entwurf-v2-contract): in-domain `dormant` is a CONFIRMED
- * not-running pi → reject (enqueuing would be a silent pileup; resume is the honest
- * place, and resume is out of a SEND fallback's scope). `unsupported` is UNKNOWN liveness
- * with no socket axis → the mailbox is its honest channel when deliverable.
+ * The N2 asymmetry (frozen in entwurf-v2-contract) is a RECEIVER question, not a backend
+ * privilege: a mailbox is offered only where an active receiver actually drains it. An
+ * `unsupported` citizen gets one exactly while `mailboxDeliverable` holds, and is rejected as
+ * `mailbox-undeliverable` the moment it does not. An in-domain `dormant` pi is a CONFIRMED
+ * not-running session, so nothing would ever drain that enqueue — a silent pileup → reject.
  */
 import { isLivenessSupported, resolveDispatch } from "./entwurf-v2-contract.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir } from "./meta-session.js";
@@ -104,8 +105,8 @@ export async function resolveDeadControlSendFallback(plan, lock, deps) {
         return { kind: "reject", reason: receipt.reason };
     }
     // fire-and-forget + live is the ONLY in-domain allow cell → control-socket send. A
-    // resume/spawn-bg or meta-mailbox transport here would be a frozen-table drift, so
-    // fail loud rather than mis-route a SEND fallback into a child spawn.
+    // meta-mailbox transport here would be a frozen-table drift, so fail loud rather than
+    // mis-route a SEND fallback onto another rail.
     if (receipt.transport !== "control-socket") {
         throw new Error(`entwurf-v2-send-fallback: in-domain fire-and-forget re-resolve yielded unexpected transport (${receipt.transport}) — table drift.`);
     }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -45,7 +45,7 @@ export async function executeControlSocketSend(plan, lock, deps) {
     const policy = decideReleasePolicy(plan, lock);
     const held = lock;
     // Lock-leak backstop: once the lock is held, ANY throw out of the drive — a
-    // contract-violation guard (spawn-bg re-resolve), the mis-route assert, even a buggy
+    // contract-violation guard, the mis-route assert, even a buggy
     // dep that throws where it should return — must still release the lock before it
     // propagates. A leaked lock pins the gid forever (5a's worst failure). So convert any
     // such throw into a `failed` final outcome, run finalizeRelease (which releases on
@@ -127,14 +127,9 @@ async function driveDeadFallback(plan, lock, deps) {
             catch (err) {
                 return { outcome: "failed", error: err };
             }
-        case "spawn-bg":
-            // A SEND fallback must never re-resolve into a spawn — that is a decider
-            // contract violation (a send and a spawn are different actions), so fail loud
-            // rather than silently mis-execute.
-            throw new Error("entwurf-v2-send: re-resolve returned a spawn-bg plan for a send fallback (contract violation).");
         case "native-push":
             // The dead-control-socket fallback re-resolves only the pi socket domain
-            // (control-socket / mailbox / spawn); it never routes the native-push rail. A
+            // (control-socket / mailbox); it never routes the native-push rail. A
             // native-push rePlan here is structurally impossible — fail loud.
             throw new Error("entwurf-v2-send: re-resolve returned a native-push plan for a send fallback (contract violation).");
     }