@junghanacs/entwurf 0.13.1 → 0.14.0

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -3,23 +3,22 @@
  * (0.11 Stage 0 step 5b). It turns a caller's (target, intent, …) request plus
  * already-resolvable facts into a single `DispatchDecision`: either a reject
  * receipt, or an execute receipt + an `ExecutionPlan` + (for in-domain backends) a
- * held `LockClaim`. It performs NO transport: no send, no enqueue, no spawn, no
- * release-watcher. Step 5c executes the chosen plan; step 5d registers the MCP
- * surface. The decider only DECIDES.
+ * held `LockClaim`. It performs NO transport: no send, no enqueue, no release-watcher.
+ * Step 5c executes the chosen plan; step 5d registers the MCP surface. The decider
+ * only DECIDES.
+ *
+ * Since the visible-first cut (contract header) this module also starts NO process:
+ * the resume verdict, its trust preflight, and the detached spawn-bg plan are gone.
+ * Every plan it can emit now targets a citizen that is already running.
  *
  * Why a separate pure module (step 4 discipline = gate-first → pure-before-IO →
  * wire): every IO surface the decision needs — the target lookup, the per-gid lock,
- * the lstat/connect socket inspection, the trust preflight, the mailbox-deliverability
- * seam — is INJECTED via `DispatchDeciderDeps`, so the gate drives every branch with
- * fakes and the live wrappers wire the real fns. The plan is shaped so 5c's
- * transport hand consumes it WITHOUT re-deriving any path/arg (socketPath,
- * mailboxDir, sessionsDir, launchArgs are all planted here once — 4c "재유도 금지"):
- * the hand is a plan-keyed dispatcher, never a second brain. The two deliberate
- * exceptions (GPT힣 1차 검수): the spawned child's runtime pid is NOT in the plan
- * (it is born during 5c execution → it is the watcher's release-context, not a plan
- * input), and the launch identity (provider/model) is read by the 5c launcher from
- * the saved session JSONL (its existing authority) — putting that read in the
- * decider would make it impure. So the plan carries no provider/model.
+ * the lstat/connect socket inspection, the mailbox-deliverability seam — is INJECTED
+ * via `DispatchDeciderDeps`, so the gate drives every branch with fakes and the live
+ * wrappers wire the real fns. The plan is shaped so 5c's transport hand consumes it
+ * WITHOUT re-deriving any path/arg (socketPath, mailboxDir, sessionsDir are all
+ * planted here once — 4c "재유도 금지"): the hand is a plan-keyed dispatcher, never a
+ * second brain.
  *
  * The frozen 7-step order (NEXT.md "통합 decider 순서"):
  *   1. requireGardenId   — runtime guard BEFORE any path is built (F2-P1; closes the
@@ -32,8 +31,7 @@
  *   4. acquireLock       — IN-DOMAIN ONLY (？7), BEFORE lstat/connect, so the probe
  *      happens under the lock (the TOCTOU 5a's lock closes).
  *   5. in-domain         — inspectTargetControlSocket (lstat-then-connect, ？2) →
- *      resolveDispatch → on a resume verdict, preflight the target cwd (1B: deny →
- *      nonce-owned release → untrusted-fail-fast) → plan.
+ *      resolveDispatch → control-socket send plan, or a reject that releases the lock.
  *   6. unsupported       — NO lock; deps.mailboxDeliverabilityFor (REQUIRED seam: wake-mode
  *      capability AND a live active-receiver, fail-closed) → resolveDispatch → meta-mailbox
  *      plan or reject. SE-2 2d-3: a terminated/drifted self-fetch citizen is refused, never
@@ -48,7 +46,6 @@
 
 import type { MailboxDeliverabilityResult } from "./entwurf-deliverability.ts";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
-import type { PreflightOutcome } from "./entwurf-preflight.ts";
 import {
 	type EntwurfIntent,
 	type EntwurfV2Receipt,
@@ -77,17 +74,6 @@ import type { SocketLiveness } from "./socket-probe.ts";
 // single import site for it (it is the SAME fn the fact-provider listing uses).
 export { isOutOfSocketDomainGardenIdConflict };
 
-// ── observe timeout (？3) ───────────────────────────────────────────────────
-// The bounded wait 5c's release-watcher gives a spawned child to surface its
-// control socket / exit. Planted into the resume plan so the hand does not invent
-// a timeout. A standalone constant + env override (NOT a multiple of the probe
-// timeout — a different concern); 30s initial, tunable to 45s after live data.
-export const ENTWURF_V2_OBSERVE_TIMEOUT_MS = ((): number => {
-	const raw = process.env.ENTWURF_V2_OBSERVE_TIMEOUT_MS;
-	const n = raw !== undefined && raw !== "" ? Number(raw) : Number.NaN;
-	return Number.isFinite(n) && n > 0 ? n : 30_000;
-})();
-
 export const ENTWURF_V2_MODE_DEFAULT = "follow_up" as const;
 
 // ── receipt branch aliases ──────────────────────────────────────────────────
@@ -97,9 +83,9 @@ export type EntwurfV2Mode = "steer" | "follow_up";
 
 // ── ExecutionPlan (5c-consumable, no re-derivation) ─────────────────────────
 // Each plan kind carries every value 5c's transport fn needs, planted once by the
-// decider. control-socket send and meta-mailbox send carry the message; spawn-bg
-// resume carries the launch inputs MINUS provider/model (D4: 5c-owned identity
-// read) and MINUS the child pid (born at execution, watcher's release-context).
+// decider. Every remaining kind is a SEND to an already-running citizen: the
+// spawn-bg resume plan (launch inputs, expected socket path, observe timeout) went
+// with the transport in the visible-first cut.
 export type ExecutionPlan =
 	| {
 			transport: "control-socket";
@@ -119,22 +105,6 @@ export type ExecutionPlan =
 			wantsReply: boolean;
 			message: string;
 	  }
-	| {
-			transport: "spawn-bg";
-			action: "resume";
-			targetGardenId: string;
-			sessionId: string;
-			cwd: string;
-			prompt: string;
-			// wantsReply rides the plan so the dormant rail's <sender_info> carries the
-			// same wants_reply etiquette marker a live socket delivery renders (#50 F2).
-			// mode stays live-injection-only (meaningless for a resume prompt).
-			wantsReply: boolean;
-			launchArgs: readonly string[];
-			expectedSocketPath: string;
-			observeTimeoutMs: number;
-			releaseWhen: "socket-alive-or-child-exited";
-	  }
 	// native-push send (봉인 4): direct-inject into a live app-server conversation. LOCK-FREE
 	// (the DispatchDecision carries lock:null). Carries the decider-probed VOLATILE route so
 	// the executor sends without re-deriving it (봉인 3 "used within the same dispatch"); the
@@ -154,9 +124,9 @@ export type ExecutionPlan =
 // ── DispatchDecision (the decider's only output) ────────────────────────────
 // reject ⇒ NO plan AND NO retained lock (any acquired lock was released before
 // return). execute ⇒ a plan + a receipt whose transport matches plan.transport;
-// `lock` is non-null for an in-domain execute (control-socket send OR spawn-bg
-// resume — both keep the claim so 5c's at-most-once re-resolve runs under the same
-// nonce) and null for the lock-free meta-mailbox path (？7).
+// `lock` is non-null for an in-domain execute (the control-socket send keeps the
+// claim so 5c's at-most-once re-resolve runs under the same nonce) and null for the
+// lock-free meta-mailbox path (？7).
 //
 // A reject's optional machine-readable diagnostic. Only `target-locked` carries one:
 // the `LockConflict` (holder pid/host/createdAt, lockPath, human detail) the lock
@@ -218,10 +188,6 @@ export interface DispatchDeciderDeps {
 	inspectSocket: (gardenId: string) => Promise<TargetSocketInspection>;
 	probeSocket: (socketPath: string) => Promise<SocketLiveness>;
 	// MaybePromise (0.12.1 B-2): production lazy-imports the pi-coding-agent-backed
-	// preflight via `await import()` so the harness-neutral bridge boots pi-free;
-	// only the owned-outcome resume branch (below) awaits it. Sync test fakes that
-	// return a plain PreflightOutcome still satisfy this.
-	preflightForCwd: (cwd: string) => PreflightOutcome | Promise<PreflightOutcome>;
 	/**
 	 * SE-2 slice 2d-3: the REQUIRED mailbox-deliverability seam (no default). The decider
 	 * does NOT judge deliverability itself — it asks this injected fn, which combines the
@@ -246,7 +212,6 @@ export interface DispatchDeciderDeps {
 	nativePushProbe: (identity: MetaIdentity) => NativePushProbeResult | Promise<NativePushProbeResult>;
 	mailboxDir?: string;
 	sessionsDir?: string;
-	observeTimeoutMs?: number;
 }
 
 /**
@@ -290,10 +255,9 @@ export function resolveMailboxWakeModeCapability(
 export async function decideDispatch(input: DispatchInput, deps: DispatchDeciderDeps): Promise<DispatchDecision> {
 	const mailboxDir = deps.mailboxDir ?? defaultMetaMailboxDir();
 	const sessionsDir = deps.sessionsDir ?? defaultMetaSessionsDir();
-	const observeTimeoutMs = deps.observeTimeoutMs ?? ENTWURF_V2_OBSERVE_TIMEOUT_MS;
 	const mode: EntwurfV2Mode = input.mode ?? ENTWURF_V2_MODE_DEFAULT;
 	const wantsReply = input.wantsReply ?? false;
-	const ctx: InDomainCtx = { mode, wantsReply, observeTimeoutMs };
+	const ctx: InDomainCtx = { mode, wantsReply };
 
 	const reject = (receipt: RejectReceipt, diagnostic?: RejectDiagnostic): DispatchDecision =>
 		diagnostic ? { kind: "reject", receipt, diagnostic } : { kind: "reject", receipt };
@@ -378,7 +342,7 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 	}
 
 	// 4-5. control-socket domain (currently backend pi): lock → inspect → route.
-	return decideInDomain(gardenId, input, deps, ctx, identity.cwd);
+	return decideInDomain(gardenId, input, deps, ctx);
 }
 
 // ── control-socket-domain probe (steps 4-5; currently backend pi). Every target
@@ -386,17 +350,14 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 // The lock lifecycle (B2) lives here: acquire BEFORE lstat/connect, every reject path
 // releases explicitly (rejectAfterRelease), every execute path that keeps the lock sets
 // retainLock=true, and a thrown IO error releases the still-held lock before rethrowing so
-// the long-lived MCP bridge never pins a gid. `cwd` comes from the meta-record — the only
-// resume authority — so the resume verdict's preflight+spawn always launch into a
-// record-owned working directory.
-type InDomainCtx = { mode: EntwurfV2Mode; wantsReply: boolean; observeTimeoutMs: number };
+// the long-lived MCP bridge never pins a gid.
+type InDomainCtx = { mode: EntwurfV2Mode; wantsReply: boolean };
 
 async function decideInDomain(
 	gardenId: string,
 	input: DispatchInput,
 	deps: DispatchDeciderDeps,
 	ctx: InDomainCtx,
-	cwd: string,
 ): Promise<DispatchDecision> {
 	const { acquireLock, releaseLock, inspectSocket, probeSocket } = deps;
 
@@ -431,37 +392,15 @@ async function decideInDomain(
 
 		const receipt = resolveDispatch(input.intent, liveness, false);
 		if (!receipt.ok) {
-			// resolver reject (owned-live-no-autosend / indeterminate-no-spawn / …) — the
-			// lock was for an in-domain probe that yielded no execute, so release it.
+			// resolver reject (dormant-fire-forget-unsupported / indeterminate-no-spawn) —
+			// the lock was for an in-domain probe that yielded no execute, so release it.
 			return rejectAfterRelease(receipt);
 		}
 
-		if (receipt.action === "resume") {
-			// 1B: preflight runs ONLY here (the sole branch that launches a child into a
-			// target cwd). deny → nonce-owned release → untrusted-fail-fast, with the
-			// honest measured liveness (dormant = the `dead` we just probed).
-			const outcome = await deps.preflightForCwd(cwd);
-			if (outcome.kind === "deny") {
-				return rejectAfterRelease(makeRejectReceipt("untrusted-fail-fast", liveness));
-			}
-			const plan: ExecutionPlan = {
-				transport: "spawn-bg",
-				action: "resume",
-				targetGardenId: gardenId,
-				sessionId: gardenId, // D3: gid is the pi resume authority, not nativeSessionId.
-				cwd,
-				prompt: input.message,
-				wantsReply: ctx.wantsReply,
-				launchArgs: outcome.launchArgs,
-				expectedSocketPath: socketPath,
-				observeTimeoutMs: ctx.observeTimeoutMs,
-				releaseWhen: "socket-alive-or-child-exited",
-			};
-			retainLock = true;
-			return { kind: "execute", receipt, plan, lock };
-		}
-
-		// receipt.action === "send" → control-socket send (lock kept for 5c re-resolve).
+		// `send` is the only action this table can return since the visible-first cut, so
+		// there is exactly one execute shape here → control-socket send (lock kept for the
+		// 5c re-resolve). The resume branch that used to sit above this — preflight the
+		// target cwd, then plan a detached spawn-bg child — is gone with the transport.
 		const plan: ExecutionPlan = {
 			transport: "control-socket",
 			action: "send",

package/pi-extensions/lib/entwurf-v2-lock.ts

@@ -1,12 +1,21 @@
 /**
  * entwurf-v2-lock — the per-gid dispatch lock primitive (0.11 Stage 0 step 5a,
- * 버킷 B F2). LOAD-BEARING: the guard against a double-spawn of the same dormant
- * target by two V2 dispatchers that share the substrate through different entry
- * points. SCOPE (honest): this protects v2/v2 only. It was written while the legacy
- * `entwurf_resume` still ran unchanged (동결결정 10 scope A) without taking this
- * lock, which left a v2/legacy concurrent-resume gap. That verb was REMOVED in the
- * 0.12 cutover, so the gap is closed by subtraction — not by this lock growing to
- * cover it. Any NEW resume entry point must take this lock or the gap reopens.
+ * 버킷 B F2). LOAD-BEARING, and its SHIPPED ROLE HAS NARROWED: today it serializes
+ * concurrent in-domain dispatch at one garden id, so two V2 dispatchers entering
+ * the substrate through different entry points cannot interleave against the same
+ * control socket.
+ *
+ * It was BORN as a double-spawn guard: the dormant cell's `spawn-bg` resume ran
+ * under this same lock, and "two dispatchers resume one citizen twice" was the
+ * failure it was designed against. That transport was withdrawn under the
+ * visible-first rule, so no shipped path can double-launch anything — the
+ * mechanism below is unchanged, the threat model it currently answers is smaller.
+ * Read every "double-spawn" note in this file as the ORIGINAL motivation, kept
+ * because it explains why the reclaim rules are as strict as they are.
+ *
+ * SCOPE (honest): this protects v2/v2 only. Any NEW resume entry point — the
+ * visible same-id resume, when it lands — MUST take this lock, or the original
+ * concurrent-resume gap reopens the day a relaunch path exists again.
  *
  * ENVIRONMENT ASSUMPTION (stale reclaim): `hostname` equality is used as the
  * proxy for "same machine", so a holder pid is reclaim-probed with kill(0) only

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -8,10 +8,10 @@
  *
  * Three invariants this factory exists to guarantee (each gate-proven):
  *   - ONE lock domain (Q2/QB3). A single `release` closure bound to `lockDir` is the lock
- *     authority for EVERY hand: the decider's `releaseLock`, the control-send hand's
- *     `releaseLock`, AND the spawn watcher's `releaseFn`. The spawn factory's default
- *     `releaseFn` ignores `lockDir` (it would release into the DEFAULT lock dir) — passing
- *     `release` explicitly is what closes that split-brain.
+ *     authority for EVERY hand: the decider's `releaseLock` and the control-send hand's
+ *     `releaseLock`. (A third hand used to share it — the spawn watcher's `releaseFn`,
+ *     whose own default would have released into the DEFAULT lock dir; that split-brain
+ *     went with the transport, the single-authority rule did not.)
  *   - ONE mailbox sender (Q3). A single `makeProductionSendViaMailbox` instance is the
  *     top-level meta-mailbox hand AND the control-send dead-fallback's mailbox enqueue, so a
  *     direct send and a fallback send never drift in sender envelope / dirs.
@@ -30,7 +30,6 @@
  */
 
 import {
-	formatSenderInfoBlock,
 	type RpcClientOptions,
 	type RpcCommand,
 	type RpcResponse,
@@ -43,12 +42,6 @@ import {
 	receiverMarkerMatchesIdentity,
 } from "./entwurf-deliverability.ts";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
-// 0.12.1 B-2: TYPE-ONLY import — `entwurf-preflight.ts` value-imports
-// `@earendil-works/pi-coding-agent` (ProjectTrustStore), so a static value-import
-// here would re-couple the harness-neutral MCP bridge to pi at boot
-// (check-entwurf-bridge-pi-free). The real preflight is reached ONLY via the lazy
-// `await import()` in `lazyProductionPreflight`, on the owned-outcome resume branch.
-import type { PreflightInput, PreflightOutcome } from "./entwurf-preflight.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
 import {
 	type DispatchDeciderDeps,
@@ -74,9 +67,6 @@ import {
 	type RpcSendResult,
 } from "./entwurf-v2-send.ts";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.ts";
-import type { SpawnBgPlan } from "./entwurf-v2-spawn.ts";
-import { executeSpawnBgResume } from "./entwurf-v2-spawn.ts";
-import { makeProductionSpawnBgResumeDeps, type ProductionSpawnOpts } from "./entwurf-v2-spawn-production.ts";
 import {
 	defaultMetaMailboxDir,
 	defaultMetaSessionsDir,
@@ -127,10 +117,6 @@ export interface ProductionEntwurfV2Seams {
 	releaseLock: (claim: LockClaim, deps: { dir?: string }) => unknown;
 	inspectSocket: (gid: string, dir: string) => Promise<TargetSocketInspection>;
 	probeSocket: (socketPath: string) => Promise<SocketLiveness>;
-	// MaybePromise (0.12.1 B-2): the production default is the lazy wrapper, which
-	// `await import()`s the pi-coding-agent-backed preflight only on a resume verdict.
-	// A deterministic gate may still inject a sync spy returning a plain PreflightOutcome.
-	preflight: (input: PreflightInput) => PreflightOutcome | Promise<PreflightOutcome>;
 	classifyConnect: (code: string | undefined) => "dead" | "indeterminate";
 	sendRpc: (socketPath: string, command: RpcCommand, options?: RpcClientOptions) => Promise<{ response: RpcResponse }>;
 	enqueue: (opts: EnqueueMetaMessageOptions) => EnqueueMetaMessageResult;
@@ -139,9 +125,6 @@ export interface ProductionEntwurfV2Seams {
 	 * fake adapter drives both the probe (routing decision) and the send (delivery + retry).
 	 * Default: the real registry resolver. */
 	resolveNativePushAdapter: (backend: string) => NativePushAdapter;
-	/** Extra spawn-factory overrides (timers/spawnChild/probe) for a deterministic spawn gate.
-	 * `releaseFn` is NOT overridable here — the factory injects the shared `release` (QB3). */
-	spawnOverrides: Omit<ProductionSpawnOpts, "releaseFn">;
 }
 
 export interface ProductionEntwurfV2Opts {
@@ -150,44 +133,14 @@ export interface ProductionEntwurfV2Opts {
 	 * control socket actually exists, not a hardcoded true). ONE provider feeds the
 	 * control-socket RPC sender AND the meta-mailbox body sender (they share the envelope). */
 	senderProvider: () => SenderEnvelope | undefined;
-	/** pi agent dir holding `trust.json` (preflight). Omit → preflight's own default. */
-	agentDir?: string;
-	/** Operator-policy auto-approve roots (preflight prefix promotion). No package default. */
-	prefixRoots?: readonly string[];
 	lockDir?: string;
 	sessionsDir?: string;
 	mailboxDir?: string;
 	controlSocketDir?: string;
-	observeTimeoutMs?: number;
-	killGraceMs?: number;
 	/** Gate/smoke seam overrides — defaults are the real IO. */
 	seams?: Partial<ProductionEntwurfV2Seams>;
 }
 
-/**
- * 0.12.1 B-2: the production `preflight` seam default. preflight value-imports
- * `@earendil-works/pi-coding-agent` (ProjectTrustStore), so importing it eagerly
- * would pull pi into the harness-neutral MCP bridge's boot closure. This wrapper
- * defers that to a lazy `await import()` reached ONLY on the owned-outcome resume
- * branch (the decider awaits it). peers/self/list/mailbox-deliver therefore boot
- * with no pi package present.
- *
- * WHAT THIS DEFERRAL DOES NOT DO — corrected 0.12.8. The old sentence framed the
- * pi-less case as an edge ("a pi-less environment that DOES hit a spawn-bg resume
- * surfaces an honest module-not-found"). In a published consumer tree that is not an
- * edge, it is the DEFAULT: `@earendil-works/pi-coding-agent` is an optional peer that
- * a neutral `npm install` does not resolve (entwurf-preflight.ts:51), so this import
- * throws for every installed user and the owned-outcome lane has never lived in any
- * published version. The deferral still buys what it claims — a pi-free boot — and
- * "module-not-found" is still honest, but it is a permanent floor on the install path,
- * not a rare condition. Reviving that lane (declared dep / pi CLI subprocess / PATH
- * resolution) is a separate decision; nothing here should read as if it works today.
- */
-async function lazyProductionPreflight(input: PreflightInput): Promise<PreflightOutcome> {
-	const { preflight } = await import("./entwurf-preflight.ts");
-	return preflight(input);
-}
-
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
  * `isOutOfSocketDomainGardenIdConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
@@ -235,12 +188,10 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		releaseLock: s.releaseLock ?? realReleaseLock,
 		inspectSocket: s.inspectSocket ?? inspectTargetControlSocket,
 		probeSocket: s.probeSocket ?? probeSocketLiveness,
-		preflight: s.preflight ?? lazyProductionPreflight,
 		classifyConnect: s.classifyConnect ?? classifyConnectError,
 		sendRpc: s.sendRpc ?? realSendRpc,
 		enqueue: s.enqueue ?? enqueueMetaMessage,
 		resolveNativePushAdapter: s.resolveNativePushAdapter ?? realResolveNativePushAdapter,
-		spawnOverrides: s.spawnOverrides ?? {},
 	};
 
 	// ── ONE lock domain (Q2/QB3): a single lockDir-bound release for ALL hands ─
@@ -324,8 +275,6 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		releaseLock: release,
 		inspectSocket,
 		probeSocket,
-		preflightForCwd: (cwd: string): PreflightOutcome | Promise<PreflightOutcome> =>
-			io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
 		mailboxDeliverabilityFor,
 		// 봉인 4: resolve the native-push adapter for this backend + probe the conversation.
 		// Only reached on a nativePushSupported backend (the decider gates it), so the resolver
@@ -334,7 +283,6 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 			Promise.resolve(io.resolveNativePushAdapter(identity.backend).probe(identity.nativeSessionId)),
 		mailboxDir,
 		sessionsDir,
-		observeTimeoutMs: opts.observeTimeoutMs,
 	};
 
 	// ── control-send hand deps (5c-2): the dead-fallback shares resolveTarget /
@@ -368,28 +316,6 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 	// ── executor: the three transport hands, each pre-bound ───────────────────
 	const executor: DispatchExecutorDeps = {
 		sendControl: (plan, lock) => executeControlSocketSend(plan as ControlSocketPlan, lock, controlSendDeps),
-		resumeSpawnBg: (plan, lock) => {
-			const spawnPlan = plan as SpawnBgPlan;
-			// Caller-edge preservation (#50 C3): the dormant rail delivers the SAME
-			// structured <sender_info> the live socket rail synthesizes at its
-			// receiver — one formatter (entwurf-control-rpc SSOT), appended after the
-			// task text exactly as a live delivery would render it. Without this, a
-			// resumed citizen woke with an anonymous prompt while every other rail
-			// carried the sender envelope.
-			const sender = opts.senderProvider();
-			const prompt = sender ? spawnPlan.prompt + formatSenderInfoBlock(sender, spawnPlan.wantsReply) : spawnPlan.prompt;
-			return executeSpawnBgResume(
-				{ ...spawnPlan, prompt },
-				lock,
-				// QB3: inject the shared lockDir-bound `release` — never the spawn factory's
-				// default releaseFn (which would release into the DEFAULT lock dir).
-				makeProductionSpawnBgResumeDeps({
-					...io.spawnOverrides,
-					killGraceMs: opts.killGraceMs ?? io.spawnOverrides.killGraceMs,
-					releaseFn: release,
-				}),
-			);
-		},
 		sendMailbox: (plan, _lock) => sendViaMailbox(plan as MetaMailboxPlan, _lock as LockClaim),
 		// native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
 		// so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).

package/pi-extensions/lib/entwurf-v2-release.ts

@@ -6,24 +6,25 @@
  * AT MOST ONCE.
  *
  * Why a pure reducer before any transport IO (5b discipline = gate-first →
- * pure-before-IO → wire): the load-bearing risk of 5c is NOT the spawn/send IO, it
- * is the RELEASE TIMING (Fable 3, "release-after-observation"). A spawn-bg dispatch
- * that releases its lock too early — on spawn-started/ack instead of on an observed
- * liveness transition — reopens the exact double-spawn window 5a's per-gid lock
- * exists to close. So the timing logic is isolated here as a pure state machine the
- * gate drives over every event order, and 5c-2/5c-3/5c-4 only WIRE the real
- * send/spawn/mailbox IO onto it. The hand feeds events; this module decides release.
+ * pure-before-IO → wire): the load-bearing risk of 5c is NOT the send IO, it is the
+ * RELEASE TIMING. A dispatch that releases its lock too early — on an ack instead of
+ * on a final outcome — reopens the window 5a's per-gid lock exists to close. So the
+ * timing logic is isolated here as a pure state machine the gate drives over every
+ * event order, and 5c-2/5c-4 only WIRE the real send/mailbox IO onto it. The hand
+ * feeds events; this module decides release.
  *
- * The three policies (one per ExecutionPlan transport):
- *   - no-lock                       — meta-mailbox (？7: no lock was ever held).
- *     Nothing to release on any event.
+ * The two policies (one per ExecutionPlan transport):
+ *   - no-lock                       — meta-mailbox and native-push (？7 / 봉인 4: no
+ *     lock was ever held). Nothing to release on any event.
  *   - release-after-send-final      — control-socket send. The lock is held only for
  *     the at-most-once re-resolve; release once the send reaches a FINAL outcome.
- *   - release-after-spawn-observation — spawn-bg resume. The lock is held until the
- *     FIRST observable transition: socket-alive OR child-exited (any code). A
- *     spawn-started event is explicitly NOT a release trigger (that is the whole
- *     point). A spawn that never started (spawn-start-failed) has no child to watch,
- *     so it releases to free the gid — keeping the lock would pin it forever.
+ *
+ * There was a third, `release-after-spawn-observation`, for the spawn-bg resume: hold
+ * the lock until an OBSERVED liveness transition (socket-alive / child-exited), never
+ * on spawn-started. It went with that transport in the visible-first cut, and with it
+ * the spawn event vocabulary. The rule it encoded — a launch is finalized by an
+ * observation, not by having started — is the one a visible resume will have to
+ * restate for itself; it is not inherited by anything shipped here.
  *
  * The release authority is ALWAYS the LockClaim the decider handed over (5c wires it
  * through). This module never re-derives a lock by gid, never re-resolves a path —
@@ -34,24 +35,15 @@ import type { ExecutionPlan } from "./entwurf-v2-decider.ts";
 import type { LockClaim } from "./entwurf-v2-lock.ts";
 
 // ── ReleasePolicy (derived once from the plan + held lock) ───────────────────
-export type ReleasePolicy =
-	| { kind: "no-lock" }
-	| { kind: "release-after-send-final" }
-	| { kind: "release-after-spawn-observation" };
+export type ReleasePolicy = { kind: "no-lock" } | { kind: "release-after-send-final" };
 
 // ── ReleaseEvent (the transport hand feeds these as execution proceeds) ──────
 // `send-final` carries the terminal send outcome (legacy parity: a fallback-sent is
-// a real final outcome, not a hidden retry). `child-exited` carries the code (null =
-// killed by signal) but the policy releases on ANY code. `mailbox-enqueued` is the
-// terminal ack on the lock-free path. `spawn-started`/`spawn-start-failed` bracket
-// the spawn attempt — only the FAILURE finalizes; a successful start must wait for an
-// observed transition.
+// a real final outcome, not a hidden retry). `mailbox-enqueued` is the terminal ack on
+// the lock-free path. The four spawn/observation events (spawn-started,
+// spawn-start-failed, socket-alive, child-exited) went with the spawn-bg transport.
 export type ReleaseEvent =
 	| { kind: "send-final"; outcome: "sent" | "fallback-sent" | "rejected" | "failed" }
-	| { kind: "spawn-started"; pid: number }
-	| { kind: "spawn-start-failed"; error: string }
-	| { kind: "socket-alive" }
-	| { kind: "child-exited"; code: number | null }
 	| { kind: "mailbox-enqueued" };
 
 // ── ReleaseState (single-release accumulator) ───────────────────────────────
@@ -64,7 +56,7 @@ export function initialReleaseState(): ReleaseState {
 }
 
 /**
- * An in-domain execute (control-socket / spawn-bg) must hold a lock whose gardenId
+ * An in-domain execute (control-socket) must hold a lock whose gardenId
  * IS the plan's target. Both halves are 5b decider-contract invariants, not runtime
  * conditions: a null lock or a lock paired with the WRONG plan are the same grade of
  * mis-wiring (a later release would free nothing, or free a DIFFERENT gid's lock), so
@@ -85,7 +77,7 @@ function assertInDomainLock(plan: ExecutionPlan, lock: LockClaim | null): assert
 /**
  * Derive the release policy from the plan, cross-checking the lock invariants the 5b
  * decider guarantees: meta-mailbox ⇒ lock null (？7); in-domain (control-socket /
- * spawn-bg) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
+ * control-socket) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
  * a decider contract violation, not a runtime condition — it throws so a mis-wired
  * hand fails loud instead of silently dropping or mis-releasing a lock.
  */
@@ -108,9 +100,6 @@ export function decideReleasePolicy(plan: ExecutionPlan, lock: LockClaim | null)
 		case "control-socket":
 			assertInDomainLock(plan, lock);
 			return { kind: "release-after-send-final" };
-		case "spawn-bg":
-			assertInDomainLock(plan, lock);
-			return { kind: "release-after-spawn-observation" };
 	}
 }
 
@@ -123,8 +112,9 @@ export interface ReduceReleaseResult {
  * Fold one execution event into the release decision. `shouldRelease` is true
  * EXACTLY ONCE — on the first event that satisfies the policy's release condition;
  * every later event (after `state.released`) returns false. The single-release
- * guarantee is what lets the spawn watcher race socket-alive against child-exit
- * without a double release: whichever fires first releases, the other is a no-op.
+ * guarantee is what let the retired spawn watcher race two observations without a
+ * double release, and it is why the control-socket hand can feed a final outcome more
+ * than once without paying for it twice.
  */
 export function reduceRelease(policy: ReleasePolicy, state: ReleaseState, event: ReleaseEvent): ReduceReleaseResult {
 	if (state.released) {
@@ -140,19 +130,5 @@ export function reduceRelease(policy: ReleasePolicy, state: ReleaseState, event:
 		case "release-after-send-final":
 			// Release once the send reaches a final outcome; hold before that.
 			return event.kind === "send-final" ? release() : hold();
-		case "release-after-spawn-observation":
-			// Fable 3: spawn-started is NOT a release event. Release on the first
-			// observed transition (socket-alive / child-exited, any code), or on a
-			// failed start (no child to watch).
-			switch (event.kind) {
-				case "socket-alive":
-				case "child-exited":
-				case "spawn-start-failed":
-					return release();
-				case "spawn-started":
-				case "send-final":
-				case "mailbox-enqueued":
-					return hold();
-			}
 	}
 }

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -6,9 +6,9 @@
  * to the right 5c transport hand, returning ONE outcome-rich `EntwurfV2RunResult`. It performs
  * ZERO IO of its own and makes ZERO routing decisions — `decideDispatch` chose the plan,
  * this only DISPATCHES it. Each hand is an injected dep (the gate fakes them; 5d-2 wires
- * the production `executeControlSocketSend` / `executeSpawnBgResume` / production
- * `sendViaMailbox`), so the routing + result mapping is gate-provable without a socket,
- * spawn, or timer — the same pure-before-IO, IO-via-dep discipline 5b/5c kept.
+ * the production `executeControlSocketSend` / `sendViaMailbox` / native-push sender), so
+ * the routing + result mapping is gate-provable without a socket — the same
+ * pure-before-IO, IO-via-dep discipline 5b/5c kept.
  *
  * Why a result type richer than the receipt: the carry-over contracts from 5c demand it.
  *   - N3 (5c-2b): a dead-path re-resolve `rejected` carries the resolver's `rejectReason`
@@ -19,8 +19,6 @@
  *     re-send would double-deliver. The runner surfaces this as `execution-failed` with
  *     `finalizedOutcome` + `releaseFailed` so the surface renders "delivered, lock dirty,
  *     do NOT retry", never "send failed".
- *   - spawn-bg `lock-retained` is a RETURNED result (fail-closed, not a throw): it rides
- *     the `executed` branch so 5d's surface can render the retained-lock diagnostic.
  *
  * `retrySafe` is conservatively `false` on EVERY `execution-failed`: a thrown send is
  * never confidently retry-safe (an `indeterminate` connect may have delivered to an
@@ -47,17 +45,15 @@ import {
 	SendDeliveredReleaseFailedError,
 	type SendFinalOutcome,
 } from "./entwurf-v2-send.ts";
-import type { SpawnBgPlan, SpawnBgResumeResult } from "./entwurf-v2-spawn.ts";
 
 /**
  * The three transport hands, each PRE-BOUND with its own deps (production or fake). Lock
  * is typed `LockClaim | null` to mirror the real hands EXACTLY — the runner passes
  * `decision.lock` straight through and the hand fails loud on a null/mis-paired lock
- * (control-socket / spawn-bg get a non-null claim; meta-mailbox gets null — ？7).
+ * (control-socket gets a non-null claim; meta-mailbox and native-push get null — ？7 / 봉인 4).
  */
 export interface DispatchExecutorDeps {
 	sendControl: (plan: ControlSocketPlan, lock: LockClaim | null) => Promise<ControlSocketSendResult>;
-	resumeSpawnBg: (plan: SpawnBgPlan, lock: LockClaim | null) => Promise<SpawnBgResumeResult>;
 	sendMailbox: (plan: MetaMailboxPlan, lock: LockClaim | null) => Promise<RpcSendResult>;
 	// native-push (봉인 4): lock-free like meta-mailbox — the runner passes the null lock
 	// verbatim and the hand ignores it. Owns the 1-shot re-probe→re-send retry internally.
@@ -66,12 +62,10 @@ export interface DispatchExecutorDeps {
 
 /** The per-transport success outcome, discriminated by transport so the surface renders
  * each without guessing. `control-socket` carries the optional N3 `rejectReason`;
- * `spawn-bg` carries the whole `SpawnBgResumeResult` (incl. the `lock-retained`
- * fail-closed diagnostic); `meta-mailbox` is always `success:true` (enqueue has no
- * in-band refuse — a failure is a throw, handled as `execution-failed`). */
+ * `meta-mailbox` is always `success:true` (enqueue has no in-band refuse — a failure is
+ * a throw, handled as `execution-failed`). */
 export type ExecutedOutcome =
 	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string }
-	| { transport: "spawn-bg"; result: SpawnBgResumeResult }
 	| { transport: "meta-mailbox"; success: true }
 	// native-push carries `retried` so the surface can note the 1-shot re-probe retry fired.
 	| { transport: "native-push"; success: true; retried: boolean };
@@ -143,15 +137,6 @@ export async function executeDispatch(
 				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
 			}
 		}
-		case "spawn-bg": {
-			try {
-				// `lock-retained` is a RETURNED result (fail-closed), not a throw — it rides `executed`.
-				const result = await deps.resumeSpawnBg(plan, lock);
-				return { kind: "executed", receipt, transport, outcome: { transport: "spawn-bg", result } };
-			} catch (err) {
-				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
-			}
-		}
 		case "meta-mailbox": {
 			try {
 				// lock is null here (？7) — passed verbatim; the production adapter ignores it.