@junghanacs/entwurf 0.13.1 → 0.14.0

package/VERIFY.md

@@ -5,7 +5,7 @@ invariants live in gates; this file defines evidence strength, release acceptanc
 and the manual judgements a gate cannot make.
 
 > **Current surface.** `entwurf-bridge` exposes `entwurf_v2`, `entwurf_peers`,
-> `entwurf_self`, `entwurf_inbox_read`, and `entwurf_register_native`. The ACP
+> `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and `entwurf_register_native`. The ACP
 > backends are Claude and Snowflake Cortex Code. Antigravity is a separate shipped
 > native-push citizen lane; Codex has delivery-probe evidence but no managed citizen
 > lane. Retired v1 verbs and bridge implementations belong only in CHANGELOG/git.
@@ -40,19 +40,27 @@ Verification here is not a benchmark. In production we exchange short turns and
 
 ### The canonical floor — two entry points
 
-- **Deterministic floor:** `pnpm check` — the full `check-*` gate set (the `check` script in `package.json` is the SSOT for what runs). Run first; it is the offline, machine-checkable layer.
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (inside `pnpm check`) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
-- **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm check` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
-  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm check`, `smoke-entwurf-v2-spawn-resume-live`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the two axes wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-entwurf-v2-spawn-live`, `smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
+- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
+- **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
+  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
-  - **Every MUST step is invoked and reports its own outcome** (P1 STEP OUTCOME protocol, `scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
+  - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
 
-> **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The 0.13.1 aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass.
+> **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The release aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass.
 >
 > A cut that touches the prompt-lifecycle contract (no wall clock on a running turn) owes one long-turn acceptance the aggregate floor is too short to carry: `LIVE=1 ./run.sh smoke-acp-long-turn-live` drives a real turn whose tool work outlasts the retired 600s cutoff and requires exactly one cold ACP bootstrap in the transcript. It takes >12 minutes by construction and is on-demand, not part of `release-gate`.
 >
-> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm check`; do not misreport the aggregate gate as live agy evidence.
+> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-5.6-terra` and recorded-ACP `entwurf/claude-sonnet-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
+>
+> One cell cannot be fully fenced, and that is recorded rather than glossed: the recorded-ACP pi cell runs under the operator's REAL home, because its provider spawns `claude` as a child that authenticates from there — measured, a fenced HOME kills that turn with `Authentication required` before the model is ever reached, and `CLAUDE_CONFIG_DIR` alone does not fix it. That is the same trade `smoke-acp-bundled-mcp-live` already makes. While that cell runs, its citizen's control socket and per-gid lock exist under the operator's own `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks`; its meta store stays fixture, so no garden record is minted outside the fixture, and the run ends by proving all six real roots hold the entry sets they started with, with no fixture garden id and no leftover lock.
+>
+> Be honest about its cost, because it is a MUST: it spends real model turns on the operator's configured runtimes (two pi siblings, each resumed once, plus one Claude Code sibling), it READS the operator's real runtime config, and the siblings' native session transcripts stay in the real pi agent dir — they are not cleaned up, and they are part of the evidence a resume was real. The fence is per-axis rather than absolute: the four meta roots (records, mailbox, receivers, senders) are fixture for every cell, so no garden record is ever minted outside it; the native pi cell's control socket and v2 lock are fixture too; the ACP pi cell's are REAL and transient (see the paragraph above); and the Claude cell runs its runtime under the real HOME while its mailbox and meta stay fixture. The run ends by proving the operator's SIX real roots — the four meta roots plus `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks` — hold the entry sets they started with, with no fixture garden id anywhere, and that proof now runs on the failure path as well as the green one. Missing prerequisites decline with the protocol SKIP (97), which `release-gate --cut` refuses rather than rounding up.
+>
+> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends two model turns, and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut.
+>
+> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence.
 >
 > Authoritative per-cut counts and digests live in BASELINE/CHANGELOG, not inline
 > here; embedding them in the protocol makes a correct guide stale after every cut.
@@ -63,7 +71,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 
 | Axis | Required proof | Limit |
 |---|---|---|
-| Source | `pnpm check` | Does not prove an installed consumer. |
+| Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | all required CI jobs green at the exact SHA | A different green SHA is not transferable evidence. |
@@ -78,7 +86,7 @@ consumer image outside this standing protocol.
 
 ### Verifying the two capabilities a gate cannot fully judge
 
-- **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for live pi, mailbox-backed meta, or native-push targets; `owned-outcome` only on a dormant target in the control-socket liveness domain (currently backend `pi`), where it selects **spawn-bg — a relaunch transport, not the control-socket rail that carries live sends**; the launch leaf checks backend authority. Picking the wrong intent is rejected, never auto-fixed.
+- **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2 fire-and-forget` — the intent axis is single-valued since the visible-first cut. It reaches a live pi target over its control socket, a deliverable self-fetch citizen through the mailbox, and a probe-alive native-push conversation by direct injection. A DORMANT in-domain citizen rejects as `dormant-fire-forget-unsupported` — delivery never wakes it; reopen it with the separate lifecycle verb `entwurf_resume_call {target}`, then dispatch again. A wrong target state is rejected, never auto-fixed and never launched into.
 - **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
 - **agy citizenship:** in a fresh agy conversation, the first `PreInvocation` must yield a garden id, `entwurf_self` must report `agentId=meta-session/antigravity` and `replyable:true` only while the native probe is alive, and a reply to that same garden id must direct-inject into the same conversation. No mailbox/receiver-marker evidence counts on this rail.
 
@@ -199,7 +207,7 @@ Pass (carrier honesty): the subject distinguishes engraving from pi-context-augm
 
 - **Layer 0 — self-awareness:** ask environment self-awareness / MCP visibility / upstream-instruction awareness, guessing prohibited. Pass: recognizes native tool family, says "I don't know" honestly, answers MCP visibility only as configured, describes upstream instruction type without reproducing internal prompts. Fail: claims a nonexistent tool, conflates pi-custom and native tools, hallucinates MCP visibility, or conflates the two carriers (§1A.0).
 - **Layer 1 — native tool use:** throw file-reading / structure-analysis / regression-hunting tasks. Pass: Read/Edit/Bash/Grep/Glob selection is natural; no detour through MCP or recursive `pi`. Fail: strange detours for simple reads; speaks from memory without reading.
-- **Layer 2 — MCP boundary:** by default the five entwurf MCP tools are not visible (they appear only when `entwurf-bridge` is registered). Pass: says invisible tools are not visible; explains the native-vs-MCP boundary; treats `entwurf_register_native` as binding an already-running conversation, never as fresh spawn. Fail: pretends to use an unseen tool; mimics entwurf via recursive `pi`.
+- **Layer 2 — MCP boundary:** by default the seven entwurf MCP tools are not visible (they appear only when `entwurf-bridge` is registered). Pass: says invisible tools are not visible; explains the native-vs-MCP boundary; treats `entwurf_register_native` as binding an already-running conversation, never as fresh spawn. Fail: pretends to use an unseen tool; mimics entwurf via recursive `pi`.
 - **Layer 3 — focus across turns:** inject a fact, then accumulate turns mixing retrieval/exploration. Pass (post-0.4.1): after **8 turns** holds **3+ early facts** incl. **one verbatim string injected before turn 5**; no repeated exploration, no self-contradiction, no tool-strategy drift. Fail: forgets early reads; paraphrases instead of returning the verbatim string. Note: entwurf exposes no user-facing compaction; use the backend's `usage_update` footer as an overflow-risk signal (it follows the ACP backend's `used/size`, not pi's visible-transcript estimate).
 - **Layer 4 — vs direct Claude Code:** requires a verifier holding **both** the `entwurf` and a direct path (human-in-loop, or both transport handles). Compare latency / native tool accuracy / detours / boundary confusion / quality around turns 10–15. Repeated tool confusion, long-turn forgetting, or boundary workarounds are a fail.
 
@@ -265,11 +273,11 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 
 The minimum passing bar:
 
-1. **Deterministic floor green:** `pnpm check` passes (lint + typecheck + the `check-*` gate set + `check-pack`).
+1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus a `./run.sh check-gate-qualification` green on the same candidate.
 2. **All three CI jobs green on the exact release commit:** `check`, `install-surface`, and the required Linux `artifact-consumer`; preserve the latter's tarball digest and image identity.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.
-5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its five current tools, and presents a backend-native (not normalized) tool surface.
+5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its seven current tools, and presents a backend-native (not normalized) tool surface.
 6. **Carrier separation honored:** engraving vs pi-context-augment kept distinct (§1A.0); no bridge-identity narrative attributed to the engraving carrier.
 7. **agy shipped lane accepted:** all three agy doctors are green; automatic birth/statusline/sender identity and same-gid native-push reply are confirmed in a fresh conversation. `agentId=meta-session/antigravity` is correct; model display is not part of that contract. Same-pid concurrent conversation invocation is not claimed.
 8. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
@@ -285,7 +293,7 @@ Passing establishes a **release verification floor**, not an 8-hour/day operatio
 
 - **`ENTWURF_CHILD_STDERR_LOG`** mirrors child stderr to a file for bootstrap-path visibility — but it must be present at **bridge-process spawn time**; `export` from a shell already bound to a running bridge does not propagate. Restart the parent session with it exported, then `grep -E '\[entwurf:(bootstrap|model-switch|cancel|shutdown)\]' "$ENTWURF_CHILD_STDERR_LOG"`.
 - **Retired dedicated smokes, live code invariants** (manual/troubleshooting only — *not* part of the release floor):
-  - *Model-switch lock* — entwurf sessions are locked to their starting model. Gate: `check-model-lock` (in `pnpm check`). The dedicated live `smoke-model-switch` was retired in v2; the invariant lives in `pi-extensions/model-lock.ts` (extension guard) + `session-store.ts` `SessionModelLockedError` (the `decideBootstrap` fail-loud model lock).
+  - *Model-switch lock* — entwurf sessions are locked to their starting model. Gate: `check-model-lock` (in `pnpm check`, core tier). The dedicated live `smoke-model-switch` was retired in v2; the invariant lives in `pi-extensions/model-lock.ts` (extension guard) + `session-store.ts` `SessionModelLockedError` (the `decideBootstrap` fail-loud model lock).
   - *Cancel / abort cleanup* — `onAbort` → `cancelActivePrompt()` (session stays reusable); the stream catch closes the bridge only on `stopReason === "error"`. Dedicated `smoke-cancel` retired; invariant in code.
 
 ### Evidence preservation when a problem occurs

package/demo/README.md

@@ -137,7 +137,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.83.0)
+- `pi` on PATH (current floor 0.84.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/demo/demo-baseline.sh

@@ -76,12 +76,10 @@ tmux kill-session -t "$SESSION" 2>/dev/null || true
 # entwurf siblings can address it if a follow-up demo needs it.
 COMMON_ENV="ENTWURF_DEBUG=1 PI_EMACS_AGENT_SOCKET=$EMACS_SOCKET"
 COMMON_ARGS="--entwurf-control --emacs-agent-socket $EMACS_SOCKET"
-new_session_id() { bash "$REPO_ROOT/run.sh" new-session-id; }
 
 # ---------- start driver (single pane) ----------
-DRIVER_LAUNCH_ID=$(new_session_id)
 tmux new-session -d -s "$SESSION" -n demo -x 220 -y 50 \
-  "$COMMON_ENV pi --session-id $DRIVER_LAUNCH_ID --model $DRIVER_MODEL $COMMON_ARGS 2>>$DRIVER_LOG"
+  "$COMMON_ENV pi --model $DRIVER_MODEL $COMMON_ARGS 2>>$DRIVER_LOG"
 DRIVER_PANE=$(tmux list-panes -s -t "$SESSION" -F '#{pane_id}' | head -1)
 
 # Give pi time to print its banner and reach the prompt.

package/demo/demo.sh

@@ -77,7 +77,6 @@ tmux kill-session -t "$SESSION" 2>/dev/null || true
 # Plain `2>>` is POSIX sh — works under tmux's default /bin/sh.
 COMMON_ENV="ENTWURF_DEBUG=1 PI_EMACS_AGENT_SOCKET=$EMACS_SOCKET"
 COMMON_ARGS="--entwurf-control --emacs-agent-socket $EMACS_SOCKET"
-new_session_id() { bash "$REPO_ROOT/run.sh" new-session-id; }
 
 # Snapshot pre-existing control sockets so we can detect which one this demo's
 # peer pane creates. Without this, Scene 3 could greet an unrelated live pi
@@ -107,9 +106,8 @@ wait_for_new_socket() {
 # the operator's tmux `base-index` / `pane-base-index` settings.
 
 # ---------- start peer (top pane)  — equivalent to: piat / piag / piat5 ----------
-PEER_LAUNCH_ID=$(new_session_id)
 tmux new-session -d -s "$SESSION" -n demo -x 220 -y 50 \
-  "$COMMON_ENV pi --session-id $PEER_LAUNCH_ID --model $PEER_MODEL $COMMON_ARGS 2>>$PEER_LOG"
+  "$COMMON_ENV pi --model $PEER_MODEL $COMMON_ARGS 2>>$PEER_LOG"
 PEER_PANE=$(tmux list-panes -s -t "$SESSION" -F '#{pane_id}' | head -1)
 
 PEER_ID=$(wait_for_new_socket "$PRE_SOCKETS") || {
@@ -122,9 +120,8 @@ echo "Peer  sessionId: $PEER_ID  pane=$PEER_PANE"
 POST_PEER_SOCKETS=$(ls "$SOCK_DIR"/*.sock 2>/dev/null | sort || true)
 
 # ---------- start sender (bottom pane, split below)  — equivalent to: pias / piao ----------
-SENDER_LAUNCH_ID=$(new_session_id)
 SENDER_PANE=$(tmux split-window -t "$PEER_PANE" -v -P -F '#{pane_id}' \
-  "$COMMON_ENV pi --session-id $SENDER_LAUNCH_ID --model $SENDER_MODEL $COMMON_ARGS 2>>$SENDER_LOG")
+  "$COMMON_ENV pi --model $SENDER_MODEL $COMMON_ARGS 2>>$SENDER_LOG")
 
 SENDER_ID=$(wait_for_new_socket "$POST_PEER_SOCKETS") || {
   echo "ERROR: sender session never registered a control socket. Check $SENDER_LOG." >&2

package/docs/acp-backend-rail.md

@@ -159,8 +159,10 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.64.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.66.0 nor the Cortex landing adds a client-side
 readiness fence, and `mcpServerStatus()` is not called by the common loop.
+(Re-measured at the 0.65.0 → 0.66.0 bump: the goal extension is not a fence,
+and `mcpServerStatus` appears nowhere in the 0.66.0 adapter source.)
 
 ### 11-7-a/b. Instrument and first measurement
 
@@ -183,7 +185,10 @@ exit/signal behavior, bounds NDJSON framing, scrubs only the exact probe env all
 and timestamps snapshot/prompt hand-offs inside the downstream write callback. One
 post-wire init snapshot may support the controlled-absence row; malformed, duplicate,
 pre-wire, unarmed, or target-mismatched snapshots invalidate the run rather than proving
-absence. The deterministic mutants in `probe-ordering.json` are the detailed oracle.
+absence. `check-probe-cli-shim` is the detailed producer oracle: its 20 direct
+`[CHECK:*]` assertions remain, while their verification-infra replants were deliberately
+removed by #70. `probe-ordering.json` retains only the product-subject no-production-prompt-cutoff
+replant consumed by `check-probe-ordering`.
 
 Current probe contract and gates:
 
@@ -200,7 +205,7 @@ fail when the callable surface is absent. Do not add sleeps or infer readiness f
 Deterministic floor:
 
 ```bash
-pnpm check
+pnpm run check:full
 ./run.sh check-acp-provider-surface
 ./run.sh check-acp-sdk-surface
 ./run.sh check-acp-session-reuse
@@ -227,5 +232,5 @@ not this standing contract.
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;
 - broader installed-host and cross-machine Cortex evidence;
-- Codex managed native-citizen work on the reserved 0.14.0 lane—separate from ACP;
+- any future Codex managed native-citizen lane—separate from ACP; 0.14.0 does not ship one;
 - persisted ACP resume/load, which is not implemented by today's in-memory reuse.

package/docs/external-mcp-host.md

@@ -9,16 +9,15 @@ the one-line registration; everything an operator needs to actually wire a host
 - **plain external MCP host**: no garden meta-record / sender marker. It can call the read surfaces (`entwurf_peers`, `entwurf_inbox_read`), but `entwurf_v2` sends are **refused by default** (#50 C4: "if we don't know who sent it, we don't send it"). The operator may wire the explicit hatch below; the send then goes out external/non-replyable.
 - **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Fresh sibling creation from nothing is a deferred lane. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call needs its selected runtime (`pi` or `claude`) on the server's PATH; resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
 Observed: Claude Code, Codex CLI, and Antigravity CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 
 Prerequisites on the host running the external MCP client:
 
-- `pi` on PATH (for the `owned-outcome` spawn-bg resume path).
 - A live pi session launched with `--entwurf-control` populates `~/.pi/entwurf-control/<gardenId>.sock` — the key is the **record's** garden id, never a transcript/session id (`PI_SESSION_ID` only carries the id record birth already established). Required for `entwurf_v2` control-socket dispatch and `entwurf_peers`.
 
-> **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. If `pi` works in your terminal but an external-host `entwurf_v2` spawn-bg resume fails with `spawn pi ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find `pi`. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
+> **PATH boundary.** MCP servers are often launched by GUI/editor daemons and may not inherit the interactive shell's PATH. No `entwurf_v2` rail launches a process, so this does not affect delivery — but `entwurf_fresh_call` and `entwurf_resume_call` do open a fixed runtime. If that runtime works in your terminal but an external-host call fails with `spawn pi ENOENT` or `spawn claude ENOENT`, pass a full PATH in the MCP server `env`, set `ENTWURF_BRIDGE_ENV_FILE` to a small shell file that exports PATH, or point the host at a wrapper that can find the runtime. `start.sh` sources only the explicit `ENTWURF_BRIDGE_ENV_FILE`; it never reads personal dotfiles automatically.
 
 Example env file:
 
@@ -46,7 +45,7 @@ External/meta-session semantics:
 
 - `entwurf_v2` from a plain external host is **refused by default** (no authoritative sender — #50 C4). With the explicit `ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1` hatch it delivers with `origin: "external-mcp"` / `replyable: false`; there is still no reply address.
 - `entwurf_v2` from a trusted meta-session delivers with `origin: "meta-session"`, and `replyable` is **derived from that sender's own rail — not granted by being trusted**: a self-fetch sender (Claude Code) is replyable only while its receiver is live and armed, and a native-push sender (Antigravity) only while its adapter probe finds the live conversation. Identity survives either way; only `replyable` drops to `false`. When it is `true`, `wants_reply: true` is allowed and the receiver can reply to the sender's garden id.
-- `entwurf_v2` with `intent: "owned-outcome"` to a dormant pi target needs `pi` on PATH (it spawns a `pi --entwurf-control` resume child); async completion followUp requires a replyable pi control-socket caller.
+- `entwurf_v2` never launches a process, so no delivery path needs `pi` on PATH. A dormant pi target is refused as `dormant-fire-forget-unsupported`: the hidden background resume that used to answer there was withdrawn under the visible-first rule, and re-opening the session is the separate `entwurf_resume_call` verb — which DOES need `pi` on PATH, because it starts one.
 - `entwurf_self` returns the same authoritative identity for pi sessions **and** trusted meta-sessions. A plain external host with no pi env and no trusted sender marker still fails because there is no reply address to report.
 
 #### Claude Code
@@ -114,7 +113,7 @@ entwurf doctor-agy-hooks
 
 The three adapters deliberately own different atoms:
 
-- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox) and neither is the manual `entwurf_register_native` fallback;
+- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox), neither is the manual `entwurf_register_native` fallback, and neither are `entwurf_fresh_call` / `entwurf_resume_call` (both launch into the caller's own tmux session, which an agy conversation is not);
 - statusline: the complete `statusLine` subtree pointing at the bare stable bin `entwurf-agy-statusline`;
 - hooks: one named `PreInvocation` hook pointing at the bare stable bin `entwurf-agy-imprint`.
 

package/docs/setup-clean-host.md

@@ -11,7 +11,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm | bundled with Node | package installation |
 | entwurf | `@junghanacs/entwurf` | all lanes |
-| pi | optional, `@earendil-works/pi-coding-agent >=0.83.0 <0.84` | ACP provider, control sockets, spawn-bg resume |
+| pi | optional, `@earendil-works/pi-coding-agent >=0.84.1 <0.85` | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
@@ -49,14 +49,14 @@ npx entwurf check-bridge
 ```
 
 `check-bridge` is auth-free. It proves the installed prebuilt MCP server boots and
-lists the five garden tools; it does not prove a backend model turn or native hook.
+lists the seven garden tools; it does not prove a backend model turn or native hook.
 
 ## 2. Optional pi adapter / ACP plugin
 
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.83.0
+npm install -g @earendil-works/pi-coding-agent@0.84.1
 pi --version
 
 cd ~/entwurf-smoke
@@ -64,10 +64,10 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.83.0 <0.84`. It is a hard minimum: installing this
-release onto a 0.82.x pi host upgrades the runtime rather than keeping the older
+The supported range is `>=0.84.1 <0.85`. It is a hard minimum: installing this
+release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
-control socket or dormant `owned-outcome` resume.
+control socket; no delivery rail launches a pi process.
 
 For daily garden-native pi sessions:
 
@@ -174,7 +174,8 @@ and exit-code contract is [fresh-cut-policy.md](./fresh-cut-policy.md).
 ## 7. Release acceptance versus host acceptance
 
 - `entwurf check-bridge`: installed MCP bytes boot; no backend auth.
-- `pnpm check`: source deterministic floor; maintainer checkout only.
+- `pnpm check` / `pnpm run check:full`: tiered source deterministic floors (everyday
+  core / full candidate floor); maintainer checkout only.
 - `check-install-container`: checkout-invisible Linux package-consumer shape using
   fixtures; not a native lifecycle proof.
 - `doctor-meta-bridge`: one installed real Claude host, only with a new live session.

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -11,7 +11,7 @@
  * Currently exposed tools (scope is deliberately narrow — anything that can live
  * as a local skill should live as a skill, not here):
  *   - entwurf_v2      — canonical delivery surface for existing garden citizens; the decider
- *                       chooses live control-socket send / dormant spawn-bg resume / meta-mailbox.
+ *                       chooses live control-socket send / meta-mailbox enqueue / native-push.
  *   - entwurf_peers   — entwurf fact surface: garden citizens (meta-records) with liveness +
  *                       diagnostics (#50 C4: record-less sockets surface THERE, never as identity).
  *                       Brain = pi-extensions/lib/entwurf-fact-provider (listEntwurfFacts) +
@@ -24,6 +24,18 @@
  *                       garden record may call this — so the surface is "drain the inbox you were
  *                       pointed at", not "drain your own". A rung doorbell is a wake attempt;
  *                       this read is the receipt.
+ *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
+ *                       conversation (antigravity) to a garden id. Never a spawn.
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session;
+ *                       returns a LAUNCH receipt only, and the new address arrives later as the
+ *                       sender envelope of the sibling's nonce callback.
+ *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
+ *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
+ *                       apart.
+ *
+ * That list is the WHOLE public surface — seven verbs — and `check-entwurf-bridge-boot`
+ * (G1f) holds it as an exact set on the runtime tools/list, so a verb added or dropped
+ * here without a decision is red rather than merely undocumented.
  *
  * Removed from this v2-only surface: legacy MCP `entwurf`, `entwurf_resume`, and
  * `entwurf_send`. Use `entwurf_v2` for delivery to existing garden citizens.
@@ -57,8 +69,11 @@ import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-ren
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
+import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
+import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
@@ -286,13 +301,12 @@ function abbreviateHomeMcp(cwd) {
 }
 // entwurf_v2 — the unified v2 dispatch verb (0.11 step 5d-3b). It hands the
 // target + intent to the 5b decider, which chooses the transport (live
-// control-socket send / spawn-bg resume / meta-mailbox enqueue / native-push
-// direct injection) and reports one outcome. The per-target lock is NOT taken by
-// every rail: the decider locks only a control-socket-domain dispatch, which
-// covers the live send AND the dormant cell's spawn-bg resume; the mailbox and
-// native-push branches carry `lock: null` (entwurf-v2-decider.ts). It runs
+// control-socket send / meta-mailbox enqueue / native-push direct injection) and
+// reports one outcome. The per-target lock is NOT taken by every rail: the decider
+// locks only a control-socket-domain dispatch; the mailbox and native-push branches
+// carry `lock: null` (entwurf-v2-decider.ts). It runs
 // IN-PROCESS here (the same production runner pi-native uses) — NOT a delegating
-// RPC — so control, mailbox, native-push, AND spawn-bg all flow through
+// RPC — so control, mailbox and native-push all flow through
 // `runEntwurfV2`. The sender envelope is
 // `buildSendSenderEnvelope()` verbatim (origin/replyable as resolved) — v2 does
 // NOT gate on replyability (a `wants_reply` from an external/non-replyable caller
@@ -300,11 +314,10 @@ function abbreviateHomeMcp(cwd) {
 // sender replyability).
 server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id " +
     "alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport " +
-    "from liveness (live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; " +
-    "deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection " +
-    "into its conversation) and reports ONE outcome (delivered / rejected / lock-retained / " +
-    "delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers. INTENT — picking wrong is " +
-    "rejected, never auto-converted. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
+    "from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge " +
+    "mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE " +
+    "outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
+    "entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
     "citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
     '"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
     "gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
@@ -312,24 +325,25 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     "session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
     "inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
     "native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
-    "owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → " +
-    "owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → " +
-    "native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND " +
-    "the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The " +
+    "DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
+    "— same receiver rule as the mailbox, no active drainer means no delivery. " +
+    "The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
+    "and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. " +
+    "LOCK: taken for a control-socket-DOMAIN dispatch. The " +
     "mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode " +
     "applies to a CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message " +
     "caps at 16000 chars; send an artifact path + digest for more.", {
     target: z.string().min(1).describe("Target garden id (use entwurf_peers to discover)"),
     intent: z
-        .enum(["fire-and-forget", "owned-outcome"])
+        .enum(["fire-and-forget"])
         .describe("fire-and-forget = send/reply/hand-off to a LIVE socket target or to any citizen with no " +
         "socket liveness — the decider picks its rail, and a rail can also REJECT (self-fetch → " +
         "mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, " +
         "dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate); set " +
-        "wants_reply for an answer. owned-outcome = " +
-        "wake a DORMANT socket-domain citizen via spawn-bg resume ONLY — on a live target rejected " +
-        "as owned-live-no-autosend, on self-fetch as backend-liveness-unsupported, on native-push as " +
-        "native-push-no-resume-authority, and never auto-converted"),
+        "wants_reply for an answer. This is the ONLY intent: owned-outcome, which resumed a dormant " +
+        "citizen by launching a hidden background child, was withdrawn under the visible-first rule. " +
+        "It is not selectable, not deprecated-but-tolerated; a dormant citizen is currently " +
+        "unreachable by this verb and rejects as dormant-fire-forget-unsupported."),
     message: z
         .string()
         .min(1)
@@ -339,8 +353,8 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         .enum(["steer", "follow_up"])
         .optional()
         .describe("Injection style for a CONTROL-SOCKET send only: steer (interrupt the current turn) or " +
-        "follow_up (queue after it). The mailbox, native-push, and spawn-bg plans carry no mode, so it " +
-        "has no effect on those rails."),
+        "follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
+        "effect on those rails."),
     wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
 }, async ({ target, intent, message, mode, wants_reply }) => {
     try {
@@ -348,8 +362,9 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         // + the mailbox body sender share one envelope. No replyability gate (see above).
         const sender = await buildSendSenderEnvelope();
         const rendered = await runAndRenderEntwurfV2FromSurface({ target, intent, message, mode, wants_reply }, 
-        // agentDir / prefixRoots intentionally omitted: runAndRenderEntwurfV2FromSurface falls
-        // back to the ENTWURF_PREFIX_ROOTS env SSOT for prefixRoots (5d-4); agentDir stays undefined.
+        // No trust-preflight inputs are passed, and none exist to pass: the preflight on this
+        // path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
+        // the whole options surface now (see the pi-native surface for the same note).
         { senderProvider: () => sender });
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
@@ -432,7 +447,9 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
     "`unsupported` for a backend with no control-socket probe such as claude-code); the dispatch " +
     "decision (send vs resume) is computed LATER by the entwurf_v2 contract from that liveness, " +
     "not here — this surface carries no per-row routing field, so do not read a transport off a " +
-    "row. In particular `unsupported` does NOT mean mailbox: it means this backend has no " +
+    "row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is " +
+    "currently unreachable by any verb, so listing it grants no action — appearing here is not " +
+    "an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no " +
     "control-socket probe. Which rail it answers on is a capability the decider resolves at dispatch " +
     "time, and there are THREE possible answers, not two — a self-fetch mailbox (only while that " +
     "mailbox is deliverable), native-push direct injection (only while its adapter probe is alive), " +
@@ -442,8 +459,8 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
     "is not a departed host. So " +
     "`unsupported` does not promise reachability either: a record whose backend has no adapter on " +
     "this lane resolves to that reject. " +
-    "Note: this is the *active* world. It is NOT a fresh-sibling creation surface; pass an " +
-    "existing garden id to entwurf_v2.", {}, async () => {
+    "Note: this is the *active* world and it is facts-only — it creates nothing. Pass an " +
+    "existing garden id to entwurf_v2; to open a NEW sibling use entwurf_fresh_call.", {}, async () => {
     try {
         // Meta-store axis: entries WITH their kind (ENOENT = fresh install = empty; any
         // other readdir failure is a real error, not a silent empty). The name-only
@@ -535,6 +552,109 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
         return textErr(`entwurf_register_native error: ${err instanceof Error ? err.message : String(err)}`);
     }
 });
+// The caller identity for THIS surface comes from the same authoritative resolution
+// `entwurf_self` uses — BOTH of its certified paths: the pi carrier this child inherited
+// (PI_SESSION_ID + PI_AGENT_ID, which a record minted at birth), or a trusted meta-sender marker
+// the native host's own hook wrote. Neither is a guess and neither is deprecated here.
+//
+// What is refused is a caller-supplied id. The measured failure mode is exactly that: asked for
+// its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
+// environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
+// against that answer would call home to a garden id nobody holds.
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Two fixed " +
+    "backends only: pi, claude-code. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+    "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
+    "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
+    "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
+    "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
+    "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
+    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code); there are no " +
+    "arbitrary command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to " +
+    "same-user processes on this host. Requires that this agent itself runs " +
+    "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
+    backend: z
+        .enum(["pi", "claude-code"])
+        .describe("Which fixed runtime to open. Only these two; there is no arbitrary command."),
+    model: z
+        .string()
+        .min(1)
+        .max(200)
+        // The `\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source
+        // text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a
+        // Rust regex engine that rejects an unescaped `[` inside a character class as "unclosed
+        // character class" — a 400 on tools/list that stops EVERY Claude session from opening
+        // (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must
+        // stay on the line DIRECTLY above the expression, or it attaches to nothing and reads
+        // as an unused suppression while the escape goes back to being fixable.
+        // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
+        .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
+        .describe("Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias."),
+    task: z
+        .string()
+        .min(1)
+        .max(16000)
+        .describe("What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description)."),
+}, async ({ backend, model, task }) => {
+    let callerGardenId = null;
+    try {
+        const self = await buildAuthoritativeSelfEnvelope();
+        callerGardenId = self.envelope.sessionId;
+    }
+    catch (err) {
+        // ONE error is a legitimate answer here: this host has no authoritative identity at all
+        // (no pi carrier inherited, no trusted marker written), so the sibling would have nowhere
+        // to call home. That normalises to the named refusal.
+        //
+        // Everything else — a corrupt record, an unreadable store, a broken marker — keeps its
+        // own diagnosis and fails loud. Folding those into "you are anonymous" would relabel a
+        // store defect as a wiring choice, and the operator would go looking in the wrong place.
+        if (!(err instanceof EntwurfEnvelopeWiringError))
+            throw err;
+        callerGardenId = null;
+    }
+    try {
+        const rendered = renderFreshCall(freshCall({ backend, model, task, callerGardenId }));
+        return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+    }
+    catch (err) {
+        return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
+// The composition root for a visible resume: this surface is the only layer that may know BOTH
+// halves, so it is where the mux launcher is handed to the v2 composition. `entwurf-v2-visible-
+// resume` cannot open a window on its own and `mux-resume-call` cannot read a record — that is
+// the import fence in docs/mux-launch-rail.md §11, expressed as a function argument.
+const visibleResumeLaunch = (input) => {
+    const launched = resumeCall({ cwd: input.cwd, runtimeArgs: input.runtimeArgs });
+    return launched.ok
+        ? { ok: true, handle: launched.receipt }
+        : { ok: false, reason: launched.reason, hint: RESUME_CALL_REJECT_HINT[launched.reason] };
+};
+server.tool("entwurf_resume_call", "Reopen ONE DORMANT pi citizen under its OWN garden id, in a visible window in the operator's own tmux " +
+    "session. The record supplies everything — which transcript, which model, which provider, which cwd — so " +
+    "the only input is the target id: there is no model override, no task, and no prompt. This runs NO turn: " +
+    "the window comes back with the conversation and waits, and talking to it is still entwurf_v2 " +
+    "fire-and-forget on the socket this call stands up. You get TWO receipts and they mean different things: a " +
+    "LAUNCH receipt (tmux made a window and was asked to start pi) and an OBSERVATION receipt (the control " +
+    "socket answered under the same id, or resume-unobserved). Unobserved is a real outcome, not an error to " +
+    "retry — the window is visible, so read it. A citizen that is already LIVE is refused: address it with " +
+    "entwurf_v2 instead. Only pi citizens have a same-id resume, because only they stand a control socket up. " +
+    "Requires that this agent itself runs inside tmux.", {
+    target: z
+        .string()
+        .min(1)
+        .regex(/^\d{8}T\d{6}-[0-9a-f]{6}$/)
+        .describe("Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers)."),
+}, async ({ target }) => {
+    try {
+        const result = await visibleResume(target, makeVisibleResumeDeps(visibleResumeLaunch));
+        const rendered = renderVisibleResume(result);
+        return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+    }
+    catch (err) {
+        return textErr(`entwurf_resume_call error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
 // ============================================================================
 // Main
 // ============================================================================