@junghanacs/entwurf 0.13.1 → 0.14.1

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -8,10 +8,10 @@
  *
  * Three invariants this factory exists to guarantee (each gate-proven):
  *   - ONE lock domain (Q2/QB3). A single `release` closure bound to `lockDir` is the lock
- *     authority for EVERY hand: the decider's `releaseLock`, the control-send hand's
- *     `releaseLock`, AND the spawn watcher's `releaseFn`. The spawn factory's default
- *     `releaseFn` ignores `lockDir` (it would release into the DEFAULT lock dir) — passing
- *     `release` explicitly is what closes that split-brain.
+ *     authority for EVERY hand: the decider's `releaseLock` and the control-send hand's
+ *     `releaseLock`. (A third hand used to share it — the spawn watcher's `releaseFn`,
+ *     whose own default would have released into the DEFAULT lock dir; that split-brain
+ *     went with the transport, the single-authority rule did not.)
  *   - ONE mailbox sender (Q3). A single `makeProductionSendViaMailbox` instance is the
  *     top-level meta-mailbox hand AND the control-send dead-fallback's mailbox enqueue, so a
  *     direct send and a fallback send never drift in sender envelope / dirs.
@@ -28,7 +28,7 @@
  * canonical socket path; `indeterminate` (EACCES/unknown) fails loud rather than silently
  * claiming "no conflict". The decider's later `inspectSocket` probe is a SEPARATE step.
  */
-import { formatSenderInfoBlock, sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
+import { sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
 import { mailboxConversationalDeliverable, receiverMarkerMatchesIdentity, } from "./entwurf-deliverability.js";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
@@ -38,35 +38,10 @@ import { makeProductionSendViaMailbox } from "./entwurf-v2-mailbox.js";
 import { makeNativePushSend } from "./entwurf-v2-native-push.js";
 import { executeControlSocketSend, } from "./entwurf-v2-send.js";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.js";
-import { executeSpawnBgResume } from "./entwurf-v2-spawn.js";
-import { makeProductionSpawnBgResumeDeps } from "./entwurf-v2-spawn-production.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter as realResolveNativePushAdapter, } from "./native-push/adapter.js";
 import { CONTROL_SOCKET_DIR, controlSocketPath, inspectControlSocketPath, inspectTargetControlSocket, isRecordLessSocketCandidate, } from "./socket-discovery.js";
 import { classifyConnectError, probeSocketLiveness } from "./socket-probe.js";
-/**
- * 0.12.1 B-2: the production `preflight` seam default. preflight value-imports
- * `@earendil-works/pi-coding-agent` (ProjectTrustStore), so importing it eagerly
- * would pull pi into the harness-neutral MCP bridge's boot closure. This wrapper
- * defers that to a lazy `await import()` reached ONLY on the owned-outcome resume
- * branch (the decider awaits it). peers/self/list/mailbox-deliver therefore boot
- * with no pi package present.
- *
- * WHAT THIS DEFERRAL DOES NOT DO — corrected 0.12.8. The old sentence framed the
- * pi-less case as an edge ("a pi-less environment that DOES hit a spawn-bg resume
- * surfaces an honest module-not-found"). In a published consumer tree that is not an
- * edge, it is the DEFAULT: `@earendil-works/pi-coding-agent` is an optional peer that
- * a neutral `npm install` does not resolve (entwurf-preflight.ts:51), so this import
- * throws for every installed user and the owned-outcome lane has never lived in any
- * published version. The deferral still buys what it claims — a pi-free boot — and
- * "module-not-found" is still honest, but it is a permanent floor on the install path,
- * not a rare condition. Reviving that lane (declared dep / pi CLI subprocess / PATH
- * resolution) is a separate decision; nothing here should read as if it works today.
- */
-async function lazyProductionPreflight(input) {
-    const { preflight } = await import("./entwurf-preflight.js");
-    return preflight(input);
-}
 /** Map a record-side socket inspection to the singleton (socketGids, symlinkedGids) the
  * `isOutOfSocketDomainGardenIdConflict` predicate consumes. `indeterminate` fails LOUD (QB2): an
  * unprovable conflict must NOT be folded to "no conflict" — that would silently allow an
@@ -107,12 +82,10 @@ export function makeProductionEntwurfV2Deps(opts) {
         releaseLock: s.releaseLock ?? realReleaseLock,
         inspectSocket: s.inspectSocket ?? inspectTargetControlSocket,
         probeSocket: s.probeSocket ?? probeSocketLiveness,
-        preflight: s.preflight ?? lazyProductionPreflight,
         classifyConnect: s.classifyConnect ?? classifyConnectError,
         sendRpc: s.sendRpc ?? realSendRpc,
         enqueue: s.enqueue ?? enqueueMetaMessage,
         resolveNativePushAdapter: s.resolveNativePushAdapter ?? realResolveNativePushAdapter,
-        spawnOverrides: s.spawnOverrides ?? {},
     };
     // ── ONE lock domain (Q2/QB3): a single lockDir-bound release for ALL hands ─
     const acquire = (gid) => io.acquireLock(gid, { dir: lockDir });
@@ -185,7 +158,6 @@ export function makeProductionEntwurfV2Deps(opts) {
         releaseLock: release,
         inspectSocket,
         probeSocket,
-        preflightForCwd: (cwd) => io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
         mailboxDeliverabilityFor,
         // 봉인 4: resolve the native-push adapter for this backend + probe the conversation.
         // Only reached on a nativePushSupported backend (the decider gates it), so the resolver
@@ -193,7 +165,6 @@ export function makeProductionEntwurfV2Deps(opts) {
         nativePushProbe: (identity) => Promise.resolve(io.resolveNativePushAdapter(identity.backend).probe(identity.nativeSessionId)),
         mailboxDir,
         sessionsDir,
-        observeTimeoutMs: opts.observeTimeoutMs,
     };
     // ── control-send hand deps (5c-2): the dead-fallback shares resolveTarget /
     // inspect / probe / dirs with the decider; the mailbox enqueue is the SAME
@@ -224,25 +195,6 @@ export function makeProductionEntwurfV2Deps(opts) {
     // ── executor: the three transport hands, each pre-bound ───────────────────
     const executor = {
         sendControl: (plan, lock) => executeControlSocketSend(plan, lock, controlSendDeps),
-        resumeSpawnBg: (plan, lock) => {
-            const spawnPlan = plan;
-            // Caller-edge preservation (#50 C3): the dormant rail delivers the SAME
-            // structured <sender_info> the live socket rail synthesizes at its
-            // receiver — one formatter (entwurf-control-rpc SSOT), appended after the
-            // task text exactly as a live delivery would render it. Without this, a
-            // resumed citizen woke with an anonymous prompt while every other rail
-            // carried the sender envelope.
-            const sender = opts.senderProvider();
-            const prompt = sender ? spawnPlan.prompt + formatSenderInfoBlock(sender, spawnPlan.wantsReply) : spawnPlan.prompt;
-            return executeSpawnBgResume({ ...spawnPlan, prompt }, lock, 
-            // QB3: inject the shared lockDir-bound `release` — never the spawn factory's
-            // default releaseFn (which would release into the DEFAULT lock dir).
-            makeProductionSpawnBgResumeDeps({
-                ...io.spawnOverrides,
-                killGraceMs: opts.killGraceMs ?? io.spawnOverrides.killGraceMs,
-                releaseFn: release,
-            }));
-        },
         sendMailbox: (plan, _lock) => sendViaMailbox(plan, _lock),
         // native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
         // so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-release.js

@@ -6,24 +6,25 @@
  * AT MOST ONCE.
  *
  * Why a pure reducer before any transport IO (5b discipline = gate-first →
- * pure-before-IO → wire): the load-bearing risk of 5c is NOT the spawn/send IO, it
- * is the RELEASE TIMING (Fable 3, "release-after-observation"). A spawn-bg dispatch
- * that releases its lock too early — on spawn-started/ack instead of on an observed
- * liveness transition — reopens the exact double-spawn window 5a's per-gid lock
- * exists to close. So the timing logic is isolated here as a pure state machine the
- * gate drives over every event order, and 5c-2/5c-3/5c-4 only WIRE the real
- * send/spawn/mailbox IO onto it. The hand feeds events; this module decides release.
+ * pure-before-IO → wire): the load-bearing risk of 5c is NOT the send IO, it is the
+ * RELEASE TIMING. A dispatch that releases its lock too early — on an ack instead of
+ * on a final outcome — reopens the window 5a's per-gid lock exists to close. So the
+ * timing logic is isolated here as a pure state machine the gate drives over every
+ * event order, and 5c-2/5c-4 only WIRE the real send/mailbox IO onto it. The hand
+ * feeds events; this module decides release.
  *
- * The three policies (one per ExecutionPlan transport):
- *   - no-lock                       — meta-mailbox (？7: no lock was ever held).
- *     Nothing to release on any event.
+ * The two policies (one per ExecutionPlan transport):
+ *   - no-lock                       — meta-mailbox and native-push (？7 / 봉인 4: no
+ *     lock was ever held). Nothing to release on any event.
  *   - release-after-send-final      — control-socket send. The lock is held only for
  *     the at-most-once re-resolve; release once the send reaches a FINAL outcome.
- *   - release-after-spawn-observation — spawn-bg resume. The lock is held until the
- *     FIRST observable transition: socket-alive OR child-exited (any code). A
- *     spawn-started event is explicitly NOT a release trigger (that is the whole
- *     point). A spawn that never started (spawn-start-failed) has no child to watch,
- *     so it releases to free the gid — keeping the lock would pin it forever.
+ *
+ * There was a third, `release-after-spawn-observation`, for the spawn-bg resume: hold
+ * the lock until an OBSERVED liveness transition (socket-alive / child-exited), never
+ * on spawn-started. It went with that transport in the visible-first cut, and with it
+ * the spawn event vocabulary. The rule it encoded — a launch is finalized by an
+ * observation, not by having started — is the one a visible resume will have to
+ * restate for itself; it is not inherited by anything shipped here.
  *
  * The release authority is ALWAYS the LockClaim the decider handed over (5c wires it
  * through). This module never re-derives a lock by gid, never re-resolves a path —
@@ -33,7 +34,7 @@ export function initialReleaseState() {
     return { released: false };
 }
 /**
- * An in-domain execute (control-socket / spawn-bg) must hold a lock whose gardenId
+ * An in-domain execute (control-socket) must hold a lock whose gardenId
  * IS the plan's target. Both halves are 5b decider-contract invariants, not runtime
  * conditions: a null lock or a lock paired with the WRONG plan are the same grade of
  * mis-wiring (a later release would free nothing, or free a DIFFERENT gid's lock), so
@@ -51,7 +52,7 @@ function assertInDomainLock(plan, lock) {
 /**
  * Derive the release policy from the plan, cross-checking the lock invariants the 5b
  * decider guarantees: meta-mailbox ⇒ lock null (？7); in-domain (control-socket /
- * spawn-bg) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
+ * control-socket) ⇒ lock non-null AND lock.gardenId === plan.targetGardenId. A mismatch is
  * a decider contract violation, not a runtime condition — it throws so a mis-wired
  * hand fails loud instead of silently dropping or mis-releasing a lock.
  */
@@ -74,17 +75,15 @@ export function decideReleasePolicy(plan, lock) {
         case "control-socket":
             assertInDomainLock(plan, lock);
             return { kind: "release-after-send-final" };
-        case "spawn-bg":
-            assertInDomainLock(plan, lock);
-            return { kind: "release-after-spawn-observation" };
     }
 }
 /**
  * Fold one execution event into the release decision. `shouldRelease` is true
  * EXACTLY ONCE — on the first event that satisfies the policy's release condition;
  * every later event (after `state.released`) returns false. The single-release
- * guarantee is what lets the spawn watcher race socket-alive against child-exit
- * without a double release: whichever fires first releases, the other is a no-op.
+ * guarantee is what let the retired spawn watcher race two observations without a
+ * double release, and it is why the control-socket hand can feed a final outcome more
+ * than once without paying for it twice.
  */
 export function reduceRelease(policy, state, event) {
     if (state.released) {
@@ -99,19 +98,5 @@ export function reduceRelease(policy, state, event) {
         case "release-after-send-final":
             // Release once the send reaches a final outcome; hold before that.
             return event.kind === "send-final" ? release() : hold();
-        case "release-after-spawn-observation":
-            // Fable 3: spawn-started is NOT a release event. Release on the first
-            // observed transition (socket-alive / child-exited, any code), or on a
-            // failed start (no child to watch).
-            switch (event.kind) {
-                case "socket-alive":
-                case "child-exited":
-                case "spawn-start-failed":
-                    return release();
-                case "spawn-started":
-                case "send-final":
-                case "mailbox-enqueued":
-                    return hold();
-            }
     }
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -6,9 +6,9 @@
  * to the right 5c transport hand, returning ONE outcome-rich `EntwurfV2RunResult`. It performs
  * ZERO IO of its own and makes ZERO routing decisions — `decideDispatch` chose the plan,
  * this only DISPATCHES it. Each hand is an injected dep (the gate fakes them; 5d-2 wires
- * the production `executeControlSocketSend` / `executeSpawnBgResume` / production
- * `sendViaMailbox`), so the routing + result mapping is gate-provable without a socket,
- * spawn, or timer — the same pure-before-IO, IO-via-dep discipline 5b/5c kept.
+ * the production `executeControlSocketSend` / `sendViaMailbox` / native-push sender), so
+ * the routing + result mapping is gate-provable without a socket — the same
+ * pure-before-IO, IO-via-dep discipline 5b/5c kept.
  *
  * Why a result type richer than the receipt: the carry-over contracts from 5c demand it.
  *   - N3 (5c-2b): a dead-path re-resolve `rejected` carries the resolver's `rejectReason`
@@ -19,8 +19,6 @@
  *     re-send would double-deliver. The runner surfaces this as `execution-failed` with
  *     `finalizedOutcome` + `releaseFailed` so the surface renders "delivered, lock dirty,
  *     do NOT retry", never "send failed".
- *   - spawn-bg `lock-retained` is a RETURNED result (fail-closed, not a throw): it rides
- *     the `executed` branch so 5d's surface can render the retained-lock diagnostic.
  *
  * `retrySafe` is conservatively `false` on EVERY `execution-failed`: a thrown send is
  * never confidently retry-safe (an `indeterminate` connect may have delivered to an
@@ -71,16 +69,6 @@ export async function executeDispatch(decision, deps) {
                 return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
             }
         }
-        case "spawn-bg": {
-            try {
-                // `lock-retained` is a RETURNED result (fail-closed), not a throw — it rides `executed`.
-                const result = await deps.resumeSpawnBg(plan, lock);
-                return { kind: "executed", receipt, transport, outcome: { transport: "spawn-bg", result } };
-            }
-            catch (err) {
-                return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
-            }
-        }
         case "meta-mailbox": {
             try {
                 // lock is null here (？7) — passed verbatim; the production adapter ignores it.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send-fallback.js

@@ -18,17 +18,18 @@
  * must read the same row. That pin is also what makes "no resume promotion" structural,
  * not just a 5c-2a guard: the `fire-and-forget` row has NO resume cell —
  *   live          → send / control-socket   (the retry)
- *   dormant(dead) → reject (dormant-fire-forget-unsupported)  ← NOT resume/spawn-bg
+ *   dormant(dead) → reject (dormant-fire-forget-unsupported)  ← nothing is launched
  *   indeterminate → reject (indeterminate-no-spawn)
- * Only `owned-outcome + dormant` is resume/spawn-bg, and an owned-outcome dispatch never
- * yields a control-socket send plan in the first place. So a dead re-resolve can only
- * retry (alive), reject (dead/indeterminate pi), or — on an UNSUPPORTED backend, via the
- * separate mailbox mini-table — enqueue to a deliverable citizen. It can never spawn.
+ * Since the visible-first cut there is no resume cell ANYWHERE — the intent that owned one
+ * is gone from the contract — so a dead re-resolve can only retry (alive), reject
+ * (dead/indeterminate pi), or — on an UNSUPPORTED backend, via the separate mailbox
+ * mini-table — enqueue to a deliverable citizen. It can never start a process.
  *
- * The N2 asymmetry (frozen in entwurf-v2-contract): in-domain `dormant` is a CONFIRMED
- * not-running pi → reject (enqueuing would be a silent pileup; resume is the honest
- * place, and resume is out of a SEND fallback's scope). `unsupported` is UNKNOWN liveness
- * with no socket axis → the mailbox is its honest channel when deliverable.
+ * The N2 asymmetry (frozen in entwurf-v2-contract) is a RECEIVER question, not a backend
+ * privilege: a mailbox is offered only where an active receiver actually drains it. An
+ * `unsupported` citizen gets one exactly while `mailboxDeliverable` holds, and is rejected as
+ * `mailbox-undeliverable` the moment it does not. An in-domain `dormant` pi is a CONFIRMED
+ * not-running session, so nothing would ever drain that enqueue — a silent pileup → reject.
  */
 import { isLivenessSupported, resolveDispatch } from "./entwurf-v2-contract.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir } from "./meta-session.js";
@@ -104,8 +105,8 @@ export async function resolveDeadControlSendFallback(plan, lock, deps) {
         return { kind: "reject", reason: receipt.reason };
     }
     // fire-and-forget + live is the ONLY in-domain allow cell → control-socket send. A
-    // resume/spawn-bg or meta-mailbox transport here would be a frozen-table drift, so
-    // fail loud rather than mis-route a SEND fallback into a child spawn.
+    // meta-mailbox transport here would be a frozen-table drift, so fail loud rather than
+    // mis-route a SEND fallback onto another rail.
     if (receipt.transport !== "control-socket") {
         throw new Error(`entwurf-v2-send-fallback: in-domain fire-and-forget re-resolve yielded unexpected transport (${receipt.transport}) — table drift.`);
     }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -45,7 +45,7 @@ export async function executeControlSocketSend(plan, lock, deps) {
     const policy = decideReleasePolicy(plan, lock);
     const held = lock;
     // Lock-leak backstop: once the lock is held, ANY throw out of the drive — a
-    // contract-violation guard (spawn-bg re-resolve), the mis-route assert, even a buggy
+    // contract-violation guard, the mis-route assert, even a buggy
     // dep that throws where it should return — must still release the lock before it
     // propagates. A leaked lock pins the gid forever (5a's worst failure). So convert any
     // such throw into a `failed` final outcome, run finalizeRelease (which releases on
@@ -127,14 +127,9 @@ async function driveDeadFallback(plan, lock, deps) {
             catch (err) {
                 return { outcome: "failed", error: err };
             }
-        case "spawn-bg":
-            // A SEND fallback must never re-resolve into a spawn — that is a decider
-            // contract violation (a send and a spawn are different actions), so fail loud
-            // rather than silently mis-execute.
-            throw new Error("entwurf-v2-send: re-resolve returned a spawn-bg plan for a send fallback (contract violation).");
         case "native-push":
             // The dead-control-socket fallback re-resolves only the pi socket domain
-            // (control-socket / mailbox / spawn); it never routes the native-push rail. A
+            // (control-socket / mailbox); it never routes the native-push rail. A
             // native-push rePlan here is structurally impossible — fail loud.
             throw new Error("entwurf-v2-send: re-resolve returned a native-push plan for a send fallback (contract violation).");
     }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -14,33 +14,13 @@
  *     from mode/action — that would blur the F1 ownership contract).
  *   - `renderEntwurfV2Result` — the result union → `{ text, isError }`, surfacing the carry-overs
  *     the surface must NOT drop: a reject's reason+diagnostic, a control `rejectReason` (N3), a
- *     spawn `lock-retained` diagnostic, and the N1 delivered+lock-dirty `execution-failed`.
+ *     and the N1 delivered+lock-dirty `execution-failed`.
  *   - `runAndRenderEntwurfV2FromSurface` — assemble production deps + run + render, so the root
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
-import * as path from "node:path";
 import { makeProductionEntwurfV2Deps } from "./entwurf-v2-production.js";
 import { runEntwurfV2 } from "./entwurf-v2-runner.js";
 import { FRESH_CUT_PRESCRIPTION } from "./meta-session.js";
-/** The operator-policy SSOT for v2 dispatch's preflight prefix-auto-approve roots (5d-4b).
- * ONE shared env var feeds BOTH surfaces (pi-native + MCP) — a pi session and an MCP child
- * both inherit it, so there is no per-surface config fork. `prefixRoots` is operator policy,
- * not session-local UX, so it is an env var, not a pi flag. */
-export const ENTWURF_PREFIX_ROOTS_ENV = "ENTWURF_PREFIX_ROOTS";
-/** Parse `ENTWURF_PREFIX_ROOTS` into the preflight's `prefixRoots`. `path.delimiter`-
- * separated (`:` on Linux/macOS); entries are trimmed, empty segments dropped. Unset / empty
- * / delimiters-only ⇒ `[]` (no prefix promotion — frozen decision 7, no package default).
- * It does NOT throw on a nonexistent/typo path: `preflight`'s normalize keeps an absolute
- * fallback, so a bad root simply never matches (a typo must not broaden approve, and must not
- * turn every owned-outcome dispatch into a loud failure). `~` is left for preflight to expand. */
-export function parseEntwurfPrefixRootsEnv(raw = process.env[ENTWURF_PREFIX_ROOTS_ENV]) {
-    if (!raw)
-        return [];
-    return raw
-        .split(path.delimiter)
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
-}
 /** Surface params → the runner's `DispatchInput`. `wants_reply`→`wantsReply`; `intent` and
  * `message` pass through; `mode`/`wantsReply` are left undefined when absent so the decider's
  * own defaults (follow_up / false) apply — no double-default. */
@@ -55,27 +35,36 @@ export function toDispatchInput(params) {
 }
 /**
  * Detour B (B-a) — actionable rendering of an honest reject. The decider is UNCHANGED:
- * a reject stays a reject (Hard Rule 3), and intent is NEVER auto-converted (Hard Rule 2 —
- * owned→fire-and-forget mailbox fallback would break the F1 ownership contract). This only
- * appends a one-line "what to do instead" to the reject TEXT, so an honest reject stops
- * reading as "delivery impossible". Returns undefined for rejects with no useful next step.
+ * a reject stays a reject (Hard Rule 3). This only appends a one-line "what to do instead"
+ * to the reject TEXT, so an honest reject stops reading as "delivery impossible". Returns
+ * undefined for rejects with no useful next step.
  */
 export function actionableRejectHint(reason) {
     switch (reason) {
-        case "backend-liveness-unsupported":
-            // A meta-session backend (e.g. claude-code self-fetch) has no liveness predicate, so
-            // owned-outcome has nothing to own. Replies go to the mailbox via fire-and-forget.
-            return ("meta-session backend has no liveness predicate → owned-outcome is unsupported. " +
-                "To reply, dispatch with intent: fire-and-forget — it routes to the meta-mailbox when a " +
-                "deliverable/active receiver is armed (else it fail-closes as mailbox-undeliverable). " +
-                "(Intent is not auto-converted; you choose it.)");
-        case "owned-live-no-autosend":
-            // A live target is reachable, but owned-outcome is not an auto-send (Q2/F1).
-            return "target is live — owned-outcome never auto-sends. Use intent: fire-and-forget (with wants_reply if you need a reply).";
-        case "native-push-no-resume-authority":
-            // A native-push backend (antigravity) has no pi-child to own, so owned-outcome has
-            // nothing to own. Delivery is a direct inject via fire-and-forget.
-            return "native-push target (e.g. antigravity) has no resume/spawn authority → owned-outcome is unsupported. Use intent: fire-and-forget to direct-inject into the live conversation.";
+        case "dormant-fire-forget-unsupported":
+            // The cell that carries the whole cost of the visible-first cut. Naming the real
+            // state — the citizen exists and is not running — matters more than ever now that
+            // there is no verb behind it: a caller that reads "reject" as "wrong id" goes
+            // looking in the wrong place.
+            return ("this citizen's record is intact but its session is not running, and delivery has no way to wake it. " +
+                "The resume that used to answer here launched a hidden background child and was withdrawn under the " +
+                "visible-first rule; the visible same-id resume is the separate lifecycle verb entwurf_resume_call. " +
+                "Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again.");
+        case "indeterminate-no-spawn":
+            // The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe
+            // is not a measured death, and dispatching into it could double-deliver. Say
+            // "the PROBE was inconclusive", never "the socket answered inconclusively":
+            // `indeterminate` also covers a probe that got no answer at all, was refused by
+            // permissions, or timed out, and "answered" claims a reply that may never have
+            // existed. The wire id is FROZEN and still spells "-no-spawn"; it names the rule
+            // (never dispatch into an indeterminate target), not a capability that still
+            // exists. So the hint's job is to say plainly what did NOT happen: nothing
+            // delivered, nothing started.
+            return ("the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a " +
+                "measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen " +
+                "'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). " +
+                "Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at " +
+                "that garden id by a session that died without cleaning up.");
         case "native-push-target-dead":
             // The adapter probe found no live host process for the conversation.
             return "native-push conversation is not live (no host process found). Re-open the conversation, then retry — there is nothing to inject into.";
@@ -97,7 +86,7 @@ export function actionableRejectHint(reason) {
 /** Render the outcome-rich result to `{ text, isError }`. A reject or a thrown/failed/dirty
  * delivery is `isError:true`; a sent/fallback-sent/enqueued/observed delivery is `isError:false`.
  * A control in-band `rejected` is a non-delivery (isError:true) and carries N3 `rejectReason`
- * when present; a spawn `lock-retained` is fail-closed (isError:true) with its diagnostic. */
+ * when present. */
 export function renderEntwurfV2Result(result) {
     switch (result.kind) {
         case "rejected": {
@@ -125,27 +114,6 @@ export function renderEntwurfV2Result(result) {
                     isError: !delivered,
                 };
             }
-            if (o.transport === "spawn-bg") {
-                const res = o.result;
-                if (res.kind === "lock-retained") {
-                    const d = res.diagnostic;
-                    return {
-                        text: `entwurf_v2 spawn-bg LOCK RETAINED (${res.reason}) — lock NOT released, operator must clear:` +
-                            `\n  target: ${d.targetGardenId}` +
-                            `\n  lockPath: ${d.lockPath}` +
-                            `\n  expectedSocketPath: ${d.expectedSocketPath}` +
-                            `\n  observeTimeoutMs: ${d.observeTimeoutMs}, killGraceMs: ${d.killGraceMs}` +
-                            (res.error ? `\n  error: ${res.error}` : ""),
-                        isError: true,
-                    };
-                }
-                if (res.kind === "spawn-start-failed") {
-                    return { text: `entwurf_v2 spawn-bg failed to start: ${res.error}`, isError: true };
-                }
-                const pid = "pid" in res && res.pid !== undefined ? ` (pid ${res.pid})` : "";
-                const exit = res.kind === "child-exited" ? ` exitCode=${res.exitCode}` : "";
-                return { text: `entwurf_v2 spawn-bg → ${res.kind}${pid}${exit}, lock released`, isError: false };
-            }
             if (o.transport === "native-push") {
                 // direct-inject succeeded; note if the 1-shot re-probe retry fired.
                 return {
@@ -179,12 +147,7 @@ export function renderEntwurfV2Result(result) {
  * fence types stay behind this one entry point.
  */
 export async function runAndRenderEntwurfV2FromSurface(params, opts) {
-    const prodOpts = {
-        senderProvider: opts.senderProvider,
-        agentDir: opts.agentDir,
-        // Explicit opts win (test / future surface override); otherwise the shared env SSOT.
-        prefixRoots: opts.prefixRoots ?? parseEntwurfPrefixRootsEnv(),
-    };
+    const prodOpts = { senderProvider: opts.senderProvider };
     const result = await runEntwurfV2(toDispatchInput(params), makeProductionEntwurfV2Deps(prodOpts));
     return renderEntwurfV2Result(result);
 }