@junghanacs/entwurf 0.14.0 → 0.14.2

package/AGENTS.md

@@ -30,7 +30,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 - **pi adapter** attaches a pi session to a record at `session_start`, hosts the record-keyed control socket, and exposes the native pi tool surface.
 - **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code is mailbox/self-fetch; Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
 - **ACP plugin** registers provider `entwurf` inside a pi host session and drives a backend under an isolated overlay. The host pi session is already a record-backed socket citizen; the plugin does not mint another citizen/socket/peer layer.
-- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`); resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/cwd/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
+- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`); it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
 - **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, active self-fetch mailbox enqueue, and probe-alive native-push. NO route starts a process: the hidden background resume for a dormant citizen was withdrawn under the visible-first rule, so a dormant in-domain citizen rejects as `dormant-fire-forget-unsupported` and the intent axis is single-valued. Every other complementary state pair rejects honestly too. Fresh creation is a separate verb — `entwurf_fresh_call` — and it returns a launch receipt only; the new sibling's address arrives asynchronously as the sender envelope of its nonce callback.
 
 ## Hard Rules
@@ -101,6 +101,17 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 - Sender envelope: `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`.
 - Human-opened and spawned/resumed siblings use the same addressing and messaging semantics.
 
+## Issue queue — a manual sweeper, not a backlog
+
+- OPEN issues are live contracts only, capped at five. A sixth means something closes first; the cap does not bend.
+- A slot is earned by a current defect or executable contract, not by importance, age, or possible future value.
+- Direction, philosophy, frozen invariants and observations without a current action live in `ROADMAP.md`, durable docs, or closed history.
+- Nothing stays open "in case." If a closed problem recurs, it returns as a new issue carrying the new evidence.
+- Anything whose only value is knowing it gets moved to the document that owns it, then closed.
+- A new issue brings the best available observation plus an executable next measurement. Recovering a missing signature may be the first acceptance; an idea with neither evidence nor a next measurement is not an issue.
+- No collection points, umbrella trackers, or fallout buckets. Merge issues only when they share one cause and one acceptance.
+- Sweep manually after a release and before opening an issue. Solved work closes at its durable SHA; it does not wait for the next release.
+
 ## Verification
 
 Two axes are required: deterministic/package gates and opt-in LIVE evidence.
@@ -169,7 +180,7 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.1 <0.85` with devDep exact `0.84.1`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- pi runtime range is `>=0.84.2 <0.85` with devDep exact `0.84.2`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
 - ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style

package/CHANGELOG.md

@@ -4,6 +4,69 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.14.2 — 2026-08-20
+
+This patch makes bridge availability a property of the exact invocation each harness will run, preserves child-exit facts across ACP transport closure, and records Copilot delivery as probe evidence without admitting a new citizen rail.
+
+### Changed
+
+- **ACTION REQUIRED — the certified runtime floor is now Pi `0.84.2`, with Claude ACP adapter `0.70.0`.** Pi's exact development pin and closed peer range move to `0.84.2` / `>=0.84.2 <0.85`; Claude ACP `0.70.0`, ACP SDK `1.3.0`, and Claude Code `>=2.1.217` are the measured support coordinates. Re-run setup after upgrading so the installed package and stable bridge launcher agree with this release. (#79)
+- **Every live-spend harness default is now `openai-codex/gpt-5.6-luna`.** The cross-harness chain, the v2 matrix, mux fresh/lifecycle, the resident garden guard, and the `entwurf-dev` skill's Pi default all name the cheaper model; the `ENTWURF_LIVE_TARGET` / `ENTWURF_CHAIN_GPT_TARGET` / `SMOKE_RGG_MODEL` overrides are unchanged. Fixture model strings are deliberately untouched — they assert exact argv or routing and spend nothing. This is a cost decision, not a gate change: no step moved tier and the LIVE gate was re-earned on the new default rather than inherited. Antigravity has no harness-side model at all (the operator opens that conversation), so its free-account fence — `gemini-3.6-flash`, never a Pro tier — is recorded in `VERIFY.md` and the `run.sh` help.
+- **Pi and Antigravity doctors boot the exact configured stdio invocation.** Runtime truth is separate from repair ownership: every effective Pi entry, including an unowned override, is probed without being overwritten; Antigravity preserves its configured `command`, `args`, and `env`. A valid MCP `initialize` response must arrive before `notifications/initialized` and `tools/list`, and the returned surface must equal the seven public Entwurf verbs. Closes #81.
+
+### Added
+
+- **A direct-native Copilot raw probe records one bounded Linux observation without claiming support.** The current probe binds a unique marker body to `user.message.interactionId`, then to one `assistant.turn_start.turnId`, and accepts only assistant events from that turn; missing or ambiguous identity fails closed, the control session rejects any `user.message` or `assistant.*` event, and cleanup is bounded. The earlier 2026-08-19 L4 observation used a chronological slice on one workstation and its stdout was not archived, so it is not evidence that the corrected named-turn contract has run LIVE. Copilot remains outside `MetaIdentity`, backend registries, `entwurf_v2`, native-push, fresh, and resume; admission work is tracked in #82.
+
+### Fixed
+
+- **ACP prompt failures no longer lose child exit facts when transport EOF arrives first.** A one-shot child-end latch gives an already-failed turn a bounded post-mortem settle before Entwurf teardown, preserving the original backend error plus lifecycle phase, exit code, signal, stderr tail, or an honest bounded absence. It adds no running-prompt timeout, replay, watcher, supervisor, or recovery API; #72 remains open for the natural retained-child death cause.
+- **A configured bridge cannot pass because its name resolves, its defaults boot, or it answers `tools/list` before initialization.** Pi and Antigravity reject dead overrides, argument/environment-specific failures, invalid invocation shapes, malformed initialize replies, missing/extra verbs, and foreign or relocated launchers while retaining the rule that Entwurf never clobbers a launcher it does not own.
+- **The release gate boots the operator's CONFIGURED Pi bridge invocation before it reaches the LIVE tier.** `check-bridge` only proves the launcher this checkout ships, so a relocated or shimmed `entwurf-bridge` that `command -v` resolves while `exec` returns 127 used to stay invisible until sixteen LIVE steps and real model spend later. `doctor-pi-provider` is now a release-gate MUST `run_step` — not LIVE-gated, with no skip arm — so that class fails in about a second instead of after a model turn. (#81 follow-up)
+- **The bridge probe preserves the launcher's own stderr across fast exit and asynchronous stdin `EPIPE`.** It installs the pipe error guard before the first write, consumes newline JSON-RPC frames once, and waits for process exit plus stderr end before issuing the exit verdict, so a Node stack trace cannot replace the diagnostic the operator needs.
+
+### Verification
+
+- **Landing SHA `d0fb8e6a37d401fc5ef660c90c1051db4b0811e8`** passed exact-SHA GitHub Actions run [32230953648](https://github.com/junghan0611/entwurf/actions/runs/32230953648): `check`, `install-surface`, and `artifact-consumer` all concluded success. At that SHA the combined landing candidate passed focused bridge 11/11, Pi provider 52/52, Antigravity 177/177, qualification **184/184 killed**, and `pnpm run check:full` in 315s before push. Those two numbers belong to `d0fb8e6` and are kept as its record — they are not this release's shipped figures.
+- **The accepted 0.14.2 candidate** passed qualification **185/185 killed** — the `release-gate` lane grew 11 → 12 with `PI-DOCTOR-IS-RELEASE-MUST`, added by `877b4da` — and `pnpm run check:full` in 207s standalone / 209s inside the gate (remeasured 2026-08-20; `run.sh` is a mutant subject, so the pre-edit 311s does not describe this tree). **185 is the shipped inventory.**
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.2.c5VqTP --cut` — MUST PASS=21 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** Log: `/tmp/entwurf-release-gate-0.14.2.c5VqTP/release-gate.log` (SHA-256 `27346d86be4a1a96a8ea8cab97687fcce807e4fa4bd6e3d179b91f85dbbcbe53`). Both model-in-loop lifecycle steps ran on the new default: `smoke-entwurf-chain-live` and `smoke-mux-lifecycle-live` passed with `openai-codex/gpt-5.6-luna`, so the cheaper default is proven LIVE rather than assumed. Cortex stayed the documented on-demand axis and is not part of this aggregate.
+- The new hermetic `check-probe-bridge-command` lane requires sequential initialization, exact tool equality, stderr preservation, bounded cleanup, and the stdin `EPIPE` guard; its `bridge-command-boot` qualification lane carries nine claims within the shipped 185-mutant inventory.
+
+### Notes
+
+- Snowflake Cortex has neither a subscription nor a free tier reachable from the source-owning host (measured 2026-08-20), so `smoke-acp-cortex-live` can only report protocol SKIP here. That is an absent axis, not a pass, and no other backend substitutes for it.
+- Copilot is probe-only in this release. #82 owns authentication, permission, liveness, stale/crash, operator-session cleanup, durable LIVE evidence, and the final admit/reject decision.
+- #76 (subscription-first refusal of `openrouter/*` sibling launches), #78 (macOS/native-Windows portability evidence), #80 (public vocabulary), and the remaining #72 field-cause investigation stay outside this patch.
+
+## 0.14.1 — 2026-08-13
+
+This patch fills the cross-repository creation gap in the visible mux lifecycle shipped in 0.14.0, so one operator tmux session can form siblings in multiple project roots without borrowing a dormant session as a cwd carrier.
+
+### Added
+
+- **`entwurf_fresh_call` accepts one optional literal absolute `cwd` for cross-repository siblings.** Omitting it (or passing `""`) keeps the caller's current directory; Pi and Claude Code receive the selected directory through their existing visible launch path, and the launch receipt reports the requested value without claiming runtime acceptance.
+
+### Changed
+
+- **The lifecycle selection matrix now separates address, continuity, and project root.** Use `entwurf_v2` for an existing live citizen, `entwurf_resume_call` only for continuity with a dormant Pi citizen under its recorded cwd and garden id, and `entwurf_fresh_call` for a new sibling — omitting `cwd` for the caller's project or passing an absolute `cwd` for another repository. Resume is not a substitute for cross-repository fresh creation.
+
+### Fixed
+
+- **The Claude meta-bridge installer relinquishes its retired ownership of `skipDangerousModePermissionPrompt`.** Proven prior install state is restored once when the value is still exactly entwurf's former managed value; operator-changed or unproven values remain untouched, malformed ownership evidence fails loud, and later uninstall cannot overwrite the returned choice.
+- **The cross-harness chain LIVE smoke no longer inherits the runner's `PI_SESSION_ID` / `PI_AGENT_ID`.** When release-gate (or any pi `--entwurf-control` parent) spawned hop A, the MCP bridge preferred those carriers over A's SessionStart meta-sender marker and stamped the runner's garden id on hop 1 — payload still traversed, identity assertion failed. Child env now strips the pi identity carriers so the Claude hop's own marker is authoritative.
+
+### Verification
+
+- Release-gate candidate: the in-gate `pnpm run check:full` exited 0 in 208s, and `./run.sh check-gate-qualification` killed **173/173** committed mutants.
+- `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.1.j2eAVu --cut` — **MUST PASS=20 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Full log: `/tmp/entwurf-release-gate-0.14.1.j2eAVu/release-gate.log` (SHA-256 `bdd4d0b332d08c24210e9f56382b5898c0544fb6dffbf70287dade2f00e67c36`).
+- Pre-tag installed-consumer diagnostics also passed: `./run.sh check-pack-install` installed the 0.14.1 tarball and proved the seven-tool boot plus physical delivery; `ENTWURF_REQUIRE_DOCKER=1 ./run.sh check-install-container` reached `container-consumer: PASS` in a checkout-invisible non-root Node 24 consumer (throwaway candidate SHA-256 `48778d33d1088af8078fe6b59ad932fb34ac8564e80bef84c34b25bab2bd5ef6`). These are diagnostic pack-once artifacts, not the preserved release candidate.
+- On the source-owned operator host, `./run.sh install-meta-bridge` completed the retired-warning relinquishment and `./run.sh doctor-meta-bridge` passed with live MCP owner join, physical delivery, and writer parity. Exact prepared-HEAD CI and acceptance of one preserved immutable candidate remain `make` responsibilities.
+
+### Notes
+
+- #76 (subscription-first refusal of `openrouter/*` sibling models), #60, #72, and #75 remain outside this patch.
+- The chain-smoke repair only scrubs ambient pi identity carriers from its children. The MCP bridge's existing pi-carrier precedence is unchanged; any general nested-runner product guard is a separate contract, not part of 0.14.1 or #76.
+
 ## 0.14.0 — 2026-08-08
 
 Two arcs meet in this release. The product arc makes sibling sessions **visible**: opening and resuming a garden citizen is now an explicit, observable act, and the hidden alternatives were removed rather than kept as compatibility surface. The verification arc keeps the product from being swallowed by its own test cost: the everyday gate now runs in under a minute while the release floor stays strict. Claude Code native + pi + the meta-record store remain the main rail; the ACP backends (Claude ACP, Cortex) are optional service adapters on top of it.

package/DELIVERY.md

@@ -81,6 +81,7 @@ D8 robustness: partial reason="..."
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. |
 | **Codex app-server-backed TUI** | verified probe | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. No managed citizen lane yet. |
 | **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. |
+| **Copilot CLI TUI+server** | verified probe | D7; D8 unproven | **Old chronological-slice run; the named-turn probe in the tree is unrun.** Official SDK over hidden `--ui-server`: foreground native id + metadata, two-session addressed idle enqueue, same-session auto-model reply, completion events read back through the official session event-history API. Loopback RPC authentication is not established; no managed citizen lane. Evidence is L4 direct-native on ONE Linux workstation, host-local stdout, not archived. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 
 “Verified probe” means the transport worked in a reproducible raw probe but entwurf
@@ -126,6 +127,62 @@ shipping commitment: GLG closed the managed native Codex lane on 2026-08-01 beca
 already supplies the official GPT provider path. Entwurf will not duplicate it as a
 native citizen or ACP backend. `turn/steer` is active-turn steering, not idle wake.
 
+### Copilot CLI: TUI+server is the positive launch mode
+
+**Two things are recorded here and they are not the same thing: what was MEASURED on
+2026-08-19, and what the probe now CONTRACTS to measure.** The measurement below was
+taken with the earlier chronological-slice probe, which scored the events following the
+marker's position in the history. The current probe scores a named turn instead (next
+subsection). No result below has been re-taken under that contract, and none of it is
+retroactively a demonstration of it.
+
+**Measured 2026-08-19 (old chronological-slice probe).** A plain Copilot TUI and shell
+command hooks do not establish the measured route. CLI 1.0.80 launched with hidden
+`--ui-server --port <port>` and joined by first-party `@github/copilot-sdk` 1.0.11 did:
+protocol-v3 ping, foreground session id plus cwd/git metadata, exact session resume, idle
+`enqueue`, same-session model-`auto` reply, and `assistant.message`/`turn_end`/`session.idle`
+completion. A second run created a no-turn control session B, targeted A, and proved B
+received no user/turn/assistant event, closing D3 on one Linux workstation.
+
+The two-session shape also exposed a D8 gap: A visibly replied and persisted
+`assistant.message` + `turn_end`, but the joining SDK client did not receive ephemeral
+`session.idle`, so SDK `sendAndWait()` timed out. Bounded reads of the official session
+event-history API (`session.getEvents()` / `getMessages()`) then observed the completed
+target turn. Claim that at its real size: it is the SDK's own full event history, not a
+narrower or more privileged view, and equally not TUI, file, or database transcript
+scraping — the probe never reads Copilot's own storage. It is probe evidence, not a
+product polling/retry design.
+
+**Evidence level for everything above: L4 direct-native, ONE Linux workstation, one run.**
+The receipt is host-local probe stdout; it was not archived as a durable artifact, so this
+row is reproducible-by-instruction, not citable to a stored file.
+
+**Current probe contract (not yet run LIVE).** Attribution is now a named chain rather
+than a position in the history: the probe's unique marker body must match exactly one
+`user.message`; that event's `interactionId` must open exactly one `assistant.turn_start`;
+that turn_start must expose a `turnId`; and only `assistant.message` / `assistant.turn_end`
+carrying that `turnId` are scored. Every link is required, and absent-or-ambiguous fails
+the probe closed — there is no positional fallback and no "the turn after ours" rule.
+Note what is deliberately NOT the key: `session.send()` resolves to the SDK's own
+submission handle, a string that appears on no server event and is a different axis from
+`user.message.id`/`interactionId`, so joining on it cannot hold. It is logged as a
+diagnostic only. The next LIVE turn is what would demonstrate this contract; until then
+it is a design, not evidence.
+
+The probe also stays out of the operator's lifecycle, stated precisely: it never deletes
+target session A and issues no `A.disconnect()` of its own. `client.stop()` does tear down
+every tracked session — A included — as a wire `session.destroy`; because A's foreground
+ownership is re-confirmed immediately before teardown, the TUI keeps A as its foreground
+session, so the net effect on A is detach-equivalent, not removal.
+
+This is not yet admissible as a native-push adapter. The flag is hidden from CLI help,
+and the loopback JSON-RPC server did not enforce the SDK connection token in the
+measured launch: an unauthenticated client connected, while a token-bearing client was
+rejected as `AUTHENTICATION_NOT_CONFIGURED`. The TCP port is only a runtime endpoint,
+never identity authority. Do not add a record backend or dispatch route until
+permission ownership, stale/crash handling, and a supported fail-closed local
+boundary are demonstrated.
+
 ## Recording a new claim
 
 For every matrix change, record:

package/README.md

@@ -114,6 +114,12 @@ npx entwurf install .
 npx entwurf check-bridge
 ```
 
+For an npm upgrade, rerun the install command in the same scope (use
+`@junghanacs/entwurf@latest` when you want the registry's stable line explicitly),
+then make the first check from that same scope: `entwurf check-bridge` for a global
+install or `npx entwurf check-bridge` for a project-local install. Native-harness
+installers and process restarts remain a separate post-upgrade step below.
+
 For manual MCP registration from a project-local install, point the host at:
 
 ```text
@@ -139,12 +145,16 @@ pnpm install
 
 A development clone runs the bridge source through Node's strip-types path;
 an npm-installed package runs the prebuilt JS under `mcp/entwurf-bridge/dist/`
-because Node refuses to strip `.ts` files under `node_modules`.
+because Node refuses to strip `.ts` files under `node_modules`. The dev launcher's
+source path means `./run.sh check-bridge` needs no build. After `git pull`, however,
+run `pnpm install` when the lockfile changed and run `pnpm run build-bridge` before
+artifact-consuming checks such as `./run.sh check-bridge-delivery`: `dist/` is
+gitignored and may be absent or stale immediately after a checkout or pull.
 
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.84.1 <0.85`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.84.2 <0.85`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -218,9 +228,8 @@ host evidence boundaries are [VERIFY.md](./VERIFY.md) and [BASELINE.md](./BASELI
 
 The curated model registry exposes unprefixed Claude ids plus `cortex-` rows.
 Codex is not an ACP backend or a shipped managed citizen lane: it has verified
-native-delivery probe evidence only. Release 0.14.0 does not add Codex support;
-any future managed lane still owes lifecycle, identity, installation, and doctors
-before calling it supported.
+native-delivery probe evidence only. No managed Codex support is claimed; lifecycle,
+identity, installation, and doctors remain prerequisites for any such lane.
 
 **Snowflake Cortex Code is the second ACP backend** (contract and audit:
 [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)). Curated ids are
@@ -418,7 +427,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / Claude-Code-meta-mailbox / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi` or `claude-code`) as a visible window in the operator's own tmux session, requires an explicit model, passes that model on the runtime CLI, and hands it a first task; the sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model plus tmux coordinates and never claims that the runtime accepted the model or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / Claude-Code-meta-mailbox / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi` or `claude-code`) as a visible window in the operator's own tmux session, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; the sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd plus tmux coordinates and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -437,7 +446,7 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 
 **`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi or Claude Code runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect, returns only a synchronous launch receipt, and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi or Claude Code runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 

package/VERIFY.md

@@ -43,16 +43,16 @@ Verification here is not a benchmark. In production we exchange short turns and
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
 - **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
-  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
+  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), and `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end. (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
   - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
 
-> **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The release aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass.
+> **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The release aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass. **Operator-host limit (2026-08-20, measured):** the source-owning host has no Snowflake subscription, and Cortex Code offers no free tier that a live turn can reach — a direct attempt confirmed it. So on this host `smoke-acp-cortex-live` can only ever report protocol SKIP, and no LIVE Cortex evidence can be produced here until Snowflake supplies a free-usable route or the account is subscribed. Record that SKIP as an absent axis; never soften it into a pass, and never substitute a different backend as Cortex evidence.
 >
 > A cut that touches the prompt-lifecycle contract (no wall clock on a running turn) owes one long-turn acceptance the aggregate floor is too short to carry: `LIVE=1 ./run.sh smoke-acp-long-turn-live` drives a real turn whose tool work outlasts the retired 600s cutoff and requires exactly one cold ACP bootstrap in the transcript. It takes >12 minutes by construction and is on-demand, not part of `release-gate`.
 >
-> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-5.6-terra` and recorded-ACP `entwurf/claude-sonnet-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
+> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-5.6-luna` and recorded-ACP `entwurf/claude-sonnet-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
 >
 > One cell cannot be fully fenced, and that is recorded rather than glossed: the recorded-ACP pi cell runs under the operator's REAL home, because its provider spawns `claude` as a child that authenticates from there — measured, a fenced HOME kills that turn with `Authentication required` before the model is ever reached, and `CLAUDE_CONFIG_DIR` alone does not fix it. That is the same trade `smoke-acp-bundled-mcp-live` already makes. While that cell runs, its citizen's control socket and per-gid lock exist under the operator's own `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks`; its meta store stays fixture, so no garden record is minted outside the fixture, and the run ends by proving all six real roots hold the entry sets they started with, with no fixture garden id and no leftover lock.
 >
@@ -60,7 +60,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 >
 > **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends two model turns, and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut.
 >
-> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence.
+> The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence. **Cost fence:** the agy conversation this smoke drives runs on a free account, so open it on `gemini-3.6-flash` — never a Pro tier. The model is the operator's choice at conversation-open time; entwurf never selects it, and no assertion reads it (see the shipped-lane note: model display is not part of the agy contract).
 >
 > Authoritative per-cut counts and digests live in BASELINE/CHANGELOG, not inline
 > here; embedding them in the protocol makes a correct guide stale after every cut.

package/demo/README.md

@@ -2,6 +2,8 @@
 
 > **Archived pre-0.12 evidence.** These scripts still describe the retired v1 `entwurf` / `entwurf_resume` / `entwurf_send` demo flow. They are kept for historical comparison and will be replaced by a v2-native retake in a post-0.12 follow-up; do not treat them as the current 0.12 runnable recipe.
 
+> **Model ids here are archived, not recommended (2026-08-20).** The `entwurf/gpt-5.4` rows below record what these GIFs actually ran on. They are stale twice over: `entwurf/gpt-5.4` is no longer a curated `entwurf` ACP id at all — that provider serves only the `claude-*` and `cortex-*` rows in `pi-extensions/lib/acp/models.ts` — and the live-spend default has since moved to `openai-codex/gpt-5.6-luna` under a cheaper plan. Read them as a record of the recording, never as a default to copy; the current defaults live in `VERIFY.md` and `NEXT.md`.
+
 Two recorded GIF scripts live here. Both use `asciinema` for capture and
 `agg` for cast → GIF conversion. Both share the same gitignore policy
 (`*.cast` global, `demo/*.gif`, `demo/*.log` — only the `.sh` and this
@@ -137,7 +139,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.84.1)
+- `pi` on PATH (current floor 0.84.2)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/demo/demo-baseline.sh

@@ -7,6 +7,17 @@
 #   2. Entwurf surface — spawn a sibling via the entwurf tool and receive its
 #      reply in the same pane (cross-model, mode=sync).
 #
+# ARCHIVED pre-0.12 evidence — NOT a runnable recipe. Scene 2 drives the retired
+# v1 `entwurf` verb, which the 0.12 cutover removed. Kept for historical
+# comparison only. See demo/README.md.
+#
+# MODEL NOTE (2026-08-20). The model ids below are the ARCHIVED values these
+# recordings actually used — they are kept as the historical record, not as a
+# recommendation. Two things are stale about them: `entwurf/gpt-5.4` is no
+# longer a curated `entwurf` ACP id at all (that provider serves only the
+# claude-* and cortex-* rows in pi-extensions/lib/acp/models.ts), and GLG's
+# live-spend default moved to `openai-codex/gpt-5.6-luna` on a Plus plan. Do
+# NOT copy these ids into a live harness default — see VERIFY.md and NEXT.md.
 # Layout (tmux, 220x50):
 #   pane 0 (single) — driven pi (claude-sonnet-5) — receives both prompts.
 #
@@ -32,7 +43,7 @@ DRIVER_LOG="$OUTDIR/baseline-debug.log"
 # Driven pi runs the bridge surface and answers both prompts.
 DRIVER_MODEL=${DRIVER_MODEL:-entwurf/claude-sonnet-5}   # pias
 # Sibling spawned via entwurf in scene 2 — different backend for contrast.
-SIBLING_MODEL=${SIBLING_MODEL:-entwurf/gpt-5.4}            # piat
+SIBLING_MODEL=${SIBLING_MODEL:-entwurf/gpt-5.4}            # piat — ARCHIVED id, see MODEL NOTE above
 SIBLING_CWD=${SIBLING_CWD:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}
 
 # Pacing in seconds.

package/demo/demo.sh

@@ -7,6 +7,14 @@
 # See demo/README.md. Scene 3's delivery proof was recovered as a deterministic gate
 # (scripts/check-bridge-delivery.ts); the v2-native retake is a post-0.12 follow-up.
 #
+#
+# MODEL NOTE (2026-08-20). The model ids below are the ARCHIVED values these
+# recordings actually used — they are kept as the historical record, not as a
+# recommendation. Two things are stale about them: `entwurf/gpt-5.4` is no
+# longer a curated `entwurf` ACP id at all (that provider serves only the
+# claude-* and cortex-* rows in pi-extensions/lib/acp/models.ts), and GLG's
+# live-spend default moved to `openai-codex/gpt-5.6-luna` on a Plus plan. Do
+# NOT copy these ids into a live harness default — see VERIFY.md and NEXT.md.
 # Layout (tmux, 220x50):
 #   pane 0 (top)    — peer pi (codex, gpt-5.4)       — idle, waits for greeting
 #   pane 1 (bottom) — sender pi (claude-sonnet-5)  — driven by send-keys
@@ -37,7 +45,7 @@ PEER_LOG="$OUTDIR/peer-debug.log"
 SENDER_LOG="$OUTDIR/sender-debug.log"
 
 # Models match the user's piat / pias aliases.
-PEER_MODEL=${PEER_MODEL:-entwurf/gpt-5.4}        # piat
+PEER_MODEL=${PEER_MODEL:-entwurf/gpt-5.4}        # piat — ARCHIVED id, see MODEL NOTE above
 SENDER_MODEL=${SENDER_MODEL:-entwurf/claude-sonnet-5}  # pias
 
 # Pacing in seconds. Tuned from real runs: each scene's actual agent work

package/docs/acp-backend-rail.md

@@ -70,7 +70,7 @@ none.** A turn ends only on a lifecycle event:
 |---|---|
 | the agent answers | mapped through the terminal set above |
 | the operator aborts | ACP `session/cancel` first — the agent closes its own turn (`cancelled → aborted`); process-group teardown only after a bounded grace, so an abort always returns |
-| the child dies / stdio ends | the turn fails naming the exit status and the session-scoped stderr tail, on both the new and the reuse path |
+| the child dies / stdio ends | the turn fails naming the exit status and the session-scoped stderr tail — or an honest bounded absence when transport EOF wins the race — on both the new and the reuse path |
 
 Elapsed time is not evidence of failure, and a silent turn is not a failed turn: tool
 use, reasoning, and provider queueing all legitimately outrun any number we could pick.
@@ -85,6 +85,102 @@ turned one long turn into four in 0.13.0. Gates: `check-acp-prompt-lifecycle` (b
 with pi's own classifier as the oracle), `check-probe-ordering` (no production prompt
 cutoff in source).
 
+## Support contract (#81)
+
+What "supported" means here, per declaration class. The classes are kept apart on purpose: one
+undifferentiated "supported" column is what let a Claude PASS read as if it also certified Cortex.
+
+| Surface | Declaration | Class | What a green actually says |
+|---|---|---|---|
+| Entwurf package | `0.14.1` | shipped baseline | the package contract these rows belong to |
+| pi runtime | devDep exact `0.84.2`, peer `>=0.84.2 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.2; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| ACP wire SDK | `@agentclientprotocol/sdk 1.3.0` | **exact** | the shared wire oracle both adapters speak |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.70.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude Agent SDK | `0.3.232` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
+| Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
+| Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
+| Node | `>=24` (`engines.node`) | **floor** | single axis, derived everywhere else |
+| Cortex Code | operator-installed CLI | **on-demand**, external | NOT a pinned dependency. Each LIVE record must name the exact CLI version it measured |
+
+Current Cortex host reading: **`Cortex Code v1.1.52`, observed on the reference host `oracle`
+(2026-08-19)**. This is an OBSERVATION of what happens to be installed, not a pin, not a range, and
+not a direct LIVE certification — no Cortex evidence record is created by writing it down. It is
+recorded here only so the on-demand row names a concrete number instead of an abstraction.
+
+Reading rules that do not bend:
+
+- **Claude PASS never certifies Cortex, and a Cortex SKIP never becomes a PASS.** They are separate
+  evidence axes with separate records; Cortex stays outside the Claude release floor.
+- **Exact** means one measured build. **Range** means a closed accepted interval. **Floor** means a
+  minimum entwurf enforces itself. **On-demand** means the operator supplies the runtime and the
+  evidence names its version — presence of an adapter certifies no external release.
+- A declared pin is not evidence. Package/deterministic gates bind the declarations
+  (`check-dep-versions`, `check-acp-sdk-surface`, the pack/install consumer gates); LIVE gates carry
+  the runtime claim.
+
+### Minimum core value
+
+One provider identity, `entwurf`, with model-id routing to backend adapters. The host pi session is
+already the record-backed socket citizen; the ACP plugin mints no second citizen, socket, or peer
+layer. Backend differences stay behind `adapterSettings` and adapter methods, and the turn sequence
+stays backend-invariant.
+
+Supported: one real model turn; curated routing with authoritative model enforcement; a narrow
+callable tool surface; explicit MCP wiring including the entwurf bridge; session reuse with
+delta-only user history; operator cancellation with bounded cleanup; honest terminal/error mapping.
+
+Not supported, by design: workflow ownership, planner state, a memory DB, transcript hydration,
+credential proxying, or a second harness inside pi.
+
+### Capability posture
+
+`clientCapabilities: {}` is the support posture, not an oversight. Optional upstream features do not
+become reachable merely because an adapter ships them — but they stay out of reach for **two
+different reasons, and collapsing them would hide a real risk**:
+
+- **Capability-gated.** AIR typed session failures, the 0.69.0 AIR file-change report, terminal
+  output widgets and nested subagent transcripts each test a client capability entwurf does not
+  send, so the adapter itself keeps the legacy path.
+- **Advertised but never called.** Some surfaces carry no capability prerequisite at all — 0.70.0's
+  `providers/list` / `providers/set` / `providers/disable` are advertised unconditionally. They are
+  unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
+  enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+
+Adopting either class requires a separate observed need plus a complete rendering/lifecycle/evidence
+contract. An optional upstream feature is not a core-value gap.
+
+### Bump / defer rubric
+
+`claude-agent-acp latest` is not a work queue. Certify when at least one holds:
+
+- a turn/session/error path reachable under the default capability posture changes;
+- the Claude Agent SDK, ACP SDK, peer resolution, pi floor, or backend process contract moves;
+- a security, compatibility, or observed runtime defect requires the release;
+- accumulated inactive minors are best folded into the next meaningful certification.
+
+Otherwise record and defer. Every certification separates declared pins, deterministic/package
+evidence, Claude LIVE aggregate evidence, and Cortex direct on-demand evidence (with its CLI
+version). Per-bump measurements live in the ROADMAP **Dep bump(별도 트랙)** ledger.
+
+### Bridge reachability is part of the contract
+
+Explicit entwurf-bridge connectivity inside an ACP turn is core value, so it is measured rather than
+assumed. `command -v` succeeding is not evidence: a launcher can resolve and still fail to exec (a
+relocated package-manager shim deriving its target from `$0` exits 127), which leaves a turn with no
+`mcp__entwurf-bridge__*` tool at all while every ownership check reads green. Both doctors therefore boot the exact configured stdio invocation — `command`, `args`, and
+`env` — and require the full bridge verb set back over one shared leaf
+(`./run.sh probe-bridge-command <cmd>` runs a simple command standalone; the agy doctor passes
+its JSON invocation). The probe waits for a valid MCP `initialize` response before it sends
+`notifications/initialized` and `tools/list`; a tools response alone is not boot evidence.
+
+- **agy** probes every configured candidate invocation.
+- **pi** probes every effective stdio invocation, including a legacy managed path or unowned
+  override. Runtime truth says whether the command pi will launch works; ownership separately says
+  whether entwurf may repair or normalize it.
+
+entwurf never repairs a launcher it does not own — a foreign one is reported fail-loud with the
+operator's repair named.
+
 ## Shipped adapters
 
 | Seam | Claude | Cortex Code |
@@ -159,10 +255,13 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.66.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.70.0 nor the Cortex landing adds a client-side
 readiness fence, and `mcpServerStatus()` is not called by the common loop.
-(Re-measured at the 0.65.0 → 0.66.0 bump: the goal extension is not a fence,
-and `mcpServerStatus` appears nowhere in the 0.66.0 adapter source.)
+(Re-measured at the 0.68.0 → 0.70.0 bump: AIR typed failures and the 0.69.0 AIR
+file-change report are both capability-gated and unadvertised by entwurf; 0.70.0's
+`providers/set` / `providers/disable` are advertised unconditionally by the adapter but
+entwurf calls neither, so no session's provider state is transitioned; goal extension is
+still not a fence. This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
 

package/docs/external-mcp-host.md

@@ -9,7 +9,7 @@ the one-line registration; everything an operator needs to actually wire a host
 - **plain external MCP host**: no garden meta-record / sender marker. It can call the read surfaces (`entwurf_peers`, `entwurf_inbox_read`), but `entwurf_v2` sends are **refused by default** (#50 C4: "if we don't know who sent it, we don't send it"). The operator may wire the explicit hatch below; the send then goes out external/non-replyable.
 - **garden-native native session**: a trusted lifecycle hook minted a garden id and sender marker — `SessionStart` for Claude Code, `PreInvocation` for agy. It is not a pi control-socket session, but it can be replyable by garden id when its own mailbox/probe rail says so.
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call needs its selected runtime (`pi` or `claude`) on the server's PATH; resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime (`pi` or `claude`) on the server's PATH; resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
 Observed: Claude Code, Codex CLI, and Antigravity CLI all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude becomes symmetric/replyable through its mailbox-backed meta-session; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 

package/docs/setup-clean-host.md

@@ -11,7 +11,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm | bundled with Node | package installation |
 | entwurf | `@junghanacs/entwurf` | all lanes |
-| pi | optional, `@earendil-works/pi-coding-agent >=0.84.1 <0.85` | ACP provider, control sockets |
+| pi | optional, `@earendil-works/pi-coding-agent >=0.84.2 <0.85` | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
@@ -56,7 +56,7 @@ lists the seven garden tools; it does not prove a backend model turn or native h
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.1
+npm install -g @earendil-works/pi-coding-agent@0.84.2
 pi --version
 
 cd ~/entwurf-smoke
@@ -64,7 +64,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.1 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.84.2 <0.85`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.