@junghanacs/entwurf 0.18.1 → 0.19.0

package/AGENTS.md

@@ -30,7 +30,7 @@ For agents that own this repo: invariant principles and reproducible verificatio
 - **pi adapter** attaches a pi session to a record at `session_start`, hosts the record-keyed control socket, and exposes the native pi tool surface.
 - **Native bridges** register already-running native sessions without taking over their transcript or auth: Claude Code and Copilot CLI are mailbox/self-fetch (a Claude hook arms the watch; a forked Copilot extension holds it); Antigravity is probe-backed native-push. Codex has archived probe evidence, but its managed native lane was declined because pi already supplies the official GPT provider path; do not duplicate it as a native citizen or ACP backend.
 - **ACP plugin** registers provider `entwurf` inside a pi host session and drives a backend under an isolated overlay. The host pi session is already a record-backed socket citizen; the plugin does not mint another citizen/socket/peer layer.
-- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append/close inside the caller's own session), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), and the cwd-aware resume placement composition (`mux-resume-call.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`, Copilot `--model <name>` beside `--interactive <prompt>` and the explicit `--yolo` policy — a GLG width decision, 2026-08-25, after a callback-only `--allow-tool` grant stopped the sibling at every task tool); the Copilot backend opens through entwurf's OWN managed invocation (`entwurf copilot`), never the bare vendor, and its four required capabilities — birth, MCP hand, receiver, visible footer — are decided by `copilot-fresh-preflight.ts` BEFORE the tmux mutation, so a missing unit is a named refusal instead of a dead window; it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
+- **mux is launch-only and deliberately small.** Shipped: the tmux placement leaf (`mux-placement.ts` — inspect/append in the caller's own session, close on its whole SERVER), the visible runtime launch composition (`mux-launch.ts`), the fresh-call composition (`mux-fresh-call.ts`), the cwd-aware resume placement composition (`mux-resume-call.ts`), and the import-free leaves they inject (`classify-tmux-cwd.ts`, `resolve-tmux-session.ts`). Fresh call is exposed as `entwurf_fresh_call`; visible same-id resume is `entwurf_resume_call`, composed at the two public surfaces by injecting `mux-resume-call` into the v2-side `entwurf-v2-visible-resume.ts`. The exact import graph is enumerated in [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11. `entwurf_v2` behavior is unchanged and delivery still never imports launch. Fresh call learns a new sibling's garden id from the CALLBACK it makes, never from a lookup — so the pre-injected-token → identity-lookup design (rail §6) is **closed, not paused**. Do not reopen it without new evidence and explicit GLG re-approval. Fresh-call requires one explicit model and passes it in each runtime's measured CLI dialect (Pi `--model <provider/model>`, Claude Code `--model=<id-or-alias>`, Copilot `--model <name>` beside `--interactive <prompt>` and the explicit `--yolo` policy — a GLG width decision, 2026-08-25, after a callback-only `--allow-tool` grant stopped the sibling at every task tool); the Copilot backend opens through entwurf's OWN managed invocation (`entwurf copilot`), never the bare vendor, and its four required capabilities — birth, MCP hand, receiver, visible footer — are decided by `copilot-fresh-preflight.ts` BEFORE the tmux mutation, so a missing unit is a named refusal instead of a dead window; it also takes ONE optional literal absolute `cwd` (#73 — omitted/`""` means the caller's own directory; no trim, no realpath, no project-name resolver; classified by the shared `classify-tmux-cwd.ts` leaf; the receipt echoes the REQUEST only), so a cross-repo fresh sibling is a fresh-call fact and never a reason to resume a dormant record. It also takes ONE optional project seat, `placement.tmuxSession` (#105 — the exact name of an EXISTING session on the caller's OWN server, turned into a `$id` by `resolve-tmux-session.ts` before anything reaches `-t`). **It creates nothing** — `tmux-session-missing`/`tmux-session-name-invalid` are named refusals, no `ifMissing`/`new-session` axis exists (GLG, 2026-09-07), seat and cwd never infer each other, and close binds to the SERVER half since a placed window may sit outside the caller's session. Resume takes only an existing target id and gets transcript/model/provider/cwd from its record. Do not grow either narrow carrier into a generic driver, harness profile, arbitrary command/env selection, or a second creation API. Ownership and import prohibitions: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) §11.
 - **One delivery verb:** `entwurf_v2` addresses an existing garden id. Current routes are live control-socket send, active self-fetch mailbox enqueue, and probe-alive native-push. NO route starts a process: the hidden background resume for a dormant citizen was withdrawn under the visible-first rule, so a dormant in-domain citizen rejects as `dormant-fire-forget-unsupported` and the intent axis is single-valued. Every other complementary state pair rejects honestly too. Fresh creation is a separate verb — `entwurf_fresh_call` — and it returns a launch receipt only; the new sibling's address arrives asynchronously as the sender envelope of its nonce callback.
 
 ## Hard Rules
@@ -157,7 +157,7 @@ implement → affected focused gates → independent review → one amendment bu
 
 - **Inner loop:** run only the gates whose subject changed. Do not open the full floor to learn what a focused gate already answers.
 - **Review before floor:** independent review and its corrections close as one bundle before the full floor runs.
-- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every branch push, and release-gate carries it as a MUST step. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all; the same SHA's branch run already carries every job, and that branch run is the exact-SHA evidence a release quotes.
+- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on a branch push whose two-dot range touched the qualification surface (`scripts/ci-qualify-decide.sh` derives that path set from the manifests themselves), unconditionally on `workflow_dispatch -f qualify=true` and a weekly schedule, and release-gate carries it as a MUST step. The exact-SHA release oracle refuses a SHA whose body step did not conclude success, so a filtered-out release commit is a named failure with a documented dispatch recovery, never a quiet pass. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit carries the body concluding success — the branch run when the push moved the qualification surface, else the dispatch run the release skill's recovery creates.
 - **Full floor once** (`pnpm run check:full`), on the frozen commit candidate. While it runs, nothing edits the worktree or index — including the NEXT boot sectors; a moved candidate voids the run's evidence.
 - **pre-commit is not the floor.** `.husky/pre-commit` carries only fast static checks (whitespace, lint, typecheck); the full floor is owned by this protocol, not by the hook. Do not grow the hook back, and do not build receipt/cache machinery to prove the protocol was followed.
 - **Release/LIVE acceptance is untouched.** VERIFY.md floors keep full strength; a shorter inner loop never lowers release evidence.

package/CHANGELOG.md

@@ -4,6 +4,254 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.19.0 - 2026-09-07
+
+One lane: #105 slice ①, the project seat. `entwurf_fresh_call` gains an optional
+`placement.tmuxSession` so a fresh sibling can open in the operator's project session instead of the
+caller's own, and `closeWindow` binds to the server half so a window placed elsewhere can still be
+closed by its handle. Minor rather than patch: an optional input appears on all three public
+surfaces at once and a shipped contract moves. Slices ② (no-turn retirement) and ③ (remote routing)
+did not ship and were carried out of the issue intact before it closed, so nothing about them is
+inferred from what landed here.
+
+It also carries two repairs that were not planned: verifying this release ran the deterministic floor
+often enough to expose a defect class the repo had already written down and not finished applying —
+an early-exiting `grep -q` whose producer dies of SIGPIPE, which `pipefail` then promotes into the
+CLEAN branch of an `if`. One instance was a shipped operator doctor; the other was a credential
+tripwire that had been dead since it was written.
+
+### Added
+
+- **One project seat: `placement: { tmuxSession }` (#105).** The exact name of an EXISTING session
+  on the caller's own tmux server. **It creates nothing** — an absent session is
+  `tmux-session-missing`, a name outside `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`,
+  and both leave no window and no session behind. There is no `ifMissing`/`create` axis and no
+  `new-session` verb anywhere in the product (GLG, 2026-09-07: "없으면 reject … 다 자동화하면
+  테스트·검증 비용이 커진다"). The operator makes the seat and calls again. Omitting `placement`
+  keeps today's behaviour exactly.
+- **`pi-extensions/lib/resolve-tmux-session.ts`** — an import-free leaf owning the name grammar and
+  the name → native `$id` lookup, with its tmux runner injected so it cannot run tmux itself. The
+  engine is `list-windows -t '=NAME' -F '#{session_id}'` with absence read from the exit code, and
+  every rule in its header is a measured tmux 3.6a behaviour: the `-f` filter engine matched **every**
+  session when a name contained `}` (6/6), `display-message -p -t '=NAME'` answers rc=0 with empty
+  output for a name that does not exist, `#` is format-expanded when the name is stored, `.` and `:`
+  are tmux's own pane/window separators inside a target, and a session NAMED `$0` loses to the id
+  `$0`. Only the resolved id ever reaches `-t`.
+- **Nine kill-qualified claims and their exact-once replants, inventory 373 → 382:**
+  `TMUXSESSION-LOOKUP-ENGINE`, `TMUXSESSION-NAME-GRAMMAR`, `RESOLVE-TMUX-SESSION-IMPORT-FREE`,
+  `FRESHCALL-PLACEMENT-MISSING-REJECTS`, `FRESHCALL-PLACEMENT-TARGET-ARGV`,
+  `FRESHCALL-PLACEMENT-RECEIPT-TARGET`, `FRESHCALL-PLACEMENT-SURFACE-PARITY`,
+  `FRESHCALL-PLACEMENT-BACKEND-PARITY` and `MUX-CLOSE-SERVER-BOUND`.
+
+### Changed
+
+- **`closeWindow` binds to the SERVER half (`requireSameServer`), not the session.** A placed window
+  may legitimately live outside the caller's session, so the old handle↔now context check would have
+  refused a normal close. The session half was measured to add no protection and real harm: window
+  ids are never reused within one server's lifetime (`@1` killed → next is `@2`; a whole session
+  killed → the counter still moves), so a vanished session's handle already reaches the existing
+  `already-gone` outcome, and a session clause would have turned that into a throw. `isSameContext` /
+  `requireSameContext` are untouched and still guard `appendWindow` / `launchPi`.
+- **The seat is stated the same way on every surface an operator reads.** A documentation review
+  (pi `grok-4.6`) read README, the skill and the tool schema as three independent readers and found
+  five places where each was correct alone but a caller reading only one got the seat wrong — the
+  README's v2 section did not mention the seat at all, `docs/external-mcp-host.md` advertised the
+  verb as `{backend, model, task, cwd?}`, "an absent one is refused" read equally as an absent
+  session and an omitted placement, and the grammar lived only inside a schema `describe`. The most
+  expensive misreading had no positive statement anywhere: **naming the `org` seat does not put the
+  sibling in the `org` directory.** That is now said as a fact, not as a prohibition.
+- **A symlinked `cwd` shows two spellings of one place, and the docs now say so.** entwurf never
+  resolves the path — it hands the literal string to tmux — so the launch receipt echoes what was
+  requested while the record, the transcript path, the callback envelope and `pane_current_path` all
+  carry what the OS resolved it to. The resolved one is what `entwurf_resume_call` later reopens,
+  which is why recording it that way is load-bearing rather than incidental.
+
+### Fixed
+
+- **`entwurf doctor-omp-bridge` could report a contaminated omp process as clean.** Its carrier scan
+  read `/proc/<pid>/environ` through `tr '\0' '\n' | grep -qE …` under `set -o pipefail`. `grep -q`
+  exits at the FIRST match and closes the pipe; `tr` — still writing the rest of a ~12 KB environ —
+  dies of SIGPIPE (141); `pipefail` makes that the pipeline's status, and the `if` takes the clean
+  branch. So a live omp session whose MCP children would speak under a PARENT pi citizen's garden id
+  was reported as no contamination, and the doctor printed PASS. It is a race on how far `tr` got, so
+  it read as flakiness rather than a defect: measured on one live fixture at 5–15% of reads depending
+  on load (6/40 and 1/40 in two independent measurements; 0/40 with `pipefail` off, and the shipped
+  doctor answered PASS on 3 of 60 runs against a genuinely contaminated fixture). The scan now counts
+  with `grep -c`, which consumes all of stdin, so there is no early close and nothing to race. The
+  predicate itself is unchanged byte-for-byte — `grep -qz` would have removed the pipeline entirely
+  but also quietly changes what counts as a carrier in both directions (a `PI_SESSION_ID=` inside
+  another variable's value; a value containing a newline), so transport was fixed and contract left
+  alone. `smoke-omp-bridge-state`'s own `wait_carrier` carried the same shape, where it cost only a
+  retry, and was fixed with it.
+- **The `sync_auth` credential tripwire had never been able to fire (`check-fresh-cut-gate` D4b).**
+  Same cause, deterministic rather than racy: the producer is `awk` over a 433 KB `run.sh` emitting
+  ~229 KB, so an early-exiting `grep -q` guarantees SIGPIPE. Measured with one `sync_auth` line
+  injected as code into a copy of `run.sh`: the pipeline exited 141 on **100 of 100** runs and the
+  gate printed `ok — no sync_auth credential surface remains`, while a clean `run.sh` exits 1 and is
+  correctly green. The tripwire was blind exactly when it had something to catch, which is why a
+  green floor never revealed it. After the repair the injected copy fires 50/50 and the clean copy
+  stays silent. D7 — the cell that forbids an install from cutting a generation by itself — carried
+  the same shape and is under one pipe buffer today, so it had no SIGPIPE window; that is a size
+  coincidence rather than a property, and it was counted too.
+
+### Verification
+
+All on oracle (Linux, node 24.18.1, pi 0.85.1, tmux 3.6a).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.19.0.0HsnIq --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0, 06:06:31→07:05:45
+  (59m14s). `check-gate-qualification` as its MUST step: **385/385 KILLED**. `pnpm run check:full`
+  inside it: exit 0, 507s.
+- **`check-gate-qualification` 381/381 KILLED** on the frozen `a39b637` candidate;
+  `pnpm run check:full` exit 0 (554s).
+- **`LIVE=1 ./run.sh smoke-mux-fresh-call-live` 39/39** — four launches covering the
+  {cwd omitted, cwd requested} × {caller session, seat} matrix, reading `pane_current_path` by stable
+  pane id after a settle delay, with the seat session's own `session_path` a fourth directory no cell
+  may land in. On-demand, not a release MUST (VERIFY.md).
+- **`check-mux-launch-tmux` 36** including a real-tmux seat cell that calls production
+  `freshCall`/`closeWindow` against a second session on a private server; `check-mux-fresh-call`
+  186/186; `check-gate-manifests` 383 mutants across 40 lanes.
+- **For the two repairs above:** `smoke-omp-bridge-state` 20 consecutive green runs (it was 1 red in
+  5 before) and `check-fresh-cut-gate` 169/169 with its two new self-test cells. Three replants,
+  inventory 383 → 385, each KILLED 3/3 deterministically at its own signature:
+  `OMP-DOCTOR-CARRIER-NONBLANK-IS-RED`, `FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES` and
+  `FRESHCUT-PREFLIGHT-CUT-DETECTED`. The middle one replants the ACTUAL defect — `grep -c` back to
+  `grep -q` — and that is only a valid replant because the self-test plants its surface early in a
+  file far larger than the pipe buffer, which makes the SIGPIPE deterministic. The omp one cannot be
+  written that way: there the same restoration fails only ~15% of runs and would SURVIVE
+  qualification, so it makes the identical false-clean deterministic by another route. Same defect,
+  two replant strategies, and the difference is recorded in the manifests rather than smoothed over.
+
+### Notes
+
+- **The seat's first pass over the real MCP wire was the operator's, not a gate's.** Both mux LIVE
+  smokes were blind to that seam by construction: `smoke-mux-fresh-call-live` imports `freshCall` and
+  calls it directly, and `smoke-mux-lifecycle-live` does enter through `tools/call` but passes no
+  `placement`. Between them the bridge handler's pass-through was proven by a tools/list schema and a
+  source regex — by construction, never by execution. GLG's hand-driven review on 2026-09-07 closed
+  that: four `tools/call entwurf_fresh_call` invocations (seat, seat + cwd, absent session, off-grammar
+  name), receipts read as receipts, with the whole-server `list-windows -a` byte-identical across both
+  refusals and exactly one added line across the successes.
+- **Every seat assertion this repo owned was written against `pi`.** The unit block, the real-tmux
+  seat cell and both LIVE seat cells all passed `backend: "pi"`, so a later branch making the seat a
+  pi-only input would have gone unnoticed — while the cwd axis (#73) had carried four-backend parity
+  since it landed. The production path was already uniform (the seat becomes `targetSessionId`, the
+  backend becomes `backendArgs`, and `buildFreshCallArgs` takes them as separate parameters); what was
+  missing was an oracle saying so. `FRESHCALL-PLACEMENT-BACKEND-PARITY` is that oracle, and
+  `check-gate-manifests` caught the omission that came with it — a manifest set that drifted from its
+  declared inventory is red before any mutant runs.
+- **Two ceilings are close enough to name.** The composed ACP first-user augment sits **311 bytes**
+  under its 50 KB cap (measured: 50,889 / 51,200 with the shipped repo AGENTS.md plus a 12 KB global
+  baseline), and the MCP `entwurf_fresh_call` description sits **28 chars** under the 2048-char host
+  cap (measured: 2020). The first already bit once during this lane: the initial qualification run
+  went CONTROL-RED on `check-acp-carrier-augment` because the feature's +1207 B to AGENTS.md breached
+  a cap that had 932 B of headroom, and the text was compressed to +616 B rather than the cap moved.
+  Neither number is a gate threshold to tune; both are room that the next lane has to spend
+  deliberately.
+- **Independent review is where the second defect came from.** A `zai/glm-5.3` sibling was asked to
+  review the doctor repair and to try to disprove it, reproducing everything in an isolated snapshot
+  rather than trusting the implementer's summary. It confirmed the mechanism, corrected two claims —
+  the measured miss rate is load-dependent rather than a fixed 15%, and Copilot's immunity comes from
+  a TypeScript `readFileSync` reader rather than the Python one that was asserted — rejected the
+  `grep -qz` alternative on evidence the implementer did not have, and then found the dead credential
+  tripwire, which is the more severe of the two and was in a different lane entirely.
+- **A forbidding cell that is green on a clean tree cannot tell blindness from compliance.** That is
+  why D4b was dead for as long as it was: it printed `ok` on every run this repo ever took, and it
+  would have printed `ok` on the run that mattered. Both cells now carry a self-test that plants the
+  thing they forbid and requires the SAME predicate — factored into a function precisely so a
+  re-typed copy cannot keep passing while the real one goes blind — to see it. The `sync_auth` plant
+  goes near the TOP of the real 433 KB `run.sh` rather than into a small synthetic fixture, because
+  the defect only exists when the consumer can exit while the producer still has bulk to write; a
+  tidy fixture would pass under the very mutant that must kill it.
+- **A MUST gate can fail with the wiring intact.** `smoke-mux-lifecycle-live` is release-blocking on
+  the stated ground that a gate which TELLS the model which tool to call owns its own failures. This
+  cut met the case that rule does not describe: the wiring delivered perfectly — launch receipt, a
+  born citizen with its own garden id, the mandated first-action prompt verbatim on the visible pane —
+  and the model spent its one turn advising the operator to go to bed instead of calling back. Twice,
+  at 00:00 and 01:04, with the same cause and different wording, then green on the first daytime run.
+  Nothing was changed to make it pass: adjusting a shipped prompt to a current model's habit would
+  outlive the habit. Recorded because "MUST because failure is ours" now has a measured exception.
+- **The long-command discipline earned its receipt.** The harness low-memory watchdog killed a
+  background tool call mid-cut while `free` reported 7 GB available and the kernel logged no OOM —
+  the lead recorded in 0.18.0's notes, met directly on a release lane for the first time. The gate
+  itself, running under tmux, was untouched every time. "Long commands go in tmux" stops being a
+  preference at that point.
+- **An agent asking tmux where it is will answer wrong from a seat.** A seated sibling is opened
+  detached, so `tmux display-message -p` without `-t "$TMUX_PANE"` resolves to the target session's
+  ACTIVE window, not the sibling's own — measured, while the carrier itself was correct
+  (`TMUX_PANE=%181` in the process env). entwurf's own facts are unaffected: the launch receipt and
+  `list-windows` both name the right window. This is an agent-instruction gap and is tracked outside
+  this repo (junghan0611/sorge#7).
+
+## 0.18.2 - 2026-09-07
+
+One lane: #103, the second stage of the CI evidence budget (#99). The mutant body — 373 replants,
+~30 minutes — stops running on every branch push, and the release oracle stops accepting a run that
+did not carry it. Nothing in the runtime surface moves.
+
+### Changed
+
+- **The exact-SHA release oracle requires the qualification BODY, not three green job names (#103
+  piece 1).** `verify-exact-ci.sh` reads a fourth axis over one guard: the `check` job's
+  `Run ./run.sh check-gate-qualification` step must conclude `success`, with absent, skipped and
+  failed each named separately in the refusal. It also stops filtering to `--event push`, so a
+  `workflow_dispatch` run at the same SHA is admissible evidence — which is exactly when the
+  always-present `headSha` check starts carrying load, because `gh workflow run --ref` takes a
+  branch and never a SHA. A skipped body is not evidence: the oracle refuses that SHA and prints the
+  dispatch command that fixes it. This landed BEFORE the skip could exist.
+- **The body runs only on a branch push that moved the qualification surface (#103 piece 2).**
+  `scripts/ci-qualify-decide.sh` diffs the two-dot push range GitHub itself compares and intersects
+  it with a path set **derived from `scripts/mutants/*.json` at runtime** — no copy in YAML, so a new
+  mutant subject cannot land outside the filter. Five numbered fail-opens, each naming itself in the
+  log: an all-zero base, a forced push (whose base GitHub does not document), a dispatch without
+  `qualify=true` or a schedule, an unreadable range, and `pull_request`. `workflow_dispatch -f
+  qualify=true` and a weekly schedule run the body unconditionally; `fetch-depth: 0` on the check job
+  is what keeps the base readable, and it measured free (2s checkout, the same as depth 1).
+- **Measured on real runs, not argued.** A code push ran the body and took 36m24s
+  ([34047559085](https://github.com/junghan0611/entwurf/actions/runs/34047559085)); a docs-only push
+  skipped it and took 6m13s
+  ([34065841309](https://github.com/junghan0611/entwurf/actions/runs/34065841309)); the four-axis
+  oracle **refused** that second SHA while all three of its jobs were green, and the documented
+  dispatch recovery turned the refusal back into a pass
+  ([34066181211](https://github.com/junghan0611/entwurf/actions/runs/34066181211)). The historical
+  justification is replayed rather than remembered: all five qualification reds this repo's CI has
+  ever produced still run the body under the filter.
+
+### Added
+
+- Three kill-qualified claims and their exact-once replants, inventory 370 → 373:
+  `RELEASE-SHA-QUALIFIED-IN-CI` (the fourth axis), `QUALIFY-FILTER-COVERS-SUBJECTS` (every manifest
+  subject and signatureSource decides `run_body=true`, asserted behaviourally against the shipped
+  script), and `QUALIFY-FILTER-READS-PUSH-RANGE` (a hermetic throwaway repo with a docs-only tip over
+  a commit that touched a subject — the two-dot reading, proven without repo history).
+  `QUALIFY-FILTER-REPLAYS-PAST-CATCHES` replays the five reds from recorded file lists.
+- `scripts/fixtures/qualify-replay.json` — the five historical reds as the push ranges GitHub
+  compared, measured once here because history is not readable everywhere the gate runs.
+
+### Verification
+
+All on oracle (Linux, node 24.18.1, pi 0.85.1, omp 18.1.12 — updated from 18.0.0 during this lane).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.2.JlEU88 --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0, 3305s (55m05s).
+  `check-gate-qualification` as its MUST step: **373/373 KILLED**.
+- `pnpm run check:full` on the prepared tree: exit 0, 504s.
+- Pre-version landing run for `0f6667d`: CI run
+  [34070192960](https://github.com/junghan0611/entwurf/actions/runs/34070192960), all three jobs
+  success — and this is the first release landing judged by the fourth axis the same release adds:
+  the oracle read that run's qualification step, not just its job names.
+
+### Notes
+
+- **A gate that reads repo history cannot live in the qualification snapshot.** The replay cell first
+  read live git objects and went CONTROL-RED inside the snapshot's fresh baseline, costing the whole
+  release-gate lane its 17 kills. That is why the fixture carries file lists and the range semantics
+  are proven hermetically instead.
+- **Key order in `ci.yml` is a contract.** The body step keeps `run:` as its leading key: cell 8a
+  counts that sequence-item form exactly once, and the oracle matches GitHub's rendered
+  `Run <command>` step name, so an `if:` placed first — or any `name:` — would break both. Confirmed
+  on a real run after the filter landed.
+
 ## 0.18.1 - 2026-09-06
 
 Two lanes, both landing on `main` after `v0.18.0`: the CI evidence-budget stage 1 (#102, from

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on every branch push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -19,7 +19,7 @@ Claude Code / Copilot / Codex / agy / omp / pi
       → control-socket | meta-mailbox | native-push
 ```
 
-[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation. It starts no process on any rail: the hidden background resume that used to answer a dormant target was withdrawn under the visible-first rule, so a dormant citizen rejects honestly here and is reopened by a separate lifecycle verb, `entwurf_resume_call`. The meta-record is the sole address authority (#50 C4): a record-less control socket is refused as a `record-less-socket` diagnostic, never dispatched. The v1 entwurf verbs are gone. Fresh siblings and resumes are separate verbs — `entwurf_fresh_call` opens a NEW sibling in the operator's own tmux session and learns its garden id from the callback it makes, while `entwurf_resume_call` reopens a DORMANT pi citizen under its own garden id in a visible window without running a turn; the non-Claude ACP lane landed earlier — Snowflake Cortex Code became the second backend in 0.13.0.
+[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation. It starts no process on any rail: the hidden background resume that used to answer a dormant target was withdrawn under the visible-first rule, so a dormant citizen rejects honestly here and is reopened by a separate lifecycle verb, `entwurf_resume_call`. The meta-record is the sole address authority (#50 C4): a record-less control socket is refused as a `record-less-socket` diagnostic, never dispatched. The v1 entwurf verbs are gone. Fresh siblings and resumes are separate verbs — `entwurf_fresh_call` opens a NEW sibling in the operator's tmux — the caller's own session, or one existing named session on the same server — and learns its garden id from the callback it makes, while `entwurf_resume_call` reopens a DORMANT pi citizen under its own garden id in a visible window without running a turn; the non-Claude ACP lane landed earlier — Snowflake Cortex Code became the second backend in 0.13.0.
 
 **Garden id is deliberate vocabulary.** It is not a decorative synonym for session id, worker, delegate, or subagent. The unfamiliar word is a guard: each harness keeps its own identity and transcript, while `entwurf` supplies a narrow addressable surface between siblings.
 
@@ -454,9 +454,11 @@ LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live  # Co
 `pnpm run check:full` includes the AGY permission contract matrix and the qualification
 HEAD (`check-gate-manifests` — runner self-test, manifest-set validation, declared lane
 inventory, zero mutants executed); the committed-mutant EXECUTION is scheduled separately
-(`./run.sh check-gate-qualification` — the CI `check` job runs it on every branch push,
-and release-gate carries it as a MUST step; a tag push runs no CI, since the same SHA's
-branch run already carries every job). A gate a
+(`./run.sh check-gate-qualification` — the CI `check` job runs it on a branch push that touched the qualification surface,
+unconditionally on `workflow_dispatch -f qualify=true` and a weekly schedule, and release-gate
+carries it as a MUST step; a tag push runs no CI at all). A branch run whose body was filtered out
+is not release evidence: the exact-SHA oracle requires the run it reads to carry that step
+concluding success. A gate a
 release touches must kill its known defect for the claimed `[QK:<claim>]` reason —
 the descriptions above name what each smoke covers, and no check count is quality
 evidence on its own. Gate qualification needs the git work surface, while the matrix
@@ -511,7 +513,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, `copilot`, or `omp`) as a visible window in the operator's own tmux session, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd plus tmux coordinates and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, `copilot`, or `omp`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -530,7 +532,7 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 
 **`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, Copilot or OMP runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, Copilot or OMP runtime visibly on the caller's tmux server — its own session by default, or one EXISTING named session via the optional `placement.tmuxSession` — with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 

package/VERIFY.md

@@ -41,7 +41,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 ### The canonical floor — two entry points
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every branch push, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, because the same SHA's branch run already carries every job and is the exact-SHA evidence a release quotes) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
@@ -58,7 +58,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 >
 > Be honest about its cost, because it is a MUST: it spends real model turns on the operator's configured runtimes (two pi siblings, each resumed once, plus one Claude Code sibling), it READS the operator's real runtime config, and the siblings' native session transcripts stay in the real pi agent dir — they are not cleaned up, and they are part of the evidence a resume was real. The fence is per-axis rather than absolute: the four meta roots (records, mailbox, receivers, senders) are fixture for every cell, so no garden record is ever minted outside it; the native pi cell's control socket and v2 lock are fixture too; the ACP pi cell's are REAL and transient (see the paragraph above); and the Claude cell runs its runtime under the real HOME while its mailbox and meta stay fixture. The run ends by proving the operator's SIX real roots — the four meta roots plus `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks` — hold the entry sets they started with, with no fixture garden id anywhere, and that proof now runs on the failure path as well as the green one. Missing prerequisites decline with the protocol SKIP (97), which `release-gate --cut` refuses rather than rounding up.
 >
-> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends two model turns, and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
+> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends four model turns (two in the caller's own session, two in a second SEAT session on the same private server — the #105 seat x cwd matrix), and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
 
 > **A visible-fresh receipt outside the MUST tier is no longer the general rule — it is Copilot's preserved exception.** #87 measured what that wording permitted: because clause 7 sat outside every aggregate, a harness could be admitted as a full D6 citizen that `entwurf_fresh_call` cannot open, carry an honest "not a supported harness" sentence in the delivery matrix, and still pass the whole floor toward a cut. From OMP onward, the FIRST release of a harness admitted under the #82 contract owes its clause 7 receipt as a release-gate MUST step (`smoke-omp-fresh-live`), and the deterministic half of the same rule (`check-harness-admission-parity`, inside `check:full`) makes a citizen backend missing from `FRESH_CALL_BACKENDS` a red floor rather than a documented one. Forward-only by decision: Copilot's row is not reopened. The contract lives in `docs/adding-a-harness.md` step 9, "The release stop"; this note exists so the cost discipline above is not read as permission.
 >
@@ -76,7 +76,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
-| Exact release commit | all required CI jobs green at the exact SHA | A different green SHA is not transferable evidence. |
+| Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |

package/docs/external-mcp-host.md

@@ -11,7 +11,7 @@ the one-line registration; everything an operator needs to actually wire a host
 
   **Being garden-native is not the same as being replyable, and Copilot is the case that separates them.** Its hook writes a sender marker, so an `entwurf_v2` send carries its own garden id and the receiver learns who wrote — measured 2026-08-21 on Copilot CLI 1.0.80, where a live send arrived under its own garden id with `origin: "meta-session"` and `replyable: false`. Replyability arrived later and through a different process: a first-party extension (`run.sh install-copilot-receive`) that the CLI forks, which binds to the same V3 record and writes a receiver marker owned by its own pid (#82 RAIL 5). So a Copilot citizen is `replyable: true` exactly while that extension is armed for it, and `replyable: false` — honestly, with a real garden identity — when it is not installed, not launched with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` (which is what `entwurf copilot` sets for one invocation), not yet born, or gone. Read the two facts off different rails: the sender marker answers *who sent this*; the receiver marker answers *can a reply land*. The onboarding obligations are in [`adding-a-harness.md`](./adding-a-harness.md) step 7, and the evidence boundary — the managed LIVE acceptance that moved receive to D6, and what D7-partial / D3-pending still exclude — is in [`DELIVERY.md`](../DELIVERY.md).
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, `entwurf` or `omp` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor, while OMP is opened as the bare `omp` runtime); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?, placement?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call also accepts one optional `placement.tmuxSession`: the exact name of an EXISTING session on the caller's own tmux server, so the sibling opens in the operator's project seat rather than beside the caller. It creates nothing — an absent session is refused as `tmux-session-missing`, a name outside `[A-Za-z0-9][A-Za-z0-9_-]*` as `tmux-session-name-invalid`, and no window and no session are left behind either way. The seat and the `cwd` never infer each other: with `cwd` omitted a seated sibling starts in the CALLING agent's own directory, not the target session's path. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, `entwurf` or `omp` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor, while OMP is opened as the bare `omp` runtime); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
 Observed: Claude Code, Codex CLI, Antigravity CLI, GitHub Copilot CLI and OMP all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude, Copilot and OMP become symmetric/replyable through a mailbox-backed meta-session — Claude's watch armed by its own hook, Copilot's by the forked extension it installs, OMP's by an extension running inside the operator's own TUI process; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 
@@ -151,7 +151,7 @@ entwurf doctor-agy-hooks
 
 The three adapters deliberately own different atoms:
 
-- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox), neither is the manual `entwurf_register_native` fallback, and neither are `entwurf_fresh_call` / `entwurf_resume_call` (both launch into the caller's own tmux session, which an agy conversation is not);
+- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox), neither is the manual `entwurf_register_native` fallback, and neither are `entwurf_fresh_call` / `entwurf_resume_call` (both launch into the caller's own tmux server, which an agy conversation has none of);
 - statusline: the complete `statusLine` subtree pointing at the bare stable bin `entwurf-agy-statusline`;
 - hooks: one named `PreInvocation` hook pointing at the bare stable bin `entwurf-agy-imprint`.
 

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -26,10 +26,11 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
- *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
- *                       returns a LAUNCH receipt only, and the new address arrives later as the
- *                       sender envelope of the sibling's nonce callback.
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's tmux — the caller's own
+ *                       session, or ONE EXISTING named session on the same server (the project
+ *                       seat, #105; nothing is ever created), optionally at ONE literal requested
+ *                       cwd (cross-repo fresh, #73); returns a LAUNCH receipt only, and the new
+ *                       address arrives later as the sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
  *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
  *                       apart.
@@ -609,7 +610,7 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed " +
     "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
@@ -624,6 +625,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     "prompt, so the sibling could not call you back at all). An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+    "An optional placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an " +
+    "absent SESSION is tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
@@ -653,7 +656,15 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         .string()
         .optional()
         .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
-}, async ({ backend, model, task, cwd }) => {
+    placement: z
+        .object({
+        tmuxSession: z
+            .string()
+            .describe("EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid."),
+    })
+        .optional()
+        .describe("Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id."),
+}, async ({ backend, model, task, cwd, placement }) => {
     let callerGardenId = null;
     try {
         const self = await buildAuthoritativeSelfEnvelope();
@@ -672,7 +683,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
+        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, placement, callerGardenId }));
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {