@junghanacs/entwurf 0.18.2 → 0.20.0

package/README.md

@@ -19,7 +19,7 @@ Claude Code / Copilot / Codex / agy / omp / pi
       → control-socket | meta-mailbox | native-push
 ```
 
-[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation. It starts no process on any rail: the hidden background resume that used to answer a dormant target was withdrawn under the visible-first rule, so a dormant citizen rejects honestly here and is reopened by a separate lifecycle verb, `entwurf_resume_call`. The meta-record is the sole address authority (#50 C4): a record-less control socket is refused as a `record-less-socket` diagnostic, never dispatched. The v1 entwurf verbs are gone. Fresh siblings and resumes are separate verbs — `entwurf_fresh_call` opens a NEW sibling in the operator's own tmux session and learns its garden id from the callback it makes, while `entwurf_resume_call` reopens a DORMANT pi citizen under its own garden id in a visible window without running a turn; the non-Claude ACP lane landed earlier — Snowflake Cortex Code became the second backend in 0.13.0.
+[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation. It starts no process on any rail: the hidden background resume that used to answer a dormant target was withdrawn under the visible-first rule, so a dormant citizen rejects honestly here and is reopened by a separate lifecycle verb, `entwurf_resume_call`. The meta-record is the sole address authority (#50 C4): a record-less control socket is refused as a `record-less-socket` diagnostic, never dispatched. The v1 entwurf verbs are gone. Fresh siblings and resumes are separate verbs — `entwurf_fresh_call` opens a NEW sibling in the operator's tmux — the caller's own session, or one existing named session on the same server — and learns its garden id from the callback it makes, while `entwurf_resume_call` reopens a DORMANT pi citizen under its own garden id in a visible window without running a turn; the non-Claude ACP lane landed earlier — Snowflake Cortex Code became the second backend in 0.13.0.
 
 **Garden id is deliberate vocabulary.** It is not a decorative synonym for session id, worker, delegate, or subagent. The unfamiliar word is a guard: each harness keeps its own identity and transcript, while `entwurf` supplies a narrow addressable surface between siblings.
 
@@ -79,6 +79,33 @@ A few words that look unusual for a coding tool.
 
 ## Install
 
+**Platform evidence, in one breath.** The Entwurf-only install surface on
+macOS is CERTIFIED (CI) (`macos-install-surface`). On macOS every
+garden-native harness rail (pi, Claude, Copilot, OMP, agy), marker join,
+ACP turn, and mux is NOT CERTIFIED — pending physical host; on Linux those
+same rails are the certified axis. native Windows is UNSUPPORTED.
+CERTIFIED (CI) is weaker than a physical-host doctor green.
+The npm package has no `os` restriction; that is installability, not a
+support claim.
+
+**macOS in this release.** This release adds macOS support for Entwurf's
+install surface: the npm package installs, `entwurf --help` and `entwurf
+check-bridge` boot, and `entwurf setup` composes the integrations it finds.
+The four installers that previously rejected Darwin by platform name no longer
+do. We validated that surface only in macOS CI because the developers did not
+have a physical Mac. So macOS native-harness rails—marker join, an ACP turn,
+and mux included—are not yet certified; setup writes their wiring but reports
+them non-green. Linux's certified rail status is unchanged.
+
+On Darwin, `entwurf setup` that detects a harness is intentionally
+non-green: the wiring WAS written and nothing failed to install, but the
+harness rail is NOT CERTIFIED — pending physical host. That FAIL is not
+an install defect. An Entwurf-only host (no harness on PATH) stays green.
+
+A physical Mac can send host facts without installing or logging in:
+`scripts/raw-macos-measure/probe.sh` (`/bin/sh`, ~3.5s). Measurement,
+not certification.
+
 `entwurf` is a neutral npm package first. Get the package, then run **`entwurf setup
 <project>`** — one command, the same front door from an npm global install, an npm
 project-local install, or a source checkout. It composes every harness it finds on the
@@ -187,6 +214,9 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 
 ### Pi adapter / ACP plugin lane
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host (control sockets, mux, ACP plugin hosting).
+
 To use the `entwurf` provider inside pi, install a compatible pi binary
 separately (`@earendil-works/pi-coding-agent >=0.85.1 <0.86`). Then point pi at
 the npm-installed package or development clone:
@@ -217,10 +247,10 @@ for every harness it detects — you do not paste this list to install. This is
 surface: each unit has its own installer, its own doctor with a named refusal, and its own
 inverse, so a single broken unit can be redone without touching the rest.
 
-- **Claude Code** (Linux-certified axis) — `install-meta-bridge`, `doctor-meta-bridge`.
-- **Antigravity / agy** — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
-- **GitHub Copilot CLI** — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
-- **OMP (`omp`)** — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
+- **Claude Code** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-meta-bridge`, `doctor-meta-bridge`.
+- **Antigravity / agy** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
+- **GitHub Copilot CLI** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
+- **OMP (`omp`)** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
 
 Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
 walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).
@@ -275,10 +305,10 @@ Copilot units included — and restart its existing processes; reach for a singl
 only when a **new** session using the
 installed artifact makes `doctor-meta-bridge` exit 0 with the live owner join.
 
-Linux is the only currently certified Claude meta-bridge axis. New macOS wiring is
-refused because the strict live-owner doctor depends on `/proc`; Darwin uninstall
-remains available for legacy cleanup, and the neutral package itself has no `os`
-restriction. Detailed diagnosis and clean-host steps live in
+The Claude meta-bridge rail is CERTIFIED on Linux. On macOS it is
+NOT CERTIFIED — pending physical host. The Darwin install fence is
+open; uninstall was already open. Detailed diagnosis and clean-host
+steps live in
 [docs/setup-clean-host.md](./docs/setup-clean-host.md).
 
 The active citizen store is V3-only. A store that fails certification is never
@@ -303,7 +333,8 @@ host evidence boundaries are [VERIFY.md](./VERIFY.md) and [BASELINE.md](./BASELI
 2. **`require.resolve(...)` against the bundled package dependency** (`@agentclientprotocol/claude-agent-acp`). This is the default path; no extra global install needed.
 3. **`PATH:claude-agent-acp` fallback** — used when the package resolution fails (e.g. a hand-edited `node_modules`).
 
-The curated model registry exposes unprefixed Claude ids plus `cortex-` rows.
+The curated model registry exposes unprefixed Claude ids — `claude-opus-5`, `claude-sonnet-5`,
+`claude-fable-5-1` — plus the `cortex-` rows below.
 Codex is not an ACP backend or a shipped managed citizen lane: it has verified
 native-delivery probe evidence only. No managed Codex support is claimed; lifecycle,
 identity, installation, and doctors remain prerequisites for any such lane.
@@ -513,7 +544,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, `copilot`, or `omp`) as a visible window in the operator's own tmux session, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd plus tmux coordinates and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, `copilot`, or `omp`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -532,7 +563,7 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 
 **`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, Copilot or OMP runtime visibly in the caller's tmux session with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, Copilot or OMP runtime visibly on the caller's tmux server — its own session by default, or one EXISTING named session via the optional `placement.tmuxSession` — with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 

package/VERIFY.md

@@ -58,7 +58,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 >
 > Be honest about its cost, because it is a MUST: it spends real model turns on the operator's configured runtimes (two pi siblings, each resumed once, plus one Claude Code sibling), it READS the operator's real runtime config, and the siblings' native session transcripts stay in the real pi agent dir — they are not cleaned up, and they are part of the evidence a resume was real. The fence is per-axis rather than absolute: the four meta roots (records, mailbox, receivers, senders) are fixture for every cell, so no garden record is ever minted outside it; the native pi cell's control socket and v2 lock are fixture too; the ACP pi cell's are REAL and transient (see the paragraph above); and the Claude cell runs its runtime under the real HOME while its mailbox and meta stay fixture. The run ends by proving the operator's SIX real roots — the four meta roots plus `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks` — hold the entry sets they started with, with no fixture garden id anywhere, and that proof now runs on the failure path as well as the green one. Missing prerequisites decline with the protocol SKIP (97), which `release-gate --cut` refuses rather than rounding up.
 >
-> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends two model turns, and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
+> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends four model turns (two in the caller's own session, two in a second SEAT session on the same private server — the #105 seat x cwd matrix), and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
 
 > **A visible-fresh receipt outside the MUST tier is no longer the general rule — it is Copilot's preserved exception.** #87 measured what that wording permitted: because clause 7 sat outside every aggregate, a harness could be admitted as a full D6 citizen that `entwurf_fresh_call` cannot open, carry an honest "not a supported harness" sentence in the delivery matrix, and still pass the whole floor toward a cut. From OMP onward, the FIRST release of a harness admitted under the #82 contract owes its clause 7 receipt as a release-gate MUST step (`smoke-omp-fresh-live`), and the deterministic half of the same rule (`check-harness-admission-parity`, inside `check:full`) makes a citizen backend missing from `FRESH_CALL_BACKENDS` a red floor rather than a documented one. Forward-only by decision: Copilot's row is not reopened. The contract lives in `docs/adding-a-harness.md` step 9, "The release stop"; this note exists so the cost discipline above is not read as permission.
 >
@@ -77,6 +77,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
+| macOS Entwurf-only install | required `macos-install-surface` CI job at the exact release SHA | Shape-only, CERTIFIED (CI): certifies the Entwurf-only install path on macOS only — never Claude/Copilot/OMP/agy wiring, the pi rail, ACP or mux. Promoted from non-voting (`continue-on-error`) to required in 0.20.0 after its first CERTIFIED (CI) green on a GitHub Actions `macos-latest` runner (not a physical host): run 34303884286 @ `70eda03` (2026-09-09), 65s, all 10 steps success — the packed candidate installed clean, `entwurf --help` and `entwurf check-bridge` ran (the latter listing the seven current `entwurf-bridge` MCP tools), an all-harness-absent `entwurf setup` reached `result: green` across the five documented SKIP probes (`pi`/`claude`/`agy`/`copilot`/`omp`), and five checked paths (`.pi`, `settings.json`, `.gemini`, `.copilot`, `auth.json.bak`) plus a byte-identical `auth.json` proved zero harness/credential writes. A macOS runner failure now blocks every release cut, the same as any other required job. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
@@ -155,6 +156,13 @@ Expected tail on a fully green host: `DONE: entwurf setup — result: green (com
 
 The wiring / meta-bridge / smoke steps are internal building blocks of `setup` (`install_local_package`, `scripts/meta-bridge-install.sh`, `validate_entwurf_bridge`) — call `setup`, never the parts. Consumers who `npm install @junghanacs/entwurf` get the obvious npm surface; that path is not the developer concern here.
 
+Installation portability and rail certification are separate axes (Hard Rule 17).
+A harness-absent `setup` on the macOS CI runner reaching `result: green` is
+CERTIFIED (CI) for the Entwurf-only install surface only. On a platform that is
+not certified, a detected harness is named non-green (FAIL) whose wording is
+not an install failure: the wiring WAS written, but the rail is NOT CERTIFIED —
+pending physical host. That FAIL is the honest setup verdict, not a skip.
+
 ### 1.1 Variables (optional)
 
 ```bash
@@ -286,7 +294,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 The minimum passing bar:
 
 1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus a `./run.sh check-gate-qualification` green on the same candidate.
-2. **All three CI jobs green on the exact release commit:** `check`, `install-surface`, and the required Linux `artifact-consumer`; preserve the latter's tarball digest and image identity.
+2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its seven current tools, and presents a backend-native (not normalized) tool surface.

package/docs/acp-backend-rail.md

@@ -197,7 +197,7 @@ operator's repair named.
 
 | Seam | Claude | Cortex Code |
 |---|---|---|
-| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
+| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
 | Launch | bundled `claude-agent-acp`; `CLAUDE_AGENT_ACP_COMMAND` override | `cortex acp serve`; optional connection; `CORTEX_ACP_COMMAND` override; never a launch-time `-m` |
 | Model authority | per-turn ACP set-model | per-turn ACP set-model; an unavailable curated id fails before prompt |
 | Carrier | engraving in `_meta.systemPrompt` | no system-prompt carrier; engraving rides the first-user augment |
@@ -256,6 +256,14 @@ Cortex containment was measured against the live CLI rather than copied from Cla
   exact-writes an overlay-private `cortex/mcp.json`. Non-stdio declarations fail before
   spawn. Only the `entwurf-bridge` entry receives the real operator HOME required to
   see the garden store.
+- **`realHome` absoluteness:** the D10 guard judges the captured `realHome` in BOTH
+  path flavors (POSIX and win32), so the refusal rule states the contract rather than
+  the host it happens to run on. This claims no native-Windows support — native
+  Windows is UNSUPPORTED. The certified ACP axis remains Linux
+  desktop/workstation; macOS ACP turns are NOT CERTIFIED — pending physical
+  host. The flavor-explicit form only stops a POSIX host from reading a
+  drive/UNC path as relative, which is what made the defect unkillable on
+  Linux (PR #77).
 - **Carrier:** Cortex has no `_meta.systemPrompt` contract. The engraving is placed at
   the head of the first-user augment; claiming a system-prompt engraving is false.
 

package/docs/external-mcp-host.md

@@ -11,7 +11,7 @@ the one-line registration; everything an operator needs to actually wire a host
 
   **Being garden-native is not the same as being replyable, and Copilot is the case that separates them.** Its hook writes a sender marker, so an `entwurf_v2` send carries its own garden id and the receiver learns who wrote — measured 2026-08-21 on Copilot CLI 1.0.80, where a live send arrived under its own garden id with `origin: "meta-session"` and `replyable: false`. Replyability arrived later and through a different process: a first-party extension (`run.sh install-copilot-receive`) that the CLI forks, which binds to the same V3 record and writes a receiver marker owned by its own pid (#82 RAIL 5). So a Copilot citizen is `replyable: true` exactly while that extension is armed for it, and `replyable: false` — honestly, with a real garden identity — when it is not installed, not launched with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` (which is what `entwurf copilot` sets for one invocation), not yet born, or gone. Read the two facts off different rails: the sender marker answers *who sent this*; the receiver marker answers *can a reply land*. The onboarding obligations are in [`adding-a-harness.md`](./adding-a-harness.md) step 7, and the evidence boundary — the managed LIVE acceptance that moved receive to D6, and what D7-partial / D3-pending still exclude — is in [`DELIVERY.md`](../DELIVERY.md).
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, `entwurf` or `omp` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor, while OMP is opened as the bare `omp` runtime); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation (normal agy birth is automatic through the installed hook). Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?, placement?}`**, and reopen a DORMANT pi citizen under its own garden id with **`entwurf_resume_call {target}`**. Fresh call accepts one optional literal absolute `cwd`: omit it or pass `""` for the caller's cwd; otherwise it must name an existing directory and may not contain `#`. Use that input for a new cross-repository sibling — resume preserves a dormant Pi citizen's recorded continuity and is not a cwd substitute. Fresh call also accepts one optional `placement.tmuxSession`: the exact name of an EXISTING session on the caller's own tmux server, so the sibling opens in the operator's project seat rather than beside the caller. It creates nothing — an absent session is refused as `tmux-session-missing`, a name outside `[A-Za-z0-9][A-Za-z0-9_-]*` as `tmux-session-name-invalid`, and no window and no session are left behind either way. The seat and the `cwd` never infer each other: with `cwd` omitted a seated sibling starts in the CALLING agent's own directory, not the target session's path. Fresh call needs its selected runtime on the server's PATH (`pi`, `claude`, `entwurf` or `omp` — Copilot opens through the managed `entwurf copilot` invocation, never the bare vendor, while OMP is opened as the bare `omp` runtime); resume call always needs `pi`. Both start a runtime, while delivery does not. (The old v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.)
 
 Observed: Claude Code, Codex CLI, Antigravity CLI, GitHub Copilot CLI and OMP all reach the read surfaces through this MCP bridge from a plain external host — `entwurf_peers` is a pure fact projection, while `entwurf_inbox_read` is a **mutating drain** (it archives the messages and stamps the read-receipt), so "read" here does not mean side-effect-free; **sending** needs an identity lane. Claude, Copilot and OMP become symmetric/replyable through a mailbox-backed meta-session — Claude's watch armed by its own hook, Copilot's by the forked extension it installs, OMP's by an extension running inside the operator's own TUI process; agy becomes symmetric/replyable through its record-backed sender marker plus live native-push probe. Codex has no managed citizen lifecycle yet, so a Codex host cannot send without the explicit anonymous hatch below.
 
@@ -52,9 +52,12 @@ Prerequisites on the host running the external MCP client:
 > carrier reader trims and tests truthiness, so empty and absent are the same answer by
 > construction. Pinned by `[QK:FRESHCALL-IDENTITY-SCRUB]` in the `check-mux-fresh-call` vitest lane,
 > inside `check:full`. The DETECT half is unchanged and still load-bearing, because a seam covers
-> only the launches that pass through it: `doctor-omp-bridge` reads `/proc/<pid>/environ` for every
-> live `omp` process and goes RED on its own axis when one carries either carrier. An omp the
-> operator started from a pi citizen's bash never touched the seam and is still unsupported, exactly
+> only the launches that pass through it: `doctor-omp-bridge` reads each live `omp`
+> process's environment (on Linux, `/proc/<pid>/environ`) and goes RED on its own
+> axis when one carries either carrier. The remaining uncertified Darwin axis is
+> per-process environment DISCOVERY, not `/proc` absence; macOS rails are
+> NOT CERTIFIED — pending physical host. An omp the operator started
+> from a pi citizen's bash never touched the seam and is still unsupported, exactly
 > as this boundary says.
 
 Example env file:
@@ -151,7 +154,7 @@ entwurf doctor-agy-hooks
 
 The three adapters deliberately own different atoms:
 
-- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox), neither is the manual `entwurf_register_native` fallback, and neither are `entwurf_fresh_call` / `entwurf_resume_call` (both launch into the caller's own tmux session, which an agy conversation is not);
+- bridge: one `entwurf-bridge` server in `~/.gemini/config/mcp_config.json`, plus one narrow permission string per tool the normal agy workflow calls — `mcp(entwurf-bridge/entwurf_v2)`, `mcp(entwurf-bridge/entwurf_peers)`, `mcp(entwurf-bridge/entwurf_self)` — in `~/.gemini/antigravity-cli/settings.json`. agy defaults every `mcp` action to Ask, so a tool that ships without its own rule stops for a y/n on every call; `entwurf_inbox_read` is deliberately not granted (native-push has no inbox), neither is the manual `entwurf_register_native` fallback, and neither are `entwurf_fresh_call` / `entwurf_resume_call` (both launch into the caller's own tmux server, which an agy conversation has none of);
 - statusline: the complete `statusLine` subtree pointing at the bare stable bin `entwurf-agy-statusline`;
 - hooks: one named `PreInvocation` hook pointing at the bare stable bin `entwurf-agy-imprint`.
 

package/docs/setup-clean-host.md

@@ -1,8 +1,18 @@
 # Clean-host setup
 
-Current operator recipe for a fresh Linux desktop/workstation. The neutral npm
-package can install elsewhere, but Claude's garden-native meta-bridge is certified
-only on Linux because its strict live-owner join uses `/proc`.
+Operator recipe for a POSIX host. **Linux is the certified axis** — §2–§6 are
+written for it and their receipts are Linux receipts. What follows is the macOS
+evidence split, and its three states must not collapse into "macOS is supported":
+
+- **CERTIFIED (CI)** — the Entwurf-only install surface on macOS
+  (`macos-install-surface`). Weaker than a physical-host doctor green. §1 is
+  this surface.
+- **NOT CERTIFIED — pending physical host** — **on macOS**, every garden-native
+  harness rail in §2–§6 (pi, Claude, Copilot, OMP, agy), marker join, ACP turn,
+  mux. Wiring may be written; that is not a rail receipt. The remaining
+  unmeasured Darwin doctor reason is per-process environment DISCOVERY
+  (start-key is portable).
+- **UNSUPPORTED** — native Windows only. macOS is never this.
 
 ## Requirements
 
@@ -22,8 +32,35 @@ only on Linux because its strict live-owner join uses `/proc`.
 Claude Code >=2.1.217 is required for the managed exec-hook lifecycle. The package
 never supplies or proxies backend credentials.
 
+On a physical Darwin host, `python3` may be the CommandLineTools stub (a
+dialog instead of an interpreter) — unmeasured. That is a probe cell
+(`scripts/raw-macos-measure/probe.sh` M3), not a certification path.
+
 ## 1. Install Node and entwurf
 
+This section is the Entwurf-only install surface. On macOS it is
+**CERTIFIED (CI)** (`macos-install-surface`): npm pack → clean consumer
+install → bins → `--help` → `check-bridge` → harness-absent `setup`. That
+is not a harness-rail receipt.
+
+On Darwin, `entwurf setup` is intentionally non-green when it detects a
+harness. The wiring is written; the row is FAIL:
+
+> the wiring WAS written and nothing failed to install, but this harness
+> rail is NOT CERTIFIED — pending physical host on Darwin. setup runs no
+> doctor; the rail axis is owned by '<doctor>', which refuses on this
+> platform. Tracking: #78.
+
+That FAIL is honest: setup runs no doctor, and no physical-host rail
+receipt exists — it is not an install failure. An Entwurf-only host (no
+harness on PATH) stays green (five SKIP, `bins: PASS`, `core: PASS`,
+`result: green`), which is what CERTIFIED (CI) observed.
+
+A physical Mac can send host facts without installing entwurf or logging
+into a harness: `scripts/raw-macos-measure/probe.sh` (`/bin/sh`, ~3.5s,
+cells M1–M9, writes nothing). Measurement, not certification — it does
+not move CERTIFIED (CI) or close a rail.
+
 Use the host's normal Node 24 installation. With nvm:
 
 ```bash
@@ -107,6 +144,12 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 
 ## 2. Optional pi adapter / ACP plugin
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. Control sockets, mux, and ACP plugin hosting have no
+physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
+on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
+`setup` names the pi row FAIL with the §1 Darwin wording.
+
 Install the exact release floor, then wire the project:
 
 ```bash
@@ -134,6 +177,9 @@ The V3 record births the garden id; do not inject a pi session id manually.
 
 ## 3. Optional Claude Code native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending physical
+host (see the end of this section).
+
 First register the MCP bridge if the stable bin is not already present:
 
 ```bash
@@ -159,12 +205,21 @@ validation, or hand-inspected marker cannot replace a new real session. If the l
 form is unsupported, reinstall; if ownership is correct but the live join is absent,
 restart the affected session.
 
-New macOS wiring is refused because the live join is not instrumented there. Darwin
-uninstall remains available for cleaning an older managed install; this is an evidence
-boundary, not a permanent impossibility claim.
+The Darwin install fence is open (`Linux | Darwin`); python3 is the
+refusal, not the platform name. A completed Darwin install is still not
+a rail receipt: this rail is NOT CERTIFIED — pending physical host. The
+remaining unmeasured doctor reason is per-process environment DISCOVERY
+of live bridge children (start-key is portable). A CI runner cannot
+supply a Claude login. Uninstall is open on Darwin too. That is an
+evidence boundary, not UNSUPPORTED.
 
 ## 4. Optional GitHub Copilot CLI native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. The Darwin install fence for `install-copilot-bridge` is
+open (`Linux | Darwin`); a completed install is not a rail receipt. That
+is an evidence boundary, not UNSUPPORTED.
+
 Copilot has four independently owned surfaces. `setup` composes all four when `copilot` is on
 PATH (#86 C3b); the commands below are the per-unit repair, doctor, and inverse surfaces. All
 four must be green for supported visible fresh; a manual citizen may omit the footer, but fresh
@@ -187,7 +242,12 @@ scanning for that process, checks the receiver, removes inherited pi identity ca
 the model/permission defaults. Birth occurs on the first prompt. `entwurf_fresh_call` uses this
 same managed invocation and requires the birth, MCP, receiver, and visible-identity preflight.
 
-## 4b. Optional OMP (`omp`) native citizen — accepted on one host
+## 4b. Optional OMP (`omp`) native citizen — accepted on one Linux host (thinkpad)
+
+This rail is CERTIFIED on Linux (one host, named in the version rule
+below); on macOS it is NOT CERTIFIED — pending physical host. The Darwin
+install fences for `install-omp-bridge` and `install-omp-receive` are
+open (`Linux | Darwin`); a completed install is not a rail receipt.
 
 Three independently owned surfaces, and a boundary that is part of the instructions rather
 than a footnote. Birth, visible identity, who-sent, the MCP hand and RECEIVE are landed, and
@@ -338,6 +398,10 @@ why `disabledServers` is never the way to hide an import.
 
 ## 5. Optional Antigravity native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. The installers may write on Darwin; a green install is
+not a native-push receipt.
+
 Install the three independently owned surfaces:
 
 ```bash
@@ -363,6 +427,10 @@ LIVE=1 AGY_CONVERSATION_ID=<id> entwurf smoke-agy-native-push-live
 
 ## 6. Optional ACP backend turns
 
+ACP turns are CERTIFIED on Linux; on macOS they are NOT CERTIFIED —
+pending physical host. Mux (visible fresh / resume) is the same state.
+A CI runner has no Claude or Cortex login.
+
 Claude uses the operator's existing local Claude authentication:
 
 ```bash
@@ -386,6 +454,15 @@ After upgrading the package, rerun the managed installers for every native harne
 in use and restart their existing processes. Native plugin caches are not live-reload
 safe across launch-contract changes.
 
+On Darwin the four previously closed install fences
+(`install-meta-bridge`, `install-copilot-bridge`, `install-omp-bridge`,
+`install-omp-receive`) now accept `Linux | Darwin` and refuse on the
+real toolchain (python3 / node / harness presence), not the platform
+name. Re-running them writes wiring. `setup` still names every detected
+harness unit FAIL with the §1 Darwin wording — upgrade does not mint a
+rail receipt. Doctors refuse on Darwin until a physical-host receipt
+exists.
+
 If install or doctor reports an unreadable/old active citizen generation, do not edit
 records by hand. Close pi, Claude, Copilot, and agy sessions first, run
 `entwurf meta-bridge-fresh-cut`, and read its exit status before any install. Then choose the
@@ -414,6 +491,10 @@ PASS/SKIP/FAIL summary. The complete quiescence, archive, and exit-code contract
   core / full candidate floor); maintainer checkout only.
 - `check-install-container`: checkout-invisible Linux package-consumer shape using
   fixtures; not a native lifecycle proof.
+- `macos-install-surface`: macOS Entwurf-only package-consumer shape, CERTIFIED (CI)
+  (`macos-latest` runner, run 34303884286 @ `70eda03`); not a native lifecycle proof.
+- `scripts/raw-macos-measure/probe.sh`: physical-Darwin host facts (~3.5s,
+  no install, no login). Measurement, not a certification path.
 - `doctor-meta-bridge`: one installed real Claude host, only with a new live session.
 - `LIVE=1 entwurf release-gate /path/to/scratch --cut`: aggregate runtime acceptance (`--cut` makes any MUST SKIP red; without it the run is a diagnostic pass).
 
@@ -422,6 +503,11 @@ host verdicts are [BASELINE.md](../BASELINE.md).
 
 ## Uninstall
 
+Darwin uninstall is open for the same surfaces the installers write
+(the Claude uninstall fence was already open; the four install fences
+now match). Running an inverse on Darwin is cleanup, not a rail
+certification.
+
 Run only the surfaces this host owns:
 
 ```bash

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -26,10 +26,11 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
- *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
- *                       returns a LAUNCH receipt only, and the new address arrives later as the
- *                       sender envelope of the sibling's nonce callback.
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's tmux — the caller's own
+ *                       session, or ONE EXISTING named session on the same server (the project
+ *                       seat, #105; nothing is ever created), optionally at ONE literal requested
+ *                       cwd (cross-repo fresh, #73); returns a LAUNCH receipt only, and the new
+ *                       address arrives later as the sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
  *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
  *                       apart.
@@ -609,7 +610,7 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed " +
     "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
@@ -624,6 +625,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     "prompt, so the sibling could not call you back at all). An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
     "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+    "An optional placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an " +
+    "absent SESSION is tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
     "same-user processes on this host. Requires that this agent itself runs " +
     "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
@@ -653,7 +656,15 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         .string()
         .optional()
         .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
-}, async ({ backend, model, task, cwd }) => {
+    placement: z
+        .object({
+        tmuxSession: z
+            .string()
+            .describe("EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid."),
+    })
+        .optional()
+        .describe("Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id."),
+}, async ({ backend, model, task, cwd, placement }) => {
     let callerGardenId = null;
     try {
         const self = await buildAuthoritativeSelfEnvelope();
@@ -672,7 +683,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
+        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, placement, callerGardenId }));
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -49,11 +49,11 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"];
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"];
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
-// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/overlay.js

@@ -35,7 +35,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 /** Operator's real Claude config dir — the symlink-passthrough SOURCE. */
 export const CLAUDE_REAL_CONFIG_DIR = join(homedir(), ".claude");
 /** pi-owned overlay dir — the CLAUDE_CONFIG_DIR target for ACP child spawns. */
@@ -356,7 +356,11 @@ function cortexLinkIfExists(realPath, overlayPath) {
  * Returns the isolated HOME/SNOWFLAKE_HOME the spawn env must carry.
  */
 export function ensureCortexDualHomeOverlay(params) {
-    if (!params.realHome || !params.realHome.startsWith("/")) {
+    // Absoluteness is judged in BOTH path flavors so the guard states the contract
+    // ("the parent captured an absolute HOME") instead of the host it happens to run
+    // on. This asserts nothing about native-Windows support; it only stops a POSIX
+    // host from silently accepting a drive/UNC path as "relative".
+    if (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {
         throw new Error(`entwurf: cortex dual-HOME overlay requires an absolute realHome captured by the parent (got ${JSON.stringify(params.realHome)})`);
     }
     const overlaysRoot = params.overlaysRoot ?? CORTEX_OVERLAYS_ROOT;