@junghanacs/entwurf 0.18.2 → 0.20.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -1,6 +1,7 @@
 /**
- * mux-fresh-call — open ONE visible sibling in the caller's own tmux session, hand it its first
- * task in the launch argv, and let it name itself back to the caller.
+ * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
+ * default, or one named existing session on that server since #105), hand it its first task in
+ * the launch argv, and let it name itself back to the caller.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -43,6 +44,36 @@
  *   - the receipt echoes what was REQUESTED, exactly as `runtimePath` does. It never reports
  *     `pane_current_path`: proving where the pane actually landed belongs to acceptance, not
  *     to the launch receipt.
+ *
+ * ── The optional project seat (issue #105) ──
+ *
+ * A fresh sibling opens in the caller's own tmux session — unless the caller names ONE session
+ * on the SAME server. That input exists because the operator's seats are per-project: a sibling
+ * opened for the `org` project belongs in the `org` session, and before this the only way to
+ * put it there was for the operator to move the window by hand. The rules are as narrow as the
+ * cwd input's, and for the same reason:
+ *
+ *   - `undefined` means the caller's own session, and the argv is byte-identical to the
+ *     pre-#105 shape. A named session is resolved to its native `$id` by the shared
+ *     `resolve-tmux-session.ts` leaf and ONLY that id ever reaches `-t`.
+ *   - a session that does not exist is `tmux-session-missing` and NOTHING is created — not the
+ *     window, not the session. There is no `ifMissing` axis and no `new-session` verb anywhere
+ *     in this product (GLG, 2026-09-07): the operator creates the seat and calls again. A name
+ *     outside the leaf's grammar is the separate `tmux-session-name-invalid` — a different
+ *     repair, because that name is a shape this rail does not address rather than a session
+ *     that is absent. The leaf owns which shapes and why; part of that set tmux genuinely
+ *     cannot resolve and part is a narrowing this rail chose, and it says which is which.
+ *   - `-d` is what makes this safe to do to a session someone is looking at. `[측정]` without
+ *     it, a `new-window` into another session changes THAT session's active window and steals
+ *     the operator's focus. It was already fixed in this argv; #105 is where it became
+ *     load-bearing.
+ *   - the seat is ORTHOGONAL to the cwd. `[측정 ×2]` with `-c` omitted, a window opened into
+ *     another session lands in the cwd of the process that ran `new-window` — not the target
+ *     session's `session_path` and not its active pane. Neither input is ever inferred from
+ *     the other.
+ *   - the receipt echoes the REQUESTED name and carries the OBSERVED target `$id`, which is
+ *     the session the window is actually in. It still reports no `pane_current_path`, and
+ *     there is no "session created" field because nothing here creates one.
  */
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
@@ -50,6 +81,7 @@ import { COPILOT_PREFLIGHT_HINT, copilotFreshPreflight, } from "./copilot-fresh-
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 import { OMP_PREFLIGHT_HINT, ompFreshPreflight } from "./omp-fresh-preflight.js";
+import { classifyTmuxSessionName, resolveTmuxSessionId } from "./resolve-tmux-session.js";
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
  * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract, and
  * `omp` by #87 Bundle C under the same one. The set is joined to the citizen backends by
@@ -316,9 +348,16 @@ function defaultRandomHex() {
 const SCRUBBED_INHERITED_ENV = ["PI_SESSION_ID=", "PI_AGENT_ID="];
 /** Launch argv: the leaf's detached-append shape, the identity scrub, optionally `-c` at the
  * resume-symmetric token position (after `-t`, before `-P -F`), the runtime, then the backend's
- * dialect. An omitted cwd adds no `-c` carrier at all. */
-export function buildFreshCallArgs(placement, runtimePath, backendArgs, cwd) {
-    assertSelector("session", placement.sessionId);
+ * dialect. An omitted cwd adds no `-c` carrier at all.
+ *
+ * The first parameter is the TARGET session id, not the caller's placement. Since #105 those
+ * are not always the same session, and taking a `Placement` here would invite exactly the
+ * defect this signature prevents: copying the caller's own id into a cross-session launch. A
+ * name never reaches this function — the seat is resolved to a native `$id` before it is
+ * called, and `assertSelector` refuses anything that is not one. `-d` is not optional: without
+ * it a window opened into another session steals that session's focus (measured). */
+export function buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd) {
+    assertSelector("session", targetSessionId);
     assertLaunchTarget(runtimePath);
     if (cwd !== undefined) {
         const bad = classifyTmuxCwd(cwd);
@@ -331,7 +370,7 @@ export function buildFreshCallArgs(placement, runtimePath, backendArgs, cwd) {
         "-a",
         ...SCRUBBED_INHERITED_ENV.flatMap((assignment) => ["-e", assignment]),
         "-t",
-        `${placement.sessionId}:{end}`,
+        `${targetSessionId}:{end}`,
         ...(cwd === undefined ? [] : ["-c", cwd]),
         "-P",
         "-F",
@@ -373,6 +412,17 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         if (badCwd)
             return { ok: false, reason: badCwd };
     }
+    // The seat's NAME is classified here, beside the cwd and for the same reason: it is decidable
+    // without tmux, so an unresolvable name is answered before anything else runs. Whether that
+    // session EXISTS is a tmux question and is asked below, after the caller's own context is
+    // proven — a name check that needed a live server would refuse for the wrong reason on a
+    // host with no tmux at all.
+    const seat = params.placement?.tmuxSession;
+    if (seat !== undefined) {
+        const badSeat = classifyTmuxSessionName(seat);
+        if (badSeat)
+            return { ok: false, reason: badSeat };
+    }
     let runtimePath;
     try {
         runtimePath = resolveRuntimeOnPath(FRESH_CALL_RUNTIME[params.backend], env);
@@ -403,6 +453,17 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         return { ok: false, reason: inspected.reason };
     const placement = inspected.placement;
     requireSameContext("freshCall", placement, env);
+    // The caller's own context is now proven, which is what makes the next lookup's exit code
+    // readable as "that session is not here" rather than "there is no server". Only the resolved
+    // native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
+    // absent seat refuses with no window anywhere.
+    let targetSessionId = placement.sessionId;
+    if (seat !== undefined) {
+        const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
+        if (!resolved.ok)
+            return { ok: false, reason: resolved.reason };
+        targetSessionId = resolved.sessionId;
+    }
     const composition = {
         prompt: buildFreshCallPrompt({
             backend: params.backend,
@@ -412,7 +473,7 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         }),
         bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
     };
-    const run = runTmux(buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, composition, model), cwd), env);
+    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model), cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -422,17 +483,18 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         // The window exists and its id is precisely what could not be read. Diffing the inventory
         // to find "the new one" is the guess this rail forbids everywhere else, so name the orphan.
         throw new Error(`mux-fresh-call: launched ${runtimePath} but could not read the window handle tmux printed — a window may ` +
-            `be open in session ${placement.sessionId} that this call cannot identify or close: ${err instanceof Error ? err.message : String(err)}`);
+            `be open in session ${targetSessionId} that this call cannot identify or close: ${err instanceof Error ? err.message : String(err)}`);
     }
     return {
         ok: true,
         receipt: {
             serverPid: placement.serverPid,
-            sessionId: placement.sessionId,
+            sessionId: targetSessionId,
             ...fields,
             backend: params.backend,
             model,
             ...(cwd === undefined ? {} : { cwd }),
+            ...(seat === undefined ? {} : { tmuxSession: seat }),
             runtimePath,
             nonce,
         },
@@ -454,6 +516,8 @@ const REJECT_HINT = {
     "cwd-format-token": "the requested cwd contains '#', which tmux expands as a format inside -c — it would silently rewrite the path or run a command",
     "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
     "cwd-not-directory": "the requested cwd exists but is not a directory",
+    "tmux-session-name-invalid": "the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
+    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "task-empty": "task is empty after trimming",
@@ -487,6 +551,9 @@ export function renderFreshCall(result) {
             `  backend:  ${r.backend} (${r.runtimePath})\n` +
             `  model:    ${r.model} (requested on the runtime CLI)\n` +
             (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+            (r.tmuxSession === undefined
+                ? ""
+                : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +
             `  nonce:    ${r.nonce}\n` +

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-placement.js

@@ -8,11 +8,17 @@
  * session the operator is looking at. Inheriting the environment IS the addressing: this
  * module never takes a socket path or a session name from a caller.
  *
+ * That sentence is still exactly true of THIS leaf, and #105 is where it started to be worth
+ * saying precisely. The fresh-call composition above may now be handed one session NAME by its
+ * caller, but it resolves that name to a native `$id` through its own leaf before anything
+ * reaches here — `appendWindow` still appends only to the caller's own session, and no function
+ * in this file has ever seen or will see a session name.
+ *
  * Three actions, deliberately not four:
  *
  *   inspectPlacement()   the caller's own $session/@window/%pane, or a named refusal
  *   appendWindow()       one default-shell window at the end of that same session
- *   closeWindow()        that window, by stable id, in the context it was opened in
+ *   closeWindow()        that window, by stable id, on the server it was opened on
  *
  * What this module is NOT: a delivery transport, an address, a liveness fact, a launcher.
  * It opens a place. `entwurf_v2` still owns delivery (`V2-DELIVERY-EXCLUDES-MUX`), and
@@ -51,8 +57,20 @@
  * 4. BINDING. A `Placement` is a fact about one server and one session, and the environment
  *    passed to a later call could name a different — or restarted — server where the same
  *    `$3`/`@7` mean something else entirely. Every mutation re-reads the caller's placement
- *    and refuses unless the server pid and session id still match the ones the handle was
- *    born in.
+ *    before it runs.
+ *
+ *    The two mutations bind to DIFFERENT halves of that fact, because they are answering
+ *    different questions. `appendWindow` asks "is the target the caller gave me still the
+ *    caller's own seat?" and needs both halves — `isSameContext`. `closeWindow` asks "is this
+ *    handle still the window it was born as?" and needs only the SERVER half — a `@id` is
+ *    unique for the life of one server, so the session half adds nothing there. `[측정
+ *    2026-09-07, private server]` ids are handed out monotonically and are never recycled:
+ *    after `@2` was killed the next window was `@3`, and after a whole session holding `@4`
+ *    and `@5` was killed the next was `@6`. Requiring the handle's session to still exist
+ *    would also break the more informative answer below — a window whose session is gone is
+ *    `already-gone`, which is a fact the caller wants, not an error. Since #105 a launched
+ *    window may legitimately live in a session that is not the caller's, and that is exactly
+ *    when this distinction stops being academic.
  *
  * The machine-readable rows carry ONLY native ids and decimal numbers, joined by `|`. The
  * free-form fields tmux could also report (`socket_path`, `session_name`) are deliberately
@@ -260,6 +278,36 @@ export function requireSameContext(label, origin, env) {
             `now server ${now.placement.serverPid} session ${now.placement.sessionId})`);
     }
 }
+/**
+ * Same server, whatever the session. The close-side half of boundary 4, kept as its own pure
+ * predicate for the same reason `isSameContext` is one: the decision is what a deterministic
+ * gate can pin, and the re-read around it is not.
+ */
+export function isSameServer(origin, now) {
+    return origin.serverPid === now.serverPid;
+}
+/**
+ * Re-read the caller's placement and refuse unless the handle was born on the SAME SERVER. The
+ * close-side half of boundary 4, and deliberately NOT `requireSameContext`: since #105 a handle
+ * can name a window in a session that is not the caller's, and the session half would refuse a
+ * legitimate close. What it must still refuse is a handle from a DIFFERENT — or restarted —
+ * server, where `@7` names some other window entirely.
+ *
+ * The session half is not lost, it is covered better: `@id`s are unique for one server's whole
+ * life (measured — see boundary 4), so on a matching server the id alone identifies the window,
+ * and a window whose session has since been killed is proven absent by `closeWindow`'s own
+ * `list-windows -a` read and reported as `already-gone`.
+ */
+export function requireSameServer(label, origin, env) {
+    const now = inspectPlacement(env);
+    if (!now.ok) {
+        throw new Error(`mux-placement: ${label} refused — the caller's placement is not resolvable (${now.reason})`);
+    }
+    if (!isSameServer(origin, now.placement)) {
+        throw new Error(`mux-placement: ${label} refused — server changed (handle was born on server ${origin.serverPid}, ` +
+            `this environment names server ${now.placement.serverPid})`);
+    }
+}
 /** One detached default-shell window at the end of the caller's own session. */
 export function appendWindow(placement, env = process.env) {
     requireSameContext("appendWindow", placement, env);
@@ -268,11 +316,11 @@ export function appendWindow(placement, env = process.env) {
     return { serverPid: placement.serverPid, sessionId: placement.sessionId, ...parseWindowFields(run.stdout) };
 }
 /**
- * Close one window by stable id, in the context it was opened in. Reports whether it was
- * closed or had already gone.
+ * Close one window by stable id, on the server it was opened on. Reports whether it was closed
+ * or had already gone. The binding is the server, not the session — see `requireSameServer`.
  */
 export function closeWindow(handle, env = process.env) {
-    requireSameContext("closeWindow", handle, env);
+    requireSameServer("closeWindow", handle, env);
     const run = runTmux(buildCloseArgs(handle.windowId), env);
     if (run.status === 0)
         return "closed";

package/mcp/entwurf-bridge/dist/pi-extensions/lib/resolve-tmux-session.js

@@ -0,0 +1,114 @@
+/**
+ * resolve-tmux-session — the ONE resolution of a caller-supplied tmux SESSION NAME into the
+ * native `$id` a placement may target. Narrow leaf of the fresh-call composition (#105); it
+ * owns the name grammar and the name→id lookup and NOTHING else — it never runs tmux (the
+ * runner is injected), never phrases a hint (each consumer owns its own wording), never
+ * creates a session, and has no fallback session.
+ *
+ * Same shape and same discipline as `classify-tmux-cwd.ts`: this file imports nothing at all,
+ * not even a node builtin, so it stays deletable on its own and cannot acquire an opinion
+ * about mux, entwurf, identity or delivery. The injected runner is matched STRUCTURALLY to
+ * `mux-placement.TmuxRun` rather than by a type import, for the same reason.
+ *
+ * Every rule below is a MEASURED tmux 3.6a behaviour (2026-09-07, private `-S` servers; the
+ * research lane's two independent reproductions are in issue #105's thread), and each one is a
+ * way a lookup would look successful while addressing the wrong thing:
+ *
+ *   1. `-t '=NAME'` performs NO format expansion — `=a}b`, `=a|b`, `=a b`, `=a,b` all resolve
+ *      exactly. The `-f '#{==:#{session_name},NAME}'` FILTER engine does the opposite: a `}`
+ *      inside the name closes the comparison early, the filter becomes a truthy string, and
+ *      EVERY session matches (6/6 measured). So the engine here is `-t '='`, never a filter.
+ *   2. absence is reported by EXIT CODE, not by output. `list-windows -t '=nosuch'` exits 1
+ *      with `can't find session: nosuch`, while `display-message -p -t '=NAME'` exits 0 with
+ *      EMPTY output for a name that exists AND for one that does not — it is unusable as a
+ *      probe. Only an rc=0 answer is ever parsed here.
+ *   3. some names cannot be addressed at all, for two different measured reasons. `#` is
+ *      FORMAT-EXPANDED when `new-session -s` stores it (`a#{x}` stored as `a`), so the
+ *      requested name never exists; and `.`/`:` are tmux's own PANE/WINDOW separators inside a
+ *      `-t` target, so the requested name is SPLIT before any session is matched. Measured
+ *      with this leaf's own engine: `list-windows -t '=my.project'` → rc=1
+ *      `can't find pane: project`, and `list-windows -t '=my:project'` → rc=1
+ *      `can't find session: my`. The exact wording is NOT contract — it moves with which
+ *      sessions happen to exist (`can't find window: project` once a session `my` is there) —
+ *      the fact is that the split happens at all. Both characters are ALSO normalised to `_`
+ *      when stored, so `a.b` and `a:b` are the same stored name `a_b` and whichever is created
+ *      second is a `duplicate session` error rather than a second seat. The lookup half is the
+ *      load-bearing one: whatever tmux stored, the REQUESTED name can never address it.
+ *      NOTE the difference from `classify-tmux-cwd.ts`: there `#(…)`
+ *      was observed EXECUTING inside a `-c` value; here it expands but does NOT execute (a
+ *      `q#(touch …)q` name stored as `qq` and wrote no file). Do not copy that leaf's
+ *      rationale into this one, or relaxing one will silently relax the other.
+ *   4. `=` protects a name against `%9`/`@1` id syntax but NOT against `$`: with a session
+ *      NAMED `$0` beside one whose ID is `$0`, `-t '=$0'` resolves the ID (measured — the
+ *      name-holder was `$1` and the lookup returned `$0`). And a session literally named
+ *      `=foo` needs `==foo`. An escaping layer here would be a second parser to keep true.
+ *
+ * The grammar is `^[A-Za-z0-9][A-Za-z0-9_-]*$`, and it is WIDER than what rules 3-4 force. Say
+ * that plainly rather than letting the reasons above cover the whole refusal set: `a}b`, `a|b`,
+ * `a b`, `a;b`, `a,b` and `_a` are all created verbatim AND resolved exactly by `-t '=NAME'`
+ * (measured 2026-09-07, one server, six sessions, six exact ids). They are refused anyway, and
+ * the reason is a DECISION, not a tmux limit — this is the grammar entwurf would need to CREATE
+ * a session safely, kept symmetric for lookup, with the remaining foreign-name width closed
+ * until an operator need for it is actually observed. That is why the refusal is
+ * `tmux-session-name-invalid` ("this rail does not address that shape") and not
+ * `tmux-session-missing` ("no such session here"): the caller's repair differs, and telling an
+ * operator their perfectly findable session "could never be found" would be a false cause.
+ *
+ * ONE BOUNDED IMPRECISION, STATED RATHER THAN LAUNDERED: rc≠0 also covers "no server running
+ * on <socket>" (measured). This leaf reads every rc≠0 as `tmux-session-missing`, so a server
+ * that died between the caller's context proof and this lookup is reported under the narrower
+ * word. That is safe — both readings are refusals that mutate nothing, and the consumer's hint
+ * names both — and it is preferred over matching tmux's own stderr text, which would pin this
+ * leaf to one vendor version's wording.
+ */
+const SESSION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+const SESSION_ID = /^\$[0-9]+$/;
+/**
+ * Classify a candidate session NAME. Separate from the lookup because the operator's next move
+ * differs: an out-of-grammar name is a shape this rail does not address — some of those tmux
+ * genuinely cannot resolve (rules 3-4), others it resolves fine and this rail declines anyway —
+ * while a missing session is something the operator creates and retries.
+ */
+export function classifyTmuxSessionName(name) {
+    return SESSION_NAME.test(name) ? null : "tmux-session-name-invalid";
+}
+/** The lookup argv. `-t '=NAME'` is the exact-name selector; `list-windows` is the engine that
+ * answers with an exit code for absence. The builder re-validates rather than trusting its
+ * caller, the same way the fresh-call argv builder re-checks a cwd. */
+export function buildTmuxSessionLookupArgs(name) {
+    if (classifyTmuxSessionName(name)) {
+        throw new Error(`resolve-tmux-session: refusing to build a lookup for an unresolvable session name: ${name}`);
+    }
+    return ["list-windows", "-t", `=${name}`, "-F", "#{session_id}"];
+}
+/**
+ * Resolve a session name to its native `$id` on whatever server the runner's environment names.
+ * The id is the ONLY thing a caller-supplied name is allowed to become: everything downstream
+ * targets `$id`, never the name again.
+ *
+ * A session always holds at least one window, so an rc=0 answer prints one `$id` line per
+ * window and they are all the same id. An rc=0 that cannot be read that way is an operational
+ * anomaly, not an answer about the session, and is raised rather than turned into a refusal.
+ */
+export function resolveTmuxSessionId(name, run) {
+    const badName = classifyTmuxSessionName(name);
+    if (badName)
+        return { ok: false, reason: badName };
+    const result = run(buildTmuxSessionLookupArgs(name));
+    // A signalled call is not tmux answering — it carries no information about the session at
+    // all, so it must never be read as absence.
+    if (result.status === null) {
+        throw new Error(`resolve-tmux-session: the lookup for session "${name}" was killed by a signal: ${result.stderr.trim()}`);
+    }
+    if (result.status !== 0)
+        return { ok: false, reason: "tmux-session-missing" };
+    const lines = result.stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const first = lines[0];
+    if (first === undefined || !SESSION_ID.test(first) || lines.some((line) => line !== first)) {
+        throw new Error(`resolve-tmux-session: tmux answered rc=0 for session "${name}" with something that is not one native session id: ${JSON.stringify(result.stdout)}`);
+    }
+    return { ok: true, sessionId: first };
+}

package/mcp/entwurf-bridge/src/index.ts

@@ -26,10 +26,11 @@
  *                       this read is the receipt.
  *   - entwurf_register_native — explicit/manual fallback binding an ALREADY-RUNNING native
  *                       conversation (antigravity) to a garden id. Never a spawn.
- *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's own tmux session,
- *                       optionally at ONE literal requested cwd (cross-repo fresh, #73);
- *                       returns a LAUNCH receipt only, and the new address arrives later as the
- *                       sender envelope of the sibling's nonce callback.
+ *   - entwurf_fresh_call — open ONE fresh visible sibling in the operator's tmux — the caller's own
+ *                       session, or ONE EXISTING named session on the same server (the project
+ *                       seat, #105; nothing is ever created), optionally at ONE literal requested
+ *                       cwd (cross-repo fresh, #73); returns a LAUNCH receipt only, and the new
+ *                       address arrives later as the sender envelope of the sibling's nonce callback.
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
  *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
  *                       apart.
@@ -706,7 +707,7 @@ server.tool(
 // against that answer would call home to a garden id nobody holds.
 server.tool(
 	"entwurf_fresh_call",
-	"Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed " +
+	"Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed " +
 		"backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
 		"sender envelope of that callback is its garden id — that is how you learn the address of something that " +
 		"did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
@@ -721,6 +722,8 @@ server.tool(
 		"prompt, so the sibling could not call you back at all). An optional " +
 		"cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
 		"for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
+		"An optional placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an " +
+		"absent SESSION is tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. " +
 		"There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
 		"same-user processes on this host. Requires that this agent itself runs " +
 		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
@@ -757,8 +760,20 @@ server.tool(
 			.describe(
 				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
 			),
+		placement: z
+			.object({
+				tmuxSession: z
+					.string()
+					.describe(
+						"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.",
+					),
+			})
+			.optional()
+			.describe(
+				"Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id.",
+			),
 	},
-	async ({ backend, model, task, cwd }) => {
+	async ({ backend, model, task, cwd, placement }) => {
 		let callerGardenId: string | null = null;
 		try {
 			const self = await buildAuthoritativeSelfEnvelope();
@@ -775,7 +790,7 @@ server.tool(
 			callerGardenId = null;
 		}
 		try {
-			const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, callerGardenId }));
+			const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, placement, callerGardenId }));
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
 		} catch (err) {
 			return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.18.2",
-	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
+	"version": "0.20.0",
+	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, and Antigravity; Claude and Snowflake Cortex Code ACP backends. Codex has verified delivery-probe evidence, not a managed native-citizen lane.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",

package/pi-extensions/acp-provider.ts

@@ -14,7 +14,7 @@
 // registry (backend-adapter.ts), NOT a per-backend list spelled here. Adding a
 // backend therefore never edits this file. check-acp-provider-surface pins that
 // the compiled entry really registers the EXACT union
-// ([QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]).
+// ([QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE]).
 //
 // Fence: this entry rides the emit-capable root tsconfig (it is not in the root
 // `exclude` list); its lib modules are imported with `.js` suffixes (the root

package/pi-extensions/entwurf-control.ts

@@ -1504,6 +1504,7 @@ interface MuxFreshCallModule {
 			model: string;
 			task: string;
 			cwd?: string;
+			placement?: { tmuxSession: string };
 			callerGardenId: string | null;
 		},
 		env?: NodeJS.ProcessEnv,
@@ -1529,7 +1530,7 @@ function registerFreshCallTool(pi: ExtensionAPI): void {
 	registerTool({
 		name: "entwurf_fresh_call",
 		label: "Open Fresh Sibling",
-		description: `Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Four fixed
+		description: `Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed
 backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the
 sender envelope of that callback is its garden id — that is how you learn the address of something that did
 not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing else:
@@ -1543,7 +1544,9 @@ launch is refused the same way if this host lacks the OMP birth, MCP, receiver o
 omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the prompt, so the sibling
 could not call you back at all). An optional cwd starts the
 sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume for a dormant
-record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. There are no
+record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. An optional
+placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an absent SESSION is
+tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. There are no
 arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
 processes on this host.`,
 		parameters: Type.Object({
@@ -1569,10 +1572,30 @@ processes on this host.`,
 						"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
 				}),
 			),
+			placement: Type.Optional(
+				Type.Object(
+					{
+						tmuxSession: Type.String({
+							description:
+								"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.",
+						}),
+					},
+					{
+						description:
+							"Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id.",
+					},
+				),
+			),
 		}),
 		async execute(
 			_toolCallId: string,
-			params: { backend: "pi" | "claude-code" | "copilot" | "omp"; model: string; task: string; cwd?: string },
+			params: {
+				backend: "pi" | "claude-code" | "copilot" | "omp";
+				model: string;
+				task: string;
+				cwd?: string;
+				placement?: { tmuxSession: string };
+			},
 			_signal: AbortSignal | undefined,
 			_onUpdate: unknown,
 			_ctx: ExtensionContext,
@@ -1584,6 +1607,7 @@ processes on this host.`,
 					model: params.model,
 					task: params.task,
 					cwd: params.cwd,
+					placement: params.placement,
 					callerGardenId: residentGardenId,
 				});
 				const rendered = mux.renderFreshCall(result);

package/pi-extensions/lib/acp/models.ts

@@ -53,13 +53,13 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"] as const;
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"] as const;
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
 
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
-// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/pi-extensions/lib/acp/overlay.ts

@@ -46,7 +46,7 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 
 import type { AcpMcpServer } from "./config.js";
 
@@ -416,7 +416,11 @@ function cortexLinkIfExists(realPath: string, overlayPath: string): void {
  * Returns the isolated HOME/SNOWFLAKE_HOME the spawn env must carry.
  */
 export function ensureCortexDualHomeOverlay(params: CortexOverlayParams): CortexOverlayResult {
-	if (!params.realHome || !params.realHome.startsWith("/")) {
+	// Absoluteness is judged in BOTH path flavors so the guard states the contract
+	// ("the parent captured an absolute HOME") instead of the host it happens to run
+	// on. This asserts nothing about native-Windows support; it only stops a POSIX
+	// host from silently accepting a drive/UNC path as "relative".
+	if (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {
 		throw new Error(
 			`entwurf: cortex dual-HOME overlay requires an absolute realHome captured by the parent (got ${JSON.stringify(params.realHome)})`,
 		);

package/pi-extensions/lib/meta-session.ts

@@ -1622,6 +1622,31 @@ export type MarkerOwnerVerdict = "live" | "dead" | "uncertain";
  * comparable to each other: `linux:<starttime ticks since boot>` and `ps:<lstart
  * wall-clock text>` describe the same process with different numbers, so a
  * mismatch ACROSS schemes says nothing about whether the process changed.
+ *
+ * They are also NOT equally resolved. `linux:` carries `/proc` clock ticks at
+ * 10 ms granularity; `ps:` carries `lstart` wall-clock text at ONE-SECOND
+ * granularity [measured, oracle 2026-09-09: two children spawned 50 ms apart
+ * returned identical `lstart` strings, and widening to `lstart=,command=`
+ * still collided when argv was identical]. Darwin has no `/proc`, so it ALWAYS
+ * takes the `ps:` branch — there the pid-reuse defense window is 100x wider
+ * than on Linux. 0.20.0 ships no key change anyway, and the numbers are why.
+ * A same-second pid reuse on Darwin requires pid N to die, the whole
+ * sequential pid space (PID_MAX 99999, wrapping after ~99,899 spawns and
+ * skipping live pids) to wrap back around to N, and the replacement to start
+ * in the SAME wall-clock second — a sustained ~99,900 spawns/second for a full
+ * second. Measured on the reference host: 19.9 forks/second average under real
+ * load, ~14,873 forks/second pathological synthetic peak (6.7x short even at
+ * the synthetic peak), with Darwin's default `kern.maxproc` (~2,500) capping
+ * churn in flight besides. The error direction is one-sided: a coarser clock
+ * can only make more keys compare EQUAL, and {@link classifyMarkerOwner} grants
+ * `live` on equal keys — coarsening can mint a false `live` (identity grant
+ * fails OPEN) and can never mint a false `dead` (the generation cut stays
+ * fail-CLOSED). The migration axis is empty by measurement, not argument: a
+ * read-only scan of this host's real marker store found 1,248 marker files —
+ * all `linux:`, zero `ps:` keys — because on Linux `/proc` always wins, so no
+ * Linux install ever minted a `ps:` key; only a Darwin install can. A
+ * Darwin-side hardening decision, if one is ever wanted, belongs with the
+ * physical-Mac receipts (#78), not ahead of them.
  */
 export type StartKeyScheme = "linux" | "ps";