@junghanacs/entwurf 0.20.0 → 0.21.0

package/README.md

@@ -10,7 +10,7 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code and GitHub Copilot CLI are shipped as mailbox-backed self-fetch meta-sessions; Antigravity (`agy`) is shipped as a native-push citizen with automatic `PreInvocation` birth, ambient garden-id status, and a managed MCP/permission install surface. OMP (`omp`) is a self-fetch citizen on the same rail as Claude and Copilot, opened by `entwurf_fresh_call` and accepted under the step 9 visible-fresh contract on 2026-08-30 — its first turn is a two-stage in-process bootstrap rather than an argv prompt, because the vendor connects its MCP tools in the background after the session starts. Codex has a launch-mode-specific verified delivery probe documented in [DELIVERY.md](./DELIVERY.md), but no managed native-citizen install lane yet. The ACP plugin ships two backends through one adapter rail: Claude (the reference) and Snowflake Cortex Code (landed in 0.13.0 under the measured contract in [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)).
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one adapter, not the project subject. Claude Code, GitHub Copilot CLI, and OMP (`omp`) are shipped self-fetch citizens; Antigravity (`agy`) is shipped native-push. Codex CLI is a **native-push citizen, supported in 0.21.0 on Linux** over the operator-owned app-server: vendor-trusted user-scope birth, strict request-scoped identity, loaded-thread probe, one-shot queue delivery, and visible fresh in one explicit operator-owned tmux home named `codex`. Unrestricted attached-TUI seat inference is not supported or claimed; that non-goal no longer blocks the explicit home topology. Codex remains native so it keeps its vendor tools, delegation, and work context; this is not another way to buy or expose GPT through ACP.
 
 ```text
 Claude Code / Copilot / Codex / agy / omp / pi
@@ -19,7 +19,7 @@ Claude Code / Copilot / Codex / agy / omp / pi
       → control-socket | meta-mailbox | native-push
 ```
 
-[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation. It starts no process on any rail: the hidden background resume that used to answer a dormant target was withdrawn under the visible-first rule, so a dormant citizen rejects honestly here and is reopened by a separate lifecycle verb, `entwurf_resume_call`. The meta-record is the sole address authority (#50 C4): a record-less control socket is refused as a `record-less-socket` diagnostic, never dispatched. The v1 entwurf verbs are gone. Fresh siblings and resumes are separate verbs — `entwurf_fresh_call` opens a NEW sibling in the operator's tmux — the caller's own session, or one existing named session on the same server — and learns its garden id from the callback it makes, while `entwurf_resume_call` reopens a DORMANT pi citizen under its own garden id in a visible window without running a turn; the non-Claude ACP lane landed earlier — Snowflake Cortex Code became the second backend in 0.13.0.
+[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation or loaded Codex thread. It starts no process on any rail. `entwurf_fresh_call` is separate lifecycle. With Codex placement omitted, it resolves the exact existing tmux session named `codex`; that operator-owned home holds the app-server and supported Codex TUIs. Missing home or app-server rejects before launch, and Entwurf never creates or supervises either. An explicit `placement.tmuxSession` remains an expert override. Exact 0.153.4 source confirms that arbitrary attached-TUI request→seat inference is unavailable, so Entwurf makes no such claim. Codex has no resume surface.
 
 **Garden id is deliberate vocabulary.** It is not a decorative synonym for session id, worker, delegate, or subagent. The unfamiliar word is a guard: each harness keeps its own identity and transcript, while `entwurf` supplies a narrow addressable surface between siblings.
 
@@ -60,10 +60,9 @@ native Antigravity / agy
 ```
 
 Claude's `install-meta-bridge`, Copilot's four `install-copilot-*` surfaces, agy's
-`install-agy-{bridge,statusline,hooks}` and OMP's four `install-omp-{bridge,mcp,config,receive}`
-units are distinct because their lifecycle and delivery transports are
-genuinely different. Codex remains verified probe evidence, not a shipped managed native-citizen
-lane; see [DELIVERY.md](./DELIVERY.md).
+`install-agy-{bridge,statusline,hooks}`, OMP's four `install-omp-{bridge,mcp,config,receive}`,
+and Codex's birth, MCP and statusline units are distinct because their
+lifecycle and delivery transports are genuinely different. See [DELIVERY.md](./DELIVERY.md).
 
 > **Direction.** Inverse of [`pi-acp`](https://github.com/svkozak/pi-acp). `pi-acp` lets external ACP clients talk *to* pi; `entwurf` lets garden citizens talk across harness boundaries — with pi as one adapter, not the center.
 
@@ -72,7 +71,7 @@ lane; see [DELIVERY.md](./DELIVERY.md).
 A few words that look unusual for a coding tool.
 
 - **Entwurf** (기투, projection-of-self) — sibling sessions with their own runtime boundary. Not "delegate," not "worker," not "sub-agent." Opening a visible sibling (`entwurf_fresh_call`), live peer messaging (`entwurf_v2`) and reopening a dormant one (`entwurf_resume_call`) are first-class; the hidden background resume that preceded the last of those was withdrawn under the visible-first rule.
-- **Garden / garden id** — the garden is the shared address space where independent harness sessions become citizens without losing their own runtime or transcript. A garden id is the stable address of one such citizen (for pi, a garden-native session id like `YYYYMMDDTHHMMSS-<6hex>`; for native harnesses, a meta-session id minted from an authoritative lifecycle hook — Claude `SessionStart`, Copilot's first-prompt birth hook, agy `PreInvocation`, and for OMP an in-process extension bound to both session edges that mints only the visible `mode === "tui"` host). It is not a worker name and not proof that pi owns the session. The same-looking id may name a live control socket, a dormant pi record, a mailbox-backed native session, or a native-push conversation, so callers discover facts with `entwurf_peers` and deliver with `entwurf_v2` instead of choosing a transport by hand.
+- **Garden / garden id** — the garden is the shared address space where independent harness sessions become citizens without losing their own runtime or transcript. A garden id is the stable address of one such citizen (for pi, a garden-native session id like `YYYYMMDDTHHMMSS-<6hex>`; for native harnesses, a meta-session id minted from an authoritative lifecycle hook — Claude `SessionStart`, Codex `SessionStart`, Copilot's first-prompt birth hook, agy `PreInvocation`, and for OMP an in-process extension bound to both session edges that mints only the visible `mode === "tui"` host). It is not a worker name and not proof that pi owns the session. The same-looking id may name a live control socket, a dormant pi record, a mailbox-backed native session, or a native-push conversation/thread, so routing always reads the record and live rail facts first.
 - **Engraving** — optional short operator text delivered through each backend's native identity carrier. Not a giant hidden prompt, not a tool catalog.
 - **MCP** — in this repo, MCP is just the transport by which ACP-backed sessions receive pi capabilities that native pi exposes directly as extensions. It is not a general MCP platform. Explicit `entwurfProvider.mcpServers` only; no ambient `~/.mcp.json` scanning, no automatic retrieval. The same `entwurf-bridge` entry can also be wired into another host's MCP catalog (Claude Code, Copilot, Codex, Antigravity, OMP, …) when the operator chooses. `entwurf_self` returns an authoritative pi-session or trusted meta-session identity envelope; `entwurf_v2` requires an authoritative sender by default (#50 C4) — a plain external MCP host with no identity lane is refused unless the operator explicitly wires the documented anonymous hatch, and even then it is never replyable.
 - **Session persistence** — re-attaches pi to the same remote ACP session. Does not hydrate backend transcripts into pi history.
@@ -81,21 +80,28 @@ A few words that look unusual for a coding tool.
 
 **Platform evidence, in one breath.** The Entwurf-only install surface on
 macOS is CERTIFIED (CI) (`macos-install-surface`). On macOS every
-garden-native harness rail (pi, Claude, Copilot, OMP, agy), marker join,
-ACP turn, and mux is NOT CERTIFIED — pending physical host; on Linux those
-same rails are the certified axis. native Windows is UNSUPPORTED.
+garden-native harness rail, marker/request join, ACP turn, and mux is NOT CERTIFIED —
+pending physical host. On Linux the released harness rails are the certified axis;
+Codex joined them in 0.21.0. Its explicit-home first admission was measured on 2026-09-12 — a real Pi
+outside `codex` opened Codex and outbound Pi inside it, with exact callbacks and delivery both ways —
+and the release acceptance that followed closed `check:full`, the LIVE release gate at MUST 24/0/0,
+and a 475/475 qualification.
+Unrestricted attached-TUI placement
+is unsupported rather than a release blocker.
+Native Windows is UNSUPPORTED.
 CERTIFIED (CI) is weaker than a physical-host doctor green.
 The npm package has no `os` restriction; that is installability, not a
 support claim.
 
-**macOS in this release.** This release adds macOS support for Entwurf's
+**macOS landed in 0.20.0.** That release added macOS support for Entwurf's
 install surface: the npm package installs, `entwurf --help` and `entwurf
 check-bridge` boot, and `entwurf setup` composes the integrations it finds.
 The four installers that previously rejected Darwin by platform name no longer
-do. We validated that surface only in macOS CI because the developers did not
+do. That surface was validated only in macOS CI because the developers did not
 have a physical Mac. So macOS native-harness rails—marker join, an ACP turn,
-and mux included—are not yet certified; setup writes their wiring but reports
-them non-green. Linux's certified rail status is unchanged.
+and mux included—are **NOT CERTIFIED — pending physical host**; setup writes
+their wiring but reports them non-green. Linux's certified rail status is
+unchanged.
 
 On Darwin, `entwurf setup` that detects a harness is intentionally
 non-green: the wiring WAS written and nothing failed to install, but the
@@ -242,15 +248,18 @@ SKIP while the detected harnesses are composed.
 ### Native harness repair and doctors
 
 A plain MCP registration exposes the bridge tools; a **garden-native** session also
-needs entwurf's lifecycle hook and identity marker. `setup` already composes all of that
-for every harness it detects — you do not paste this list to install. This is the repair
-surface: each unit has its own installer, its own doctor with a named refusal, and its own
-inverse, so a single broken unit can be redone without touching the rest.
+needs entwurf's lifecycle and identity unit. `setup` composes every user-scope unit
+for each detected harness, including Codex's birth hook — its paths are the operator's
+own, so nothing here asks for root. What setup cannot do is answer the vendor's one-time
+hook-trust prompt: only the operator can, in their own visible Codex, so a first setup on
+a Codex host writes every byte and stays honestly non-green until they have. This is the
+repair surface: each unit has its own installer, doctor, and inverse.
 
 - **Claude Code** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-meta-bridge`, `doctor-meta-bridge`.
 - **Antigravity / agy** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
 - **GitHub Copilot CLI** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
 - **OMP (`omp`)** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
+- **OpenAI Codex CLI** (supported in 0.21.0 on Linux; macOS NOT CERTIFIED — pending physical host) — `install-codex-birth` publishes the `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`, all operator-owned; the vendor trust receipt for that declaration is the operator's single answer, and `doctor-codex-birth` reports it as its own axis (present, or red with the exact instruction — never computed, never written); `install-codex-mcp` owns `[mcp_servers.entwurf-bridge]`, including the `env_vars` boundary for `CODEX_HOME`, Entwurf garden/control roots, and the app-server's `TMUX`/`TMUX_PANE`; `install-codex-statusline` owns `thread-title`. Each has a matching doctor and inverse. The operator owns one existing tmux session named `codex`, starts the app-server there, and seats supported Codex TUIs there. Omitted Codex fresh placement selects that home; Entwurf never creates or supervises the session/app-server and never discovers arbitrary attached-TUI seats. An explicit placement is an expert override. Exact 0.153.4 source's missing per-client carrier bounds the unsupported topology; it does not block this explicit home deployment.
 
 Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
 walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).
@@ -335,9 +344,9 @@ host evidence boundaries are [VERIFY.md](./VERIFY.md) and [BASELINE.md](./BASELI
 
 The curated model registry exposes unprefixed Claude ids — `claude-opus-5`, `claude-sonnet-5`,
 `claude-fable-5-1` — plus the `cortex-` rows below.
-Codex is not an ACP backend or a shipped managed citizen lane: it has verified
-native-delivery probe evidence only. No managed Codex support is claimed; lifecycle,
-identity, installation, and doctors remain prerequisites for any such lane.
+Codex is not an ACP backend. Its native-citizen lane, supported in 0.21.0, is independent so the
+session retains Codex's native tools, delegation, and work context: trust-gated hook birth, strict
+request `_meta` identity, app-server probe, one-shot native-push, and visible fresh.
 
 **Snowflake Cortex Code is the second ACP backend** (contract and audit:
 [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)). Curated ids are
@@ -443,8 +452,10 @@ The Claude ACP backend keeps its native model / API / tools; entwurf shapes only
 
 **Claude** uses `_meta.systemPrompt` for the engraving carrier (kept short and pure — billing-safe; rich operator context rides the first user message instead, see [Context carriers](#context-carriers)) and `CLAUDE_CONFIG_DIR` for a whitelist overlay so auth/runtime entries stay available while operator memory, hooks, agents, history, local settings, and project memory remain hidden. The overlay writes an explicit empty `hooks: {}` because Claude SDK organic compaction needs the configured-empty shape; no operator hook definitions are inherited. It also pins `permissions.defaultMode: "bypassPermissions"` so an unattended ACP turn cannot suspend on an interactive permission prompt; explicit `tools` / `disallowedTools` still constrain the callable surface and backend authentication remains the operator's. The four-tool baseline is `Read`, `Bash`, `Edit`, and `Write`; `permissionAllow` carries their allow declarations, and `Skill` is added automatically when `skillPlugins` is non-empty. Operator context cap override: `ENTWURF_ACP_CLAUDE_CONTEXT=<int>`.
 
-Codex is not an ACP backend here. Its native delivery probe remains separate from
-the governed ACP adapter rail and does not yet constitute a managed garden citizen.
+Codex is not an ACP backend here. Its native-push lane, supported in 0.21.0, uses `SessionStart`
+for birth, strict request `_meta` for who-sent, and a loaded app-server thread as the live route.
+Its supported visible topology is one operator-owned existing tmux home named `codex`; omitted
+Codex fresh placement selects it, while unrestricted attached-TUI seat inference is not claimed.
 
 Antigravity is also not an ACP backend. It is a native-push citizen: `PreInvocation` supplies birth/sender identity, `entwurf_v2` probes and direct-injects replies into the live conversation, and no mailbox/receiver marker is involved.
 
@@ -460,6 +471,9 @@ pnpm run check:full                     # full deterministic floor (adds the her
 ./run.sh smoke-agy-statusline-state     # agy ambient garden-id install surface
 ./run.sh smoke-agy-hooks-state          # agy PreInvocation birth hook
 ./run.sh check-agy-sender-identity      # record-backed pid/start-key sender identity
+./run.sh check-codex-native-push       # deterministic Codex UDS probe + no-replay queue contract
+./run.sh smoke-codex-config-state      # Codex MCP/status-line install, doctor, and inverse
+./run.sh check-codex-birth-hook        # sandboxed payload + declaration: one V3 per top-level thread, the envelope's own axes, no markers
 
 # source-maintainer only — qualification snapshots the git work surface, and both
 # commands are source-contract gates rather than installed operator checks:
@@ -470,6 +484,20 @@ pnpm run check:full                     # full deterministic floor (adds the her
 # agy LIVE acceptance — requires an already-running conversation:
 LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 
+# Codex loaded-thread probe (pre-amendment evidence; not first-release acceptance):
+LIVE=1 CODEX_LIVE_THREAD_ID=<threadId> ./run.sh smoke-codex-native-push-live
+
+# Codex explicit-home acceptance. Run from a DIFFERENT tmux session; the operator-owned
+# app-server and supported Codex TUIs sit in the existing exact `codex` session. Record
+# initial Pi, app-server, fresh Codex, and outbound Pi coordinates separately:
+LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid> \
+  ENTWURF_CODEX_FRESH_MODEL=<codex-model> \
+  ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
+  ./run.sh smoke-codex-fresh-live
+# This accepts only a real visible Pi → visible Codex → visible Pi run: initial Pi outside
+# the Codex home, then Codex and its outbound Pi inside it. A fixture or self-fetch first leg
+# may collect receipts but does not satisfy the topology. No arbitrary attached-TUI parity is claimed.
+
 # ACP plugin LIVE acceptance — need the operator's local Claude auth/credit:
 LIVE=1 ./run.sh smoke-acp-socket-citizen-live   # turn-free socket citizenship (S1)
 LIVE=1 ./run.sh smoke-acp-raw-turn-live         # pinned ACP pipe + raw 1 turn (S2a)
@@ -544,7 +572,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / Antigravity-native-push, and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one fixed backend (`pi`, `claude-code`, `copilot`, or `omp`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement is now a per-backend policy rather than one rule: `pi`, `claude-code`, `copilot` and `omp` open in the CALLER's own seat, while `codex` resolves the exact existing operator-owned `codex` session (a missing home rejects; nothing is created). 0.21.0 is the first release to carry such a backend-selected default — every backend could already be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -561,9 +589,9 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 | dead / indeterminate native-push conversation | fire-and-forget | **reject** (`native-push-target-dead` / `native-push-probe-indeterminate`) |
 | record-less control socket (no meta-record) | any | **reject** (`record-less-socket` — pre-probe; diagnostic state, #50 C4) |
 
-**`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
+**`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity or Codex, and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one fixed Pi, Claude Code, Copilot or OMP runtime visibly on the caller's tmux server — its own session by default, or one EXISTING named session via the optional `placement.tmuxSession` — with a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one of five fixed runtimes — Pi, Claude Code, Copilot, OMP or Codex — visibly on the caller's tmux server. Omitting placement is a per-backend policy: the first four open in the caller's own session, while Codex resolves the exact EXISTING operator-owned `codex` home and rejects if it is absent. An explicit `placement.tmuxSession` sends ANY of the five to an existing named session instead (see the `entwurf_fresh_call` paragraph above for the owning detail). Each launch carries a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 

package/VERIFY.md

@@ -7,8 +7,14 @@ and the manual judgements a gate cannot make.
 > **Current surface.** `entwurf-bridge` exposes `entwurf_v2`, `entwurf_peers`,
 > `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and `entwurf_register_native`. The ACP
 > backends are Claude and Snowflake Cortex Code. Antigravity is a separate shipped
-> native-push citizen lane; Codex has delivery-probe evidence but no managed citizen
-> lane. Retired v1 verbs and bridge implementations belong only in CHANGELOG/git.
+> native-push citizen lane. Codex is a native-push citizen supported in 0.21.0, whose birth hook is
+> operator-owned and gated on one vendor trust receipt, with strict request-scoped identity and
+> visible fresh; it remains outside ACP and has no resume.
+> The amended candidate carries its own full acceptance: standalone LIVE 48 assertions exit 0,
+> `check:full` exit 0, and the LIVE release gate `--cut` at MUST 24/0/0 with `check-gate-qualification`
+> killing 475/475 and both purity axes green. Earlier focused, 460-mutant, and 57-assertion receipts
+> stay their own pre-amendment axes and are not promoted across it.
+> Retired v1 verbs and bridge implementations belong only in CHANGELOG/git.
 
 This is a working protocol, not a metrics ledger. Per-run counts, digests, and release
 chronology belong in [BASELINE.md](./BASELINE.md), CHANGELOG, and release artifacts.
@@ -64,6 +70,27 @@ Verification here is not a benchmark. In production we exchange short turns and
 >
 > The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence. **Cost fence:** the agy conversation this smoke drives runs on a free account, so open it on `gemini-3.6-flash` — never a Pro tier. The model is the operator's choice at conversation-open time; entwurf never selects it, and no assertion reads it (see the shipped-lane note: model display is not part of the agy contract).
 >
+> Aggregate release-gate does not own a loaded Codex thread. Codex native-push remains an
+> on-demand host axis. The final first-admission acceptance passed on 2026-09-12 with the
+> explicit home topology; `DELIVERY.md` owns its 57-assertion receipt and digest. Re-runs start
+> from a tmux session other than `codex`; the operator-owned
+> app-server and supported Codex TUIs sit in the existing exact `codex` session; omitted Codex
+> placement resolves there; and the Codex-opened Pi stays there. Exact `rust-v0.153.4` source
+> exposes no arbitrary request→attached-TUI-seat value, so that wider topology is unsupported
+> and unclaimed rather than a blocker to the explicit home.
+>
+> The A cell takes no inferred server or models:
+> `LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid>
+> ENTWURF_CODEX_FRESH_MODEL=<codex-model>
+> ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> ./run.sh smoke-codex-fresh-live`.
+>
+> The command name is not proof. The first leg must be a real record-backed visible Pi
+> citizen outside the Codex home opening Codex; if a fixture or self-fetch receipt collector
+> is what OPENS Codex, the gate does not satisfy the topology. A fixture that only COLLECTS
+> receipts beside that real Pi leg is not the disqualifier — substituting for the leg is (see
+> `docs/adding-a-harness.md`, the same wording). The receipt must separately name the initial
+> Pi, app-server, fresh Codex, and outbound Pi coordinates.
+>
 > Authoritative per-cut counts and digests live in BASELINE/CHANGELOG, not inline
 > here; embedding them in the protocol makes a correct guide stale after every cut.
 
@@ -81,6 +108,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
+| Native Codex host | explicit-home first admission accepted 2026-09-12 | Operator-owned birth/MCP/statusline atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: initial Pi outside the existing exact `codex` home; app-server, omitted-placement fresh Codex, and outbound Pi inside it; exact callbacks and addressed delivery both ways. `DELIVERY.md` owns the 57-assertion receipt and digest. Arbitrary attached-TUI placement is unsupported and unclaimed. |
 
 The repo-local `entwurf-release` skill owns the `land → prepare → make → publish`
 state machine. Each mode is a separate GLG authorization. Preserve one candidate,
@@ -143,8 +171,9 @@ The goal is not merely "invoke Claude Code." We want:
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
 6. Copilot four-unit composition (birth → MCP → receiver → visible footer) — only when `copilot` is on PATH (#86 C3b); the units run independently, each keeps its package-owned install-state and inverse, and a failed unit is a named component FAIL. The explicit `install-copilot-*`/`uninstall-copilot-*` surfaces remain the per-unit repair and inverse path
-7. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
-8. computed summary — per-component PASS/SKIP/FAIL; any detected-integration FAIL makes the whole command exit nonzero while valid components stay installed
+7. Codex composition — only when `codex` is on PATH: setup publishes all three operator-owned atoms and stays non-green until the vendor's trust receipt for the birth declaration exists; it never invokes sudo, never writes `[hooks.state]`, and never starts the app-server or creates the `codex` tmux home. Its setup cells prove the exact `env_vars` boundary, independent component outcomes, idempotence, the non-green-until-trusted verdict with its named operator repair, and that setup never writes the receipt itself. First-admission qualification follows the separate explicit-home LIVE; unrestricted attached-TUI placement is outside the claim.
+8. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
+9. computed summary — per-component PASS/SKIP/FAIL; any detected-integration FAIL makes the whole command exit nonzero while valid components stay installed
 
 ```bash
 git clone https://github.com/junghan0611/entwurf /path/to/entwurf && cd $_
@@ -300,9 +329,10 @@ The minimum passing bar:
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its seven current tools, and presents a backend-native (not normalized) tool surface.
 6. **Carrier separation honored:** engraving vs pi-context-augment kept distinct (§1A.0); no bridge-identity narrative attributed to the engraving carrier.
 7. **agy shipped lane accepted:** all three agy doctors are green; automatic birth/statusline/sender identity and same-gid native-push reply are confirmed in a fresh conversation. `agentId=meta-session/antigravity` is correct; model display is not part of that contract. Same-pid concurrent conversation invocation is not claimed.
-8. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
-9. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
-10. **New-harness admission closed:** a release that introduces a native harness admitted under the #82 contract has that harness in `FRESH_CALL_BACKENDS` on all three public surfaces, with `check-harness-admission-parity` green and its clause 7 visible-fresh LIVE step green in the MUST tier. That release also owes the cross-harness leg the same release stop names — two dispatch receipts, an existing citizen's live turn delivered into the new citizen and the new citizen's live turn delivered into an existing one — recorded in `DELIVERY.md`; its deterministic half is an owed follow-up, so until that gate lands this half of the condition is prose and is judged by the recorded receipts. Partial evidence is a branch state; an `unsupported` note in `DELIVERY.md` is a description, never a permit.
+8. **Codex first-admission home topology accepted:** its birth/MCP/status-line doctors are green and the on-demand real visible `Pi → Codex → Pi` cell records four coordinates: initial Pi in a session other than the exact existing `codex` home; operator-owned app-server, omitted-placement fresh Codex, and Codex-opened outbound Pi in that home; exact callbacks and addressed delivery succeed both ways. Missing home/app-server rejects without mutation. Entwurf neither creates nor supervises them, infers attached-TUI panes, nor claims unrestricted client placement. Codex remains outside ACP and has no resume claim.
+9. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
+10. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
+11. **New-harness admission closed:** a release that introduces a native harness admitted under the #82 contract has that harness in `FRESH_CALL_BACKENDS` on all three public surfaces, with `check-harness-admission-parity` green and its clause 7 visible-fresh LIVE step green in the MUST tier. That release also owes the cross-harness leg the same release stop names — two dispatch receipts, an existing citizen's live turn delivered into the new citizen and the new citizen's live turn delivered into an existing one — recorded in `DELIVERY.md`; its deterministic half is an owed follow-up, so until that gate lands this half of the condition is prose and is judged by the recorded receipts. Partial evidence is a branch state; an `unsupported` note in `DELIVERY.md` never weakens this stop.
 
 Passing establishes a **release verification floor**, not an 8-hour/day operational guarantee. The floor says: gates hold, the agent honestly recognizes its environment, no tool surface is normalized away, no identity leaks, no orphans. It does **not** say a real-day workload (50–100+ turns, tool bursts, partial MCP failures, auth/version drift) survives — that needs L3–L5 evidence (appendix).
 

package/docs/acp-backend-rail.md

@@ -92,10 +92,10 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
+| Entwurf package | `0.20.0` | shipped baseline | the package contract these rows belong to |
 | pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.75.1` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.76.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
@@ -151,6 +151,23 @@ different reasons, and collapsing them would hide a real risk**:
   entwurf passes that flag nowhere (repo grep, 0 hits). They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+- **Advertised but never called — 0.76.0 adds exactly one.** Upstream #1111 puts a
+  `recommendedValue` on AIR config options, and it is **opt-in**: the adapter turns it on only
+  when `initialize`'s `clientCapabilities._meta.jetbrains.air.capabilities` names
+  `recommendedValue`. entwurf sends `clientCapabilities: {}` (`backend.ts:1758`), so
+  `useRecommendedValue` is false on every branch. The label normalization, the `default` row and
+  the effort selector that ride it are unreachable for a second, independent reason as well:
+  `[측정 2026-09-10]` `git grep -c configOptions pi-extensions/lib/acp/` is **0**, and entwurf
+  has never set `EFFORT_CONFIG_ID`, which is the other gate on the SDK-side `applyFlagSettings`.
+  The rest of 0.76.0 is one refactor: `resolveModelPreference` moved into a new
+  `dist/session-model.*` (diff is comments and formatting), `dist/session-effort.*` is new, and
+  `setSessionConfigOption` — our only model-forcing wire call — is byte-identical across
+  `v0.75.1..v0.76.0`.
+- **One 0.76.0 change has a reachable SHAPE and is still inert for us.** When
+  `configuredSettings` is a STRING PATH, its `readFile` + `JSON.parse` moved out of
+  `resolvedProvider` and up onto the unconditional `session/new` path. entwurf passes `settings`
+  as an OBJECT (`tool-surface.ts:153`), so the branch is never taken. That makes "entwurf never
+  hands `settings` as a path" a contract rather than an accident; it is stated at that call site.
 - **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
   synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
   `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
@@ -275,23 +292,23 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.75.1 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.76.0 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.73.0 → 0.75.1 bump, not inherited from the previous one — and the
-0.70.0 → 0.73.0 argument is not reused either. `mcpServerStatus` call sites in
-`src/acp-agent.ts` are **2 at both v0.73.0 and v0.75.1** `[측정 2026-09-06, git grep -c]`;
-they first appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it
-where it once did not. Both were re-read at `v0.75.1 src/acp-agent.ts:1736` and `:1829`
-(the 0.73.0 coordinates were `:1618` and `:1711`): the first sits inside
+(Re-measured at the 0.75.1 → 0.76.0 bump, not inherited — the previous bump's argument is
+not reused, the way the 0.73.0 → 0.75.1 entry did not reuse 0.70.0 → 0.73.0's.
+`mcpServerStatus` call sites in `src/acp-agent.ts` are **2 at v0.75.1 and 2 at v0.76.0**
+`[측정 2026-09-10, upstream v0.76.0/src/acp-agent.ts read directly, grep -n]`; they first
+appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it where it
+once did not. Both were re-read at `v0.76.0 src/acp-agent.ts:1762` and `:1855`
+(v0.75.1: `:1736` / `:1829`; v0.73.0: `:1618` / `:1711`): the first sits inside
 `authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
 `needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
 Neither waits on every declared server before `newSession` returns. That is an auth
-handshake, not a readiness fence, so the boundary below is unchanged. The other reachable-surface findings also re-measured:
-AIR typed failures and the AIR file-change report stay capability-gated and
-unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
-unconditionally and uncalled; native subagents, async tasks, session forks, session
-titles, permission-mode kinds and clear-context planning are all new-but-uncalled.
+handshake, not a readiness fence, so the boundary below is unchanged. The surrounding 200
+lines are byte-identical and the region moved +26; the whole 0.76.0 delta is one refactor
+plus one opt-in AIR extension that `clientCapabilities: {}` never enables, so the other
+reachable-surface findings stand as re-measured at the previous bump.
 This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
@@ -384,5 +401,4 @@ Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-meas
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;
 - broader installed-host and cross-machine Cortex evidence;
-- any future Codex managed native-citizen lane—separate from ACP; 0.14.0 does not ship one;
 - persisted ACP resume/load, which is not implemented by today's in-memory reuse.