@junghanacs/entwurf 0.20.1 → 0.21.0

package/CHANGELOG.md

@@ -4,6 +4,189 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.21.0 - 2026-09-13
+
+### Added
+
+- **This is a minor release because Codex support adds a new visible citizen axis, not merely a
+  patch to an existing rail.** The operator-owned exact `codex` tmux home gives the app-server and
+  supported Codex TUIs a stable visible place without making Entwurf their lifecycle manager. UX
+  symmetry means each backend remains a sibling with its own transcript, auth, native tools, and
+  visible seat—not that unlike transports are relabeled as identical. The release also carries the
+  independent #111 and #112 bug repairs.
+- **OpenAI Codex CLI becomes an app-server-backed native-push citizen (#95).**
+  A user-scope `SessionStart` hook, declared in the operator's own `$CODEX_HOME/hooks.json`,
+  mints the V3 record on the first turn and sets the visible thread title. It needs no root:
+  the installer refuses to run as uid 0, and the declaration is trust-gated rather than
+  prompt-free — the operator answers the vendor's prompt with "Trust all" ONCE in their own
+  visible Codex, and the vendor records that decision itself. Entwurf never computes, writes,
+  pre-seeds or reads a `trusted_hash`, and never touches `config.toml`. Because the vendor
+  hashes the declaration identity (event, matcher, handler path) and not the launcher's
+  contents, the payload closure can be upgraded on later releases without asking again. The bridge strictly joins each request's Codex metadata to
+  that record, so multiple visible TUIs may share one app-server without sharing a
+  process marker. The purpose is to preserve Codex's native tools, delegation, and work
+  context as a citizen — not to add an ACP Codex backend or duplicate GPT access.
+- **Codex gets three independently owned install/doctor/inverse atoms.**
+  `install-codex-birth` owns only the fixed `$CODEX_HOME/hooks.json` declaration plus its
+  launcher/payload closure under `${XDG_DATA_HOME:-~/.local/share}/entwurf/codex-birth`, with a
+  digest inventory that licenses an exact inverse and refuses drifted bytes;
+  `install-codex-mcp` owns only `[mcp_servers.entwurf-bridge]`; and
+  `install-codex-statusline` owns only `thread-title`. The MCP atom also owns the exact
+  `env_vars` names that forward `CODEX_HOME`, Entwurf garden/control roots, and the
+  operator-owned app-server's `TMUX`/`TMUX_PANE`. `setup` never escalates or starts it.
+- **`entwurf_fresh_call` accepts `backend: "codex"` on both public tool surfaces and the
+  operator skill.** It requires an explicit model and uses the measured
+  `codex --remote unix://<default-socket> --model … --dangerously-bypass-approvals-and-sandbox`
+  shape. The birth unit, MCP/env boundary, visible title, and the operator-owned app-server
+  socket are checked before tmux mutation. With placement omitted, Codex resolves the exact
+  existing `codex` tmux home; a missing home rejects without creating one. Explicit placement
+  remains an expert override. This does not infer an attached TUI seat from request identity.
+- **Omitted placement becomes a backend-selected policy, and Codex is its first implementation.**
+  Every backend could already be sent to an operator-owned existing seat through explicit
+  `placement.tmuxSession`; that is unchanged, and named `claude`/`pi` seats stay available that
+  way without becoming omitted-placement defaults. What is new is that omitting placement no
+  longer means one thing for every backend: `pi`, `claude-code`, `copilot` and `omp` still open
+  in the caller's seat, while `codex` resolves its exact operator-owned home. tmux remains the
+  visible launch seat, never an address — the garden id is the address and arrives in the
+  callback envelope. Sibling symmetry is transcript, auth, native tools and visibility; it is
+  not a claim that the transports are the same.
+- **Why a client-side home rather than a vendor seat carrier.** Upstream
+  [openai/codex#44774](https://github.com/openai/codex/issues/44774) records the maintainer's
+  preference for client-side terminal/window management, citing multi-client steer semantics and
+  network propagation. Rather than wait for a request→pane carrier or guess one, 0.21.0 takes the
+  client-side route the exact `rust-v0.153.4` source supports: an operator-owned exact home plus
+  explicit placement, with the wider attached-TUI topology left unsupported and unclaimed.
+
+### Changed
+
+- **The native-push rail is adapter-specific instead of Antigravity-shaped.** Codex liveness
+  is `thread/loaded/list` over the app-server WebSocket UDS; delivery is the measured one-shot
+  `codex queue --remote … --thread … --message …`. It has no mailbox, receiver marker, or
+  resume surface. Unlike Antigravity, Codex delivery is never retried because vendor acceptance
+  may precede the CLI receipt; replay would duplicate the user's message.
+- **Codex remains outside ACP and Entwurf remains outside Codex lifecycle ownership.**
+  Entwurf does not install Codex, supply auth, expose a generic app-server API/manager, or
+  start/supervise/restart the app-server or create its tmux home. The supported topology is
+  one operator-owned existing session named `codex` containing the app-server and supported
+  Codex TUIs. N arbitrary attached TUIs across sessions still have no request→TUI seat join;
+  that wider topology is unsupported and unclaimed rather than a blocker to the explicit home.
+- **`entwurf_peers` bounds expensive historical observation to its 32 rendered rows (#112).**
+  Full-store parsing, duplicate/conflict authority, socket liveness, diagnostics, and all 1,012
+  measured payload rows remain intact; older receiver/transcript cells say `unobserved` rather
+  than fabricating facts. On the 1,012-record fixture, repeated warm composition fell from about
+  3.2s to 70–103ms. Generic fact-provider callers remain unbounded unless they explicitly opt in.
+- **Version-coherence gates no longer require concise `AGENTS.md` to duplicate package pins.**
+  The owning runtime/package documents remain checked; removing redundant pin prose from the
+  maintainer guide no longer makes an otherwise coherent floor fail.
+
+### Upgrade note
+
+Codex native delivery requires three user-scope atoms and one operator trust answer. No step
+needs root:
+
+```bash
+entwurf install-codex-birth
+entwurf install-codex-mcp
+entwurf install-codex-statusline
+
+# Then, ONCE, in a visible plain Codex: answer the hook prompt with "Trust all and continue"
+# and send one first turn. Until the vendor records that receipt the hook is declared and
+# never runs, and `doctor-codex-birth` / `setup` stay non-green and say so.
+
+# First create/open the operator-owned tmux session named exactly `codex`.
+# From a pane in that session:
+CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
+mkdir -p "$CODEX_HOME/app-server-control"
+codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+# Seat supported Codex TUIs in this same `codex` session.
+```
+
+Then restart/open Codex and send its first turn. `entwurf setup <project>` never runs sudo and
+never starts the app-server.
+
+### Verification
+
+- The GPT-6 review reopened five surfaces in the candidate: terminal parser, explicit
+  env-name boundary, setup acceptance, fresh preflight safety, and clause-7 composition.
+  The prior “source-complete; only host ownership remains” wording is withdrawn.
+- The 2026-09-11 Codex CLI 0.153.4 run remains pre-amendment evidence: native-push and a
+  public MCP call woke one visible loaded thread; authenticated request identity resolved
+  `agentId=meta-session/codex`, `replyable=true`; and a source hook minted a record in an
+  isolated store. It does not qualify the amended candidate.
+- The 2026-09-12 Codex 0.153.4 explicit-home LIVE passed 57 assertions. A real initial Pi
+  ran at `$150/@397`; the operator app-server remained at `$158/@390/%390`; omitted-placement
+  Codex opened at `$158/@398`; and Codex opened outbound Pi at `$158/@399`. Exact callbacks
+  and addressed delivery succeeded both ways. `DELIVERY.md` carries the garden ids, thread,
+  nonces, preserved log path, and SHA-256.
+- Two red attempts repaired the acceptance itself. “Wait” had let Codex call one-hour
+  `wait_agent`; the task now ends its turn and forbids wait tools. A model also reformatted
+  a copied LAUNCH receipt; the gate compares source-owned tool results rather than treating that prose
+  as raw evidence. Failure cleanup interrupts only the exact smoke-owned active Codex turn and removes
+  only source-receipt-named windows.
+- The second full prepare P5 remained honestly red at **MUST 23 PASS / 1 FAIL / 0 SKIP**. The initial
+  Pi's source transcript proved Codex launch, exact callback, native-push delivery, outbound Pi launch
+  and callback, and Codex's final mailbox enqueue; it also showed the missing observation's direct
+  cause: the model shortened expected launch-report token `…1G5XEKQH` to `…1G5XEKQ`. Enqueue did not
+  prove the fixture read, and cleanup had removed the mailbox needed to distinguish every downstream
+  observer hypothesis. The amendment removes intermediate model coordinate reports entirely: Pi JSONL
+  call/result rows are joined by call id, exact tool name/arguments, non-error result, and uniqueness;
+  Codex uses the corresponding structured app-server MCP items; raw callback events supply garden ids.
+  Mailbox prose can never authorize a window kill. Every drain now persists filename, byte length,
+  SHA-256, observed token candidates, phase-specific selection/exclusion reason and a 0600 body artifact
+  immediately, plus resolved-root/run/source-path manifest and a mandatory fixture/record/transcript/thread
+  snapshot before destructive cleanup on every outcome. That snapshot uses the record owner's `.meta.json`
+  filename, records missing expected sources, and still copies known raw files when optional identity recovery
+  throws; final acceptance also requires known `completed` Codex turn/items state and logs payload validation
+  separately from token/sender candidate selection. The preserved failed-rollout extraction
+  (`c3a28938…`) confirms raw outbound launch → callback → final enqueue but still not fixture read; its tracked
+  positive fixture is explicitly labelled a vendor-source-derived v2 projection, not a captured `thread/read`
+  response. A second defect the amendment itself introduced was then measured and closed: the smoke read the
+  initial Pi's `transcriptPath` once at callback correlation, and a record that gained that path 34s later
+  left every subsequent source observation permanently empty — one 300s red whose chain had in fact run to
+  completion, proven by the Codex thread's own completed final `entwurf_v2` result. The resolution is a pure
+  leaf that re-reads the record while its cached path is empty (an unreadable record stays fail-loud; only
+  "no path yet" is pending), its own `CODEX-LIVE-SOURCE-PATH-RE-RESOLVED` claim and mutant, and an explicit
+  `no unverified child window killed` line so a run that never obtains source evidence names its
+  unrecoverable windows instead of leaking them. Declared inventory is now 475 mutants across 43 lanes.
+  The amended standalone LIVE then passed: **48 assertions, exit 0**, final source audit `initial-pi=3/3`
+  and `codex=3/3` completed exact, all three opened windows reclaimed by their own receipts, artifact
+  `.probe-artifacts/codex-fresh-live-fZccoK/`. Assertion count is not comparable with the pre-amendment 57:
+  that contract counted model coordinate reports this one removes.
+- **Release acceptance for this candidate: `check:full` exit 0 in 502s, then the LIVE release gate
+  `--cut` at MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, `cut: OK`.** Its
+  `check-gate-qualification` MUST step killed 475/475 across 43 lanes with the origin HEAD and
+  work-surface hash identical before and after. The aggregate's own Codex leg repeated the
+  48-assertion source-owned acceptance (artifact `.probe-artifacts/codex-fresh-live-2oId4C/`), and the
+  mux lifecycle MUST passed in the same run. Scratch log sha256 `942d5fa0…`.
+- **Observation, not a repaired defect.** The first acceptance attempt at the identical source
+  fingerprint failed two model-in-loop MUST steps: a callback nonce arrived one character short
+  (`…c70cfb` for `…c70cfb2`) and an addressed instruction carried the wrong payload. Both oracles
+  refused fail-closed and named their cause, and the joined source receipts proved delivery and rails
+  were correct, so nothing in the product was changed. The same candidate, model, and environment then
+  passed. That leaves an intermittent exact-byte transfer failure in the model lane as a recorded
+  observation; the retry does not establish a cause for it.
+- The first 460-mutant qualification honestly stopped at 454/460. One wait-task mutant was
+  stale after the prompt repair; the birth safe-umask mutant was killed earlier by the new
+  package-root mode doctor but carried the wrong assertion label; and four setup claims shared
+  one control-red because `smoke-setup-verdict` ran real pnpm inside the qualifier's
+  node_modules-symlink snapshot. The manifest was re-pinned, safe-umask attribution now has one
+  QK helper at both valid failure leaves, and the setup behavior gate uses a strict fixture
+  pnpm accepting only a no-op `install --frozen-lockfile` or the source-owned `build-bridge`
+  emit, whose snapshot-local dist is removed on exit. The next run killed all 460 mutants but
+  correctly rejected its own impure snapshot: the fixture had called the production dist-lock
+  wrapper, which removed its lock but left the ignored `.tmp-verify` parent. The fixture now
+  invokes the process-exclusive snapshot emit directly; a focused pre/post tree-manifest replay
+  was byte-identical. The fresh run then killed **460/460** mutants across 43 lanes in 53m42s
+  with the origin and snapshot surfaces pure. Biome only collapsed the new manifest arrays onto
+  one line afterward (claim/subject/find/replace bytes and semantics unchanged), and the frozen
+  full floor passed in 506s. The receipt-bearing final candidate passed the full floor again
+  in 501s before the implementation commit and local-main merge.
+
+### Fixed
+
+- **The Copilot receiver parent-death mutant no longer leaves one PID-1 fixture child per qualification run.** P9 found ten reparented Node stubs from ten qualifications. The gate did detect the mutant, but its failing assertion threw before the cleanup statement below it; cleanup now kills the surviving mutant child before asserting, preserving the same attributed red while leaving no process behind.
+- **Control-socket send during Pi compaction is no longer a false `delivered:true` (#111).** A compacting Pi citizen is neither idle nor an ordinary streaming turn, but the receiver only sampled `ctx.isIdle()` and forwarded every non-idle send into `pi.sendMessage({ triggerTurn: true })`. Installed Pi 0.85.1 `sendCustomMessage` then starts `_runAgentPrompt` when not streaming — racing `compact()`'s session rewrite, which is the field path that can make compaction "풀린다". There is no public `ExtensionContext.isCompacting()`. The resident arms on `session_before_compact` and refuses as `compacting`; quiet unknown non-idle (`!idle && ctx.signal === undefined`) is fail-closed as `busy`, not `compacting`, because `ctx.signal` is `agent.activeRun?.abortController.signal` and is already gone during `_handlePostAgentRun` retry/continuation while `_isAgentRunActive` is still true — that cell also covers the manual-compact start race and branch summary, which the public API cannot tell apart. Either token: no `pi.sendMessage`, no `delivered:true`. Idle and live-run steer/followUp are unchanged. Frozen v2 reject taxonomy is untouched — this is an in-band RPC refusal.
+
 ## 0.20.1 - 2026-09-10
 
 ### Fixed
@@ -124,17 +307,15 @@ Hosts with no detected harness, and every Linux host, see no new prompt.
   by the promotion above; it is where a borrowed Mac produces the physical-host
   evidence the CI runner cannot.
 - **`scripts/raw-codex-measure/` — Codex 0.153.4 vendor measurement (#95 step 1).**
-  Nothing is installed: no birth hook, no record, no marker, no doctor, and
-  `entwurf_fresh_call` still cannot open a codex sibling. GLG reversed the
-  2026-08-01 decline on 2026-09-08; live claims that still said otherwise
-  were repaired. The ledger closes step 1: SessionStart fires on the first
-  turn, not at window open; a fourth callback spelling
-  (`mcp__entwurf_bridge__entwurf_v2`); the delivery-capable app-server join
-  cannot use parent-pid as a citizen key; hook-trust is an ownership cost
-  (`/etc/codex`, root-owned), not a capability gap; clause 4 is
-  `thread/name/set` plus a status_line config. Step 2 is not opened.
-  `PIN_CODEX_MINOR` 0.144 → 0.153 is a re-verification of the archived drift
-  probe, not a product pin.
+  **At the measurement landing on 2026-09-08**, no Entwurf Codex unit had been
+  installed or built, no product record/doctor existed, and fresh did not include
+  Codex. Those are dated step-1 facts, not the current candidate state. The ledger
+  established first-turn `SessionStart`, callback spelling
+  `mcp__entwurf_bridge__entwurf_v2`, the shared-app-server refutation of a pid-keyed
+  citizen join, root-owned prompt-free hooks, and `thread/name/set`. Later #95 work
+  added the record/native-push/fresh candidate described under Unreleased.
+  `PIN_CODEX_MINOR` 0.144 → 0.153 was a re-verification of the archived drift probe,
+  not a product pin.
 
 ### Changed
 
@@ -261,9 +442,9 @@ Lane receipts (oracle, 2026-09-09) plus prepare P4/P5 on this host. There is
   CommandLineTools stub. Both are cells the borrowed-Mac probe
   (`scripts/raw-macos-measure/probe.sh`, M6 and M3) is built to answer. Do
   not fill them from a CI image spec.
-- **Codex is not a garden backend in this cut.** Step 1 of #95 closed as
-  measurement; step 2 is not opened. `entwurf_fresh_call` still cannot open a
-  codex sibling.
+- **On the 0.20.0 release date (2026-09-09), Codex was not a garden backend in that
+  cut.** Step 1 of #95 was measurement only and `entwurf_fresh_call` did not include
+  Codex. This is release archaeology; 0.21.0 support supersedes it.
 
 ## 0.19.0 - 2026-09-07
 

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` is a **garden-citizen dispatch bridge** — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail** — that lets already-running harnesses address one another by garden id; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex has native delivery-probe evidence but no managed citizen lane, and Gemini is not a shipped backend. That is the entire scope.
+`entwurf` is a **garden-citizen dispatch bridge** — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail** — that lets already-running harnesses address one another by garden id; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is an unreleased native-push candidate with record birth and delivery-probe evidence (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.
 

package/DELIVERY.md

@@ -88,8 +88,8 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
-| **Codex app-server-backed TUI** | verified probe, re-verified at 0.153.4 | D7; D8 unproven | WebSocket-over-UDS `turn/start` into a live `threadId`; status events expose completion. Re-run as shipped on 2026-09-08 at codex-cli **0.153.4** (garden lane #95): idle plain `codex` auto-attached to a bare `codex app-server --listen`, woke with zero typing, and the model replied in the same visible session — `{"ok": true, "threadId": "01a08145-ce6d-77d0-b7a4-cfb57c608282", "turnId": "01a08146-7c06-7b83-9e65-32e3814ee490", "status_seen": ["active","active","idle"]}`. No owned native-citizen install/invocation lane. Step 1 measurement only — the lane is open (#95) but nothing is installed, so this row stays the declared pre-#82 exception `check-harness-admission-parity` reads. |
-| **Codex embedded TUI** | deferred | D0 partial | No supported receive socket/hook on the measured standalone shape. Re-checked in source at 0.153.4: the hook vocabulary grew to 12 events but still has no `watchPaths`/`FileChanged`/`asyncRewake` analogue, so the negative stands. |
+| **Codex CLI app-server citizen** | supported in 0.21.0; explicit-home acceptance green on Linux at 0.153.4 | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The supported visible topology is one operator-owned existing tmux session named `codex`: the app-server and supported Codex TUIs sit there, omitted Codex fresh placement selects it, and Codex-opened Pi stays beside its caller. Missing home rejects; Entwurf creates/supervises none of it. Exact 0.153.4 source bounds unrestricted attached-TUI placement as unsupported, not as a blocker to this explicit topology. |
+| **Codex embedded TUI** | deferred | D0 partial | At the 2026-09-08 Codex 0.153.4 measurement, standalone mode had no `watchPaths`/`FileChanged`/`asyncRewake` analogue or supported idle receive route. This is dated vendor evidence, not a claim that the current candidate lacks records or fresh. |
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
 | **OMP (`omp`) garden citizen** | shipped in 0.16.0; send + receive + visible fresh accepted on one host | D6; D3 proven; D7 partial; D8 partial | Two in-process extensions in the operator's own TUI: birth mints the `mode === "tui"` host (subagents mint nothing) and names it as sender; the RECEIVER unit joins that citizen in the SAME process, holds an `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's `pi.sendUserMessage` — measured to be on the FACTORY object, not the event ctx, and measured to start a turn on an idle host with zero typing (`agent_start` +31ms). `wakeMode` is `self-fetch`: the model drains with `entwurf_inbox_read` and THAT read is the receipt. **D6 is the LIVE acceptance of 2026-08-30** (oracle, omp 18.0.0) — garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`, and the citizen's own transcript carrying `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id. **D3 is PROVEN, not pending**: with two live omp citizens armed, one addressed enqueue rang exactly one doorbell and the sibling persisted no transcript and kept an empty mailbox. D7 is PARTIAL (`lastReadAt` needs no scraping; the reply does). D8 is PARTIAL — dedupe and every stale-handling path are implemented and hermetically pinned, ordering/loop-guard/crash-recovery are not. The `/new` unarm is the rail-specific one: the watch lives in the operator's TUI, so pid + start-key cannot see a citizen change underneath a living process, and without an explicit unarm the previous garden id would keep reading deliverable. Requires `tools: xdev: false` in `~/.omp/agent/config.yml` — the vendor default hides MCP tool schemas from the prompt, so the doorbell would name a tool the model cannot call. The decisive receipt lines — the ordering probe, the D6 chain, the D3 isolation and the `/new` unarm — are pasted into `scripts/raw-omp-measure/README.md` §M7 rather than left in a host-local `/tmp` path. Evidence level L4: one Linux host, ARM. **Visible fresh (step 9) is ACCEPTED — the clause 7 LIVE went green on 2026-08-30:** `entwurf_fresh_call` opens omp on all three public surfaces through the bare `omp` runtime with an explicit `--approval-mode yolo` width and the `mcp__entwurf_bridge_entwurf_v` callback name, behind a five-axis pre-mutation preflight whose fifth axis is omp-specific (`tools.xdev !== true`, without which the model cannot call the callback tool at all). **The first turn is a TWO-STAGE BOOTSTRAP rather than a positional prompt, and that is a measured correction, not a preference.** `[LIVE 2026-08-30]` the positional-prompt candidate opened its window and minted its citizen (garden `20260830T181342-452167`, native `01a051f2-3107-7147-8806-fa2a6f527610`), delivered the byte-identical framing as a user message at `09:13:42.413Z`, and the model answered the literal text `ACK` at `09:13:47.105Z` with ZERO tool calls; the caller timed out at 240s. `[source]` the interactive UI defers MCP discovery (`sdk.ts:1847-1855`, `:1881-1905`) while the positional `initialMessage` prompts straight after `mode.init()` (`main.ts:540-565`), and `[측정]` an observer on the same runtime saw `turn_start` at +654ms with the entwurf tools absent and the callback tool present only at +1484ms. So the launcher now carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`, and the in-process birth extension polls `getAllTools`(`source:"mcp"`) AND `getActiveTools` for the exact callback name, sends a callback-ONLY prompt, arms the task only on a `tool_result` whose stored `toolCallId`, tool name, target, nonce and `isError === false` all match, and DELIVERS it at the next `turn_end` of that same session. `[LIVE 2026-08-30]` that last boundary is itself a measured correction: a first attempt sent the task from inside the `tool_result` handler with an explicit `deliverAs: "followUp"`, the hook log showed the full chain (`bootstrap-armed` → `bootstrap-ready` +440ms → `bootstrap-callback-observed` → `bootstrap-released`), and the task still never appeared in the session — `[source]` an explicit `deliverAs` queues without starting a turn in either state, while the omitted form starts one when idle (`agent-session.ts:6511-6513`), which the same transcript confirmed three seconds later when the Bundle B doorbell's omitted-option send landed and started a turn. `[측정 2026-08-30]` the callback-only half is what was proven to work: model `openai-codex/gpt-5.6-sol`, tool live at +1105ms, prompt injected at +1107ms, and the sibling calling `mcp__entwurf_bridge_entwurf_v` with the exact nonce (`omp-cb-btkvva4r87` → `20260830T184054-1aa1f2`, `meta-mailbox → enqueued`). **The clause 7 acceptance, `smoke-omp-fresh-live` (release-gate MUST), 2026-08-30, 21 assertions, omp 18.0.0 / `openai-codex/gpt-5.6-sol`:** launch through `tools/call entwurf_fresh_call` with nonce `mux-fresh-call-34faea228f3c3638684b40ff`; sibling garden `20260830T192913-df52b9` taken from the CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen (§3.5); addressed `entwurf_v2` → `meta-mailbox → enqueued`; `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`; the drain visible in that session's own transcript for its own garden id. **Both bootstrap stages are in that transcript in order** — the callback-only prompt at offset 970, the caller's task at 4732, no four-backend positional framing anywhere, and an assistant message after the task proving it started a turn rather than sitting in a queue. The unit's own log carries the state machine: `bootstrap-armed 10:29:13.399Z` → `bootstrap-ready 10:29:13.819Z` (+420ms) → `bootstrap-callback-observed 10:29:18.663Z` (`toolCallId=call_KZJtkxfzy1IEE4ejKutCPWcm|fc_0858…`) → `bootstrap-released 10:29:18.731Z` → `bootstrap-task-sent 10:29:18.759Z`. Evidence level L4: one Linux host, ARM, one run. `check-harness-admission-parity` keeps the deterministic half of the admission from being a matter of memory. What this does NOT establish: multi-host, multi-model, or repeated fresh calls in one process. **Cross-harness leg, 2026-08-31 (first bidirectional live-turn roundtrip on the committed bytes + operator redeploy):** a claude-code citizen (`20260831T090152-f998ac`) opened a fresh omp sibling through the public surface (nonce `mux-fresh-call-807cb693b1913ce98ffdbfd1`, callback sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` → `meta-mailbox → enqueued`, and the omp citizen's own live turn drained and replied into the claude mailbox — its self-report (doorbell → `entwurf_inbox_read`; callback-only first user message, task second) agrees with every receipt on the chain. |
@@ -130,64 +130,206 @@ the pid/start-key sender marker would be last-writer-wins. Current operator chec
 in [BASELINE.md](./BASELINE.md); deterministic ownership and sender gates run in
 `pnpm run check:full`.
 
-### Codex: launch mode is part of the capability
-
-Do not describe “Codex” as one delivery shape. The measured app-server-backed TUI can
-accept `turn/start` for a live thread and report completion; the standalone embedded
-TUI exposed no equivalent receive route. `turn/steer` is active-turn steering, not idle wake.
-
-**The 2026-08-01 decline is reversed.** GLG re-opened the Codex native lane on 2026-09-08
-(“코덱스 레일 들어가자”) as one of the two 사용자층 확보 axes; the lane is
-`#95` and the pi-already-supplies-GPT argument no longer settles it. Nothing here is a
-support claim: no codex record has ever been minted, there is no birth hook, no sender or
-receiver marker, and `entwurf_fresh_call` cannot open a codex sibling.
-
-**But step 2 is already spent, and it is spent WRONG.** `codex` is in `META_BACKENDS`
-(`meta-session.ts:84`) and `META_CITIZEN_BACKENDS` (`:308`), and `pi/entwurf-capabilities.json`
-grades it `wakeMode: "direct-inject"`, `deliveryLevel: "D6"`, `nativeIdLabel: "threadId"`.
-That D6 is a **registry promise with no channel behind it** — precisely the shape
-`docs/adding-a-harness.md` step 8(c) names — and it predates this lane. Correcting the grade
-is step 8 work; it is recorded here so the next reader does not inherit a D6 as evidence.
-
-**Current coordinates are 0.153.4** (source `~/repos/3rd/codex` at `rust-v0.153.4`), measured
-2026-09-08 in `scripts/raw-codex-measure/` — step 1 of `docs/adding-a-harness.md` only. The
-0.136.0 rows above are preserved history. What the re-measurement changed:
-
-- **Delivery survives 17 minor lines unchanged.** The shipped raw probe ran as-is (receipt in
-  the matrix row above). One method note: at 0.153.4 the rollout JSONL is materialized lazily,
-  so `thread/loaded/list` — not newest-rollout scraping — is the reliable `threadId` source.
-- **Birth timing is first-turn, not window-open**, and the gap is ~47s wide on a live TUI.
-- **A subagent raises `SubagentStart`, never `SessionStart`**, so §3.5's top-level predicate is
-  vendor-authoritative and costs nothing.
-- **The callback dialect is `mcp__entwurf_bridge__entwurf_v2`** — a fourth spelling; the
-  sanitizer maps `-` to `_` but keeps the digit that omp's charset eats.
-- **The step-6 join holds in both launch modes, but its owner moves — and in the
-  delivery-capable mode it cannot separate citizens.** Embedded:
-  `hook.ppid == mcp.ppid == the TUI`. App-server-attached: both resolve to the app-server, and
-  that is now measured rather than inferred — two live threads on one app-server, two separate
-  visible windows, **one `ppid` for every hook and every MCP child of both**, neither TUI in
-  the chain. A parent-pid sender marker would be one marker for N citizens, which Hard Rule 7's
-  `nativeSessionId` uniqueness forbids. **A different key was then found, and it is not a
-  marker at all:** every `tools/call` carries `_meta.threadId` plus an
-  `x-codex-turn-metadata.{session_id,thread_id,turn_id}` block, so the caller names itself on
-  each call — and that id is byte-identical to the hook's `session_id`, so birth, delivery and
-  tool calls share ONE identifier and `record.nativeSessionId = threadId` needs no mapping.
-  Both halves are vendor-traced, not just captured: `core/src/mcp_tool_call.rs:1328-1349`
-  inserts `threadId` unconditionally (constant at `:1184`) from the call site at `:506-516`,
-  and `:1238-1263` carries the turn-metadata block.
-  (The registry's pre-existing `nativeIdLabel: "threadId"` is right on that axis; its `D6` on
-  the same row still is not.) Consuming `_meta` is new bridge code and is step 6, unstarted.
-- **Both admission questions this lane opened have since been CLOSED by measurement**, and
-  neither cost a design decision. The **hook trust prompt** has a real non-interactive path: a
-  hook in the managed `/etc/codex/config.toml` layer runs with no prompt, in both launch modes,
-  with `turn/start` wake intact — while `--dangerously-bypass-hook-trust` runs the hook but
-  kills auto-attach and is therefore unusable here. The remaining constraint is ownership:
-  `/etc/codex/` is root-owned, so that is a root-level operator step, not something `setup`
-  writes (Hard Rule 17). **Clause 4** has a working carrier: `thread/name/set` plus
-  `[tui] status_line = ["thread-title", …]` renders a garden id and survives turns in both
-  orderings, because the vendor's auto-titler is guarded on the thread being unnamed
-  (`tui/src/app/thread_routing.rs:1841`). It is reachable only over the app-server, and the
-  config key needs a writer that owns exactly it.
+### Codex: one app-server-backed native-push shape
+
+Codex support is deliberately narrower than “drive Codex” and ships that way in
+**0.21.0**. Its purpose is to keep the operator's real Codex session —
+native tools, delegation, auth, transcript, and work context — addressable through
+the app-server-backed shape measured at Codex CLI **0.153.4**. It is not ACP and does
+not duplicate GPT access:
+
+```text
+operator starts app-server in existing exact tmux session `codex`
+  → its configured MCP env_vars forward that home coordinate and explicit roots
+  → visible codex TUI attaches with --remote unix://<default socket>
+    → first turn runs the vendor-trusted user-scope SessionStart birth
+      → V3 record(nativeSessionId = threadId)
+      → thread/name/set(gardenId)
+    → MCP tools/call carries strict request metadata
+      → entwurf_self / entwurf_v2 resolve that exact record
+```
+
+The standalone embedded TUI remains outside this rail: the 2026-09-08 measurement
+found no idle receive route equivalent to the app-server. `turn/steer` is active-turn
+steering, not idle wake. Entwurf does not start, stop, supervise, or health-loop the
+app-server. The operator starts it **inside the existing exact tmux session `codex`**:
+
+```bash
+# Run from a pane in the operator-owned tmux session named exactly `codex`.
+CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
+mkdir -p "$CODEX_HOME/app-server-control"
+codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+```
+
+This session is the supported home for the app-server and Codex TUIs. Omitted Codex
+fresh placement resolves its exact name from the caller's tmux server; Codex's MCP child
+then inherits the app-server's own `TMUX`/`TMUX_PANE`, so omitted outbound Pi placement
+stays in the home. An attached TUI does not lend its pane to the server, and N arbitrary
+clients in different sessions have no adjacency claim. Missing home/app-server rejects
+rather than guessing a client pane or creating/supervising either resource.
+
+Three ownership atoms remain separate:
+
+1. `entwurf install-codex-birth` owns `$CODEX_HOME/hooks.json` — one whole file, ours or
+   absent — plus its launcher and import closure under `$XDG_DATA_HOME/entwurf/codex-birth`.
+   No root: every path belongs to the operator. The vendor gates a user-layer declaration on
+   ONE interactive "Trust all", which entwurf never answers, pre-seeds or computes; the
+   receipt is read as its own doctor axis, and until it exists setup is honestly non-green.
+2. `entwurf install-codex-mcp` owns `[mcp_servers.entwurf-bridge]` in
+   `$CODEX_HOME/config.toml`, including exact `env_vars` forwarding for `CODEX_HOME`,
+   Entwurf garden/control roots, and `TMUX`/`TMUX_PANE`. This explicit name boundary
+   keeps custom roots and the app-server seat intact without storing their values.
+3. `entwurf install-codex-statusline` owns only `thread-title` within
+   `tui.status_line`. Birth calls `thread/name/set`, so the visible title is the garden id.
+
+All three have state-backed doctors and inverses. Symlinked or foreign config is a
+named refusal, not an adoption. Entwurf never installs Codex or its credentials.
+
+Sender identity is request-scoped. The bridge requires the complete Codex metadata
+tuple — `_meta.threadId`, `_meta.x-codex-turn-metadata.session_id`, and
+`_meta.x-codex-turn-metadata.thread_id` — to agree, then joins that native id through
+the addressable V3 record reader. Missing or conflicting fields refuse; there is no
+parent-pid fallback. A complete pi env claim or other native claim must also agree.
+This is load-bearing because every attached TUI shares the app-server ancestry.
+
+The native-push adapter probes `thread/loaded/list`. A missing socket, malformed
+handshake, protocol failure, or absent loaded target is `native-push-probe-indeterminate`
+or dead as defined by the probe result; no mailbox fallback exists. Delivery uses the
+measured one-shot `codex queue` command. Unlike Antigravity, Codex delivery has **zero
+retry**: losing stdout after vendor acceptance must not replay the user's message.
+
+Direct injection carries the **mailbox-serialized trusted sender envelope**, not the raw
+message. This rail has neither the control socket's RPC framing nor a mailbox file, so the
+envelope rides in the body through the same `formatMetaMailboxBody` SSOT the mailbox rail
+uses — one rail for both native-push backends, no per-backend branch. It is rendered once,
+before delivery, so Antigravity's one permitted re-probe retry replays byte-identical
+content. A caller with no authoritative sender still injects the raw message; an envelope is
+never fabricated. #95 measured the cost of the old raw behaviour: a fresh sibling's
+nonce-only callback landed in a Codex thread as bare text, so the Codex citizen could not
+name its caller and the callback was uncorrelatable.
+
+Visible fresh runs:
+
+```text
+existing tmux session: codex
+  operator-owned app-server + supported Codex TUIs
+  codex --remote unix://<default socket> --model <explicit model>
+        --dangerously-bypass-approvals-and-sandbox <callback-first prompt>
+```
+
+With `placement` omitted, the fresh composition resolves the exact existing `codex` session name
+to its native `$id` before mutation. Other backends retain caller-session default placement; an
+explicit seat remains an expert override. The amended preflight must certify the state-backed birth
+closure digests, vendor trust receipt, exact MCP/env boundary, `thread-title`, and app-server socket
+before tmux mutation. The callback spelling is `mcp__entwurf_bridge__entwurf_v2`; the new garden id
+comes only from its sender envelope. There is no Codex resume, watcher, session/app-server creator,
+or lifecycle supervisor.
+
+The 2026-09-11 Linux run used Codex 0.153.4 and the default app-server: the production
+probe found loaded thread `01a08bff-4efa-7071-9cac-b6d29da5f126`; native-push and a
+public MCP `entwurf_v2` call woke its visible TUI; a real authenticated request returned
+`agentId=meta-session/codex`, `replyable=true`; and a source birth hook minted garden
+`20260911T005221-fc7c47` in an isolated store. Those receipts are preserved as
+**pre-amendment focused delivery/identity evidence**, not qualification of the current
+candidate.
+
+The amended same-session acceptance (**A**) passed on local candidate `6e28c9e` at Codex
+0.153.4. Receipt `.probe-artifacts/a95-live-20260911T162152-6e28c9e.log` (SHA-256
+`e159f8fd1cf23cb1abd7782dc9e24cf9604add6b61ae24b7fd5260f16dfc2795`) records 50
+assertions and exit 0: real initial Pi `20260911T162155-0db222` opened and addressed Codex
+`20260911T162210-a974fe` / thread `01a08f58-588b-7620-a67c-cc0f6c62a79e`; Codex then
+opened outbound Pi `20260911T162238-7dcdaa` and correlated its exact callback nonce and
+sender garden id. The operator app-server, initial Pi, Codex, and outbound Pi all resolved to
+tmux session `$158`. Cleanup removed only smoke windows `@355`, `@356`, and `@357`,
+preserved all three records/transcripts, and left operator app-server PID `155166` and
+`$158/@351/%351` alive.
+
+That receipt established the mechanism of the now-selected deployment, but its initial Pi also sat
+in the app-server session and predates the fixed-home default. The stronger explicit-home acceptance
+passed on 2026-09-12. Receipt `.probe-artifacts/20260912T140745-codex-home-live-green.log`
+(SHA-256 `09e79bd1b62962f8a11d647ee456a71b11965b6792c7972d97ac4992119c91d7`)
+records 57 assertions and exit 0. The operator app-server stayed at `$158/@390/%390`; real initial Pi
+`20260912T140748-355654` opened outside the home at `$150/@397`, omitted-placement Codex
+`20260912T140800-8bc8d9` / thread `01a09403-e232-76b0-af9a-5cbaed8d94a9` opened at `$158/@398`,
+and Codex opened outbound Pi `20260912T140829-a08178` at `$158/@399`. The callbacks preserved exact
+nonces `mux-fresh-call-5d28f8e5bc2acf275ded30ec` and
+`mux-fresh-call-7a5fb4960dbb172843eb14fe`; initial Pi → Codex reported
+`entwurf_v2 native-push → delivered`, Codex read back its live garden-id title through `thread/read`,
+and every smoke-owned window was removed while the operator app-server remained alive.
+
+Two red attempts tightened the acceptance rather than weakening it. The first reached correct home
+placement but Codex interpreted “wait” as `wait_agent(timeout_ms=3600000)`, leaving its first turn
+active; the prompt now requires ending the turn and forbids every wait tool. The second proved that a
+model may reformat a receipt while copying it. That accepted run still travelled coordinate reports
+between citizens and checked them against Pi/Codex source results. A later prepare run exposed the
+remaining flaw by truncating a report token: the amended gate removes intermediate model reports,
+joins exact Pi toolCall/toolResult rows and structured Codex `thread/read` MCP items directly, and
+reads garden ids only from raw callback events. Failure cleanup recovers the exact Codex thread from
+its nonce callback, interrupts only its still-running smoke-owned turn, and closes only windows named
+by joined source fresh-call results.
+
+The amendment's own standalone acceptance then passed on 2026-09-12 (Codex 0.153.4): **48 assertions,
+exit 0**, final source audit `initial-pi=3/3 completed exact` and `codex=3/3 completed exact`. Fixture
+`20260912T232054-14c8e8` at `$150/@430`; initial Pi `20260912T232056-c0be9e` at `$150/@431`;
+operator-owned app-server `1693273` at `$158/@390/%390`; omitted-placement Codex `20260912T232110-1cd889`
+(thread `01a095fe-4f1a-7d93-8c5a-ed7539cf8930`) at `$158/@432`; Codex-opened Pi `20260912T232133-4ac684`
+at `$158/@433`; final token `CODEX-PI-FINAL-6QWDSELJ` carried `PI_CALLBACK_FROM=20260912T232133-4ac684`,
+`PI_SESSION_ID=$158`, `PI_WINDOW_ID=@433` into the fixture mailbox, which read it. Cleanup reclaimed
+`@433`, `@432`, `@431` — every one named by a joined source fresh-call result, with no tmux inventory scan
+and no mailbox prose promoted to authority. Artifact `.probe-artifacts/codex-fresh-live-fZccoK/`
+(`run-manifest.json` sha256 `05f20f00…`). The 57-assertion first-admission receipt above is preserved as
+its own pre-amendment axis; the two counts are different contracts, not a regression.
+
+That run also closed a defect the amendment had introduced. A source path read once at callback
+correlation froze out a record that gained `transcriptPath` 34s later, so the observer saw nothing while
+the chain actually completed — the preceding red run's Codex thread holds a completed final `entwurf_v2`
+result naming `PI_WINDOW_ID=@426`, and its two orphan windows were reclaimed only after their own joined
+source receipts named them (`@425` backend codex from the initial Pi, `@426` backend pi from the Codex
+thread; cleanup log preserved at `.probe-artifacts/codex-fresh-live-FblYLs/source-authorized-cleanup.log`,
+sha256 `07fe18fc…`, alongside `run-manifest.json` sha256 `62a538fd…`). The path is now re-read while the
+cache is empty. Note honestly what the green run does and does not prove: its manifest carries neither
+`initialPiTranscriptResolvedLate` nor `sourcePathUnresolved`, so the late-write timing did not recur and
+the repair is proven by its deterministic claim, not by this LIVE.
+
+**Repeat acceptance inside the aggregate release gate (2026-09-13).** The same acceptance ran again as
+the `smoke-codex-fresh-live` MUST step of `release-gate --cut` and passed at 48 assertions: fixture
+`20260913T065136-59d143` at `$187/@442`, initial Pi `20260913T065138-ad5f57` at `$187/@447`,
+omitted-placement Codex `20260913T065151-4b6078` (thread `01a0979a-edc4-7570-a29b-50f7e48cf298`) at
+`$158/@448`, Codex-opened Pi `20260913T065213-0811e6` at `$158/@449`, against the same operator-owned
+app-server at `$158/@390/%390`. Artifact `.probe-artifacts/codex-fresh-live-2oId4C/` (`run-manifest.json`
+sha256 `2cff6f08…`). Note the fixture seat differs from the standalone run: the aggregate builds its own
+tmux session (`$187`), while the Codex legs still resolve to the exact `codex` home. That gate reported
+MUST PASS=24 FAIL=0 SKIP=0 and `cut: OK`. Keep the three Codex acceptances apart — 57-assertion
+pre-amendment first admission, 48-assertion standalone amended (`fZccoK`), and this 48-assertion
+aggregate repeat (`2oId4C`).
+
+An earlier attempt at the identical source fingerprint failed two model-in-loop MUST steps and is kept
+as an observation rather than a defect: a callback nonce arrived one character short and an addressed
+instruction carried the wrong payload. Joined source receipts showed target, rail, and delivery were all
+correct, so both oracles refused for the right reason and nothing in the product was changed.
+
+Unrestricted attached-TUI parity (**B**) is explicitly outside this support claim. The exact vendor
+checkout `rust-v0.153.4` at `3d2ee51ca2d5db578f328aa75e20aa22c0197c9a` found no public
+request→attached-TUI-seat carrier: process-local `ConnectionId` does not cross into thread/core/MCP/hook
+state, and the TUI-local dynamic task MCP is a closed vendor namespace. That source result now bounds
+the topology instead of blocking the explicit home. Manual pane/process guessing and hidden manager
+behaviour remain invalid; explicit `placement.tmuxSession` is an operator-named expert override, not
+an inferred seat. The gate strips ambient `PI_SESSION_ID`/`PI_AGENT_ID`; a fixture may preserve receipts
+but cannot substitute for the initial visible record-backed Pi turn.
+
+Run the clause-7 invocation from a tmux session other than `codex`; the explicit app-server PID must belong to the operator-owned app-server seated in `codex`, and both models are explicit:
+
+```bash
+LIVE=1 \
+ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid> \
+ENTWURF_CODEX_FRESH_MODEL=<codex-model> \
+ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
+./run.sh smoke-codex-fresh-live
+```
+
+This is the intended gate entrypoint, not acceptance by command name. The accepted receipt above
+has a fixture only collecting evidence: a real visible record-backed Pi opens Codex from outside the
+home, and the later exact callback and bidirectional delivery receipts close the topology claim.
 
 ### Copilot CLI: one citizen, two rails, one pending receipt