@junghanacs/entwurf 0.21.0 → 0.22.0

package/AGENTS.md

@@ -21,7 +21,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 - **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and exposes pi’s native tools.
 - **Native bridges:** register existing sessions without owning transcript or auth. Claude Code and Copilot are self-fetch; Antigravity and Codex are native-push. Codex remains native rather than ACP so its vendor tools, delegation, and work context remain intact. Admission/evidence details belong in [DELIVERY.md](./DELIVERY.md) and [VERIFY.md](./VERIFY.md).
 - **ACP plugin:** one `entwurf` provider under an isolated overlay. The host pi session is already a record-backed citizen; ACP creates neither a second citizen nor a socket layer.
-- **mux:** launch-only placement and fixed-runtime launch. It never imports into delivery. Fresh identity arrives only through its callback envelope, never a lookup; same-id visible resume keeps identity/liveness/locking on the v2 side of the injected seam. Fresh call accepts only the narrow model, literal absolute cwd, and existing caller-server seat inputs; it creates no session and does not infer seat from cwd. Codex alone has one explicit omitted-placement convention: exact existing session `codex`, the operator-owned home for its app-server and supported TUIs; explicit placement still wins. Do not turn either fresh call or resume into a generic driver, command/env carrier, or second creation API. Exact module/argv/import ownership: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md).
+- **mux:** launch-only placement and fixed-runtime launch. It never imports into delivery. Fresh identity arrives only through its callback envelope, never a lookup; same-id visible resume keeps identity/liveness/locking on the v2 side of the injected seam. Fresh call accepts only the narrow model, literal absolute cwd, and existing caller-server seat inputs; it creates no session and does not infer seat from cwd. A Codex CALLER alone has an omitted-placement rule: it opens beside its own TUI pane, matched by thread-id in that pane title; 0/2+ matches reject; explicit placement still wins. Do not turn either fresh call or resume into a generic driver, command/env carrier, or second creation API. Exact module/argv/import ownership: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md).
 - **Delivery:** `entwurf_v2` addresses an existing garden id through a live control socket, deliverable self-fetch mailbox, or probe-alive native push. It never starts a process. Fresh creation and visible same-id resume are separate lifecycle verbs.
 
 ## Hard Rules
@@ -41,7 +41,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 13. **Doctors report runtime and ownership independently.** Working runtime does not prove ownership; broken ownership does not erase runtime observation. Required failure on either axis is red.
 14. **Native-hook ownership is structural.** Use shipped exec launchers and provenance, shared plausible-owner-pid policy, no shell fallback or ancestry guess. Version floors belong to their package source and are enforced there; hook contract/docs own the changing detail.
 15. **Crash, don’t warn.** Invalid config/path/model/store state throws. Empty catches are only bounded environment probes; diagnostics go to stderr.
-16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. Codex's supported home is the exact existing `codex` session containing the operator-owned app-server and supported TUIs; omitted Codex placement selects that name, not an attached-TUI pane. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
+16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. A Codex caller's seat is the pane whose title carries its own thread-id, a placement input only; it is never an address, and never a pane nobody named. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
 17. **Entwurf installs itself; setup composes.** Installation supplies Entwurf bytes and development fixtures, never a harness binary, subscription, credential, or login. Setup detects existing harness capability; absence is explicit skip and detected incompleteness is non-green. Portability evidence and rail/runtime support remain separate.
 
 History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue threads, [BASELINE.md](./BASELINE.md), or source-adjacent comments. When prose and behavior disagree, repair the owning source or document.

package/BASELINE.md

@@ -34,7 +34,9 @@ not **UNSUPPORTED** — the deliberate never, which today is native Windows only
 | Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
 | Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
 | macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental remains unscheduled; no cut has carried it. |
-| Native Codex Linux home topology | **certified** for 0.21.0 | 2026-09-12, Codex 0.153.4: 57-assertion explicit-home LIVE. Initial Pi `$150/@397`; operator app-server `$158/@390/%390`; omitted-placement Codex `$158/@398`; Codex-opened Pi `$158/@399`; exact callbacks and addressed delivery both ways. Receipt and digest: `DELIVERY.md`. Deterministic closure of that axis: qualification 460/460 across 43 lanes with origin/snapshot purity green, then frozen full floor exit 0 in 506s — both pre-amendment. **Observer-amended acceptance, 2026-09-12:** standalone LIVE 48 assertions exit 0, source audit `initial-pi=3/3`/`codex=3/3` completed exact, initial Pi `$150/@431`, Codex `$158/@432`, Codex-opened Pi `$158/@433`, all three reclaimed by their own source receipts; artifact `.probe-artifacts/codex-fresh-live-fZccoK/`. The 48 and 57 counts are different contracts, not a regression. **Release acceptance at that same fingerprint:** `check:full` exit 0 502s, LIVE release gate `--cut` MUST 24/0/0 · BEHAVIOR 1/0/0 · `cut: OK`, `check-gate-qualification` 475/475 across 43 lanes with origin purity green, and the aggregate's Codex leg repeating the 48-assertion acceptance (artifact `codex-fresh-live-2oId4C`). Unrestricted attached-TUI placement remains unsupported and unclaimed. |
+| Native Codex Linux caller-DIRECTORY axis (current; #95 lane C) | **certified** | 2026-09-16, Codex 0.153.4: 65-assertion LIVE, exit 0, at `b3e07dc` with a clean worktree. Same host and topology as the lane B row below (app-server `737636` in A `$30/@41/%45`; initial Pi `20260916T154902-556eb5` `$2/@58`, Codex `20260916T155037-10ddaa` `$2/@59`, Codex-opened Pi `20260916T155102-9add8a` `$2/@61`, `seat-source=codex-title-anchor`). **hop 1 (cwd requested):** pane `#{pane_current_path}` = rollout `session_meta.cwd` = record cwd = requested scratch = `/tmp/entwurf-codex-fresh-live-db65N2`, against app-server cwd `/home/junghan/repos/gh/entwurf` read from `/proc/737636/cwd`. **hop 2 (cwd NOT requested):** the outbound Pi's pane, its own birth-written record and the Codex caller's record all read that same scratch, and its receipt names the caller-record rule. Artifact `.probe-artifacts/codex-fresh-live-w4yJBw/`; stdout `.probe-artifacts/lane-c-live-20260916T154900.log` sha256 `712050e7a8cf03ece98e7f34029ae98a92e9b2a7fd96aff87d0c1e6ba2ee9af2`. Cleanup reclaimed `@58`/`@59`/`@61` with no failure; records and transcripts preserved; app-server and `$30` untouched. 65 and 56 are different contracts — lane C added the cwd axis on top of lane B. Long floors (qualification body, frozen `check:full`) NOT run at this SHA; GLG decides host vs CI. |
+| Native Codex Linux caller-seat topology (current; #95 lane B) | **certified** | 2026-09-16, Codex 0.153.4: 56-assertion LIVE, exit 0. App-server `737636` alone in session A `$30/@41/%45`; initial Pi `20260916T144205-e876ff` `$2/@46`, omitted-placement Codex `20260916T144230-d050d7` `$2/@47`, Codex-opened Pi `$2/@48`. A ≠ S is the decisive half: the app-server env names A, so S can only have come from the caller's pane title — receipt `seat-source=codex-title-anchor`. Artifact `.probe-artifacts/codex-fresh-live-nYcGC1/run-stdout.log` sha256 `ed60c2bd…`; the 43-assertion hop-1 run that measured the D1 retirement is kept at `codex-fresh-live-4aFCDD/run-stdout.log` sha256 `8392a603…`. Cleanup reclaimed `@46`/`@47`/`@48` with no failure; app-server and `$30` untouched. |
+| Native Codex Linux home topology (PAST CONTRACT — #95 D1 retired the fixed home 2026-09-16) | **certified** for 0.21.0 as shipped | 2026-09-12, Codex 0.153.4: 57-assertion explicit-home LIVE. Initial Pi `$150/@397`; operator app-server `$158/@390/%390`; omitted-placement Codex `$158/@398`; Codex-opened Pi `$158/@399`; exact callbacks and addressed delivery both ways. Receipt and digest: `DELIVERY.md`. Deterministic closure of that axis: qualification 460/460 across 43 lanes with origin/snapshot purity green, then frozen full floor exit 0 in 506s — both pre-amendment. **Observer-amended acceptance, 2026-09-12:** standalone LIVE 48 assertions exit 0, source audit `initial-pi=3/3`/`codex=3/3` completed exact, initial Pi `$150/@431`, Codex `$158/@432`, Codex-opened Pi `$158/@433`, all three reclaimed by their own source receipts; artifact `.probe-artifacts/codex-fresh-live-fZccoK/`. The 48 and 57 counts are different contracts, not a regression. **Release acceptance at that same fingerprint:** `check:full` exit 0 502s, LIVE release gate `--cut` MUST 24/0/0 · BEHAVIOR 1/0/0 · `cut: OK`, `check-gate-qualification` 475/475 across 43 lanes with origin purity green, and the aggregate's Codex leg repeating the 48-assertion acceptance (artifact `codex-fresh-live-2oId4C`). Unrestricted attached-TUI placement remains unsupported and unclaimed. |
 | Darwin install fence (meta/copilot/omp-bridge + omp-receive) | portable (Linux or Darwin) | Four installers accept Darwin; python3/node/harness presence holds the seat, not the platform name. A Darwin install is not a rail receipt. |
 | Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
 | setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |

package/CHANGELOG.md

@@ -4,6 +4,284 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.22.0 - 2026-09-17
+
+### Added
+
+- **A Codex sibling opened into a directory the vendor has no answer for now SAYS SO
+  (`codex-launch-cwd-undecided`).** `entwurf_fresh_call` reads the launch directory against the
+  operator's Codex config and prints what it saw — and then opens the window anyway. **It is a
+  diagnostic, not a gate, and that is the product decision (GLG, 2026-09-17):** the vendor's
+  consent screen is self-repairing for the human this rail exists to put a window in front of, one
+  answer teaches the vendor that directory for good, and a refusal would replace that with "no
+  window, go run codex yourself, then call again" while having to be right about a decision this
+  process cannot fully see. The UNATTENDED case is answered where it belongs —
+  `smoke-codex-fresh-live` asserts the same leaf up front, so a release gate with nobody at the
+  keyboard reads a named precondition instead of a callback timeout. `[source rust-v0.153.4]` a `--remote` startup — which this
+  argv always is — runs `check_directory_trust` on the `-C` value (`tui/src/lib.rs:1699-1725`), and
+  nothing on that path consults the approval or sandbox policy
+  (`tui/src/onboarding/directory_trust.rs:33-130`): the
+  `--dangerously-bypass-approvals-and-sandbox` token this launcher already carries turns off
+  approvals, never folder consent. A DIRECT decision is keyed to the exact directory and nothing else — for
+  `ProjectTrustHost::Remote` the lookup is `vec![cwd_key]` (`tui/src/config_update.rs:290-296`), with
+  no project-root marker, no git root and no parent inheritance. **The question is whether the
+  directory has been ANSWERED, not whether it is trusted:** a saved `untrusted` folder is
+  explicitly skipped on a remote target (`onboarding/directory_trust.rs:94-96`), so that turn
+  starts too and is not noted at all. A cwd inside an explicitly `untrusted` project gets its OWN
+  note (`codex-launch-cwd-untrusted-ancestor`) because the vendor answers that one with an error
+  rather than a screen — `pass the repository root explicitly with --cd`
+  (`config_update.rs:357-371`) — so its repair names a different directory, not a prompt.
+
+  **The leaf is deliberately NARROWER than the vendor's own judgment and says so rather than
+  claiming equivalence.** It reads the operator's `config.toml`; the vendor reads an effective
+  config — system, managed and cloud layers merged around that file — through its app-server, and
+  an enabled PROJECT LAYER consents on a directory's behalf with no entry at all
+  (`config_update.rs:346-354`). That gap is affordable precisely because nothing here refuses:
+  everything the leaf cannot see stays silent, and a note that turns out to be unnecessary costs a
+  line of stderr. **`[측정 2026-09-16]` this is the
+  failure it retires, not a hypothetical:** four `smoke-codex-fresh-live` runs, one scratch directory
+  each; the two whose directory carried a trust entry (`…-db65N2`, `…-pBXxOJ`, both answered by a
+  human at the keyboard) passed, and the two unattended release-gate runs (`…-2zznHl`, `…-kSsoAn`)
+  died with no rollout written after 21:28 at all — the sibling had opened on a consent screen and
+  started no turn, so there was no birth, no callback, and nothing to address. The caller then waits
+  out its entire timeout on a window that is merely waiting to be answered, which reads as a delivery
+  defect and is a folder question. The directory asked about is read back off codex's own `-C` token
+  rather than recomputed, so the consent question cannot drift from the thread's real start
+  directory, and the inherited default stays resolved in exactly one place.
+
+- **A Codex caller opens its sibling beside its own pane (#95 lane B).** Until now the seat a
+  Codex citizen got came from the app-server's inherited `TMUX`/`TMUX_PANE`, so a sibling opened
+  from Codex landed wherever the operator happened to have started the app-server rather than
+  beside the TUI the operator was looking at. `[측정 2026-09-16, codex-cli 0.153.4]` with
+  `thread-id` in `[tui].terminal_title` the TUI writes its thread UUID into the OSC 0 title and
+  tmux answers with it as `#{pane_title}` — truncated to 32 chars, i.e. 29 graphemes plus `...`
+  (`status_surfaces.rs:892-894`, `:1027-1043`; unchanged at `rust-v0.154.0`). So when the
+  reconciled sender of a fresh call is a record-backed `codex` citizen and `placement` is
+  omitted, that request's own `_meta.threadId` selects the pane whose title carries the token and
+  its `$session` becomes the target. **No vendor patch, no new carrier: one config item.**
+- **`entwurf install-codex-terminal-title` / `uninstall-` / `doctor-`** — a fourth Codex
+  ownership atom, owning only `thread-id` membership within `tui.terminal_title`. A different key
+  and a different axis from `install-codex-statusline`: `status_line` is what a human reads
+  inside the TUI, `terminal_title` is what the multiplexer reports back. The seeded list is
+  `["activity", "project-name", "thread-id"]` — `activity` leads because the herdr Codex detector
+  keys on the spinner and `Action Required` prefix — and an existing operator list is APPENDED to,
+  never reordered. `setup` composes it on a detected Codex host.
+- **The seat now follows the CALLER, never the backend being opened, on both fresh-call surfaces.**
+  An explicit `placement.tmuxSession` always wins; then a Codex CALLER's own pane
+  (`codex-title-anchor`); then the caller's own session. The anchored receipt reports its SOURCE and
+  no session name, because a session was observed rather than a name requested.
+- **`entwurf codex-app-server` — the one command that starts the operator's Codex app-server.**
+  Every Codex rail needs a server the operator starts themselves, and the command was
+  `codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`:
+  correct, in three documents, and in the text of a refusal — which meant most operators met it
+  only AFTER something had already failed. This verb owns that SPELLING and nothing else. It
+  `exec`s the vendor in the terminal it was typed in (cwd, pid, tty and exit status are the
+  server's; Ctrl-C is the operator's), creates the control directory, forwards the rest of the
+  argv byte-identical, and strips `PI_SESSION_ID`/`PI_AGENT_ID` so the server every bridge child
+  inherits from cannot carry someone else's identity. The address comes from the SAME leaf
+  delivery, preflight and the LIVE smoke read: the launcher ASKS that resolver through the new
+  internal `entwurf codex-socket-path` rather than re-deriving the path, so there is exactly one
+  spelling of this address instead of two that agree on the inputs somebody thought of.
+  Refusals are named and happen before the exec: a live socket (naming the pid whose `/proc`
+  cmdline actually carries that socket, and saying plainly when the host holds none — never an
+  inferred owner), a resolved address that is not absolute or carries a control character
+  (refused before anything is created: a relative socket is a different file for every process
+  that resolves it, and the bridge that will look for it is the app-server's MCP child with its
+  own cwd), an unidentifiable path, a second
+  `--listen`, a recursive launch, a socket classification nobody wrote, no `codex` on PATH. A dead
+  socket file is reported and launched over. **It is a managed spelling, not a managed
+  lifecycle**: no supervisor, no restart, no daemon, no pid file, and `entwurf_fresh_call` still
+  REJECTS a missing app-server rather than starting one. The tmux seat this server gives caller-seat lookups is reported as a fact, not
+  enforced as a requirement. Typing the raw vendor command remains equivalent.
+
+### Verification
+
+- **Release acceptance for this cut.** `[LIVE 2026-09-17, oracle]` `LIVE=1 ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.22.0.royX2L --cut` → **`MUST: PASS=24 FAIL=0 SKIP=0`**, **`BEHAVIOR:
+  PASS=1 FAIL=0 SKIP=0`**, **`cut: OK`**, exit 0, 18:47–20:02 KST; log preserved at
+  `<scratch>/release-gate.log`. Inside it: `check:full` exit 0 in 521s, `check-gate-qualification`
+  **520/520 killed**, `smoke-entwurf-chain-live` 24 assertions, `smoke-codex-fresh-live` **66
+  assertions** — one more than lane C's 65, because the launch-directory precondition this release
+  adds is asserted before anything launches. Gate env `ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna`,
+  `ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-luna`, `ENTWURF_CODEX_APP_SERVER_PID` naming an
+  operator-started app-server in its own tmux session. Exact-SHA CI at the pre-release commit:
+  run [`35202801617`](https://github.com/junghan0611/entwurf/actions/runs/35202801617)
+  `event=workflow_dispatch` @ `f5d6e10`, all four required jobs success and the `check` job's
+  qualification BODY step success.
+- **The host's Codex hook declaration was measured with the herdr SessionStart group temporarily
+  removed, and that is a debt this release does not pay.** `~/.codex/hooks.json` on `oracle` carries
+  a second SessionStart group installed by herdr, so `doctor-codex-birth` reports the declaration as
+  edited after install and `smoke-codex-fresh-live` cannot run. For this cut the file was moved to
+  `hooks.json.herdr-bak` and re-published by `install-codex-birth`; the vendor's trust receipt for
+  `…/hooks.json:session_start:0:0` survived that re-publication, measured by a real Codex TUI
+  starting with no consent screen. The herdr group is restored after the cut and the doctor goes RED
+  again on purpose. **#117 owns the real repair** — entwurf requires a whole-file digest where the
+  unit it actually owns is one group.
+- **Two gate defects found by the release gate itself, both repaired in test/gate code with zero
+  production bytes.** `check-gate-qualification` scored **518/520** on the first prepared commit and
+  both survivors were launch-directory claims whose assertion could not see the defect its mutant
+  plants. `CODEX-LAUNCH-CWD-ANCESTOR-PLAIN-PATHS-ONLY` guards two predicates — the cwd side and the
+  key side — and every non-plain cell put the encoded character in the KEY, so the key-side filter
+  answered alone and deleting the cwd-side guard changed nothing; cells that vary the CWD against a
+  plain untrusted key now close it. `FRESHCALL-CODEX-LAUNCH-CWD-NOTES-NEVER-REFUSES` asserted the
+  `indexOf("-C")` lookup but not the value read at it, so a note that asked about the REQUESTED cwd
+  instead of codex's own `-C` token passed; the three statements are now pinned contiguously.
+  Neither mutant was stale — each still matched its production line exactly once, which is what made
+  the hole an assertion hole rather than drift.
+- **`smoke-entwurf-chain-live` went red because a model read the operator's policy correctly, and
+  the repair moved the authority rather than the wording.** The native Claude Code hop declined to
+  forward, citing the operator's global AGENTS.md; B, C and D were all born and addressable and the
+  terminus simply received nothing. A first repair put the provenance in the payload and the hop
+  named those sentences as the tell — content that vouches for itself is the shape of an injection,
+  so no sentence inside the payload can settle it. The payload is therefore byte-identical to
+  before, and the fact now rides the disposable world the turn starts in: the gate mints that
+  directory, every `ENTWURF_META_*_DIR` resolves inside it, and it exists because the operator ran
+  `release-gate`, so an `AGENTS.md`/`CLAUDE.md` written there is a standing operator instruction of
+  exactly the kind the operator's own global policy defers to for directory-scoped behaviour. **No
+  negative instruction was added**: a "do not check your policy" line would buy the same green by
+  asking the model to stop reading, and would keep passing after the chain broke. Accepted on the
+  host default model with no model pin.
+
+- **The Codex LIVE card now measures WHERE a sibling starts, and the acceptance is recorded.**
+  `[LIVE 2026-09-16, Codex 0.153.4, 65 assertions, exit 0]` hop 1 requests a cwd and joins four
+  authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor
+  rollout's `session_meta.cwd`, the Entwurf record and the requested scratch; hop 2 requests NEITHER
+  placement NOR cwd, so its directory can only come from the Codex caller's own record. Both are
+  asserted different from the app-server's live `/proc/<pid>/cwd`, which is the failure mode staying
+  visible rather than coincidentally equal. 65 and 56 are different contracts: lane C added the cwd
+  axis on top of lane B's seat axis. Receipts and digests in `DELIVERY.md` / `BASELINE.md`.
+- **Caller-seat LIVE accepted on Linux, 2026-09-16 (Codex 0.153.4): 56 assertions, exit 0.** The
+  operator-owned app-server stayed alone in session A (`$30`/`@41`/`%45`, pid `737636`) while the
+  initial Pi, the omitted-placement Codex it opened, and that Codex's own outbound Pi all landed in a
+  different session S (`$2`: `@46`, `@47`, `@48`). A ≠ S is what makes the run decisive: the
+  app-server's inherited `TMUX` names A, so the pre-#95 environment fallback would have put the
+  outbound Pi there. Its receipt instead records `seat-source=codex-title-anchor`. `DELIVERY.md` owns
+  the coordinates, garden ids and digests, including the 43-assertion run kept as the D1 measurement.
+- **`check-codex-app-server-launch` — 29 assertions, hermetic, plus 9 mutants all killed by
+  their own claim.** A fake vendor on a sandbox PATH under the real name reports the argv, parent
+  and environment it was handed; nothing is asserted by reading the launcher's source.
+  `check-pack-install` proves the INSTALLED verb reaches a vendor at the address the INSTALLED
+  compiled resolver computes — a file-list assertion cannot tell a shipped script from one that
+  resolves its siblings wrongly under `node_modules`.
+- **Independent review caught a false success this gate had certified, and the repair removed the
+  class rather than the instance.** The launcher's first version re-derived the socket path in
+  bash and the gate compared the two spellings over four ASCII-normal inputs they agreed on.
+  `[측정 2026-09-16]` they disagree on `CODEX_HOME=$'\ufeff'` — JS `trim` strips U+FEFF, a POSIX
+  `[:space:]` trim does not, so the managed launch would have started a server at
+  `<BOM>/app-server-control/app-server-control.sock` while delivery looked at `$HOME/.codex` —
+  and on `path.join`'s normalization of a trailing slash or a `..` segment. Widening the matrix
+  would only have added the inputs somebody thought of, so the second spelling was deleted: the
+  launcher asks, the gate's hostile cells (BOM, trailing slash, `..`) keep it asking, and the
+  mutant that used to drop `CODEX_HOME` now re-derives the path in bash instead. The same review
+  found the `/proc` holder assertion over-determined (it accepted the fallback text OR a pid, so
+  deleting the scan passed) and the socket classifier not fail-closed on an unrecognised reading.
+  A second review pass then found that asking one authority for the address does not make the
+  ANSWER safe: the resolver returns `CODEX_HOME` faithfully, so
+  `CODEX_HOME=$'relative\ncontrol-home'` had the launcher create that directory under its caller's
+  cwd and bind a relative socket — a different file for every process that resolves it, while the
+  gate still passed. This launcher is the only Codex surface that CREATES and binds rather than
+  reads, so it now refuses a non-absolute or control-character address before the first write.
+  Every one of those is a discriminating cell with a mutant of its own; the lane is 9.
+- **Two gate defects surfaced on the way and were fixed rather than worked around.** A mutant whose
+  `find` no longer matched had been silently untested since a rename — a stale mutant is a claim
+  nobody is checking, so `check-gate-qualification` scores it red. And the LIVE source-call oracle
+  compared tool arguments with `isDeepStrictEqual`, so a model that omitted the optional `wants_reply`
+  rather than passing it explicitly read as drift; it now normalizes that one key to its schema
+  default. Both are recorded in `VERIFY.md`'s affected-set rules so the inner loop stops missing them.
+
+### Changed
+
+- **`smoke-codex-fresh-live` launches in ONE stable directory instead of a fresh `mkdtemp` per
+  run.** Per-run random scratch made every run an undecided folder — a trust prompt per run, an
+  entry per run in the operator's `~/.codex/config.toml`, and unattended failure whenever nobody was
+  there to answer. The path is now one stable `os.tmpdir()`-rooted directory, answered `Trust`
+  once; the smoke PRINTS it as `launch-cwd <dir>` on every run and asserts that consent by name
+  BEFORE it launches anything, so a missing answer reads as `codex-launch-cwd-undecided` — with the
+  exact `codex -C <dir>` repair command — at the top of the run rather than as a callback timeout
+  twenty assertions later. The directory is printed rather than documented as a literal because
+  `os.tmpdir()` is a host fact: a doc spelling it `$TMPDIR/...` would send an operator with no
+  `TMPDIR` to `/entwurf-codex-fresh-live` in the filesystem root, which is a different directory
+  the vendor consents to separately. Lane C is unaffected: its only requirement of that directory is that it differ
+  from the app-server's own, which the assertion still proves.
+- **The Codex live-spend default comes down to `gpt-5.6-luna`.** The `entwurf-dev` skill's Codex
+  backend default and the `smoke-codex-fresh-live` recommendation in `VERIFY.md` move off
+  `gpt-5.6-sol`. **This is the Codex axis alone** — OMP's fresh default is deliberately unchanged at
+  `openai-codex/gpt-5.6-sol` (`scripts/smoke-omp-fresh-live.ts:14`), because that is the model its
+  two-stage bootstrap callback was actually measured on and moving it would invalidate that
+  receipt. A cost decision, not a gate change: no step moved tier, and the acceptance receipt for
+  the Codex cell must be the run that actually happened on the new default rather than a `sol` run
+  inherited from before.
+
+- **The fixed `codex` tmux home is RETIRED (#95 D1).** 0.21.0 shipped it three days earlier: an
+  omitted-placement Codex TARGET selected an already-existing session named exactly `codex`, where
+  the operator was asked to seat the app-server and every Codex TUI, and the launch receipt labelled
+  that source `Codex home`. GLG retired it the moment the caller-pane anchor stood up — *"무조건
+  은퇴야 … 코덱스의 거처를 만들어주자는 말은 그냥 기술이 안돼서 무마한 개념이야. 제대로 가야지."* The
+  room was a workaround for a mapping that did not exist yet, and keeping it after the anchor landed
+  would have left Codex alone answering "where does a sibling open?" differently from every other
+  backend. `CODEX_HOME_TMUX_SESSION`, the `codex-home` receipt source, its renderer branch, its
+  deterministic cells and its mutant are gone; an omitted seat is the caller's own session for every
+  backend, and the operator seats the app-server wherever they like — Entwurf still never creates,
+  moves or supervises it. The 2026-09-12 home acceptance stays recorded in `DELIVERY.md` and
+  `docs/setup-clean-host.md` as history, not as a live contract. The reshaped LIVE card now REQUIRES
+  the app-server to sit in a different session from the Pi/Codex pair: that separation is what tells
+  the caller-pane anchor apart from the app-server's inherited environment.
+
+### Fixed
+
+- **An in-band refusal now reaches the sender with the reason the RECEIVER gave it
+  (`d49e6cb`, `0c8a42c`).** A completed control-socket RPC that came back `success:false` was
+  finalized as `rejected` with no reason at all, so every named receiver refusal — including the
+  0.21.0 compaction guard's own `compacting` / `busy` — arrived at the caller as a reasonless
+  rejection indistinguishable from "no live route". The send hand now carries that error verbatim
+  when the receiver supplied one, and invents nothing when it did not: receiver evidence is not
+  reclassified into the resolver's taxonomy (`dormant-fire-forget-unsupported`,
+  `mailbox-undeliverable`, …), and the two remain distinguishable at the surface. The gap was one
+  hop wide and entirely invisible to the unit lane — the production `sendOverSocket` closure was
+  what dropped `response.error` before `driveSend` could see it — so the guard that holds it is a
+  production-wiring assertion with its own mutant (`V2PROD-INBAND-ERROR-WIRED`), not another test
+  of the pure function.
+- **A Codex sibling's THREAD now opens where its pane is (#95 lane C).** The seat was right and the
+  directory was not: `[측정 2026-09-16]` a pi → Codex → Claude Code chain recorded the app-server's
+  `~/repos/gh/entwurf` for all three citizens while the panes sat in `~/repos/gh/agent-config`.
+  `[source rust-v0.153.4]` an explicit `--remote <endpoint>` resolves to `AppServerTarget::Remote`
+  (`codex-rs/tui/src/lib.rs:875-876`), and a Remote target takes its new thread's cwd from
+  `remote_cwd_override` alone (`app_server_session.rs:2022-2033`) — absent, the app-server opens the
+  thread in its OWN directory, and the birth hook then records that vendor-supplied cwd honestly.
+  The codex argv now always carries that override as `-C <dir>`, the flag the shared interactive
+  options already expose beside `--dangerously-bypass-approvals-and-sandbox`
+  (`utils/cli/src/shared_options.rs:53-68`), preserved for a remote target at
+  `startup_orchestration.rs:191-194`. **One flag, no vendor patch, no new layer.**
+- **A Codex CALLER that names no cwd opens its sibling in its OWN directory.** This bridge runs as
+  the operator-owned app-server's MCP child, so the directory its process reports is the
+  app-server's rather than the caller's — an omitted `cwd` used to put every sibling of every Codex
+  caller in the app-server's repo, whatever backend was being opened. The surface now hands the
+  composition that citizen's RECORD cwd under the same condition that already carries its thread
+  id, and it is consulted only when the call requested none. One value, two carriers: tmux `-c`
+  places the pane, codex `-C` places the thread. Every other caller's argv is byte-identical, and
+  the receipt names which rule chose the directory (`requested` / the Codex caller's own record
+  directory) instead of calling a caller-record path "requested".
+- **Three named refusals replace a silent wrong seat.** Zero matching panes is
+  `codex-caller-seat-unresolved` (the TUI is on another tmux server, its config carries no
+  `thread-id`, or that server has `allow-set-title off`, which `[측정]` replaces every pane title
+  with the hostname); two or more is `codex-caller-seat-ambiguous`; and a Codex caller whose own
+  `[tui].terminal_title` lacks `thread-id` is refused pre-mutation as `codex-caller-title-missing`
+  with the installer as its repair. None of them falls back to another session, and none opens a
+  window. That caller-side check runs only when the anchor is actually consulted — an explicit
+  seat never reads a title.
+- **A pane title is a placement input and nothing else (Hard Rule 16).** Any process in any pane
+  can emit the same OSC string, so the leaf's answer may only reach a `-t` target; identity,
+  delivery and liveness keep the record + `_meta` join they already had, and the first-turn
+  framing still carries the caller's garden id rather than the thread id a title matched. The leaf
+  (`pi-extensions/lib/codex-caller-seat.ts`) imports nothing at all, which is how that boundary is
+  held by the code rather than by a comment.
+- **The title match is over tokens, not ` | ` segments, and the count is over panes.**
+  `title_setup.rs:183-193` joins the `activity` item to its neighbour with a plain space rather
+  than ` | `, so on a host whose operator list ends in `activity` a working TUI renders
+  `<spinner> <thread-id>` inside one segment and a segment-equality rule would lose the seat
+  exactly while the caller is busy. Counting panes rather than tokens keeps a single pane that
+  shows the same thread twice (`thread-title` beside `thread-id`) from reading as an ambiguity.
+
 ## 0.21.0 - 2026-09-13
 
 ### Added

package/DELIVERY.md

@@ -88,7 +88,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
-| **Codex CLI app-server citizen** | supported in 0.21.0; explicit-home acceptance green on Linux at 0.153.4 | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The supported visible topology is one operator-owned existing tmux session named `codex`: the app-server and supported Codex TUIs sit there, omitted Codex fresh placement selects it, and Codex-opened Pi stays beside its caller. Missing home rejects; Entwurf creates/supervises none of it. Exact 0.153.4 source bounds unrestricted attached-TUI placement as unsupported, not as a blocker to this explicit topology. |
+| **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |
 | **Codex embedded TUI** | deferred | D0 partial | At the 2026-09-08 Codex 0.153.4 measurement, standalone mode had no `watchPaths`/`FileChanged`/`asyncRewake` analogue or supported idle receive route. This is dated vendor evidence, not a claim that the current candidate lacks records or fresh. |
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
@@ -152,23 +152,55 @@ operator starts app-server in existing exact tmux session `codex`
 The standalone embedded TUI remains outside this rail: the 2026-09-08 measurement
 found no idle receive route equivalent to the app-server. `turn/steer` is active-turn
 steering, not idle wake. Entwurf does not start, stop, supervise, or health-loop the
-app-server. The operator starts it **inside the existing exact tmux session `codex`**:
+app-server. The operator starts it in a tmux session **of their own choosing**:
 
 ```bash
-# Run from a pane in the operator-owned tmux session named exactly `codex`.
-CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
-mkdir -p "$CODEX_HOME/app-server-control"
-codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+# Run from a pane in the operator-owned tmux session that will hold the app-server.
+# For the LIVE acceptance that session must NOT be the one the Pi/Codex pair runs in.
+entwurf codex-app-server
 ```
 
-This session is the supported home for the app-server and Codex TUIs. Omitted Codex
-fresh placement resolves its exact name from the caller's tmux server; Codex's MCP child
-then inherits the app-server's own `TMUX`/`TMUX_PANE`, so omitted outbound Pi placement
-stays in the home. An attached TUI does not lend its pane to the server, and N arbitrary
-clients in different sessions have no adjacency claim. Missing home/app-server rejects
-rather than guessing a client pane or creating/supervising either resource.
-
-Three ownership atoms remain separate:
+That verb owns the SPELLING of one vendor command and nothing else — it `exec`s
+`codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`
+in the terminal it was typed in, after creating the control directory that address lives in.
+It resolves the socket through the same leaf every other Codex surface reads, so the address a
+consumer gets cannot drift from the one delivery looks for. There is no supervisor, no restart,
+no daemon and no pid file: Ctrl-C is the operator's. A live socket, an unidentifiable one, or a
+second `--listen` are named refusals; a dead socket file is reported and launched over. Passing
+the raw vendor command by hand remains equivalent and is not deprecated.
+
+#95 D1 (GLG, 2026-09-16) retired the requirement that this session be named `codex`, and with it the
+rule that an omitted-placement Codex TARGET selected it. The operator still owns the app-server and
+still chooses its room; Entwurf neither creates nor supervises it, and a missing app-server rejects.
+
+Since #95 lane B the outbound direction no longer rides the app-server's inherited
+`TMUX`/`TMUX_PANE`: a Codex CALLER with no explicit placement opens its sibling beside its own
+pane, found by matching the caller's `_meta.threadId` against the `thread-id` the TUI writes
+into that pane's title. Zero matching panes (`codex-caller-seat-unresolved`), two or more
+(`codex-caller-seat-ambiguous`) and a caller whose `[tui].terminal_title` lacks `thread-id`
+(`codex-caller-title-missing`) are all named refusals with no fallback seat. An attached TUI
+still does not lend its pane to the server, and N arbitrary clients whose threads nobody named
+still have no adjacency claim: the anchor resolves only the pane displaying the thread the
+caller itself put on the request.
+
+The seat order, for all five backends, and it follows the CALLER rather than what is being
+opened: explicit `placement` wins; then a Codex CALLER's own pane (`codex-title-anchor`, no
+session name on the receipt because a session was observed rather than requested); then the
+caller's own session.
+
+The DIRECTORY follows the caller the same way (#95 lane C, 2026-09-16): requested `cwd` wins;
+then a Codex CALLER's own RECORD cwd, because this bridge is the app-server's MCP child and its
+process directory is the app-server's rather than that caller's; then the launching process's
+own, which is what tmux gives a window opened with no `-c`. Codex alone also carries that one
+value into its argv as `-C <dir>`, and omitting it is a wrong answer rather than a neutral one:
+an explicit `--remote` target takes its new thread's cwd from that override ALONE
+(`codex-rs/tui/src/app_server_session.rs:2022-2033` at rust-v0.153.4), so without it the THREAD
+opens in the app-server's repo while its pane sits elsewhere — measured on 2026-09-16 as three
+citizens of one chain recording a directory none of them was in. The receipt names which rule
+chose the directory (`requested` / the Codex caller's own record directory) and invents nothing
+for the inherited case.
+
+Four ownership atoms remain separate:
 
 1. `entwurf install-codex-birth` owns `$CODEX_HOME/hooks.json` — one whole file, ours or
    absent — plus its launcher and import closure under `$XDG_DATA_HOME/entwurf/codex-birth`.
@@ -181,8 +213,17 @@ Three ownership atoms remain separate:
    keeps custom roots and the app-server seat intact without storing their values.
 3. `entwurf install-codex-statusline` owns only `thread-title` within
    `tui.status_line`. Birth calls `thread/name/set`, so the visible title is the garden id.
-
-All three have state-backed doctors and inverses. Symlinked or foreign config is a
+4. `entwurf install-codex-terminal-title` owns only `thread-id` within `tui.terminal_title`
+   — a different key and a different axis from atom 3: `status_line` is what a human reads
+   inside the TUI, `terminal_title` is what the multiplexer reports back as `#{pane_title}`
+   and is the only value a caller seat can be matched against. The seeded list is
+   `["activity", "project-name", "thread-id"]` (`activity` leads because the herdr Codex
+   detector keys on the spinner/action-required prefix) and an existing operator list is
+   appended to, never reordered. A tmux server with `allow-set-title off` replaces every pane
+   title with the hostname, so the seat refuses there even with the atom installed — that is
+   a repair condition the refusal names, not an inference this rail makes.
+
+All four have state-backed doctors and inverses. Symlinked or foreign config is a
 named refusal, not an adoption. Entwurf never installs Codex or its credentials.
 
 Sender identity is request-scoped. The bridge requires the complete Codex metadata
@@ -211,17 +252,44 @@ name its caller and the callback was uncorrelatable.
 Visible fresh runs:
 
 ```text
-existing tmux session: codex
+operator-owned tmux session A (any name — the operator seats it)
   operator-owned app-server + supported Codex TUIs
-  codex --remote unix://<default socket> --model <explicit model>
+  codex --remote unix://<default socket> -C <launch directory> --model <explicit model>
         --dangerously-bypass-approvals-and-sandbox <callback-first prompt>
 ```
 
-With `placement` omitted, the fresh composition resolves the exact existing `codex` session name
-to its native `$id` before mutation. Other backends retain caller-session default placement; an
-explicit seat remains an expert override. The amended preflight must certify the state-backed birth
-closure digests, vendor trust receipt, exact MCP/env boundary, `thread-title`, and app-server socket
-before tmux mutation. The callback spelling is `mcp__entwurf_bridge__entwurf_v2`; the new garden id
+With `placement` omitted the seat follows the CALLER: a Codex citizen's own TUI pane, resolved from
+the `thread-id` in that pane's title to a native `$id` before mutation, with 0 or 2+ matches refused
+and no fallback; every other caller keeps caller-session default placement. An explicit seat remains
+an expert override. The preflight must certify the state-backed birth closure digests, vendor trust
+receipt, exact MCP/env boundary, `thread-title`, `terminal_title`, app-server socket, and a narrow LOCAL
+read of the LAUNCH DIRECTORY's folder consent before tmux mutation — a guard on the cases the user
+config decides, not a certification of the vendor's verdict. That last axis is the vendor's, not ours:
+`[source rust-v0.153.4]` a `--remote` startup always runs `check_directory_trust` on the `-C` value
+(`tui/src/lib.rs:1699-1725`) and nothing on that path reads the approval or sandbox policy
+(`tui/src/onboarding/directory_trust.rs:33-130`), so
+`--dangerously-bypass-approvals-and-sandbox` does not cover it — approvals and folder consent are
+two different gates. A DIRECT decision is keyed to the exact directory: for `ProjectTrustHost::Remote` that lookup is
+`vec![cwd_key]` alone (`tui/src/config_update.rs:290-296`), with no project-root marker, git root or
+parent inheritance. An UNDECIDED directory renders a consent screen, and a TUI waiting on one has started no turn —
+no rollout, no birth, no callback. Entwurf NOTES that as `codex-launch-cwd-undecided` and opens the
+window anyway: the screen is self-repairing for the human this rail exists to put a window in front
+of, and one answer teaches the vendor that directory for good. The unattended case is answered
+where it belongs — `smoke-codex-fresh-live` asserts the same leaf up front, so a gate with nobody
+at the keyboard reads a named precondition instead of a callback timeout. A directory the operator deliberately answered `untrusted`
+is NOT refused: on a remote target the vendor skips that screen
+(`onboarding/directory_trust.rs:94-96`; `uses_remote_workspace()` is `matches!(self, Self::Remote
+{ .. })` at `tui/src/lib.rs:307-309`), so the turn starts and refusing it would be entwurf
+inventing a policy the vendor does not have. A cwd INSIDE an explicitly `untrusted` project is a
+third answer with its own reason, `codex-launch-cwd-untrusted-ancestor`: there the vendor returns
+`pass the repository root explicitly with --cd` (`config_update.rs:357-371`) rather than a screen,
+so answering a prompt at the child would only reproduce that error.
+
+**The preflight leaf is narrower than the vendor's decision and does not claim otherwise.** It
+reads one TOML file while the vendor reads a layered config through its app-server, where an
+enabled project layer can consent with no entry at all (`config_update.rs:346-354`). Every case the
+leaf cannot see resolves to "proceed", so it may fail to catch a hang but never refuses a launch
+the vendor would have run. The callback spelling is `mcp__entwurf_bridge__entwurf_v2`; the new garden id
 comes only from its sender envelope. There is no Codex resume, watcher, session/app-server creator,
 or lifecycle supervisor.
 
@@ -246,7 +314,8 @@ preserved all three records/transcripts, and left operator app-server PID `15516
 
 That receipt established the mechanism of the now-selected deployment, but its initial Pi also sat
 in the app-server session and predates the fixed-home default. The stronger explicit-home acceptance
-passed on 2026-09-12. Receipt `.probe-artifacts/20260912T140745-codex-home-live-green.log`
+passed on 2026-09-12, under the `codex` home topology #95 D1 later retired. Receipt
+`.probe-artifacts/20260912T140745-codex-home-live-green.log`
 (SHA-256 `09e79bd1b62962f8a11d647ee456a71b11965b6792c7972d97ac4992119c91d7`)
 records 57 assertions and exit 0. The operator app-server stayed at `$158/@390/%390`; real initial Pi
 `20260912T140748-355654` opened outside the home at `$150/@397`, omitted-placement Codex
@@ -298,7 +367,8 @@ omitted-placement Codex `20260913T065151-4b6078` (thread `01a0979a-edc4-7570-a29
 `$158/@448`, Codex-opened Pi `20260913T065213-0811e6` at `$158/@449`, against the same operator-owned
 app-server at `$158/@390/%390`. Artifact `.probe-artifacts/codex-fresh-live-2oId4C/` (`run-manifest.json`
 sha256 `2cff6f08…`). Note the fixture seat differs from the standalone run: the aggregate builds its own
-tmux session (`$187`), while the Codex legs still resolve to the exact `codex` home. That gate reported
+tmux session (`$187`), while the Codex legs resolved to the exact `codex` home that was the contract
+at the time. That gate reported
 MUST PASS=24 FAIL=0 SKIP=0 and `cut: OK`. Keep the three Codex acceptances apart — 57-assertion
 pre-amendment first admission, 48-assertion standalone amended (`fZccoK`), and this 48-assertion
 aggregate repeat (`2oId4C`).
@@ -308,6 +378,66 @@ as an observation rather than a defect: a callback nonce arrived one character s
 instruction carried the wrong payload. Joined source receipts showed target, rail, and delivery were all
 correct, so both oracles refused for the right reason and nothing in the product was changed.
 
+**Caller-seat acceptance (#95 lane B), 2026-09-16, Codex 0.153.4 — 56 assertions, exit 0.** This is the
+receipt for the topology that replaced the fixed home: `ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-sol`,
+`ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-luna`, final source audit `codex=3/3 completed exact`.
+On one tmux server (`36728`) the operator-owned app-server `737636` stayed in ITS OWN session
+A = `$30`/`@41`/`%45`, while all three smoke citizens opened in S = `$2`: initial Pi
+`20260916T144205-e876ff` at `@46`, omitted-placement Codex `20260916T144230-d050d7` at `@47`, and the
+Codex-opened outbound Pi at `@48`. **A ≠ S is what makes the run decisive rather than merely green:**
+the app-server's inherited `TMUX` names A, so the pre-#95 environment fallback would have put that
+outbound Pi there. It landed in S, and its receipt names the rule that chose the seat —
+`seat: $2 (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session,
+not a requested name)`, recorded as `seat-source=codex-title-anchor`. Artifact
+`.probe-artifacts/codex-fresh-live-nYcGC1/`, stdout preserved at `run-stdout.log`
+(SHA-256 `ed60c2bdb46c13c51bf1d2dcf147b88c3c9f368a86a2bf17e972d3ecfde5fde9`). Cleanup reclaimed exactly
+`@46`, `@47`, `@48` with no CLEANUP FAILURE, preserved every born record and transcript, and left the
+app-server and `$30` untouched.
+
+**Caller-directory acceptance (#95 lane C), 2026-09-16, Codex 0.153.4 — 65 assertions, exit 0.** Same
+host, same models, same four-coordinate topology (app-server `737636` in A = `$30`/`@41`/`%45`; initial
+Pi `20260916T154902-556eb5` at `$2`/`@58`, omitted-placement Codex `20260916T155037-10ddaa` at `$2`/`@59`,
+Codex-opened outbound Pi `20260916T155102-9add8a` at `$2`/`@61` with `seat-source=codex-title-anchor`),
+final source audit `initial-pi=3/3` and `codex=3/3 completed exact`. **65 and 56 are different
+contracts, not a regression:** lane C added the cwd axis (seven assertions) and the pane-directory
+reader it needs, on top of everything lane B already asserted.
+
+The two decisive receipts, both measured against the app-server's own live directory
+`/home/junghan/repos/gh/entwurf` (read from `/proc/737636/cwd`):
+
+- **hop 1, cwd REQUESTED** (`8b-codex-thread-cwd`): the fresh Codex's pane `#{pane_current_path}`, the
+  vendor's own rollout `session_meta.cwd`, its Entwurf record and the requested scratch are ONE
+  directory — `/tmp/entwurf-codex-fresh-live-db65N2` — and it is not the app-server's. Four authorities
+  that cannot borrow from each other; before `-C` the rollout carried the app-server's path while the
+  pane sat in the scratch.
+- **hop 2, cwd NOT REQUESTED** (`13b-outbound-pi-cwd`): the leg named neither placement nor cwd, and the
+  outbound Pi still opened in `/tmp/entwurf-codex-fresh-live-db65N2` — its pane, its own birth-written
+  record, and the Codex caller's record all agree. Its launch receipt names the rule rather than
+  borrowing the other one's noun: `cwd: /tmp/entwurf-codex-fresh-live-db65N2 (the Codex caller's own
+  record directory, used because no cwd was requested — not an observation)`, while both requested legs
+  still read `requested start directory`.
+
+Artifact `.probe-artifacts/codex-fresh-live-w4yJBw/` (run manifest, mailbox observations/selections and
+a 13-file pre-cleanup snapshot including all three records, both Pi transcripts and the Codex rollout);
+stdout preserved at `.probe-artifacts/lane-c-live-20260916T154900.log`
+(SHA-256 `712050e7a8cf03ece98e7f34029ae98a92e9b2a7fd96aff87d0c1e6ba2ee9af2`). Cleanup reclaimed exactly
+`@58`, `@59`, `@61` with no CLEANUP FAILURE, removed its own scratch and fixture record, preserved every
+born citizen record and transcript, and left the app-server and `$30` untouched.
+
+Two earlier attempts that day are kept as their own receipts, because each stopped at a different
+truth. The FIRST stopped at 26 assertions, before any window opened: `codex-birth-unit-missing`, because
+`~/.codex/hooks.json` carried a second `SessionStart` entry added after install, so the declaration no
+longer matched its recorded digest. The unit was not broken — entwurf's own atom and all six helper
+digests were intact — but this rail owns that file whole, and the preflight refused rather than run
+against bytes it could not vouch for. The SECOND stopped at 43 assertions with hop 1 already green, and
+its log is kept as the D1 measurement: `.probe-artifacts/codex-fresh-live-4aFCDD/run-stdout.log`
+(SHA-256 `8392a603dcfe7e89549942d55e515f97724398fb261bd8873d25806f71086afe`) carries
+`omitted placement opened fresh Codex in the caller's own session S, away from the app-server's A` —
+the retirement of the fixed home, observed on a real host. It then failed on the gate's own defect
+rather than the product's: the source-call oracle compared arguments with `isDeepStrictEqual`, so a
+model that omitted the optional `wants_reply` instead of passing it explicitly read as drift. That
+oracle now normalizes exactly that key to its schema default and nothing else.
+
 Unrestricted attached-TUI parity (**B**) is explicitly outside this support claim. The exact vendor
 checkout `rust-v0.153.4` at `3d2ee51ca2d5db578f328aa75e20aa22c0197c9a` found no public
 request→attached-TUI-seat carrier: process-local `ConnectionId` does not cross into thread/core/MCP/hook
@@ -317,7 +447,7 @@ behaviour remain invalid; explicit `placement.tmuxSession` is an operator-named
 an inferred seat. The gate strips ambient `PI_SESSION_ID`/`PI_AGENT_ID`; a fixture may preserve receipts
 but cannot substitute for the initial visible record-backed Pi turn.
 
-Run the clause-7 invocation from a tmux session other than `codex`; the explicit app-server PID must belong to the operator-owned app-server seated in `codex`, and both models are explicit:
+Run the clause-7 invocation from a tmux session OTHER than the app-server's own; the explicit app-server PID must belong to the operator-owned app-server, and that session's NAME is not a requirement — #95 D1 retired the fixed `codex` home on 2026-09-16, so A ≠ S is the precondition and no particular name is. Both models are explicit, and the launch directory must already be answered in this Codex (`VERIFY.md` owns the derivation and the one-time `Trust`):
 
 ```bash
 LIVE=1 \