@junghanacs/entwurf 0.21.0 → 0.22.0

package/README.md

@@ -10,7 +10,7 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one adapter, not the project subject. Claude Code, GitHub Copilot CLI, and OMP (`omp`) are shipped self-fetch citizens; Antigravity (`agy`) is shipped native-push. Codex CLI is a **native-push citizen, supported in 0.21.0 on Linux** over the operator-owned app-server: vendor-trusted user-scope birth, strict request-scoped identity, loaded-thread probe, one-shot queue delivery, and visible fresh in one explicit operator-owned tmux home named `codex`. Unrestricted attached-TUI seat inference is not supported or claimed; that non-goal no longer blocks the explicit home topology. Codex remains native so it keeps its vendor tools, delegation, and work context; this is not another way to buy or expose GPT through ACP.
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one adapter, not the project subject. Claude Code, GitHub Copilot CLI, and OMP (`omp`) are shipped self-fetch citizens; Antigravity (`agy`) is shipped native-push. Codex CLI is a **native-push citizen, supported in 0.21.0 on Linux** over the operator-owned app-server: vendor-trusted user-scope birth, strict request-scoped identity, loaded-thread probe, one-shot queue delivery, and visible fresh beside the CALLER's own pane. Unrestricted attached-TUI seat inference is not supported or claimed; #95 D1 retired the fixed `codex` tmux home on 2026-09-16, so the operator seats the app-server wherever they like and a Codex caller opens its sibling beside its own TUI pane. Codex remains native so it keeps its vendor tools, delegation, and work context; this is not another way to buy or expose GPT through ACP.
 
 ```text
 Claude Code / Copilot / Codex / agy / omp / pi
@@ -19,7 +19,7 @@ Claude Code / Copilot / Codex / agy / omp / pi
       → control-socket | meta-mailbox | native-push
 ```
 
-[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation or loaded Codex thread. It starts no process on any rail. `entwurf_fresh_call` is separate lifecycle. With Codex placement omitted, it resolves the exact existing tmux session named `codex`; that operator-owned home holds the app-server and supported Codex TUIs. Missing home or app-server rejects before launch, and Entwurf never creates or supervises either. An explicit `placement.tmuxSession` remains an expert override. Exact 0.153.4 source confirms that arbitrary attached-TUI request→seat inference is unavailable, so Entwurf makes no such claim. Codex has no resume surface.
+[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation or loaded Codex thread. It starts no process on any rail. `entwurf_fresh_call` is separate lifecycle. With placement omitted the seat follows the CALLER: a Codex citizen opens beside its own TUI pane, found by the `thread-id` in that pane's terminal title, and 0 or 2+ matching panes reject with no fallback; every other caller opens in its own session. A missing app-server rejects before launch, and Entwurf never creates or supervises it. An explicit `placement.tmuxSession` remains an expert override. Exact 0.153.4 source confirms that arbitrary attached-TUI request→seat inference is unavailable, so Entwurf makes no such claim. Codex has no resume surface.
 
 **Garden id is deliberate vocabulary.** It is not a decorative synonym for session id, worker, delegate, or subagent. The unfamiliar word is a guard: each harness keeps its own identity and transcript, while `entwurf` supplies a narrow addressable surface between siblings.
 
@@ -152,6 +152,55 @@ entwurf check-bridge
 whatever native harnesses are present. The global install is the easiest path when
 Claude Code's USER-scope MCP registration should work from every cwd.
 
+#### Codex: what you still type by hand
+
+`setup` writes every byte Entwurf owns, and three things are deliberately left to you. They
+are the only manual steps between a fresh install and calling a Codex sibling, and all three are
+answers only you can give:
+
+1. **Trust the birth hook once, in a visible plain Codex.** Answer `Trust all and continue`
+   and send one first turn. Nobody can do this for you: the receipt is the vendor's record of
+   *your* security decision, and writing it ourselves would turn a prompt into a silent
+   install. Until it exists, `setup` and `doctor-codex-birth` stay honestly non-green and say
+   exactly this.
+2. **Start the app-server, in a detached tmux session that is NOT where you work.**
+
+   ```bash
+   entwurf codex-app-server
+   ```
+
+   One command for the vendor string nobody wants to type. It `exec`s
+   `codex app-server --listen unix://<default socket>` right there — so Ctrl-C is yours, and
+   Entwurf neither supervises nor restarts it. The session matters because the MCP bridge is
+   this server's child and inherits its `TMUX`: that tmux server is the one caller-seat
+   lookups read. The launcher prints which seat it got rather than guessing one for you.
+3. **Answer the folder-consent prompt once for each directory you open siblings in.** Codex
+   records a direct decision per EXACT directory — not the parent, not the git root — and a
+   directory with no answer anywhere opens a consent screen instead of running a first turn.
+   `entwurf_fresh_call` prints `codex-launch-cwd-undecided` and opens the window anyway — the
+   screen is self-repairing, and answering it once is the whole fix. (Two neighbours differ: a
+   project `.codex` layer can consent with no entry at all, and a directory inside an explicitly
+   untrusted project is noted as `codex-launch-cwd-untrusted-ancestor` because the vendor answers
+   that one with an error naming the repository root instead of a prompt.) You can also do it up
+   front:
+
+   ```bash
+   codex -C <the directory you will launch siblings in>   # answer the prompt, then quit
+   ```
+
+   Same reason as step 1: it is your security decision, and writing it ourselves would turn a
+   prompt into a silent install.
+
+Then `entwurf_fresh_call` with `backend: "codex"` works. Attaching your own visible Codex TUI
+(`codex --remote "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`) is optional
+and independent — a sibling Entwurf opens brings its own.
+
+> **Observation, not a verb (#95).** That `--remote` string is exactly as unfriendly as the
+> `--listen` one was, and it has no managed spelling. It is deliberately left alone: it is how
+> an operator attaches their OWN terminal, not how a sibling is opened, and `entwurf_fresh_call`
+> already spells it internally for the siblings it launches. Whether the operator-facing half
+> deserves its own verb is open.
+
 ### From npm — project-local install
 
 ```bash
@@ -259,7 +308,7 @@ repair surface: each unit has its own installer, doctor, and inverse.
 - **Antigravity / agy** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
 - **GitHub Copilot CLI** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
 - **OMP (`omp`)** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
-- **OpenAI Codex CLI** (supported in 0.21.0 on Linux; macOS NOT CERTIFIED — pending physical host) — `install-codex-birth` publishes the `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`, all operator-owned; the vendor trust receipt for that declaration is the operator's single answer, and `doctor-codex-birth` reports it as its own axis (present, or red with the exact instruction — never computed, never written); `install-codex-mcp` owns `[mcp_servers.entwurf-bridge]`, including the `env_vars` boundary for `CODEX_HOME`, Entwurf garden/control roots, and the app-server's `TMUX`/`TMUX_PANE`; `install-codex-statusline` owns `thread-title`. Each has a matching doctor and inverse. The operator owns one existing tmux session named `codex`, starts the app-server there, and seats supported Codex TUIs there. Omitted Codex fresh placement selects that home; Entwurf never creates or supervises the session/app-server and never discovers arbitrary attached-TUI seats. An explicit placement is an expert override. Exact 0.153.4 source's missing per-client carrier bounds the unsupported topology; it does not block this explicit home deployment.
+- **OpenAI Codex CLI** (supported in 0.21.0 on Linux; macOS NOT CERTIFIED — pending physical host) — `install-codex-birth` publishes the `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`, all operator-owned; the vendor trust receipt for that declaration is the operator's single answer, and `doctor-codex-birth` reports it as its own axis (present, or red with the exact instruction — never computed, never written); `install-codex-mcp` owns `[mcp_servers.entwurf-bridge]`, including the `env_vars` boundary for `CODEX_HOME`, Entwurf garden/control roots, and the app-server's `TMUX`/`TMUX_PANE`; `install-codex-statusline` owns `thread-title` in `tui.status_line`; `install-codex-terminal-title` owns `thread-id` in `tui.terminal_title`. Each has a matching doctor and inverse. **One Codex precondition is the vendor's own and no installer supplies it: the directory a sibling starts in must already be answered in this Codex.** A direct consent decision is recorded per exact directory on this rail — not the parent, not the git root — and a directory the vendor has no answer for at all opens a consent screen instead of running a first turn, so `entwurf_fresh_call` prints `codex-launch-cwd-undecided` and opens the window anyway; that screen is self-repairing, and answering it once teaches the vendor the directory for good. **Nothing here refuses a launch** — the note is a diagnostic, and the one caller that treats it as a precondition is `smoke-codex-fresh-live`, where nobody is at the keyboard. Two neighbouring cases read differently: a directory answered `untrusted` is not noted at all (the vendor skips its screen on this rail, so that turn starts), and a directory INSIDE an explicitly untrusted project is noted as `codex-launch-cwd-untrusted-ancestor` because the vendor answers that one with an error naming the repository root rather than a prompt. The check is a narrow local read of the operator's own config, never the vendor's verdict: the vendor also consents through project layers it reads from its app-server, and everything the check cannot see stays silent. The operator owns the app-server and seats it wherever they like; Entwurf never creates or supervises it. Omitted fresh placement follows the CALLER, never the backend being opened: an explicit `placement` always wins, then a Codex CALLER opens beside its own TUI pane — located by the `thread-id` that pane's terminal title carries, with 0 or 2+ matching panes refused and no fallback — then the caller's own session. (#95 first shipped a fixed `codex` home for omitted-placement Codex TARGETS; #95 D1 retired it on 2026-09-16 once the anchor made the room unnecessary.) A pane title is a placement input only, never an address, liveness or delivery fact. Exact 0.153.4 source's missing per-client carrier still bounds placing a sibling beside a TUI whose thread nobody named as unsupported.
 
 Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
 walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).
@@ -454,8 +503,8 @@ The Claude ACP backend keeps its native model / API / tools; entwurf shapes only
 
 Codex is not an ACP backend here. Its native-push lane, supported in 0.21.0, uses `SessionStart`
 for birth, strict request `_meta` for who-sent, and a loaded app-server thread as the live route.
-Its supported visible topology is one operator-owned existing tmux home named `codex`; omitted
-Codex fresh placement selects it, while unrestricted attached-TUI seat inference is not claimed.
+A Codex CALLER with placement omitted opens its sibling beside its own TUI pane, matched by the
+`thread-id` its terminal title carries; a pane whose thread nobody named is never inferred.
 
 Antigravity is also not an ACP backend. It is a native-push citizen: `PreInvocation` supplies birth/sender identity, `entwurf_v2` probes and direct-injects replies into the live conversation, and no mailbox/receiver marker is involved.
 
@@ -487,16 +536,18 @@ LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 # Codex loaded-thread probe (pre-amendment evidence; not first-release acceptance):
 LIVE=1 CODEX_LIVE_THREAD_ID=<threadId> ./run.sh smoke-codex-native-push-live
 
-# Codex explicit-home acceptance. Run from a DIFFERENT tmux session; the operator-owned
-# app-server and supported Codex TUIs sit in the existing exact `codex` session. Record
-# initial Pi, app-server, fresh Codex, and outbound Pi coordinates separately:
+# Codex caller-seat acceptance. The operator-owned app-server must sit in a session OTHER than
+# the one the Pi/Codex pair runs in — that separation is what tells the caller-pane anchor apart
+# from the app-server's inherited environment. This smoke ALSO needs its one stable launch
+# directory answered once (manual step 3 above); VERIFY.md's Codex section owns that procedure,
+# including how to derive the exact path instead of retyping it. Record all four coordinates:
 LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid> \
   ENTWURF_CODEX_FRESH_MODEL=<codex-model> \
   ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
   ./run.sh smoke-codex-fresh-live
-# This accepts only a real visible Pi → visible Codex → visible Pi run: initial Pi outside
-# the Codex home, then Codex and its outbound Pi inside it. A fixture or self-fetch first leg
-# may collect receipts but does not satisfy the topology. No arbitrary attached-TUI parity is claimed.
+# This accepts only a real visible Pi → visible Codex → visible Pi run: initial Pi in a session
+# other than the app-server's, then Codex and its outbound Pi beside it. A fixture first leg may
+# collect receipts but does not satisfy the topology. No arbitrary attached-TUI parity is claimed.
 
 # ACP plugin LIVE acceptance — need the operator's local Claude auth/credit:
 LIVE=1 ./run.sh smoke-acp-socket-citizen-live   # turn-free socket citizenship (S1)
@@ -572,7 +623,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement is now a per-backend policy rather than one rule: `pi`, `claude-code`, `copilot` and `omp` open in the CALLER's own seat, while `codex` resolves the exact existing operator-owned `codex` session (a missing home rejects; nothing is created). 0.21.0 is the first release to carry such a backend-selected default — every backend could already be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement follows the CALLER rather than the backend being opened: a Codex CALLER opens its sibling beside its own TUI pane, located by the `thread-id` that pane's terminal title carries (0 or 2+ matching panes reject with no fallback); every other caller opens in its own seat. (0.21.0 shipped a backend-selected default instead — an omitted-placement `codex` TARGET resolved a fixed operator-owned session named `codex` — and #95 D1 retired it on 2026-09-16.) Any of the five can still be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -591,7 +642,7 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 
 **`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity or Codex, and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one of five fixed runtimes — Pi, Claude Code, Copilot, OMP or Codex — visibly on the caller's tmux server. Omitting placement is a per-backend policy: the first four open in the caller's own session, while Codex resolves the exact EXISTING operator-owned `codex` home and rejects if it is absent. An explicit `placement.tmuxSession` sends ANY of the five to an existing named session instead (see the `entwurf_fresh_call` paragraph above for the owning detail). Each launch carries a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one of five fixed runtimes — Pi, Claude Code, Copilot, OMP or Codex — visibly on the caller's tmux server. Omitting placement follows the CALLER rather than the backend being opened: an explicit seat always wins; then a Codex CALLER opens beside its own TUI pane, found by the `thread-id` in that pane's terminal title (0 or 2+ matching panes reject, with no fallback); then the caller's own session. An explicit `placement.tmuxSession` sends ANY of the five to an existing named session instead (see the `entwurf_fresh_call` paragraph above for the owning detail). Each launch carries a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 

package/VERIFY.md

@@ -71,26 +71,62 @@ Verification here is not a benchmark. In production we exchange short turns and
 > The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence. **Cost fence:** the agy conversation this smoke drives runs on a free account, so open it on `gemini-3.6-flash` — never a Pro tier. The model is the operator's choice at conversation-open time; entwurf never selects it, and no assertion reads it (see the shipped-lane note: model display is not part of the agy contract).
 >
 > Aggregate release-gate does not own a loaded Codex thread. Codex native-push remains an
-> on-demand host axis. The final first-admission acceptance passed on 2026-09-12 with the
-> explicit home topology; `DELIVERY.md` owns its 57-assertion receipt and digest. Re-runs start
-> from a tmux session other than `codex`; the operator-owned
-> app-server and supported Codex TUIs sit in the existing exact `codex` session; omitted Codex
-> placement resolves there; and the Codex-opened Pi stays there. Exact `rust-v0.153.4` source
-> exposes no arbitrary request→attached-TUI-seat value, so that wider topology is unsupported
-> and unclaimed rather than a blocker to the explicit home.
+> on-demand host axis. The first-admission acceptance passed on 2026-09-12 under the fixed `codex`
+> home topology #95 D1 later retired; `DELIVERY.md` owns its 57-assertion receipt and digest as
+> history. Re-runs follow the caller-seat topology instead: the operator-owned app-server sits in
+> its own session A, the initial Pi and the Codex it opens both sit in a DIFFERENT session S, and
+> the Codex-opened Pi must land in S. **A ≠ S is a precondition, not a preference** — the
+> app-server's inherited `TMUX` names A, so an outbound Pi in S can only have come from the
+> caller's own pane title, and the receipt must name `codex-title-anchor` as the rule that chose
+> it. Exact `rust-v0.153.4` source still exposes no arbitrary request→attached-TUI-seat value, so
+> placing a sibling beside a TUI whose thread nobody named stays unsupported and unclaimed.
 >
 > The A cell takes no inferred server or models:
 > `LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid>
 > ENTWURF_CODEX_FRESH_MODEL=<codex-model>
 > ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> ./run.sh smoke-codex-fresh-live`.
+> **Both of THIS cell's live-spend defaults are `gpt-5.6-luna` from 2026-09-17**
+> (`openai-codex/gpt-5.6-luna` on the pi side) — the Codex leg came down off `sol`. It is a tier
+> choice and not a gate change; the receipt this cell is accepted on must be the one that actually
+> ran, never a `sol` run inherited from before. This says nothing about other cells: `smoke-omp-
+> fresh-live` keeps `openai-codex/gpt-5.6-sol`, the model its bootstrap callback was measured on.
+>
+> **This cell needs its launch directory ANSWERED, once, and that is a vendor fact rather than a
+> gate setting.** Codex records a direct folder decision per exact directory on this rail, so the smoke
+> launches in one stable path instead of a fresh `mkdtemp`, and it PRINTS that path as
+> `launch-cwd <dir>` on every run. **Do not spell it `$TMPDIR/entwurf-codex-fresh-live`** — the
+> smoke resolves it with `os.tmpdir()`, which is this host's `TMPDIR` when one is set and `/tmp`
+> when it is not, so on a host with no `TMPDIR` that shell expansion names
+> `/entwurf-codex-fresh-live` in the filesystem root: a different directory the vendor would ask
+> about separately. Derive it exactly:
+>
+> ```bash
+> node -e 'console.log(require("node:os").tmpdir() + "/entwurf-codex-fresh-live")'
+> ```
+>
+> Open a plain `codex -C <that path>` once, answer the prompt, and every later run is unattended.
+> Skip it and the smoke says so in its own assertion before anything is launched —
+> `codex-launch-cwd-undecided` with the exact repair command, not a callback timeout twenty
+> assertions later. **That precondition belongs to this gate, not to the product:** an ordinary
+> `entwurf_fresh_call` only prints the same note and opens the window, because a human can answer
+> the screen. Here nobody can, which is the whole reason the gate asserts it.
 >
 > The command name is not proof. The first leg must be a real record-backed visible Pi
-> citizen outside the Codex home opening Codex; if a fixture or self-fetch receipt collector
+> citizen in a session OTHER than the app-server's opening Codex; if a fixture or self-fetch receipt collector
 > is what OPENS Codex, the gate does not satisfy the topology. A fixture that only COLLECTS
 > receipts beside that real Pi leg is not the disqualifier — substituting for the leg is (see
 > `docs/adding-a-harness.md`, the same wording). The receipt must separately name the initial
 > Pi, app-server, fresh Codex, and outbound Pi coordinates.
 >
+> **Running the 37-minute qualification on a memory-pressured host.** `[측정 2026-09-16,
+> thinkpad, 27 GiB]` `check-gate-qualification` took 37m37s and was killed three times by the
+> HARNESS's low-memory watchdog — not by any gate, and not by the kernel OOM killer. Each kill
+> left the checkout intact (the runner restores it) but discarded the run. Detaching it with
+> `setsid` survived, at the cost of the harness no longer tracking it: completion raises no
+> notification, so a separate waiter is needed for the signal. Record this as a host condition
+> rather than a gate property — it says nothing about the candidate, and the same command on a
+> less pressured host needs none of it.
+>
 > Authoritative per-cut counts and digests live in BASELINE/CHANGELOG, not inline
 > here; embedding them in the protocol makes a correct guide stale after every cut.
 
@@ -108,7 +144,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
-| Native Codex host | explicit-home first admission accepted 2026-09-12 | Operator-owned birth/MCP/statusline atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: initial Pi outside the existing exact `codex` home; app-server, omitted-placement fresh Codex, and outbound Pi inside it; exact callbacks and addressed delivery both ways. `DELIVERY.md` owns the 57-assertion receipt and digest. Arbitrary attached-TUI placement is unsupported and unclaimed. |
+| Native Codex host | caller-seat topology accepted 2026-09-16 (56 assertions, exit 0); caller-DIRECTORY axis accepted the same day (65 assertions, exit 0) | Operator-owned birth/MCP/statusline/terminal-title atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: the app-server alone in session A (`$30/@41/%45`, pid 737636), and initial Pi / omitted-placement fresh Codex / Codex-opened outbound Pi all in a different session S (`$2`, `@46`/`@47`/`@48`; `@58`/`@59`/`@61` in the lane C run); exact callbacks and addressed delivery both ways. A ≠ S is the load-bearing half — the app-server's inherited `TMUX` names A, so the outbound Pi landing in S can only have come from the caller's own pane title, and its receipt records `seat-source=codex-title-anchor`. **#95 lane C added the second axis to the same card: WHERE the sibling starts.** Hop 1 joins four authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor rollout's `session_meta.cwd`, the Entwurf record and the requested scratch — and hop 1's leg requests a cwd while hop 2 requests NONE, so hop 2's directory can only come from the Codex caller's own record; both are asserted different from the app-server's live `/proc/<pid>/cwd`. 65 and 56 are different contracts, not a regression. The 2026-09-12 fixed-home chain is PAST CONTRACT (#95 D1); `DELIVERY.md` owns every receipt and digest. Placement beside a TUI whose thread nobody named is unsupported and unclaimed. |
 
 The repo-local `entwurf-release` skill owns the `land → prepare → make → publish`
 state machine. Each mode is a separate GLG authorization. Preserve one candidate,
@@ -137,6 +173,26 @@ The manual `pi --session` path is used only when (a) the entwurf path itself is
 - Execute one command at a time (no `;`-chaining). Preserve full stdout/stderr at each step.
 - On anything wrong, **stop and hold** — preserve session/cache/process state before proceeding.
 
+### Choosing the affected set for an inner loop
+
+The inner loop runs only affected gates, so the cost of that choice is a gap nobody sees until the
+full floor runs. Two rules exist because both gaps were paid for on the #95 lane B candidate, with
+every focused gate green at the time:
+
+- **Mutant manifests are keyed by SUBJECT FILE, not by lane.** Edit a file and check every
+  `scripts/mutants/*.json` whose `subject` names it, not only the lanes you wrote. `[측정
+  2026-09-16]` renaming one local in `mcp/entwurf-bridge/src/index.ts` left
+  `FRESHCALL-CODEX-PREMUTATION-MCP` in a manifest the lane never touched; qualification reported
+  it `MUTANT-STALE` (find matched 0×). **A stale mutant is a claim nobody is testing** — its
+  assertion keeps passing while the mutation that gives it meaning is never applied — which is why
+  this is a red rather than a warning. `check-gate-manifests` validates shape and inventory in
+  seconds but cannot see a find that no longer matches; only the executing body can.
+- **Any `mcp/entwurf-bridge/src/**` edit owes `pnpm run build-bridge` plus
+  `./run.sh check-bridge-delivery` in the same inner loop.** `[측정 2026-09-16]` the same candidate
+  reached `check:full` with a stale compiled entry and failed in 22 seconds on "artifact is not
+  stale". The installed surfaces run compiled JS (Hard Rule 11), so an un-rebuilt `dist` means the
+  focused gates proved the source while every package-shaped gate still judged the previous build.
+
 ### Wording — avoid safety-interpretation contamination
 
 When injecting a fact for a continuity check, use **plaintext that does not trigger model safety interpretation**. Avoid `secret token`, `password`, `API key`, `credential`, and meta-directives like "do not leak" — such wording makes the model treat the prompt as an exfiltration attempt and refuse, which makes **continuity look broken even when it is alive** (this happened once with `test-token-123`, misdiagnosed as a delegation failure). Instead: `The password is owl → reply in one word → owl`; code names / colors / animal names. Do not mix continuity and safety-behavior verification in one prompt.
@@ -171,7 +227,7 @@ The goal is not merely "invoke Claude Code." We want:
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
 6. Copilot four-unit composition (birth → MCP → receiver → visible footer) — only when `copilot` is on PATH (#86 C3b); the units run independently, each keeps its package-owned install-state and inverse, and a failed unit is a named component FAIL. The explicit `install-copilot-*`/`uninstall-copilot-*` surfaces remain the per-unit repair and inverse path
-7. Codex composition — only when `codex` is on PATH: setup publishes all three operator-owned atoms and stays non-green until the vendor's trust receipt for the birth declaration exists; it never invokes sudo, never writes `[hooks.state]`, and never starts the app-server or creates the `codex` tmux home. Its setup cells prove the exact `env_vars` boundary, independent component outcomes, idempotence, the non-green-until-trusted verdict with its named operator repair, and that setup never writes the receipt itself. First-admission qualification follows the separate explicit-home LIVE; unrestricted attached-TUI placement is outside the claim.
+7. Codex composition — only when `codex` is on PATH: setup publishes all four operator-owned atoms (birth, MCP, status line, terminal title) and stays non-green until the vendor's trust receipt for the birth declaration exists; it never invokes sudo, never writes `[hooks.state]`, and never starts or seats the app-server. Its setup cells prove the exact `env_vars` boundary, independent component outcomes, idempotence, the non-green-until-trusted verdict with its named operator repair, and that setup never writes the receipt itself. First-admission qualification follows the separate caller-seat LIVE; unrestricted attached-TUI placement is outside the claim.
 8. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
 9. computed summary — per-component PASS/SKIP/FAIL; any detected-integration FAIL makes the whole command exit nonzero while valid components stay installed
 
@@ -329,7 +385,7 @@ The minimum passing bar:
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its seven current tools, and presents a backend-native (not normalized) tool surface.
 6. **Carrier separation honored:** engraving vs pi-context-augment kept distinct (§1A.0); no bridge-identity narrative attributed to the engraving carrier.
 7. **agy shipped lane accepted:** all three agy doctors are green; automatic birth/statusline/sender identity and same-gid native-push reply are confirmed in a fresh conversation. `agentId=meta-session/antigravity` is correct; model display is not part of that contract. Same-pid concurrent conversation invocation is not claimed.
-8. **Codex first-admission home topology accepted:** its birth/MCP/status-line doctors are green and the on-demand real visible `Pi → Codex → Pi` cell records four coordinates: initial Pi in a session other than the exact existing `codex` home; operator-owned app-server, omitted-placement fresh Codex, and Codex-opened outbound Pi in that home; exact callbacks and addressed delivery succeed both ways. Missing home/app-server rejects without mutation. Entwurf neither creates nor supervises them, infers attached-TUI panes, nor claims unrestricted client placement. Codex remains outside ACP and has no resume claim.
+8. **Codex caller-seat topology accepted:** its birth/MCP/status-line/terminal-title doctors are green and the on-demand real visible `Pi → Codex → Pi` cell records four coordinates: the operator-owned app-server in its own session A; initial Pi, omitted-placement fresh Codex, and Codex-opened outbound Pi all in a DIFFERENT session S; exact callbacks and addressed delivery succeed both ways. A ≠ S is a precondition, not a preference — the app-server's inherited environment names A, so an outbound Pi in S can only have come from the caller's own pane title, and the receipt must name `codex-title-anchor` as the rule that chose it. 0 or 2+ matching panes, and a caller whose `[tui].terminal_title` lacks `thread-id`, reject without mutation. Entwurf neither creates nor supervises the app-server, infers attached-TUI panes, nor claims placement beside a TUI whose thread nobody named. (The 2026-09-12 fixed-`codex`-home acceptance this condition replaced stays recorded in `DELIVERY.md` as history; #95 D1 retired that room.) Codex remains outside ACP and has no resume claim.
 9. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
 10. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
 11. **New-harness admission closed:** a release that introduces a native harness admitted under the #82 contract has that harness in `FRESH_CALL_BACKENDS` on all three public surfaces, with `check-harness-admission-parity` green and its clause 7 visible-fresh LIVE step green in the MUST tier. That release also owes the cross-harness leg the same release stop names — two dispatch receipts, an existing citizen's live turn delivered into the new citizen and the new citizen's live turn delivered into an existing one — recorded in `DELIVERY.md`; its deterministic half is an owed follow-up, so until that gate lands this half of the condition is prose and is judged by the recorded receipts. Partial evidence is a branch state; an `unsupported` note in `DELIVERY.md` never weakens this stop.

package/docs/external-mcp-host.md

@@ -133,15 +133,19 @@ Use the owned surfaces rather than editing `~/.codex/config.toml`:
 entwurf install-codex-birth
 entwurf install-codex-mcp
 entwurf install-codex-statusline
+entwurf install-codex-terminal-title
 
 entwurf doctor-codex-birth
 entwurf doctor-codex-mcp
 entwurf doctor-codex-statusline
+entwurf doctor-codex-terminal-title
 ```
 
 The birth unit owns a `SessionStart` declaration in `$CODEX_HOME/hooks.json`, which the vendor
-runs only after the operator trusts it once in a visible Codex; the other two units own
-only `[mcp_servers.entwurf-bridge]` and the `thread-title` status-line member. The MCP
+runs only after the operator trusts it once in a visible Codex; the other three units own
+only `[mcp_servers.entwurf-bridge]`, the `thread-title` status-line member, and the `thread-id`
+terminal-title member (that last one is the CALLER seat input: without it a Codex citizen opening
+a sibling is refused with `codex-caller-title-missing`). The MCP
 entry carries `ENTWURF_BRIDGE_NATIVE_HOST=codex`, which tells the bridge to require and
 reconcile Codex request `_meta`. Do not add the anonymous hatch.
 
@@ -149,15 +153,21 @@ Native receive and visible fresh require the operator-owned default app-server.
 does not start or supervise it:
 
 ```bash
-CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
-codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+entwurf codex-app-server
 ```
 
+`entwurf codex-app-server` owns the spelling of that one vendor command — it `exec`s
+`codex app-server --listen unix://<default socket>` in the terminal it was typed in, resolving
+the address through the same leaf delivery reads. It never supervises, restarts or daemonizes
+what it becomes.
+
 Birth occurs on the first turn, not window open. It mints
 `record.nativeSessionId = threadId` and sets the visible thread title to the garden id.
 `entwurf_v2` probes the loaded-thread list and sends once through `codex queue`; it never
-retries. `entwurf_fresh_call` accepts `backend: "codex"` after all three owned units and
-the default socket pass preflight. Codex remains outside ACP and has no resume surface.
+retries. `entwurf_fresh_call` accepts `backend: "codex"` after the birth, MCP and status-line units
+and the default socket pass preflight; the fourth unit, `install-codex-terminal-title`, is what a
+Codex CALLER needs to open a sibling at all (without it the caller has no resolvable seat and the
+call is refused as `codex-caller-title-missing`). Codex remains outside ACP and has no resume surface.
 
 #### Antigravity CLI (`agy`)
 

package/docs/setup-clean-host.md

@@ -27,7 +27,7 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
-| OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all three operator-owned units (birth/MCP/status-line) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires an operator-owned existing tmux session named `codex`, with its app-server and supported TUIs seated there | native-push and visible fresh, supported in 0.21.0 |
+| OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all four operator-owned units (birth/MCP/status-line/terminal-title) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires the operator-owned app-server, started with `entwurf codex-app-server` in a tmux session of the operator's choosing (#95 D1 retired the fixed `codex` home) | native-push and visible fresh, supported in 0.21.0 |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
 Claude Code >=2.1.217 is required for the managed exec-hook lifecycle. The package
@@ -404,19 +404,47 @@ why `disabledServers` is never the way to hide an import.
 Supported in 0.21.0 with Linux-focused evidence; on macOS it is NOT CERTIFIED —
 pending physical host. It is native, not ACP: the purpose is to preserve the operator's
 Codex tools, delegation, and work context rather than provide another GPT access path.
-Entwurf owns three atoms, not the harness and not a daemon:
+Entwurf owns four atoms, not the harness and not a daemon:
 
 ```bash
-# All three are operator-scope; `entwurf setup` runs them when it detects Codex. No root.
+# All four are operator-scope; `entwurf setup` runs them when it detects Codex. No root.
 entwurf install-codex-birth
 entwurf install-codex-mcp
 entwurf install-codex-statusline
+entwurf install-codex-terminal-title
 
 entwurf doctor-codex-birth
 entwurf doctor-codex-mcp
 entwurf doctor-codex-statusline
+entwurf doctor-codex-terminal-title
 ```
 
+The first three make a Codex session a citizen others can reach. The fourth makes it a CALLER:
+`thread-id` in `[tui].terminal_title` is the only thing that tells the multiplexer which pane is
+this thread's, so without it a Codex citizen opening a sibling is refused with
+`codex-caller-title-missing` (an explicit `placement.tmuxSession` skips that check entirely).
+
+**One thing here is NOT an entwurf atom, and installing everything above does not supply it: the
+directory a sibling starts in must be one this Codex has an answer for.** A DIRECT decision is
+recorded per exact directory on this rail — no parent, no git root — and a directory with no
+answer anywhere opens a consent screen instead of running a first turn, which unattended looks
+exactly like a sibling that never called back; `entwurf_fresh_call` prints
+`codex-launch-cwd-undecided` and opens the window anyway, because that screen is self-repairing and
+answering it once is the whole fix. That is the ordinary outcome and not the only one. Either recorded
+answer passes: a deliberate `untrusted` is skipped by the vendor on this rail and its turn starts.
+A project `.codex` layer can consent with no entry at all. A directory INSIDE an explicitly
+`untrusted` project is noted under a different name (`codex-launch-cwd-untrusted-ancestor`)
+because the vendor answers that with `pass the repository root explicitly with --cd` rather than a
+prompt — launch at that root instead.
+
+The check is a narrow LOCAL read of your own `config.toml`, not the vendor's verdict: the vendor
+merges system, managed and cloud layers around that file, so everything this check cannot see is
+allowed through rather than guessed at. The repair for the ordinary case is the vendor's own, done
+once per directory you launch siblings into: open a plain `codex -C <dir>` there and answer the
+prompt. Name that directory literally — a `$TMPDIR`-style
+spelling silently becomes a different path on a host where `TMPDIR` is unset, and the vendor keys
+its consent to the exact string.
+
 The birth atom publishes a `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its
 launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`; it mints a V3 record on the
 thread's first turn and sets the thread title to the garden id.
@@ -433,30 +461,38 @@ answer, later sessions raise no prompt and are born automatically. The MCP write
 `TMUX`, and `TMUX_PANE`.
 The status-line writer owns only `thread-title`. Foreign or symlinked config is refused.
 
-Native delivery requires the operator-owned default app-server and one existing tmux session
-named exactly `codex`. Start the app-server from a pane there and seat supported Codex TUIs there:
+Native delivery requires the operator-owned default app-server. The operator chooses the tmux
+session that holds it: #95 D1 retired the requirement that the session be named `codex`, and Entwurf
+neither creates nor supervises it. For the LIVE acceptance that session must NOT be the one the
+Pi/Codex pair runs in.
 
 ```bash
-# Run these commands inside the operator-owned tmux session named exactly `codex`.
+# Run from a pane in the operator-owned tmux session that will hold the app-server. One
+# command: entwurf spells the vendor's `app-server --listen unix://<default socket>` for you,
+# creates the control directory, and exec()s it here. Ctrl-C is yours; nothing supervises it.
+entwurf codex-app-server
+
+# Attach your own visible Codex TUI from wherever you work — any session, not a reserved room.
 CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
-mkdir -p "$CODEX_HOME/app-server-control"
-codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
 codex --remote "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
 ```
 
-Omitted Codex fresh placement resolves exact `codex` on the caller's tmux server. The app-server's
-`TMUX`/`TMUX_PANE` is forwarded to its MCP child, so a Codex citizen's omitted outbound Pi placement
-stays in that home. It is **not** an arbitrary attached-TUI pane join. Exact Codex 0.153.4 source
-exposes no request→attached-TUI-seat carrier, so clients attached from other sessions have no
-adjacency claim; that wider topology is unsupported and unclaimed. Entwurf does not guess panes,
-create the tmux home, expose a generic app-server manager/API, or start/restart the server. Custom
+Omitted fresh placement follows the CALLER on the caller's own tmux server: a Codex citizen opens
+beside its own TUI pane, matched by the `thread-id` that pane's terminal title carries, with 0 or 2+
+matching panes refused and no fallback. The app-server's `TMUX`/`TMUX_PANE` is still forwarded to its
+MCP child, but it locates stores rather than a seat. It is **not** an arbitrary attached-TUI pane
+join: exact Codex 0.153.4 source exposes no request→attached-TUI-seat carrier, so a pane whose thread
+nobody named has no adjacency claim, and that wider topology stays unsupported and unclaimed. Entwurf
+does not guess panes, create a tmux session, expose a generic app-server manager/API, or
+start/restart the server. Custom
 `CODEX_HOME` and Entwurf roots cross the same explicit `env_vars` boundary. Strict request `_meta`
 identifies the thread caller, not its seat. Delivery uses one `codex queue` invocation with no retry.
 
-The 2026-09-11 loaded-thread run remains pre-amendment native-push/identity evidence. The final
-first-admission acceptance passed on 2026-09-12: real initial Pi outside `codex`, then omitted-placement
-Codex and outbound Pi inside it, with exact callbacks and addressed delivery both ways. `DELIVERY.md`
-owns the 57-assertion receipt, four coordinates, and digest.
+The 2026-09-11 loaded-thread run remains pre-amendment native-push/identity evidence. The
+first-admission acceptance passed on 2026-09-12 under the fixed-home topology #95 D1 later retired:
+real initial Pi outside `codex`, then omitted-placement Codex and outbound Pi inside it, with exact
+callbacks and addressed delivery both ways. `DELIVERY.md` owns that 57-assertion receipt, its four
+coordinates, and its digest as history; the caller-seat re-run is pending.
 
 `entwurf_fresh_call` accepts backend `codex` — supported in 0.21.0 — and requires an explicit model. Its
 preflight must prove the safe birth closure, exact MCP/env atom, `thread-title`, and app-server
@@ -465,7 +501,11 @@ never the launch receipt. There is no Codex resume surface, watcher, supervisor,
 lifecycle ownership. The accepted LIVE used a real record-backed visible Pi for the first leg;
 release-gate stripped ambient `PI_SESSION_ID`/`PI_AGENT_ID`, and the fixture/self-fetch citizen only
 collected receipts. The smoke reported initial Pi, app-server, fresh Codex, and outbound Pi
-coordinates separately: the initial Pi differed and the latter three matched the exact `codex` home.
+coordinates separately: the initial Pi differed and the latter three matched the exact `codex` home,
+which was the contract at that date. #95 D1 (2026-09-16) retired that room — an omitted seat is now the
+caller's own session for every backend, and the reshaped card requires the app-server to sit in a
+DIFFERENT session from the Pi/Codex pair, because that is what tells the caller-pane anchor apart from
+the app-server's inherited environment.
 Qualification and the frozen full floor are complete for this lane: `check-gate-qualification`
 killed 475/475 across 43 lanes with origin purity green, `check:full` exited 0, and the LIVE release
 gate reported MUST 24/0/0 with `cut: OK`. The bounds above are unchanged — no request→arbitrary
@@ -481,9 +521,10 @@ ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
 entwurf smoke-codex-fresh-live
 ```
 
-Run this from a tmux session other than `codex`. The entrypoint name does not waive the contract
-above. A fixture/self-fetch citizen may collect receipts but cannot replace the real visible Pi leg;
-a Pi that starts inside the Codex home proves only the weaker shared-seat mechanism.
+Run this from a tmux session OTHER than the one the app-server is in. The entrypoint name does not
+waive the contract above. A fixture/self-fetch citizen may collect receipts but cannot replace the real
+visible Pi leg; a Pi that starts in the app-server's own session proves only the weaker shared-seat
+mechanism, because both the anchor and the env fallback would answer the same room.
 
 ## 5. Optional Antigravity native citizen