@junghanacs/entwurf 0.21.0 → 0.22.0

package/pi-extensions/lib/mux-fresh-call.ts

@@ -1,8 +1,9 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller. Codex is the one measured topology
- * exception: an omitted seat selects the existing `codex` home session (#95), never a TUI guess.
+ * the launch argv, and let it name itself back to the caller. A Codex CALLER is the one measured
+ * exception to "the caller's own session": it opens beside its own TUI pane, found by that
+ * pane's terminal title (#95 lane B), never by a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -39,6 +40,14 @@
  *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
  *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
  *     only cwd authority this module knows.
+ *   - when a CODEX caller omits it, the surface supplies that citizen's own record cwd and it
+ *     becomes an explicit `-c` (#95 lane C). This is not a second authority: it is the same
+ *     caller, named more precisely, because a codex caller's PROCESS directory is the
+ *     operator-owned app-server's rather than its own. Every other caller keeps the inherited
+ *     directory and an unchanged argv.
+ *   - the chosen value reaches codex TWICE, and that is one value with two carriers rather than
+ *     two inputs: tmux `-c` places the pane, and codex `-C` places the THREAD, which a
+ *     `--remote` attachment would otherwise take from the app-server (see `buildBackendArgs`).
  *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
  *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
  *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
@@ -79,7 +88,19 @@
 
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
-import { CODEX_PREFLIGHT_HINT, type CodexPreflightRejectReason } from "./codex-fresh-preflight.ts";
+import {
+	CODEX_CALLER_SEAT_HINT,
+	type CodexCallerSeatRejectReason,
+	resolveCodexCallerSeat,
+} from "./codex-caller-seat.ts";
+import {
+	CODEX_CALLER_PREFLIGHT_HINT,
+	CODEX_LAUNCH_CWD_PREFLIGHT_HINT,
+	CODEX_PREFLIGHT_HINT,
+	type CodexCallerPreflightRejectReason,
+	type CodexPreflightRejectReason,
+	codexLaunchCwdFreshPreflight,
+} from "./codex-fresh-preflight.ts";
 import {
 	COPILOT_PREFLIGHT_HINT,
 	type CopilotPreflightRejectReason,
@@ -276,12 +297,37 @@ export function isSafeFreshCallModel(model: string): boolean {
  * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
  * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
  * carrier would hand callers the launch-shaping power this rail exists to refuse.
+ *
+ * CODEX ALONE CARRIES A DIRECTORY IN ITS ARGV, AND OMITTING IT IS A WRONG ANSWER RATHER THAN A
+ * NEUTRAL ONE. `[source rust-v0.153.4]` an explicit `--remote <endpoint>` — which this argv
+ * always passes — resolves to `AppServerTarget::Remote` (`codex-rs/tui/src/lib.rs:875-876`;
+ * `LocalDaemon` is only the IMPLICIT no-flag reuse path), and a Remote target takes its new
+ * thread's directory from `remote_cwd_override` ALONE: `thread_cwd_from_config`
+ * (`codex-rs/tui/src/app_server_session.rs:2022-2033`) answers `None` without it, and the
+ * app-server then opens the thread in ITS OWN directory. That override is exactly `-C/--cd`,
+ * retained only for a remote target (`codex-rs/tui/src/startup_orchestration.rs:191-194`), and
+ * the flag lives on the shared interactive options this argv already uses for
+ * `--dangerously-bypass-approvals-and-sandbox` (`codex-rs/utils/cli/src/shared_options.rs:53-68`)
+ * — not only on the `agents` subcommand that also spells it (`codex-rs/cli/src/main.rs:334`).
+ *
+ * `[측정 2026-09-16]` with the flag absent, three citizens of one chain (pi → Codex → Claude
+ * Code) all recorded the app-server's `~/repos/gh/entwurf` while the panes themselves sat in
+ * `~/repos/gh/agent-config`, and the birth hook wrote that vendor-supplied cwd into each record
+ * honestly (#95 lane C §1). So the token is ALWAYS present for codex: ONE directory, TWO
+ * CARRIERS — tmux `-c` places the PANE, codex `-C` places the THREAD, and `launchCwd` is the
+ * single value both receive. It is not a new input axis: the value is chosen by the cwd rules
+ * this module already has, one layer up.
  */
 export function buildBackendArgs(
 	backend: FreshCallBackend,
 	composition: FreshCallComposition,
 	model: string,
 	env: NodeJS.ProcessEnv = process.env,
+	/** Where the sibling will actually start: the directory `freshCall` chose when it chose one,
+	 * and otherwise THIS process's own — which is what tmux gives a window opened with no `-c`
+	 * (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+	 * convenience, so a caller that omits it still names the truth to codex. */
+	launchCwd: string = process.cwd(),
 ): string[] {
 	switch (backend) {
 		case "pi":
@@ -296,6 +342,8 @@ export function buildBackendArgs(
 			return [
 				"--remote",
 				`unix://${resolveCodexDefaultSocketPath(env)}`,
+				"-C",
+				launchCwd,
 				"--model",
 				model,
 				"--dangerously-bypass-approvals-and-sandbox",
@@ -391,6 +439,8 @@ export type FreshCallRejectReason =
 	| CopilotPreflightRejectReason
 	| OmpPreflightRejectReason
 	| CodexPreflightRejectReason
+	| CodexCallerPreflightRejectReason
+	| CodexCallerSeatRejectReason
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -405,25 +455,41 @@ export interface FreshCallPlacement {
 	tmuxSession: string;
 }
 
-/**
- * Codex's explicit home topology (#95): the operator provides this one existing tmux session
- * and seats the operator-owned app-server plus supported Codex TUIs there. This is a placement
- * convention, not an address axis — `threadId` remains the native delivery address.
+/** Which rule chose the start directory. Mirrors `FreshCallSeatSource` deliberately: one axis,
+ * one NAMED source, and no third value that means "we worked it out". `codex-caller-record` is
+ * the codex caller's own record cwd, consulted only when the caller requested none (#95 lane C).
  */
-export const CODEX_HOME_TMUX_SESSION = "codex" as const;
-export type FreshCallSeatSource = "requested" | "codex-home";
+export type FreshCallCwdSource = "requested" | "codex-caller-record";
+
+export type FreshCallSeatSource = "requested" | "codex-title-anchor";
 export interface FreshCallSeat {
 	tmuxSession: string;
 	source: FreshCallSeatSource;
 }
 
-/** An explicit seat always wins. Only omitted Codex placement gets the fixed home. */
-export function selectFreshCallSeat(
-	backend: FreshCallBackend,
-	placement: FreshCallPlacement | undefined,
-): FreshCallSeat | null {
+/**
+ * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
+ *
+ *   1. an explicit `placement` — the expert override, and it wins over everything below.
+ *   2. a CODEX CALLER with placement omitted — the sibling opens beside the caller's own TUI
+ *      pane, found by the title anchor (#95 lane B). This one is NOT a named seat and is
+ *      therefore not decided here: it resolves to a native `$id` with no name in between, so
+ *      `freshCall` owns it directly (see the anchor step below) and this function answers
+ *      `null` so the name grammar and the name→id lookup stay out of a path that has neither.
+ *   3. anything else — the caller's own session, with no named seat at all.
+ *
+ * THE SEAT FOLLOWS THE CALLER, NEVER THE BACKEND BEING OPENED. #95 first shipped a fourth rule —
+ * an omitted-placement Codex TARGET selected a fixed existing session named `codex`, where the
+ * operator seated the app-server and their TUIs — and #95 D1 retired it (GLG, 2026-09-16). It
+ * was a workaround for a mapping that did not exist yet: nothing could find the pane a Codex
+ * caller was sitting in, so the operator was asked to keep every Codex in one known room. Rule 2
+ * is that mapping, so the room is no longer load-bearing, and keeping it would have meant Codex
+ * alone answering "where does a sibling open?" differently from every other backend. The
+ * operator-owned app-server keeps its own seat wherever the operator puts it; Entwurf still
+ * never creates, moves or supervises it.
+ */
+export function selectFreshCallSeat(placement: FreshCallPlacement | undefined): FreshCallSeat | null {
 	if (placement !== undefined) return { tmuxSession: placement.tmuxSession, source: "requested" };
-	if (backend === "codex") return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: "codex-home" };
 	return null;
 }
 
@@ -433,14 +499,21 @@ export function selectFreshCallSeat(
 export interface FreshCallReceipt extends WindowHandle {
 	backend: FreshCallBackend;
 	model: string;
-	/** The REQUESTED start directory — present only when the caller supplied one. The same kind
-	 * of fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
-	 * landed. */
+	/** The start directory this launch CHOSE — present only when one was chosen: the caller's
+	 * requested cwd, or a codex caller's own record cwd when it requested none. The same kind of
+	 * fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
+	 * landed. ABSENT means no directory was named at all and the pane inherits this process's —
+	 * that inheritance is not invented into a receipt field here. */
 	cwd?: string;
-	/** The selected session name — either caller-requested or Codex's fixed home. The RESOLVED
-	 * target is the inherited `sessionId`, which is the session the window is actually in. */
+	/** Which rule chose `cwd`. Present exactly when `cwd` is. */
+	cwdSource?: FreshCallCwdSource;
+	/** The caller-REQUESTED session name. The RESOLVED target is the inherited `sessionId`, which
+	 * is the session the window is actually in. Absent for `codex-title-anchor`, which has no
+	 * name to echo: a caller's own pane was OBSERVED, not requested by name, and inventing one
+	 * here would report a seat the caller never named. */
 	tmuxSession?: string;
-	/** Why `tmuxSession` was selected. Absent exactly when no named seat was used. */
+	/** Which rule selected the target session. Absent exactly when the caller's own session was
+	 * used with no seat rule at all. */
 	tmuxSessionSource?: FreshCallSeatSource;
 	runtimePath: string;
 	nonce: string;
@@ -531,6 +604,20 @@ export function buildFreshCallArgs(
  * `callerGardenId` is supplied by the SURFACE that registered this tool, from its own
  * record-backed context. It is not a tool parameter and this module never derives, validates
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
+ *
+ * `callerNativeSessionId` is supplied by the same surface under the same rule, and its PRESENCE
+ * is the whole signal: it is set exactly when the reconciled sender is a record-backed codex
+ * citizen, and it carries that citizen's `nativeSessionId` (the `_meta.threadId` the vendor put
+ * on this very request). This module never resolves it, never reads `_meta`, and never asks a
+ * store who is calling — it only turns a thread id into a pane, and only for placement.
+ *
+ * `callerCwd` rides the same surface rule and the same condition: it is that codex citizen's
+ * RECORD cwd, and it exists because a codex caller's process directory is NOT its own (the
+ * bridge runs as a child of the operator-owned app-server, so the directory that process
+ * reports is the app-server's — #95 lane C §2). It is consulted only when the caller requested
+ * no cwd, so an
+ * explicit request always wins, and this module never looks a cwd up, resolves it, or infers it
+ * from a seat, a workspace map or a project name.
  */
 export function freshCall(
 	params: {
@@ -540,6 +627,8 @@ export function freshCall(
 		cwd?: string;
 		placement?: FreshCallPlacement;
 		callerGardenId: string | null;
+		callerNativeSessionId?: string;
+		callerCwd?: string;
 	},
 	env: NodeJS.ProcessEnv = process.env,
 	nonce: string = mintNonce(),
@@ -555,8 +644,27 @@ export function freshCall(
 	if (task.length > TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
 	// ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
 	// value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-	// classification below instead of being silently repaired into a different directory.
-	const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	// classification below instead of being silently repaired into a different directory. The
+	// caller's own record directory answers the SAME two-value emptiness rule and is consulted
+	// ONLY second: an explicit request always wins, and a caller that supplies neither leaves the
+	// pane to inherit this process's directory exactly as before — a pi caller's argv is
+	// byte-identical, because its process directory IS its own and a `-c` token would change
+	// nothing about where that window lands.
+	const requestedCwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
+	const chosenCwd: { value: string; source: FreshCallCwdSource } | undefined =
+		requestedCwd !== undefined
+			? { value: requestedCwd, source: "requested" }
+			: callerCwd !== undefined
+				? { value: callerCwd, source: "codex-caller-record" }
+				: undefined;
+	const cwd = chosenCwd?.value;
+	// SEAM (#95 lane C): a caller-record directory is classified by the SAME shared leaf and
+	// answers the same four `cwd-*` reasons, whose hint text says REQUESTED. When a codex
+	// caller's recorded directory has since been deleted, the repair that hint points at is
+	// still the right one — that directory does not exist — but the noun belongs to the caller
+	// rather than to the request. Kept shared on purpose: doubling the reason set for a wording
+	// difference would double the refusal contract two surfaces and one leaf already agree on.
 	if (cwd !== undefined) {
 		const badCwd = classifyTmuxCwd(cwd);
 		if (badCwd) return { ok: false, reason: badCwd };
@@ -565,9 +673,10 @@ export function freshCall(
 	// without tmux, so an unresolvable name is answered before anything else runs. Whether that
 	// session EXISTS is a tmux question and is asked below, after the caller's own context is
 	// proven — a name check that needed a live server would refuse for the wrong reason on a
-	// host with no tmux at all. Codex alone selects its fixed home when the caller omitted a seat;
-	// an explicit seat remains an expert override and is reported as such.
-	const selectedSeat = selectFreshCallSeat(params.backend, params.placement);
+	// host with no tmux at all. An explicit seat is an expert override and is reported as such; a
+	// CODEX CALLER's own pane is deliberately not a name at all, so it is absent here and
+	// resolved after the context proof below — see `selectFreshCallSeat` for the three-rule order.
+	const selectedSeat = selectFreshCallSeat(params.placement);
 	const seat = selectedSeat?.tmuxSession;
 	if (seat !== undefined) {
 		const badSeat = classifyTmuxSessionName(seat);
@@ -606,10 +715,24 @@ export function freshCall(
 	// native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
 	// absent seat refuses with no window anywhere.
 	let targetSessionId = placement.sessionId;
+	let anchoredSeat = false;
 	if (seat !== undefined) {
 		const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
 		if (!resolved.ok) return { ok: false, reason: resolved.reason };
 		targetSessionId = resolved.sessionId;
+	} else if (params.placement === undefined && params.callerNativeSessionId !== undefined) {
+		// Rule 2: the caller is a codex citizen and named no seat, so the sibling belongs beside
+		// the caller's own TUI. The pane is found by the title anchor and ONLY its `$session`
+		// continues — a pane title is forgeable, so it may never become an address, a liveness
+		// claim or a delivery input (Hard Rule 16). `params.placement` is re-read here rather
+		// than inferred from `seat === undefined`: "an explicit seat always wins" is the one
+		// invariant a later edit must not be able to lose by accident.
+		// STILL PRE-MUTATION: 0 or 2+ matching panes refuse with no window anywhere and no
+		// fallback to any other session.
+		const anchor = resolveCodexCallerSeat(params.callerNativeSessionId, (args) => runTmux(args, env));
+		if (!anchor.ok) return { ok: false, reason: anchor.reason };
+		targetSessionId = anchor.seat.sessionId;
+		anchoredSeat = true;
 	}
 
 	const composition: FreshCallComposition = {
@@ -621,10 +744,38 @@ export function freshCall(
 		}),
 		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
 	};
-	const run = runTmux(
-		buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model, env), cwd),
-		env,
-	);
+	const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
+	// THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a
+	// Codex sibling opened into a directory this Codex has no answer for stops on the vendor's
+	// folder-consent screen: no first turn, no rollout, no callback. It is tempting to refuse
+	// that, and refusing is the wrong product. The consent screen is SELF-REPAIRING when a human
+	// is there — one answer and the vendor records the directory, so every later launch runs —
+	// and an operator at the keyboard is exactly who a visible-first rail is built for. A refusal
+	// would replace that one answer with "no window, go run codex yourself, then call again", and
+	// it would have to be right about a decision this process cannot fully see (the vendor merges
+	// system, managed and cloud layers around the file this leaf reads). So the launch proceeds
+	// and says what it saw.
+	//
+	// The UNATTENDED case is not answered here and must not be: a gate with nobody at the keyboard
+	// needs its precondition named before it spends a model turn, which is its own oracle's job —
+	// `smoke-codex-fresh-live` asserts this same leaf up front, so a missing answer reads as a
+	// named precondition instead of a callback timeout.
+	//
+	// The directory asked about is READ BACK off codex's own `-C` token rather than recomputed:
+	// one resolution, one authority, and no way for the note to name a directory the thread will
+	// not start in (this module is deliberately not allowed to resolve the inherited default a
+	// second time — `FRESHCALL-CWD-CALLER-ONLY`).
+	if (params.backend === "codex") {
+		const at = backendArgs.indexOf("-C");
+		const launchCwd = backendArgs[at + 1] ?? "";
+		const unanswered = codexLaunchCwdFreshPreflight(env, launchCwd);
+		if (unanswered) {
+			console.error(
+				`[fresh-call] ${unanswered}: ${launchCwd}\n` + `            ${CODEX_LAUNCH_CWD_PREFLIGHT_HINT[unanswered]}`,
+			);
+		}
+	}
+	const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
 	assertTmuxOk("new-window", run);
 
 	let fields: ReturnType<typeof parseWindowFields>;
@@ -649,9 +800,11 @@ export function freshCall(
 			...fields,
 			backend: params.backend,
 			model,
-			...(cwd === undefined ? {} : { cwd }),
+			...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),
 			...(selectedSeat === null
-				? {}
+				? anchoredSeat
+					? { tmuxSessionSource: "codex-title-anchor" as const }
+					: {}
 				: { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
 			runtimePath,
 			nonce,
@@ -667,6 +820,8 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	...COPILOT_PREFLIGHT_HINT,
 	...OMP_PREFLIGHT_HINT,
 	...CODEX_PREFLIGHT_HINT,
+	...CODEX_CALLER_PREFLIGHT_HINT,
+	...CODEX_CALLER_SEAT_HINT,
 	"no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
 	"anchor-malformed": "TMUX_PANE is not a native pane id",
 	"anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -683,7 +838,7 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	"tmux-session-name-invalid":
 		"the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
 	"tmux-session-missing":
-		"no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again; Codex's omitted-placement home is the exact session name 'codex'",
+		"no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
 	"model-empty": "model is empty after trimming; fresh calls require an explicit model",
 	"model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
 	"task-empty": "task is empty after trimming",
@@ -718,11 +873,15 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`[entwurf fresh call →]\n` +
 			`  backend:  ${r.backend} (${r.runtimePath})\n` +
 			`  model:    ${r.model} (requested on the runtime CLI)\n` +
-			(r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
-			(r.tmuxSession === undefined
+			(r.cwd === undefined
+				? ""
+				: r.cwdSource === "codex-caller-record"
+					? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\n`
+					: `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+			(r.tmuxSessionSource === undefined
 				? ""
-				: r.tmuxSessionSource === "codex-home"
-					? `  seat:     ${r.tmuxSession} (Codex home tmux session, resolved to ${r.sessionId})\n`
+				: r.tmuxSessionSource === "codex-title-anchor"
+					? `  seat:     ${r.sessionId} (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session, not a requested name)\n`
 					: `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
 			`  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
 			`  pane:     ${r.paneId} pid ${r.panePid}\n` +

package/run.sh

@@ -120,7 +120,7 @@ usage() {
   cat <<'EOF'
 Usage:
   ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
-  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex first-admission Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi outside the existing exact `codex` home, explicit operator-owned app-server PID inside it). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
+  ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
@@ -134,6 +134,7 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
+  ./run.sh check-codex-app-server-launch # #95 gate: the MANAGED app-server launch `entwurf codex-app-server`, driven through its public address against a FAKE VENDOR on a sandbox PATH. The injected `app-server --listen unix://<socket>` required to equal the product's own resolveCodexDefaultSocketPath over an env matrix that includes the inputs a bash transcription was MEASURED to diverge on (BOM-only CODEX_HOME, trailing slash, `..`), non-absolute and control-character addresses refused before any write, byte-identical operator argv, exec (not fork) parent identity, exit passthrough, live-socket and indeterminate-socket and second---listen and recursion refusals, dead-socket launch-over, the tmux fact line, and both identity carriers stripped. Hermetic; no Codex, no app-server, no model turn
   ./run.sh check-copilot-statusline   # #82 Copilot custom-footer renderer. session_id → ready/?/gid + rail `cop`; exit 0. IN pnpm check. No Copilot, no model turn
   ./run.sh check-entwurf-capabilities  # deterministic gate (0.11 Stage 0 step 3C): backend capability registry (pi/entwurf-capabilities.json) — coverage==META_CITIZEN_BACKENDS + agrees with live META_BACKEND_DESCRIPTORS + strict keyset, no API
   ./run.sh check-omp-fresh-preflight   # #87 C: the OMP fresh preflight reproduces omp_agent_dir and the tools.xdev read in TS (it runs from two emit depths and cannot call a sibling script). This drives the SHIPPED shell/python leaves over the same inputs — refusals included — and requires the TS half to agree, so the reproduction cannot silently drift from the installer's own oracle
@@ -175,7 +176,7 @@ Usage:
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
-  ./run.sh smoke-codex-fresh-live    # #95 first-admission RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback OUTSIDE the Codex home -> Pi PUBLIC omitted-placement Codex fresh/exact callback INSIDE exact existing `codex` -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement fresh Pi/exact callback IN that home -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL. The PID names the operator-owned app-server inside `codex`; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
+  ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
   ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b socket-domain 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, out-of-socket-domain+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
@@ -259,6 +260,11 @@ Usage:
   ./run.sh install-codex-statusline   # add thread-title to tui.status_line for visible garden ids
   ./run.sh uninstall-codex-statusline # remove only the recorded status-line atom
   ./run.sh doctor-codex-statusline    # effective visible-identity config + ownership verdict
+  ./run.sh install-codex-terminal-title   # add thread-id to tui.terminal_title so the multiplexer reports the caller's thread in #{pane_title} (#95 placement input, never an address)
+  ./run.sh uninstall-codex-terminal-title # remove only the recorded terminal-title atom
+  ./run.sh doctor-codex-terminal-title    # effective caller-seat config + ownership verdict
+  ./run.sh codex-socket-path              # #95 INTERNAL (the launcher asks this; you do not need it): print the Codex app-server default control-socket path for this environment, from the SAME resolver delivery and preflight read
+  ./run.sh codex-app-server [args...]     # #95: the ONE COMMAND that starts the operator's Codex app-server. exec()s `codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"` in THIS terminal (cwd/pid/exit are the vendor's, Ctrl-C is yours) — entwurf owns the SPELLING of that address, never the process's lifecycle: no supervisor, no restart, no daemon, no pid file. It does no path arithmetic: the address comes from `codex-socket-path`, the one leaf every other Codex surface reads, and a resolved address that is not absolute or carries a control character is refused before anything is created. Your arguments are forwarded byte-identical after it; a second --listen is refused by name. Refuses on a live socket (names the /proc owner it can read) or an indeterminate one, and reports which tmux server this seat gives caller-seat lookups. Run it in a DETACHED tmux session other than the one you work in
   ./run.sh install-agy-statusline     # own the agy statusLine subtree with bare entwurf-agy-statusline; preserve unrelated settings
   ./run.sh uninstall-agy-statusline   # honest inverse from statusline install-state
   ./run.sh doctor-agy-statusline      # fail-loud statusLine config/bin/state doctor + honest live SKIP
@@ -604,6 +610,7 @@ _codex_home() { echo "${CODEX_HOME:-$HOME/.codex}"; }
 _codex_config() { echo "$(_codex_home)/config.toml"; }
 _codex_mcp_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-mcp/install-state.json"; }
 _codex_statusline_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-statusline/install-state.json"; }
+_codex_terminal_title_state() { echo "${XDG_DATA_HOME:-$HOME/.local/share}/entwurf/codex-terminal-title/install-state.json"; }
 
 codex_mcp() {
   local verb="$1" config state
@@ -632,6 +639,23 @@ codex_statusline() {
   esac
 }
 
+# #95 lane B: the SECOND visible-identity atom, and a different axis from the
+# status line. `status_line`'s thread-title is what a HUMAN reads in the TUI;
+# `terminal_title`'s thread-id is what the MULTIPLEXER reports back as
+# `#{pane_title}`, which is the only value a Codex caller's `_meta.threadId`
+# can be matched against to find the pane it is sitting in. Placement input
+# only — never an address, delivery or liveness fact.
+codex_terminal_title() {
+  local verb="$1" config state
+  config="$(_codex_config)"
+  state="$(_codex_terminal_title_state)"
+  case "$verb" in
+    install) python3 "$REPO_DIR/scripts/codex-terminal-title-config.py" install "$config" "$state" ;;
+    uninstall) python3 "$REPO_DIR/scripts/codex-terminal-title-config.py" uninstall "$state" ;;
+    doctor) python3 "$REPO_DIR/scripts/codex-terminal-title-config.py" doctor-static "$config" "$state" ;;
+  esac
+}
+
 register_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   # Shared idempotent implementation (also driven by smoke-user-scope-citizen).
@@ -1026,6 +1050,14 @@ check_copilot_launch() {
   run_ts scripts/check-copilot-launch.ts
 }
 
+check_codex_app_server_launch() {
+  # #95: the managed app-server SPELLING, proved against a fake vendor. There is no second
+  # spelling of the address to compare any more — the launcher asks `codex-socket-path` — so
+  # these cells are a WIRING oracle, and they carry the hostile inputs a transcription was
+  # measured to diverge on so that re-deriving the path here goes red rather than passing.
+  run_ts scripts/check-codex-app-server-launch.ts
+}
+
 check_copilot_receive_arm() {
   # #82 RAIL 5 gate: drives the REAL receiver installer into a temp extensions dir, then
   # forks the REAL extension.mjs with the SDK specifier resolved by a loader hook (the
@@ -1414,7 +1446,10 @@ check_mux_fresh_call() {
   # tmux-coordinate-row rides here because it is the parse every tmux COORDINATE in this lane's
   # LIVE siblings depends on, and because it is the only half of a measured LIVE failure that a
   # deterministic gate can own: the row is the input, so no tmux and no model turn is needed.
-  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts
+  # codex-caller-seat rides here for the same reason as the two preflights: the leaf exists
+  # only as freshCall's Codex placement input (#95 lane B), so certifying it apart from the
+  # composition it feeds would let the two halves of one seat decision drift.
+  run_vitest test/mux-fresh-call.test.ts test/copilot-fresh-preflight.test.ts test/codex-fresh-preflight.test.ts test/fresh-call-surfaces.contract.test.ts test/fresh-call-provider.contract.test.ts test/omp-fresh-bootstrap.contract.test.ts test/tmux-coordinate-row.test.ts test/codex-fresh-live-protocol.test.ts test/codex-caller-seat.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -4498,6 +4533,57 @@ JS
   fi
   echo "[check-pack-install] installed 'entwurf copilot' reached the vendor with the scan flag and the managed argv"
 
+  # #95 — the managed app-server SPELLING, from the INSTALLED package. Same packaging risk as
+  # the copilot cell above and the same reason a file-list assertion cannot stand in for it:
+  # `scripts/codex-app-server-launch.sh` has to be in the tarball AND resolve its siblings
+  # correctly once it lives under node_modules. What makes this cell worth its seconds is the
+  # ADDRESS: this verb exists so a consumer never types that socket path, so the one thing an
+  # installed run must prove is that the path it hands the vendor is the one the product's own
+  # resolver computes — read here from the INSTALLED tree, never from this checkout.
+  local cx_launch_home="$npm_tmp/codex-appserver-home" cx_launch_bin="$npm_tmp/codex-appserver-bin"
+  mkdir -p "$cx_launch_home" "$cx_launch_bin"
+  {
+    printf '#!/usr/bin/env bash\n'
+    printf 'for a in "$@"; do printf "ARG<%%s>\\n" "$a"; done\n'
+  } > "$cx_launch_bin/codex"
+  chmod +x "$cx_launch_bin/codex"
+  # The expectation is read from the INSTALLED COMPILED resolver, not from this checkout and
+  # not transcribed here: compiled JS is what an installed consumer surface reaches (Hard Rule
+  # 11), so this asks the packed tree itself what address it believes in.
+  local cx_resolver="$npm_pkg/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/codex-ws-client.js" cx_want
+  if [ ! -f "$cx_resolver" ]; then
+    fail "[check-pack-install] the tarball carries no compiled Codex socket resolver at $cx_resolver"
+    return 1
+  fi
+  if ! cx_want=$(CODEX_HOME="$cx_launch_home/.codex" node --input-type=module -e "
+import { resolveCodexDefaultSocketPath } from '$cx_resolver';
+process.stdout.write(resolveCodexDefaultSocketPath(process.env));
+" 2>&1); then
+    fail "[check-pack-install] the INSTALLED compiled socket resolver would not load:"
+    echo "$cx_want" | tail -4 | sed 's/^/    /' >&2
+    return 1
+  fi
+  if ! op_out=$(env -u ENTWURF_CODEX_APP_SERVER_ACTIVE -u TMUX \
+      HOME="$cx_launch_home" CODEX_HOME="$cx_launch_home/.codex" PATH="$cx_launch_bin:$PATH" \
+      "$installed_entwurf" codex-app-server --config probe=1 2>&1); then
+    fail "[check-pack-install] installed 'entwurf codex-app-server' FAILED to reach the vendor:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  for want in "ARG<app-server>" "ARG<--listen>" "ARG<unix://$cx_want>" "ARG<--config>" "ARG<probe=1>"; do
+    if ! printf '%s' "$op_out" | grep -qF "$want"; then
+      fail "[check-pack-install] installed 'entwurf codex-app-server' did not hand the vendor the resolved address and argv (missing $want):"
+      echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+      return 1
+    fi
+  done
+  if printf '%s' "$op_out" | grep -qF 'ARG<codex-app-server>'; then
+    fail "[check-pack-install] installed 'entwurf codex-app-server' leaked the dispatcher verb into the vendor's argv:"
+    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] installed 'entwurf codex-app-server' reached the vendor at the INSTALLED resolver's address ($cx_want)"
+
   # The generation verb must reach its verdict from under node_modules. On the
   # sandbox 0-record agent dir it archives nothing and opens a fresh generation.
   # The exit code alone can't tell a verdict from a fence crash, so read the line.
@@ -5313,6 +5399,12 @@ setup_all() {
     else
       setup_result codex-statusline FAIL "detected codex, but the visible-identity setting did not complete (see above)"
     fi
+    codex_rc=0; codex_terminal_title install || codex_rc=$?
+    if [ "$codex_rc" -eq 0 ]; then
+      setup_harness_result codex-terminal-title "thread-id terminal title enabled (caller-seat placement input)" "./run.sh doctor-codex-terminal-title"
+    else
+      setup_result codex-terminal-title FAIL "detected codex, but the terminal-title setting did not complete (see above)"
+    fi
   fi
   # ── core bridge boundary ── deterministic preflight lives in `pnpm run
   # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
@@ -5992,6 +6084,9 @@ case "$cmd" in
   check-copilot-statusline)
     check_copilot_statusline
     ;;
+  check-codex-app-server-launch)
+    check_codex_app_server_launch
+    ;;
   check-copilot-launch)
     check_copilot_launch
     ;;
@@ -6616,6 +6711,35 @@ case "$cmd" in
   doctor-codex-statusline)
     codex_statusline doctor
     ;;
+  install-codex-terminal-title)
+    codex_terminal_title install
+    ;;
+  uninstall-codex-terminal-title)
+    codex_terminal_title uninstall
+    ;;
+  doctor-codex-terminal-title)
+    codex_terminal_title doctor
+    ;;
+  codex-socket-path)
+    # #95 INTERNAL: print the Codex app-server default control-socket path for this
+    # environment. It exists because `entwurf codex-app-server` is bash and cannot import
+    # `resolveCodexDefaultSocketPath`; re-deriving that path in bash was MEASURED to diverge
+    # (BOM-only CODEX_HOME, path normalization), so the launcher asks instead of transcribing.
+    # `run_ts` is the crossing (compiled twin when installed, strip-types in a clone), which is
+    # the whole reason this sits in the dispatcher rather than inside the leaf.
+    shift || true
+    run_ts scripts/codex-socket-path.ts "$@"
+    ;;
+  codex-app-server)
+    # #95: the managed app-server SPELLING. Same shape and same reasons as the `copilot`
+    # branch below — `exec`, no subshell and no cd, because this operates on the operator's
+    # own session rather than on the repo, and the `shift` keeps the dispatcher verb out of
+    # the vendor's argv. It is NOT the same KIND of thing: `entwurf copilot` becomes a
+    # sibling-bearing CLI, while this becomes the long-lived server those siblings' MCP
+    # children hang off. Neither one supervises what it becomes.
+    shift || true
+    exec bash "$REPO_DIR/scripts/codex-app-server-launch.sh" "$@"
+    ;;
   copilot)
     # #82 RAIL 7: the managed launch. `exec` and NO subshell/cd on purpose — the vendor
     # must inherit this terminal exactly: the caller's cwd, this pid, this tty, and its own