@junghanacs/entwurf 0.21.0 → 0.23.0

package/CHANGELOG.md

@@ -4,6 +4,664 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.23.0 - 2026-09-18
+
+### Added
+
+- **`entwurf_fresh_call` opens a sibling on the herdr rail, beside the tmux one (#116).** A session
+  running inside [herdr](https://github.com/steipete/herdr) has no tmux server to place a window
+  on, so the rail is chosen from PROCESS CONTEXT — `HERDR_ENV=1`, herdr's own marker, read for its
+  exact value — and never from a caller parameter, which would let someone request tmux placement
+  from inside herdr and fail after a mutation instead of before one. There is **no fallback either
+  direction**: an incomplete herdr context is refused by its own herdr reason rather than quietly
+  opening a window the operator cannot see from where they are standing. The pilot backends are
+  `pi` and `claude-code`; `placement` is refused BY NAME there, because placement inside herdr
+  belongs to herdr and a tmux session name would silently relocate the sibling.
+  Coordinates, refusals, reclaim and evidence grades: [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md).
+  - One composition root (`fresh-call-dispatch.ts`) now owns rail choice, the Codex preflights and
+    the render call for BOTH public surfaces, so a defect planted in one surface can no longer
+    survive on the other. The rail-neutral half of the composition (argv dialects, callback tool
+    names, first-turn framing, nonce, input contract) moved to `fresh-call-composition.ts`, which
+    knows nothing about tmux; each rail supplies only what it alone can state.
+  - A sibling is placed in a NEW TAB of the caller's own herdr workspace, without taking focus,
+    with the workspace read from herdr's answer about the caller's own pane — never the focused
+    workspace and never the `w<N>:` prefix of an id this rail treats as opaque. Orphan reclaim is
+    proven within a generation and closes the PANE rather than the tab (`[측정 2026-09-15]`).
+  - `entwurf_peers` carries a read-only `placement` column with four words
+    (`unobserved` / `none` / `ambiguous` / `herdr <pane>`), joined only on an official herdr report
+    for its own backend. A pane coordinate is a VIEW, never an address: the garden id still arrives
+    in the callback envelope (Hard Rule 16).
+- **A herdr plugin that installs entwurf onto a host where nothing entwurf is on `PATH`.**
+  `plugins/herdr/` bootstraps a stable, scoped plugin runtime from an exact checkout candidate,
+  classifies which integrations the host already has, activates only what it owns, and ships a
+  read-only citizen status pane built on the core's own `peer-facts` projection. The install
+  reports NAMED steps on the operator's terminal and ends with one usage example per activated
+  backend, because `[GLG 직접, 2026-09-17]` "정확한 모델명을 모른다" was a real blocker on a clean
+  install. Entwurf still installs only Entwurf bytes — never a harness, subscription or login
+  (Hard Rule 17) — and a clean NixOS host additionally needs `programs.nix-ld.enable = true` for
+  the ACP rail's dynamically linked vendor binary.
+
+- **A gate keeps the typing-call boundary by NAME, not by prose alone.** `[외부 관측 2026-09-17
+  19:35]` an outside reader measured this tree and found the law perfectly kept and nothing keeping
+  it: zero typing calls across `pi-extensions/`, and zero checks and zero mutants that would notice
+  one arriving. Gates here grow on top of incidents, and this boundary was named and REFUSED at
+  design time (`docs/herdr-launch-rail.md` §3 threw the keystroke verb away before it shipped), so
+  it never produced the failure that would have produced a test — and a rule kept since day one is
+  the most defenceless kind, because its green means only that nobody has broken it yet.
+  `check-typing-call-fence` scans every TRACKED AND UNTRACKED production source under
+  `pi-extensions/`, `mcp/`, `plugins/herdr/` and `scripts/herdr-*.mjs` for the names of typing calls
+  — tmux `send-keys` / `paste-buffer` / `load-buffer` and herdr's PTY verbs `agent.prompt` /
+  `agent.send_keys` / `pane.send_text` / `pane.input.set` — with comments blanked and string
+  literals KEPT, because a typing call spelled as a string is the call.
+  - The comment exemption is load-bearing rather than a convenience: the sentence that states the
+    rule contains the very names the rule forbids, so a scanner that read prose would be red on the
+    law itself and the cheapest way to green would be deleting the law.
+  - Three assertions stand in front of the claim for the same reason — the detector is proven to SEE
+    each name planted in code, proven BLIND to the same name in a comment, and the scanned inventory
+    is measured, because without those "zero hits" and "looked at nothing" print identically.
+  - **What it does not catch is named in its own header rather than implied:** it reads SPELLINGS,
+    so a verb assembled at runtime passes it. That limit is accepted rather than closed. This is a
+    tripwire for the slip — a module reaching for the vendor's typing verb because the argv route
+    looked harder that afternoon — not a defence against somebody hiding one, and a gate claiming to
+    be the latter would be the more dangerous object. The claim therefore says CARRIES a typing call
+    spelled out, which is what it measures.
+  - `scripts/` stays out as a whole: this gate lives there, and a gate that scanned itself could
+    only be made green by deleting the names it exists to forbid. Wired into `check:hermetic`;
+    8 checks over 85 production sources, one exact-once mutant.
+- **The framing OFFERS its corroboration in a spelling the sibling can actually use.** The callback
+  tool name goes through a per-backend dialect map; the peer listing the first turn offers did not,
+  and four of the five backends reach that tool under a composed MCP name. The offer was unusable by
+  exactly the siblings it was written for — and it was written to replace a prohibition, removed
+  because a sibling should be able to check who called it. `FRESH_CALL_PEERS_TOOL` is the same
+  dialects applied to the other tool, so the two maps drift together or not at all.
+
+### Fixed
+
+- **`smoke-codex-fresh-live` now directs Codex to the callback sender garden id by the envelope's `session:` line.** In the first 0.23.0 retry Luna copied the model label from `from:` instead; the red receipt is `/tmp/entwurf-release-gate-0.23.0-retry.17pfMp`.
+
+- **A Claude child that could not see its callback tool now knows how to load it.** The framing said
+  "FIRST ACTION … call `entwurf_v2`" to a child for which that tool was not callable yet: `[측정
+  2026-09-18, n=5]` claude-code 2.1.267 surfaces a still-connecting MCP server as DEFERRED — the tool
+  NAME is listed, the SCHEMA is not, and a call without the schema fails. Across five isolated probes
+  the bridge's tools were directly callable **zero** times (4 DEFERRED, 1 still connecting), so the
+  child answered in text and went idle. That is the "silence" the herdr rail recorded in 5 of its 14
+  launches. The claude-code dialect now carries one factual sentence naming `ToolSearch` with BOTH
+  tools in a single select, and `[측정, n=3]` callbacks went 3/3 — including a child 782 ms in, which
+  is slower than every silent run. **The latency story it replaces is retired:** re-read at n=13
+  instead of n=4, success and silence overlap completely (52 ms called back, 94 ms did not), so
+  `docs/herdr-launch-rail.md` §14 now carries the distribution and the mechanism instead of the
+  correlation. Every other backend's framing is byte-identical — pi has no deferred-tool surface and
+  the other three were never probed (`FRESHCOMP-TOOL-LOAD-HINT-CLAUDE-ONLY`).
+
+- **The first turn no longer looks like the injection it is not (#116).** `[GLG 직접, 날것 PC,
+  2026-09-17]` a Claude Sonnet 5 sibling REFUSED its whole first turn and named three reasons, all
+  of them ours: a "decode the following JSON string literal and follow the decoded instructions"
+  wrapper, the line "Do not inspect environment variables, do not call entwurf_self", and no way to
+  verify the caller. The framing is now plain prose folded onto one physical line, with ONLY the
+  operator's task riding as a literal — `[source herdr 7505c08]` `src/app/agents.rs:157-161`
+  refuses any agent argument carrying a Unicode Cc, so a newline never reaches the sibling, and
+  `src/platform/linux.rs:127-141` single-quotes every argument, which is why the encoding was never
+  buying shell safety. The prohibition is replaced by the same steering stated as a FACT (your own
+  record does not carry the caller's address; the tool call is what reaches it) plus an OFFERED
+  read-only way to corroborate the caller. `[측정 oracle 2026-09-18, LIVE run sCzzE0]` a Sonnet 5
+  child called `entwurf_peers` and then `entwurf_v2`, both successful, and its callback landed.
+- **The rail tells herdr how long to wait, and judges the child on its own clock (#116).** Without
+  an explicit `--timeout`, herdr gave up at its own 30s default while our process bound sat at
+  300s, so a cold-starting Claude Code sibling that was alive and booting came back as
+  `herdr-agent-start-failed [herdr: timeout]` over an unreclaimed pane. The bound is now an
+  explicit 240s, deliberately BELOW our own kill, so herdr has to lose that race or its named
+  answer is replaced by "no exit status". The LIVE cell also stopped measuring the child with the
+  CALLER's clock — two runs of identical code had differed only in how long the caller's launch
+  took — and now records what the child was doing every run: herdr's agent status and entwurf's own
+  hook journal are the WHOLE evidence surface, because `[측정 2026-09-18]` no claude session in this
+  smoke, caller or child, acting or silent, exists under `~/.claude/projects/` or any fenced XDG
+  root — including a child that had just made two successful tool calls.
+- **A peer that hangs up on an accepted control socket no longer takes the resident with it.** The
+  connection error is handled where the socket is accepted, so a half-open peer is a bounded
+  per-connection failure instead of an uncaught exception.
+- **The uncitizened `entwurf_self` notice is proven, not regexed.** The gate asserted the shape of
+  a message instead of the fact it reports, which a reworded notice would have broken while a
+  wrong notice passed.
+
+
+- **The Codex birth unit owns its own declaration, not the whole `hooks.json` (#117).** Installing
+  Herdr's official Codex integration appends a second `SessionStart` group to
+  `$CODEX_HOME/hooks.json`. The vendor kept running BOTH declarations — `[source]`
+  `codex-rs/hooks/src/engine/discovery.rs:664-665` hashes a normalized event/matcher/group/handler
+  and keys trust by `<path>:<event>:<group_idx>:<handler_idx>`, so trust was declaration-scoped all
+  along — but entwurf's certification was file-scoped: `install-state` recorded a whole-file
+  sha256 and the fresh preflight additionally required `SessionStart.length === 1`. On a host with
+  both installed, `doctor-codex-birth` was RED and every Codex fresh launch was refused
+  `codex-birth-unit-missing`. **v0.22.0's release LIVE was measured with Herdr's hooks moved
+  aside; this is the debt that names paid.**
+  - Ownership is now exactly one `SessionStart` group holding one handler whose `command` is our
+    quoted launcher path. It is certified by SHAPE (which keys may exist) and by a NORMALIZED
+    digest (recursively sorted keys, no whitespace) — blind to indentation and key order, because
+    `[측정 2026-09-17 oracle]` Herdr re-serializes the entire document through serde, which changed
+    our own handler's key order from `type,command,timeout` to `command,timeout,type`.
+  - The vendor trust receipt is read at the index our declaration was MEASURED at, never at the
+    constant `:0:0`. With a neighbour at index 0 that constant read THEIR approval and reported it
+    as ours — a green for a hook the vendor had never been asked to run.
+  - Neighbours are `present-but-foreign`: reported in the doctor's own FOREIGN section, certified
+    by nothing, never overwritten or absorbed, and no input to any verdict of ours. Editing one
+    moves nothing.
+  - Install into a file somebody else already declares in is an APPEND by text splice (never an
+    adoption and never a refusal), and appending rather than inserting leaves a neighbour's index —
+    and therefore their existing trust receipt — alone. Uninstall splices out only entwurf's group
+    (plus entwurf's own top-level `description`), removing the file only when entwurf was its sole
+    declaration. Every splice is re-parsed and deep-compared to the value it intended before it
+    reaches disk; a splice that lands anywhere else is a zero-write refusal.
+  - Our own declaration missing, edited or DUPLICATED is still a named red, in install, doctor,
+    inverse and preflight alike.
+  - Entwurf still never creates, computes, pre-seeds or bypasses a vendor trust receipt, and
+    deliberately does NOT recompute what that hash should be: the vendor normalizes with its own
+    code, and reimplementing it here would make entwurf a second opinion about somebody else's
+    security decision that drifts with every vendor release.
+  - `install-state` moves to `codex-birth-install-state/v2` (declaration receipt instead of
+    `hooksSha256`). The uninstall, doctor and preflight read v2 only and refuse v1 by name; the
+    installer reads a v1 receipt once, to supersede it forward — it removes nothing and rewrites no
+    foreign byte.
+  - New shared leaf `pi-extensions/lib/codex-declaration.js` is the single definition the
+    installer, inverse, doctor, fresh preflight and gates all decide with.
+  - Gates: `smoke-codex-birth` 102 checks (both orderings green, foreign bytes proven across
+    install and inverse, foreign edits neutral, own-declaration drift/duplication/v1 named red,
+    trust read at the measured index, the shared file's mode carried over, and an unscanned
+    FOREIGN axis reporting NOT READ rather than "none"), `check-codex-birth-hook` 101 checks (the
+    leaf's digest, selection, named refusals, span reader and splice post-condition), six new
+    preflight cells, and 8 exact-once mutants (inventory 520 → 527). Six existing
+    `FRESHCALL-CODEX-*` mutants were re-pointed at the predicates this narrowing moved;
+    `FRESHCALL-CODEX-HOOK-KEYS` moved gate as well, because under the preflight's oracle an extra
+    handler key is caught by the digest anyway — what its predicate still buys is the NAME.
+    Verification receipts at `ac3f1f8`: `pnpm run check:full` exit 0 (403s) and
+    `check-gate-qualification` **527/527 killed**, both in the exact-SHA CI run
+    [35239086438](https://github.com/junghan0611/entwurf/actions/runs/35239086438).
+  - **Not in scope, by decision:** adding Codex to `HERDR_FRESH_CALL_BACKENDS`, Herdr env carriers
+    on the Codex MCP child, plugin supervision of the app-server, and the identical ownership
+    defect in the statusline/terminal-title atoms (recorded as an Observation, its own atom).
+
+- **A sibling herdr has not been introduced to yet is no longer killed for it.** `[측정 oracle
+  2026-09-18, LIVE run XimC19]` a Claude Code child booted, wrote its own birth record at
+  01:53:38.297Z, and 0.585s later this rail closed the pane it was sitting in. The same bytes passed
+  five minutes later (run TCatjF) because that child took 1m27s to become ready instead of 4.9s — so
+  the FAST path was the dangerous one, and every green run before it was luck rather than proof.
+  - The premise was that `agent start` waits for detection before returning. It does not:
+    `[file:line @ c77af189]` `src/cli/agent.rs:592-615` returns on `agent_status ∈ {idle,done}` plus
+    `interactive_ready`, and `agent_session` is not in that condition at all. On the Claude rail that
+    id arrives afterwards from the CHILD's own one-shot hook
+    (`src/integration/assets/claude/herdr-agent-state.sh:60-99`, 0.5s socket deadline, failures
+    swallowed), so "herdr has not been told the id" is a reachable resting state for a healthy
+    sibling.
+  - `settleAgentWitness` re-READS instead of judging on the spot: `agent get <the exact name we
+    started>`, never a listing, bounded and rebound to the create receipt every time. An unreadable
+    or failed read costs one poll, because herdr answers a missing agent and a socket that blinked
+    with the same exit status.
+  - **Expiry buys nothing.** The window closing is a SUCCESSFUL launch carrying a
+    `witness: unavailable` diagnosis that says what it costs (the peers `placement` column has
+    nothing to join) and what it does not (the address was never a pane). The old
+    `witness-missing → reclaim` path is gone; the one failure this stage can still name is a
+    readable reply about a DIFFERENT agent, `herdr-agent-start-vanished`.
+  - The reclaim predicate now reads OCCUPANCY, not the session id: a pane herdr says an agent is in
+    is never closed, whether or not anybody has reported that agent's session. Collapsing those two
+    facts is what made a booted child read as an empty pane, and it would have survived in every
+    other post-create failure branch if only the witness path had been patched.
+  - The settle bound is a PROPOSAL and says so in its own comment: the red run still had nothing
+    585ms after the child's birth record, the reporter's own deadline is 500ms, and the slow run's
+    85s was a race being hidden rather than a ceiling.
+- **The Codex birth unit decides who owns the shared `hooks.json` ONCE, for all four surfaces.** The
+  fresh-call preflight required a plausible owner and refused a group/world-writable mode; the
+  installer and the inverse asked only symlink-and-regular; the doctor read the file's CONTENT
+  without ever asking who owned it. A host could install clean, read GREEN, and have every Codex
+  launch refuse it as `codex-birth-unit-missing` — three surfaces saying yes about bytes the fourth
+  said no about. `classifyOwnedPath` now lives in the shared declaration leaf all four already load,
+  and it is PURE: it judges a stat record, not a path. A neighbour's MODE stays theirs (the install
+  still carries it over untouched); WRITING into a file anyone else can rewrite is the different
+  question, and the answer there is a zero-write refusal, because a receipt cannot bind bytes
+  somebody else controls. Symlink keeps its own verdict — the repair is not a mode change, it is a
+  different file.
+- **The inverse's FILE verdict earns its delete.** It could remove a `hooks.json` this unit never
+  created: the arm asked one question — is our group the last declaration — and that is true of a
+  file we merely APPENDED to. `{"description":"foreign","hooks":{"SessionStart":[]}}` has no foreign
+  GROUP, so after our install it classified FILE and the whole document went, a neighbour's
+  top-level bytes included. The receipt had recorded `hooksExistedBefore` since the installer was
+  written and nothing read it; it does now, with two more proofs beside it (the top-level keys are
+  exactly the two this unit writes, and the description is ours). Anything else SPLICES. An absent
+  field reads as "it was already there", so an older receipt licenses a splice and never a delete.
+- **The herdr LIVE oracle joins the callback it claims to have proved.** Its pi cell compared
+  CHARACTER OFFSETS across the whole transcript, and both strings are already in the birth prompt in
+  that order — so "called back, then worked" and "never called back" read identically. It now wants
+  ONE record carrying the delivered nonce and the `sent` outcome together, with the task token in a
+  later one. Its claude cell asserted only that the first `entwurf_v2` completed, which a call
+  delivering somebody else's nonce also satisfies; the join it can actually make is across two
+  independent artifacts — the delivered message carrying the exact nonce and the child as sender,
+  enqueued inside that call's own window.
+- **Three Codex branches and one peers read stop being claims nobody tests.** An independent
+  coverage audit found the whole production path behind the peers `placement` column — env gate,
+  binary execution, timeout, parse failure — with zero assertions and zero mutants, so a typo in
+  `["pane","list"]` or a deleted timeout would have left the deterministic floor green. It has two
+  claims now, driven through a stub PROCESS (not a fake herdr: every answer-shaped fact still comes
+  from the verbatim 0.9.0 recordings, and what the stub supplies is an exit code, a hang, an
+  absence). The doctor's ORPHAN verdict, the inverse's SPLICE arm and its FILE arm gained the
+  mutants their behaviour cells never had, and the herdr rail's documented cwd asymmetry — `#` is
+  DATA here, because herdr has no format expansion for the tmux refusal to protect against — gained
+  a cell that drives a real directory through to the argv.
+
+- **The herdr rail's two-step `agent prompt` proposal is closed at the VENDOR SOURCE, not with LIVE
+  runs — and not implemented.** §14 proposed starting the agent with no prompt and sending the first
+  turn with `herdr agent prompt`, which would remove the tool-list race. The question standing in
+  front of "does the child call back" is what that verb SENDS, and the vendor answers it:
+  `[source herdr 7505c08]` `api/agents.rs:195` hands the text to `encode_api_submission_parts`,
+  `api_helpers.rs:25-32` wraps it in bracketed paste and writes it to the child pane's PTY, and
+  `:13` / `:208-212` write an encoded Enter 300 ms later. It runs NO control-character check — only
+  a non-empty one, unlike the argv path — so whether a newline pastes or submits is decided by the
+  child terminal's paste mode at that instant rather than by a contract, and what is acknowledged is
+  that input was written (the vendor's own help: "before any input is sent", "It does not track
+  turns"). So the two-step is the keystroke channel §3 already measured and refused, and adopting it
+  would put screen input on the FIRST turn — exactly what Hard Rule 16 keeps out of delivery
+  evidence. The three LIVE runs budgeted for it were NOT spent characterising a path that cannot
+  ship. The remaining legitimate direction for the race is the framing that stands before the tool
+  list, the same axis as omp's `--entwurf-bootstrap`.
+- **Two mutant claims the #116 merge moved now aim at what they were about.** Replaying every lane
+  the merge touched answered 484/486, and both refusals were the merge's own bookkeeping.
+  `FRESHCALL-CWD-SURFACE-PARITY` SURVIVED because the regenerated find was extracted from the FIRST
+  `cwd: z` block in the bridge — which belongs to `entwurf_register_native`, not
+  `entwurf_fresh_call` — so the mutation deleted a required cwd from a DIFFERENT tool and nothing
+  failed; both parity finds are now extracted from inside the `fresh_call` registration span.
+  `FRESHCALL-CWD-CALLER-ONLY` came back WRONG-REASON because the mutation now lands in the
+  composition leaf while the cell carrying its signature read only the tmux module, so three other
+  cells failed instead and the kill could not be attributed.
+
+- **The first turn says where the result goes.** `[GLG 직접, 2026-09-18]` a fresh sibling finished
+  its task, printed the answer in its own window, and the caller never saw it. The investigation
+  found no broken injection: NEITHER framing, the retired one or the current one, had ever said
+  this. It used to work because a hand-written briefing named the target and the tool, and when the
+  briefing stopped doing that the sentence turned out to live nowhere. The framing now ends with two
+  lines — where to send the result (the callback tool, in the same backend dialect) and why sending
+  is needed at all, because a sibling with a visible window has no way to know its window is not the
+  delivery. It is TOPOLOGY, not a command: nothing watches for completion or sends on the sibling's
+  behalf, and a supervisor is what this rail refuses to be.
+- **A LIVE smoke stops taking the operator's `claude` launcher** — #67's failure on a rail born
+  after its fence. The vendor resolves the two halves of its install from different roots: the
+  version store from `XDG_DATA_HOME`, the launcher from `HOME`. This smoke fenced XDG while keeping
+  the real HOME, so each Claude child found an empty store beside a real launcher, installed itself
+  into the fixture, and repointed `~/.local/bin/claude` at `<fixture>/claude/versions/2.1.267`.
+  **That is not a hazard, it happened** — seven preserved fixture roots each hold that install, and
+  the operator's launcher pointed into the newest of them, one `/tmp` sweep away from a `claude`
+  that does not start. The fixture's `xdg-data/claude` is now a symlink to the operator's vendor
+  data dir, which puts store and launcher back in one install while the rest of the tree stays
+  fenced, and the smoke consumes the shared fence: fail-closed preflight, integrity oracle in
+  teardown, cleanup verdict. The gate side stopped naming files — `LAUNCHFENCE-EXPOSED-SMOKE-WIRED`
+  asks the POPULATION (every LIVE smoke that assigns a fixture `XDG_DATA_HOME` either consumes the
+  fence or carries an exemption verified against its own source: four today, three wired, one
+  exempt), because the two claims that listed smokes by name are exactly what the newest rail walked
+  past. `[LIVE 2026-09-18]` the first run in eight to leave zero version copies behind.
+- **The herdr LIVE ordering oracle reads the join pi actually writes.** The claim asked for ONE
+  transcript record carrying both the delivered nonce and the `sent` outcome; pi cannot write that
+  record, because the nonce rides the toolCall and the outcome rides a separate toolResult, joined
+  by `toolCallId`. So the oracle failed a run whose child did exactly what the claim describes
+  (callback 04:15:01.381, `sent` .415, task token .03.728) — the most expensive kind of red: correct
+  product, red gate, and a cut that stops for nothing. The join was what the claim was always about:
+  the `sent` outcome must belong, by that id, to THE call that carried THIS nonce, and the task
+  token must appear after it. Proven on the failing transcript — the real run holds, a forged pair
+  whose `sent` belongs to a different call does not, and a run whose token appears only before the
+  callback does not.
+
+### Changed
+
+- **The two tool descriptions say what the code does.** `entwurf_v2` no longer offers `codex` as an
+  example of a backend with no adapter: Codex is a native-push backend, and that sentence pointed a
+  caller at the wrong dispatch outcome. `entwurf_fresh_call` says it opens a NEW UNFOCUSED TAB in
+  the caller's own herdr workspace rather than "a herdr pane" — the contract has been tab-first
+  since it shipped. Both surfaces lost the top-level cwd sentence the `cwd` parameter description
+  already owns, which is also what kept them inside the 2048-char host cap.
+- **The herdr rail document describes the first turn that actually ships.** §3 still recorded the
+  retired shape — the whole framing wrapped in one JSON literal behind "decode the following" —
+  which a Sonnet 5 sibling refused outright. The current shape is plain prose with only the
+  operator's task as a literal, and the section now says why: the encoding never bought shell
+  safety (herdr single-quotes every argument), and what is left is the vendor's control-character
+  refusal, so only the thing that must carry newlines is encoded.
+- **`ROADMAP.md` and `docs/setup-clean-host.md` stop calling accepted work pending.** The Codex
+  caller-seat and caller-DIRECTORY re-runs were accepted on 2026-09-16 with 56 and 65 assertions;
+  both documents said "pending", and the roadmap's current-package line still read 0.20.1.
+- **`plugins/herdr/README.md` separates an admission floor from a measured supply.** Herdr
+  `>=0.9.0` is the manifest floor; Entwurf's reproducible and CI rail is pinned to exactly 0.9.1,
+  and a different Herdr inside the admission window carries no receipt of ours. Its install-output
+  example uses `<version>` / `<full-commit>` placeholders instead of a frozen `0.21.0` and a frozen
+  commit that no longer reproduce. Both READMEs now name the two installation routes and link to
+  each other.
+
+### Observations — named rather than carried
+
+These were raised by the pre-cut review round and deliberately NOT acted on in this release. Each
+one is recorded here so the next lane inherits the finding instead of rediscovering it.
+
+- **The vendor trust receipt is bound by KEY, not by VALUE.** `doctor-codex-birth` and the fresh
+  preflight read the receipt at the index our declaration was measured at and check that its value
+  has the shape `sha256:<64 hex>` — they do not check that the hash is the one the vendor would
+  compute for the CURRENT declaration, so a stale or arbitrary well-shaped value reads as ready.
+  Closing it would mean reimplementing the vendor's normalization here, which is exactly the second
+  opinion about somebody else's security decision that Hard Rule 9 and the doctor's own prose
+  refuse. The live failure mode is bounded and visible: a stale receipt makes the vendor show its
+  consent screen again to the human sitting there, and an unattended launch reads as a callback
+  timeout.
+- **The typing fence does not detect an assembled typing call** — see its header, and the entry
+  above.
+- **The declaration span fixtures do not pin CRLF, BOM or deeply nested arrays by name.** The parser
+  and its splice post-condition handled all three correctly in a direct memory-only sample; what is
+  missing is a labelled cell, and BOM in particular would read better as an explicit refusal than as
+  an incidental one.
+- **Four more coverage gaps were enumerated and left for their own lane:** the uninstall's v1-state
+  refusal has a behaviour cell but no mutant of its own, the `trustReceiptKey` composition is
+  asserted separately by the doctor and the preflight rather than jointly, and two spawn-seam
+  sub-claims were deliberately not split into their own QKs.
+- **The Claude child's `--allowedTools` names only the callback tool**, so the corroboration the
+  framing offers is not on the auto-approved list. Measured behaviour is unchanged by this release
+  (the bare spelling was not on it either), and widening auto-approval is a decision rather than a
+  repair.
+- **`doctor-codex-birth` FOREIGN 축은 이웃 선언의 trust 부재를 판단하지 않지만 vendor 동의 화면은
+  파일 단위로 첫 턴을 막는다.** `smoke-codex-fresh-live` 전제조건은 폴더 trust만 이름짓고 hook
+  trust는 timeout으로 읽힌다 — 컷 후 atom.
+
+### Verification
+
+- **Land exact-SHA CI.** Push run
+  [`35312087142`](https://github.com/junghan0611/entwurf/actions/runs/35312087142) at
+  `09aea576a80983709a7e2bb7593d6fb546234eee` concluded green for `check`,
+  `install-surface`, `artifact-consumer`, and `macos-install-surface`; the `check` job's
+  `check-gate-qualification` body also concluded green.
+- **LIVE Codex acceptance is a focused rerun, not a final `release-gate --cut` exit 0.** First cut
+  attempt `/tmp/entwurf-release-gate-0.23.0.Ire9Nr` was red because the vendor's Herdr hook trust
+  receipt was absent; the operator answered the vendor consent screen once. Retry
+  `/tmp/entwurf-release-gate-0.23.0-retry.17pfMp` recorded `MUST: PASS=23 FAIL=1 SKIP=0`; its only
+  red cell was `smoke-codex-fresh-live`, where Luna copied the model label from the callback
+  envelope's `from:` line. The frozen-candidate delta afterwards is exactly the two instruction
+  sentences in `scripts/lib/codex-fresh-live-protocol.ts` plus these CHANGELOG records. After
+  `pnpm run build-bridge` and `./run.sh check-bridge-delivery` (19 PASS), the repaired standalone
+  `smoke-codex-fresh-live` passed 66 assertions:
+  `/tmp/entwurf-codex-smoke-0.23.0-amend.BHrPTU/smoke-codex-fresh-live.log`.
+- **Deterministic floor and explicit variance.** `pnpm run check:full` passed before the amendment
+  at `/tmp/entwurf-check-full-0.23.0.Q6GGeI`; it also passed on the amended working bytes in 579 s
+  at `/tmp/entwurf-check-full-0.23.0-amend.zBu9ic/check-full.log`. VERIFY §389 문자 조건 미충족 —
+  GLG 명시 승인 하의 편차, 사유: 통과 스텝 재실행은 자원낭비. The prepared-HEAD exact-SHA CI owns
+  the final deterministic proof.
+
+## 0.22.0 - 2026-09-17
+
+### Added
+
+- **A Codex sibling opened into a directory the vendor has no answer for now SAYS SO
+  (`codex-launch-cwd-undecided`).** `entwurf_fresh_call` reads the launch directory against the
+  operator's Codex config and prints what it saw — and then opens the window anyway. **It is a
+  diagnostic, not a gate, and that is the product decision (GLG, 2026-09-17):** the vendor's
+  consent screen is self-repairing for the human this rail exists to put a window in front of, one
+  answer teaches the vendor that directory for good, and a refusal would replace that with "no
+  window, go run codex yourself, then call again" while having to be right about a decision this
+  process cannot fully see. The UNATTENDED case is answered where it belongs —
+  `smoke-codex-fresh-live` asserts the same leaf up front, so a release gate with nobody at the
+  keyboard reads a named precondition instead of a callback timeout. `[source rust-v0.153.4]` a `--remote` startup — which this
+  argv always is — runs `check_directory_trust` on the `-C` value (`tui/src/lib.rs:1699-1725`), and
+  nothing on that path consults the approval or sandbox policy
+  (`tui/src/onboarding/directory_trust.rs:33-130`): the
+  `--dangerously-bypass-approvals-and-sandbox` token this launcher already carries turns off
+  approvals, never folder consent. A DIRECT decision is keyed to the exact directory and nothing else — for
+  `ProjectTrustHost::Remote` the lookup is `vec![cwd_key]` (`tui/src/config_update.rs:290-296`), with
+  no project-root marker, no git root and no parent inheritance. **The question is whether the
+  directory has been ANSWERED, not whether it is trusted:** a saved `untrusted` folder is
+  explicitly skipped on a remote target (`onboarding/directory_trust.rs:94-96`), so that turn
+  starts too and is not noted at all. A cwd inside an explicitly `untrusted` project gets its OWN
+  note (`codex-launch-cwd-untrusted-ancestor`) because the vendor answers that one with an error
+  rather than a screen — `pass the repository root explicitly with --cd`
+  (`config_update.rs:357-371`) — so its repair names a different directory, not a prompt.
+
+  **The leaf is deliberately NARROWER than the vendor's own judgment and says so rather than
+  claiming equivalence.** It reads the operator's `config.toml`; the vendor reads an effective
+  config — system, managed and cloud layers merged around that file — through its app-server, and
+  an enabled PROJECT LAYER consents on a directory's behalf with no entry at all
+  (`config_update.rs:346-354`). That gap is affordable precisely because nothing here refuses:
+  everything the leaf cannot see stays silent, and a note that turns out to be unnecessary costs a
+  line of stderr. **`[측정 2026-09-16]` this is the
+  failure it retires, not a hypothetical:** four `smoke-codex-fresh-live` runs, one scratch directory
+  each; the two whose directory carried a trust entry (`…-db65N2`, `…-pBXxOJ`, both answered by a
+  human at the keyboard) passed, and the two unattended release-gate runs (`…-2zznHl`, `…-kSsoAn`)
+  died with no rollout written after 21:28 at all — the sibling had opened on a consent screen and
+  started no turn, so there was no birth, no callback, and nothing to address. The caller then waits
+  out its entire timeout on a window that is merely waiting to be answered, which reads as a delivery
+  defect and is a folder question. The directory asked about is read back off codex's own `-C` token
+  rather than recomputed, so the consent question cannot drift from the thread's real start
+  directory, and the inherited default stays resolved in exactly one place.
+
+- **A Codex caller opens its sibling beside its own pane (#95 lane B).** Until now the seat a
+  Codex citizen got came from the app-server's inherited `TMUX`/`TMUX_PANE`, so a sibling opened
+  from Codex landed wherever the operator happened to have started the app-server rather than
+  beside the TUI the operator was looking at. `[측정 2026-09-16, codex-cli 0.153.4]` with
+  `thread-id` in `[tui].terminal_title` the TUI writes its thread UUID into the OSC 0 title and
+  tmux answers with it as `#{pane_title}` — truncated to 32 chars, i.e. 29 graphemes plus `...`
+  (`status_surfaces.rs:892-894`, `:1027-1043`; unchanged at `rust-v0.154.0`). So when the
+  reconciled sender of a fresh call is a record-backed `codex` citizen and `placement` is
+  omitted, that request's own `_meta.threadId` selects the pane whose title carries the token and
+  its `$session` becomes the target. **No vendor patch, no new carrier: one config item.**
+- **`entwurf install-codex-terminal-title` / `uninstall-` / `doctor-`** — a fourth Codex
+  ownership atom, owning only `thread-id` membership within `tui.terminal_title`. A different key
+  and a different axis from `install-codex-statusline`: `status_line` is what a human reads
+  inside the TUI, `terminal_title` is what the multiplexer reports back. The seeded list is
+  `["activity", "project-name", "thread-id"]` — `activity` leads because the herdr Codex detector
+  keys on the spinner and `Action Required` prefix — and an existing operator list is APPENDED to,
+  never reordered. `setup` composes it on a detected Codex host.
+- **The seat now follows the CALLER, never the backend being opened, on both fresh-call surfaces.**
+  An explicit `placement.tmuxSession` always wins; then a Codex CALLER's own pane
+  (`codex-title-anchor`); then the caller's own session. The anchored receipt reports its SOURCE and
+  no session name, because a session was observed rather than a name requested.
+- **`entwurf codex-app-server` — the one command that starts the operator's Codex app-server.**
+  Every Codex rail needs a server the operator starts themselves, and the command was
+  `codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`:
+  correct, in three documents, and in the text of a refusal — which meant most operators met it
+  only AFTER something had already failed. This verb owns that SPELLING and nothing else. It
+  `exec`s the vendor in the terminal it was typed in (cwd, pid, tty and exit status are the
+  server's; Ctrl-C is the operator's), creates the control directory, forwards the rest of the
+  argv byte-identical, and strips `PI_SESSION_ID`/`PI_AGENT_ID` so the server every bridge child
+  inherits from cannot carry someone else's identity. The address comes from the SAME leaf
+  delivery, preflight and the LIVE smoke read: the launcher ASKS that resolver through the new
+  internal `entwurf codex-socket-path` rather than re-deriving the path, so there is exactly one
+  spelling of this address instead of two that agree on the inputs somebody thought of.
+  Refusals are named and happen before the exec: a live socket (naming the pid whose `/proc`
+  cmdline actually carries that socket, and saying plainly when the host holds none — never an
+  inferred owner), a resolved address that is not absolute or carries a control character
+  (refused before anything is created: a relative socket is a different file for every process
+  that resolves it, and the bridge that will look for it is the app-server's MCP child with its
+  own cwd), an unidentifiable path, a second
+  `--listen`, a recursive launch, a socket classification nobody wrote, no `codex` on PATH. A dead
+  socket file is reported and launched over. **It is a managed spelling, not a managed
+  lifecycle**: no supervisor, no restart, no daemon, no pid file, and `entwurf_fresh_call` still
+  REJECTS a missing app-server rather than starting one. The tmux seat this server gives caller-seat lookups is reported as a fact, not
+  enforced as a requirement. Typing the raw vendor command remains equivalent.
+
+### Verification
+
+- **Release acceptance for this cut.** `[LIVE 2026-09-17, oracle]` `LIVE=1 ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.22.0.royX2L --cut` → **`MUST: PASS=24 FAIL=0 SKIP=0`**, **`BEHAVIOR:
+  PASS=1 FAIL=0 SKIP=0`**, **`cut: OK`**, exit 0, 18:47–20:02 KST; log preserved at
+  `<scratch>/release-gate.log`. Inside it: `check:full` exit 0 in 521s, `check-gate-qualification`
+  **520/520 killed**, `smoke-entwurf-chain-live` 24 assertions, `smoke-codex-fresh-live` **66
+  assertions** — one more than lane C's 65, because the launch-directory precondition this release
+  adds is asserted before anything launches. Gate env `ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna`,
+  `ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-luna`, `ENTWURF_CODEX_APP_SERVER_PID` naming an
+  operator-started app-server in its own tmux session. Exact-SHA CI at the pre-release commit:
+  run [`35202801617`](https://github.com/junghan0611/entwurf/actions/runs/35202801617)
+  `event=workflow_dispatch` @ `f5d6e10`, all four required jobs success and the `check` job's
+  qualification BODY step success.
+- **The host's Codex hook declaration was measured with the herdr SessionStart group temporarily
+  removed, and that is a debt this release does not pay.** `~/.codex/hooks.json` on `oracle` carries
+  a second SessionStart group installed by herdr, so `doctor-codex-birth` reports the declaration as
+  edited after install and `smoke-codex-fresh-live` cannot run. For this cut the file was moved to
+  `hooks.json.herdr-bak` and re-published by `install-codex-birth`; the vendor's trust receipt for
+  `…/hooks.json:session_start:0:0` survived that re-publication, measured by a real Codex TUI
+  starting with no consent screen. The herdr group is restored after the cut and the doctor goes RED
+  again on purpose. **#117 owns the real repair** — entwurf requires a whole-file digest where the
+  unit it actually owns is one group.
+- **Two gate defects found by the release gate itself, both repaired in test/gate code with zero
+  production bytes.** `check-gate-qualification` scored **518/520** on the first prepared commit and
+  both survivors were launch-directory claims whose assertion could not see the defect its mutant
+  plants. `CODEX-LAUNCH-CWD-ANCESTOR-PLAIN-PATHS-ONLY` guards two predicates — the cwd side and the
+  key side — and every non-plain cell put the encoded character in the KEY, so the key-side filter
+  answered alone and deleting the cwd-side guard changed nothing; cells that vary the CWD against a
+  plain untrusted key now close it. `FRESHCALL-CODEX-LAUNCH-CWD-NOTES-NEVER-REFUSES` asserted the
+  `indexOf("-C")` lookup but not the value read at it, so a note that asked about the REQUESTED cwd
+  instead of codex's own `-C` token passed; the three statements are now pinned contiguously.
+  Neither mutant was stale — each still matched its production line exactly once, which is what made
+  the hole an assertion hole rather than drift.
+- **`smoke-entwurf-chain-live` went red because a model read the operator's policy correctly, and
+  the repair moved the authority rather than the wording.** The native Claude Code hop declined to
+  forward, citing the operator's global AGENTS.md; B, C and D were all born and addressable and the
+  terminus simply received nothing. A first repair put the provenance in the payload and the hop
+  named those sentences as the tell — content that vouches for itself is the shape of an injection,
+  so no sentence inside the payload can settle it. The payload is therefore byte-identical to
+  before, and the fact now rides the disposable world the turn starts in: the gate mints that
+  directory, every `ENTWURF_META_*_DIR` resolves inside it, and it exists because the operator ran
+  `release-gate`, so an `AGENTS.md`/`CLAUDE.md` written there is a standing operator instruction of
+  exactly the kind the operator's own global policy defers to for directory-scoped behaviour. **No
+  negative instruction was added**: a "do not check your policy" line would buy the same green by
+  asking the model to stop reading, and would keep passing after the chain broke. Accepted on the
+  host default model with no model pin.
+
+- **The Codex LIVE card now measures WHERE a sibling starts, and the acceptance is recorded.**
+  `[LIVE 2026-09-16, Codex 0.153.4, 65 assertions, exit 0]` hop 1 requests a cwd and joins four
+  authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor
+  rollout's `session_meta.cwd`, the Entwurf record and the requested scratch; hop 2 requests NEITHER
+  placement NOR cwd, so its directory can only come from the Codex caller's own record. Both are
+  asserted different from the app-server's live `/proc/<pid>/cwd`, which is the failure mode staying
+  visible rather than coincidentally equal. 65 and 56 are different contracts: lane C added the cwd
+  axis on top of lane B's seat axis. Receipts and digests in `DELIVERY.md` / `BASELINE.md`.
+- **Caller-seat LIVE accepted on Linux, 2026-09-16 (Codex 0.153.4): 56 assertions, exit 0.** The
+  operator-owned app-server stayed alone in session A (`$30`/`@41`/`%45`, pid `737636`) while the
+  initial Pi, the omitted-placement Codex it opened, and that Codex's own outbound Pi all landed in a
+  different session S (`$2`: `@46`, `@47`, `@48`). A ≠ S is what makes the run decisive: the
+  app-server's inherited `TMUX` names A, so the pre-#95 environment fallback would have put the
+  outbound Pi there. Its receipt instead records `seat-source=codex-title-anchor`. `DELIVERY.md` owns
+  the coordinates, garden ids and digests, including the 43-assertion run kept as the D1 measurement.
+- **`check-codex-app-server-launch` — 29 assertions, hermetic, plus 9 mutants all killed by
+  their own claim.** A fake vendor on a sandbox PATH under the real name reports the argv, parent
+  and environment it was handed; nothing is asserted by reading the launcher's source.
+  `check-pack-install` proves the INSTALLED verb reaches a vendor at the address the INSTALLED
+  compiled resolver computes — a file-list assertion cannot tell a shipped script from one that
+  resolves its siblings wrongly under `node_modules`.
+- **Independent review caught a false success this gate had certified, and the repair removed the
+  class rather than the instance.** The launcher's first version re-derived the socket path in
+  bash and the gate compared the two spellings over four ASCII-normal inputs they agreed on.
+  `[측정 2026-09-16]` they disagree on `CODEX_HOME=$'\ufeff'` — JS `trim` strips U+FEFF, a POSIX
+  `[:space:]` trim does not, so the managed launch would have started a server at
+  `<BOM>/app-server-control/app-server-control.sock` while delivery looked at `$HOME/.codex` —
+  and on `path.join`'s normalization of a trailing slash or a `..` segment. Widening the matrix
+  would only have added the inputs somebody thought of, so the second spelling was deleted: the
+  launcher asks, the gate's hostile cells (BOM, trailing slash, `..`) keep it asking, and the
+  mutant that used to drop `CODEX_HOME` now re-derives the path in bash instead. The same review
+  found the `/proc` holder assertion over-determined (it accepted the fallback text OR a pid, so
+  deleting the scan passed) and the socket classifier not fail-closed on an unrecognised reading.
+  A second review pass then found that asking one authority for the address does not make the
+  ANSWER safe: the resolver returns `CODEX_HOME` faithfully, so
+  `CODEX_HOME=$'relative\ncontrol-home'` had the launcher create that directory under its caller's
+  cwd and bind a relative socket — a different file for every process that resolves it, while the
+  gate still passed. This launcher is the only Codex surface that CREATES and binds rather than
+  reads, so it now refuses a non-absolute or control-character address before the first write.
+  Every one of those is a discriminating cell with a mutant of its own; the lane is 9.
+- **Two gate defects surfaced on the way and were fixed rather than worked around.** A mutant whose
+  `find` no longer matched had been silently untested since a rename — a stale mutant is a claim
+  nobody is checking, so `check-gate-qualification` scores it red. And the LIVE source-call oracle
+  compared tool arguments with `isDeepStrictEqual`, so a model that omitted the optional `wants_reply`
+  rather than passing it explicitly read as drift; it now normalizes that one key to its schema
+  default. Both are recorded in `VERIFY.md`'s affected-set rules so the inner loop stops missing them.
+
+### Changed
+
+- **`smoke-codex-fresh-live` launches in ONE stable directory instead of a fresh `mkdtemp` per
+  run.** Per-run random scratch made every run an undecided folder — a trust prompt per run, an
+  entry per run in the operator's `~/.codex/config.toml`, and unattended failure whenever nobody was
+  there to answer. The path is now one stable `os.tmpdir()`-rooted directory, answered `Trust`
+  once; the smoke PRINTS it as `launch-cwd <dir>` on every run and asserts that consent by name
+  BEFORE it launches anything, so a missing answer reads as `codex-launch-cwd-undecided` — with the
+  exact `codex -C <dir>` repair command — at the top of the run rather than as a callback timeout
+  twenty assertions later. The directory is printed rather than documented as a literal because
+  `os.tmpdir()` is a host fact: a doc spelling it `$TMPDIR/...` would send an operator with no
+  `TMPDIR` to `/entwurf-codex-fresh-live` in the filesystem root, which is a different directory
+  the vendor consents to separately. Lane C is unaffected: its only requirement of that directory is that it differ
+  from the app-server's own, which the assertion still proves.
+- **The Codex live-spend default comes down to `gpt-5.6-luna`.** The `entwurf-dev` skill's Codex
+  backend default and the `smoke-codex-fresh-live` recommendation in `VERIFY.md` move off
+  `gpt-5.6-sol`. **This is the Codex axis alone** — OMP's fresh default is deliberately unchanged at
+  `openai-codex/gpt-5.6-sol` (`scripts/smoke-omp-fresh-live.ts:14`), because that is the model its
+  two-stage bootstrap callback was actually measured on and moving it would invalidate that
+  receipt. A cost decision, not a gate change: no step moved tier, and the acceptance receipt for
+  the Codex cell must be the run that actually happened on the new default rather than a `sol` run
+  inherited from before.
+
+- **The fixed `codex` tmux home is RETIRED (#95 D1).** 0.21.0 shipped it three days earlier: an
+  omitted-placement Codex TARGET selected an already-existing session named exactly `codex`, where
+  the operator was asked to seat the app-server and every Codex TUI, and the launch receipt labelled
+  that source `Codex home`. GLG retired it the moment the caller-pane anchor stood up — *"무조건
+  은퇴야 … 코덱스의 거처를 만들어주자는 말은 그냥 기술이 안돼서 무마한 개념이야. 제대로 가야지."* The
+  room was a workaround for a mapping that did not exist yet, and keeping it after the anchor landed
+  would have left Codex alone answering "where does a sibling open?" differently from every other
+  backend. `CODEX_HOME_TMUX_SESSION`, the `codex-home` receipt source, its renderer branch, its
+  deterministic cells and its mutant are gone; an omitted seat is the caller's own session for every
+  backend, and the operator seats the app-server wherever they like — Entwurf still never creates,
+  moves or supervises it. The 2026-09-12 home acceptance stays recorded in `DELIVERY.md` and
+  `docs/setup-clean-host.md` as history, not as a live contract. The reshaped LIVE card now REQUIRES
+  the app-server to sit in a different session from the Pi/Codex pair: that separation is what tells
+  the caller-pane anchor apart from the app-server's inherited environment.
+
+### Fixed
+
+- **An in-band refusal now reaches the sender with the reason the RECEIVER gave it
+  (`d49e6cb`, `0c8a42c`).** A completed control-socket RPC that came back `success:false` was
+  finalized as `rejected` with no reason at all, so every named receiver refusal — including the
+  0.21.0 compaction guard's own `compacting` / `busy` — arrived at the caller as a reasonless
+  rejection indistinguishable from "no live route". The send hand now carries that error verbatim
+  when the receiver supplied one, and invents nothing when it did not: receiver evidence is not
+  reclassified into the resolver's taxonomy (`dormant-fire-forget-unsupported`,
+  `mailbox-undeliverable`, …), and the two remain distinguishable at the surface. The gap was one
+  hop wide and entirely invisible to the unit lane — the production `sendOverSocket` closure was
+  what dropped `response.error` before `driveSend` could see it — so the guard that holds it is a
+  production-wiring assertion with its own mutant (`V2PROD-INBAND-ERROR-WIRED`), not another test
+  of the pure function.
+- **A Codex sibling's THREAD now opens where its pane is (#95 lane C).** The seat was right and the
+  directory was not: `[측정 2026-09-16]` a pi → Codex → Claude Code chain recorded the app-server's
+  `~/repos/gh/entwurf` for all three citizens while the panes sat in `~/repos/gh/agent-config`.
+  `[source rust-v0.153.4]` an explicit `--remote <endpoint>` resolves to `AppServerTarget::Remote`
+  (`codex-rs/tui/src/lib.rs:875-876`), and a Remote target takes its new thread's cwd from
+  `remote_cwd_override` alone (`app_server_session.rs:2022-2033`) — absent, the app-server opens the
+  thread in its OWN directory, and the birth hook then records that vendor-supplied cwd honestly.
+  The codex argv now always carries that override as `-C <dir>`, the flag the shared interactive
+  options already expose beside `--dangerously-bypass-approvals-and-sandbox`
+  (`utils/cli/src/shared_options.rs:53-68`), preserved for a remote target at
+  `startup_orchestration.rs:191-194`. **One flag, no vendor patch, no new layer.**
+- **A Codex CALLER that names no cwd opens its sibling in its OWN directory.** This bridge runs as
+  the operator-owned app-server's MCP child, so the directory its process reports is the
+  app-server's rather than the caller's — an omitted `cwd` used to put every sibling of every Codex
+  caller in the app-server's repo, whatever backend was being opened. The surface now hands the
+  composition that citizen's RECORD cwd under the same condition that already carries its thread
+  id, and it is consulted only when the call requested none. One value, two carriers: tmux `-c`
+  places the pane, codex `-C` places the thread. Every other caller's argv is byte-identical, and
+  the receipt names which rule chose the directory (`requested` / the Codex caller's own record
+  directory) instead of calling a caller-record path "requested".
+- **Three named refusals replace a silent wrong seat.** Zero matching panes is
+  `codex-caller-seat-unresolved` (the TUI is on another tmux server, its config carries no
+  `thread-id`, or that server has `allow-set-title off`, which `[측정]` replaces every pane title
+  with the hostname); two or more is `codex-caller-seat-ambiguous`; and a Codex caller whose own
+  `[tui].terminal_title` lacks `thread-id` is refused pre-mutation as `codex-caller-title-missing`
+  with the installer as its repair. None of them falls back to another session, and none opens a
+  window. That caller-side check runs only when the anchor is actually consulted — an explicit
+  seat never reads a title.
+- **A pane title is a placement input and nothing else (Hard Rule 16).** Any process in any pane
+  can emit the same OSC string, so the leaf's answer may only reach a `-t` target; identity,
+  delivery and liveness keep the record + `_meta` join they already had, and the first-turn
+  framing still carries the caller's garden id rather than the thread id a title matched. The leaf
+  (`pi-extensions/lib/codex-caller-seat.ts`) imports nothing at all, which is how that boundary is
+  held by the code rather than by a comment.
+- **The title match is over tokens, not ` | ` segments, and the count is over panes.**
+  `title_setup.rs:183-193` joins the `activity` item to its neighbour with a plain space rather
+  than ` | `, so on a host whose operator list ends in `activity` a working TUI renders
+  `<spinner> <thread-id>` inside one segment and a segment-equality rule would lose the seat
+  exactly while the caller is busy. Counting panes rather than tokens keeps a single pane that
+  shows the same thread twice (`thread-title` beside `thread-id`) from reading as an ambiguity.
+
 ## 0.21.0 - 2026-09-13
 
 ### Added