@junghanacs/entwurf 0.21.0 → 0.23.0

package/pi-extensions/lib/mux-fresh-call.ts

@@ -1,8 +1,9 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller. Codex is the one measured topology
- * exception: an omitted seat selects the existing `codex` home session (#95), never a TUI guess.
+ * the launch argv, and let it name itself back to the caller. A Codex CALLER is the one measured
+ * exception to "the caller's own session": it opens beside its own TUI pane, found by that
+ * pane's terminal title (#95 lane B), never by a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -39,6 +40,14 @@
  *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
  *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
  *     only cwd authority this module knows.
+ *   - when a CODEX caller omits it, the surface supplies that citizen's own record cwd and it
+ *     becomes an explicit `-c` (#95 lane C). This is not a second authority: it is the same
+ *     caller, named more precisely, because a codex caller's PROCESS directory is the
+ *     operator-owned app-server's rather than its own. Every other caller keeps the inherited
+ *     directory and an unchanged argv.
+ *   - the chosen value reaches codex TWICE, and that is one value with two carriers rather than
+ *     two inputs: tmux `-c` places the pane, and codex `-C` places the THREAD, which a
+ *     `--remote` attachment would otherwise take from the app-server (see `buildBackendArgs`).
  *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
  *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
  *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
@@ -77,14 +86,42 @@
  *     there is no "session created" field because nothing here creates one.
  */
 
-import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
-import { CODEX_PREFLIGHT_HINT, type CodexPreflightRejectReason } from "./codex-fresh-preflight.ts";
+import {
+	CODEX_CALLER_SEAT_HINT,
+	type CodexCallerSeatRejectReason,
+	resolveCodexCallerSeat,
+} from "./codex-caller-seat.ts";
+import {
+	CODEX_CALLER_PREFLIGHT_HINT,
+	CODEX_LAUNCH_CWD_PREFLIGHT_HINT,
+	CODEX_PREFLIGHT_HINT,
+	type CodexCallerPreflightRejectReason,
+	type CodexPreflightRejectReason,
+	codexLaunchCwdFreshPreflight,
+} from "./codex-fresh-preflight.ts";
 import {
 	COPILOT_PREFLIGHT_HINT,
 	type CopilotPreflightRejectReason,
 	copilotFreshPreflight,
 } from "./copilot-fresh-preflight.ts";
+import {
+	buildOmpBootstrapPayload,
+	composeBackendArgs,
+	composeFreshCallPrompt,
+	FRESH_CALL_BACKENDS,
+	FRESH_CALL_CALLBACK_TOOL,
+	type FreshCallBackend,
+	type FreshCallComposition,
+	type FreshCallInputRejectReason,
+	isSafeFreshCallModel,
+	MODEL_MAX_CHARS,
+	mintNonce,
+	normalizeFreshCallInputs,
+	OMP_BOOTSTRAP_FLAG,
+	OMP_BOOTSTRAP_VERSION,
+	TASK_MAX_CHARS,
+} from "./fresh-call-composition.ts";
 import {
 	assertLaunchTarget,
 	LaunchPreconditionError,
@@ -106,13 +143,69 @@ import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.ts"
 import { OMP_PREFLIGHT_HINT, type OmpPreflightRejectReason, ompFreshPreflight } from "./omp-fresh-preflight.ts";
 import { classifyTmuxSessionName, resolveTmuxSessionId, type TmuxSessionRejectReason } from "./resolve-tmux-session.ts";
 
-/** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
- * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
- * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"] as const;
-export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
+/**
+ * THE COMPOSITION MOVED, THE RAIL DID NOT (#116 S2-a). Backend argv, the first-turn framing and
+ * the nonce now live in `fresh-call-composition.ts`, which knows nothing about tmux, so the herdr
+ * rail can reach them without importing this file and dragging placement behind it. They are
+ * re-exported here unchanged: every existing caller, gate and mutant anchor that reads them from
+ * this module keeps reading the same names.
+ *
+ * The two wrappers below are where this rail states what only it can state — the sentence that
+ * says a sibling was opened in the operator's tmux session, and the Codex socket path. Both are
+ * arguments to the leaf rather than knowledge inside it.
+ */
+export {
+	buildOmpBootstrapPayload,
+	FRESH_CALL_BACKENDS,
+	FRESH_CALL_CALLBACK_TOOL,
+	type FreshCallBackend,
+	type FreshCallComposition,
+	isSafeFreshCallModel,
+	MODEL_MAX_CHARS,
+	mintNonce,
+	OMP_BOOTSTRAP_FLAG,
+	OMP_BOOTSTRAP_VERSION,
+	TASK_MAX_CHARS,
+};
+
+/** What the tmux rail tells a sibling about where it woke up. The resume verb has no equivalent
+ * because it composes no first turn at all; a herdr rail will pass its own sentence here. */
+export const TMUX_FRESH_CALL_OPENING_LINE =
+	"You are a fresh visible citizen that entwurf opened in the operator's tmux session.";
+
+/** Backend argv for THIS rail: the neutral dialect, with the two Codex facts only a rail can
+ * state — the socket resolved from the caller's env, and the directory this launch chose.
+ *
+ * `launchCwd` defaults to THIS process's own directory, which is what tmux gives a window opened
+ * with no `-c` (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+ * convenience, so a caller that omits it still names the truth to codex. Both facts reach the
+ * leaf lazily, because a host with no Codex home must still be able to open pi and claude
+ * siblings — see `composeBackendArgs`. */
+export function buildBackendArgs(
+	backend: FreshCallBackend,
+	composition: FreshCallComposition,
+	model: string,
+	env: NodeJS.ProcessEnv = process.env,
+	launchCwd: string = process.cwd(),
+): string[] {
+	return composeBackendArgs(
+		backend,
+		composition,
+		model,
+		() => resolveCodexDefaultSocketPath(env),
+		() => launchCwd,
+	);
+}
+
+/** The first turn for THIS rail: the neutral framing under this rail's placement sentence. */
+export function buildFreshCallPrompt(params: {
+	backend: FreshCallBackend;
+	task: string;
+	callerGardenId: string;
+	nonce: string;
+}): string {
+	return composeFreshCallPrompt({ ...params, openingLine: TMUX_FRESH_CALL_OPENING_LINE });
+}
 
 /**
  * The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
@@ -144,246 +237,11 @@ export const FRESH_CALL_RUNTIME: Record<FreshCallBackend, string> = {
 	codex: "codex",
 };
 
-/**
- * The callback tool NAME differs per backend and that is not cosmetic: native pi exposes the
- * capability directly (`entwurf_v2`), while an MCP-hosted session reaches it under whatever
- * name that harness composes. Naming the wrong one costs the whole first turn.
- *
- * `[측정]` Copilot CLI 1.0.80 composes `<mcpServerName>-<mcpToolName>` — NOT Claude Code's
- * `mcp__<server>__<tool>`. Read from two independent sessions' own event logs
- * (`~/.copilot/session-state/<id>/events.jsonl`): `assistant.message.toolRequests[].name` and
- * `tool.execution_start.toolName` both carry `entwurf-bridge-entwurf_v2`, with
- * `mcpServerName`/`mcpToolName` beside them as the parts. Derive-and-measure, never copy a
- * sibling's spelling (`docs/adding-a-harness.md` step 5).
- *
- * `[측정]` omp 18.0.0 is the sharpest case for that rule: it mints
- * `mcp__${sanitizedServerName}_${normalizedToolName}` with a sanitizer whose charset is
- * `[a-z_]` (`mcp/tool-bridge.ts:351-357`, `:396`), so the DIGIT IN `entwurf_v2` IS EATEN and the
- * hyphen in the server key becomes an underscore — the model-facing name is
- * `mcp__entwurf_bridge_entwurf_v`, not `..._entwurf_v2` and not Claude's double-underscore form.
- * Confirmed against a live tool dump of all seven bridge tools and a real session transcript
- * (`scripts/raw-omp-measure/README.md` "Tool-name dialect"). Unlike Copilot there is no second
- * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
- */
-export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
-	pi: "entwurf_v2",
-	"claude-code": "mcp__entwurf-bridge__entwurf_v2",
-	copilot: "entwurf-bridge-entwurf_v2",
-	omp: "mcp__entwurf_bridge_entwurf_v",
-	codex: "mcp__entwurf_bridge__entwurf_v2",
-};
-
-/** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
- * delivery surface, not a claim that a task of this size was measured through tmux. An argv
- * that the OS refuses is a launch failure and fails loud — it never reads as a delivered task. */
-export const TASK_MAX_CHARS = 16000;
-export const MODEL_MAX_CHARS = 200;
-const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/:[\]-]*$/;
-
-/** A model is an explicit launch input, not ambient process state. The grammar admits canonical
- * pi provider/model ids, Claude model ids/aliases, and bracketed context variants, while refusing
- * whitespace and tmux control syntax. It is passed without a shell using each runtime's measured
- * CLI dialect: Pi takes `--model`, value; Claude Code takes `--model=value`. */
-export function isSafeFreshCallModel(model: string): boolean {
-	return model.length > 0 && model.length <= MODEL_MAX_CHARS && MODEL_PATTERN.test(model);
-}
-
-/**
- * Backend argv AFTER the runtime path. Both orders are MEASURED, and both were measured by
- * getting them wrong first (rail §6-a):
- *
- *   pi          — prompt BEFORE `--entwurf-control`, then `--model`, value as TWO tokens.
- *                 Flag-first submitted no message; Pi rejects the equals form for `--model`.
- *   claude-code — prompt, then `--allowedTools=` and `--model=` as ONE token each. The space form
- *                 for allowedTools is variadic and eats the prompt as an option value.
- *   copilot     — the managed VERB first, then the prompt as the value of `-i/--interactive`,
- *                 `--model`, value as two tokens, and the policy as the explicit `--yolo`
- *                 token. Measured from `copilot --help` (1.0.80).
- *   omp         — NO positional prompt at all. The task rides `--entwurf-bootstrap`, a fixed
- *                 flag the installed birth extension registers, then `--model`, value as two
- *                 tokens, then the policy as `--approval-mode`, `yolo`. `-p/--print` remains
- *                 the flag this argv must never carry — it processes a prompt and EXITS,
- *                 closing the window on a sibling that has to stay open to be delivered to.
- *
- * Both pi/claude failures looked identical from outside: window open, record and socket minted,
- * no turn.
- *
- * For pi and claude-code the equals form is NOT a permission guarantee — on the measured host
- * the tool was already permitted, so the option's effect was unobservable. What was observed is
- * that it does no harm to the argv. Permission stays a documented host precondition there.
- *
- * Copilot is the backend where the policy IS carried explicitly (step 9 clause 2), and three of
- * its argv facts are load-bearing:
- *
- *   - `copilot` is argv[0] of the RUNTIME `entwurf`, i.e. the managed verb — see
- *     `FRESH_CALL_RUNTIME`. Everything after it is forwarded byte-identical by
- *     `scripts/copilot-launch.sh`.
- *   - the prompt rides `--interactive`, never `-p/--prompt`: `-p` runs the prompt and EXITS,
- *     which would close the window on a sibling that is supposed to stay open and be delivered
- *     to. `--interactive <prompt>` is non-variadic, so the space form is safe here.
- *   - the policy token is `--yolo`, STATED HERE rather than left to the launcher: the launcher
- *     injects `--yolo` only when the argv names no policy, and step 9 clause 2 requires the
- *     fresh composition to state its model and permission policy explicitly, never to rely
- *     invisibly on someone else's default.
- *
- * `--yolo` is a GLG operator decision, not a drifted default. The first cut passed a
- * callback-only `--allow-tool=entwurf-bridge(entwurf_v2)` grant, and GLG's 2026-08-25 operator
- * LIVE measured the consequence: the fresh sibling's footer showed no `YOLO`, and every tool
- * its task needed stopped on a confirmation prompt, which made the sibling impractical to work
- * with. GLG then set the policy explicitly: a fresh Copilot sibling carries the same managed
- * `--yolo` profile a human-typed `entwurf copilot` gets. (Copilot 1.0.80 help: `--yolo` = all
- * tools + all paths + all URLs.) The permission GRAMMAR lesson from that first cut — Copilot's
- * `--allow-tool` takes `<mcp-server-name>(tool-name?)`, a different dialect from the
- * model-facing tool name — stays recorded in `docs/adding-a-harness.md` step 9's worked
- * example; it is a measured vendor fact even though this argv no longer uses it.
- *
- * OMP'S POLICY TOKEN IS THE ONE MOST EASILY ARGUED AWAY, SO READ THIS BEFORE DELETING IT.
- * `[측정]` omp 18.0.0's schema default for `tools.approvalMode` IS ALREADY `yolo`
- * (vendor doc `omp://approval-mode.md`; `omp config get tools.approvalMode` → `yolo` on the
- * acceptance host). So dropping `--approval-mode yolo` changes NOTHING observable: the callback
- * still fires, the LIVE smoke still passes, and the argv silently starts depending on a vendor
- * default and on whatever the operator's config happens to say. That is exactly the drift step 9
- * clause 2 forbids — "carry the chosen width as an explicit argv token rather than relying on a
- * launcher's injected default" — and the reason the width is stated here even though the host
- * would have granted it anyway. The width itself (task-wide, not callback-only) is a GLG
- * operator decision of 2026-08-30, taken with the Copilot measurement in hand: a callback-only
- * sibling names itself and then stops at the first tool its TASK needs. omp offers no argv
- * grammar for a narrower grant at all — `tools.approval.<tool>` is a config axis, not a flag —
- * so the honest choice was between `write` and `yolo`, and `yolo` matches what a human-typed
- * `omp` gets on this host. `--approval-mode` takes both the space and equals form (measured);
- * the space form is used for symmetry with `--model`.
- *
- * WHY OMP ALONE CARRIES NO PROMPT, AND WHY THAT IS A MEASUREMENT RATHER THAN A PREFERENCE.
- * `[LIVE 2026-08-30]` the first public fresh call at omp DID pass the full framing as a bare
- * positional. The window opened, the record minted (garden `20260830T181342-452167`), the
- * prompt arrived byte-identical as a user message at `09:13:42.413Z` — and the model answered
- * the literal text `ACK` with ZERO tool calls, because the callback tool did not exist yet.
- * `[source]` the interactive UI defers MCP discovery and only refreshes the tool list once
- * `discoverAndConnect()` settles (`sdk.ts:1847-1855`, `:1881-1905`), while the positional
- * `initialMessage` prompts immediately after `await mode.init()` (`main.ts:540-565`,
- * `595-610`). `[측정]` a `/tmp` observer on the same runtime: `turn_start` at +654ms with the
- * entwurf tools ABSENT, callback tool present only at +1484ms — the turn began ~830ms before
- * the tool it was told to call existed. No argv can close that gap, because the gap is a race
- * inside the host. So the composition hands omp a PAYLOAD instead of a turn, and the
- * in-process birth extension — which can see when the tool becomes callable — owns the first
- * two messages (`pi-extensions/meta-bridge-omp.ts`, "THE TWO-STAGE FRESH BOOTSTRAP").
- *
- * The flag is fixed and one-purpose ON PURPOSE. `[측정 2026-08-30]` a normal discovered
- * extension that registers a flag receives the operator's argv value byte-identical — quotes,
- * `$VAR`, backticks and a semicolon all survived a 137-byte JSON payload — because extensions
- * load before argv classification and the reparse writes the registered map
- * (`main.ts:1799-1810`, `cli/extension-flags.ts:36-43`). An env carrier or a temp file would
- * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
- * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
- * carrier would hand callers the launch-shaping power this rail exists to refuse.
- */
-export function buildBackendArgs(
-	backend: FreshCallBackend,
-	composition: FreshCallComposition,
-	model: string,
-	env: NodeJS.ProcessEnv = process.env,
-): string[] {
-	switch (backend) {
-		case "pi":
-			return [composition.prompt, "--entwurf-control", "--model", model];
-		case "claude-code":
-			return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
-		case "copilot":
-			return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
-		case "omp":
-			return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
-		case "codex":
-			return [
-				"--remote",
-				`unix://${resolveCodexDefaultSocketPath(env)}`,
-				"--model",
-				model,
-				"--dangerously-bypass-approvals-and-sandbox",
-				composition.prompt,
-			];
-	}
-}
-
-/**
- * What a launch has to say, in the two shapes the five backends need. Four of them are
- * handed a first-turn PROMPT; omp is handed a bootstrap PAYLOAD its own installed extension
- * unpacks. Both are always built, because building one is cheap and a backend switch must
- * never be able to reach a field that was not composed.
- */
-export interface FreshCallComposition {
-	prompt: string;
-	bootstrapPayload: string;
-}
-
-/**
- * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
- * name (`extensions/loader.ts:221-228`) and this composition adds the `--` itself.
- *
- * Held equal to the installed extension's own constant by
- * `test/omp-fresh-bootstrap.contract.test.ts`. The two copies exist because the extension
- * ships INSIDE the omp agent dir carrying only its own small closure and cannot import this
- * module; the gate is what keeps the duplication from becoming drift.
- */
-export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
-
-/** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
- * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
-
-/**
- * The whole of what a fresh omp sibling is launched with.
- *
- * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
- * contract: who to call back, the nonce that proves it is this call, and the task that is
- * released only after that callback succeeds. There is no command here, no path, no env name
- * and no model — the model is already an explicit argv token, and a second copy of it inside
- * a payload would be a second place for it to disagree with the launch.
- */
-export function buildOmpBootstrapPayload(params: { callerGardenId: string; nonce: string; task: string }): string {
-	return JSON.stringify({
-		v: OMP_BOOTSTRAP_VERSION,
-		target: params.callerGardenId,
-		nonce: params.nonce,
-		task: params.task,
-	});
-}
-
-/**
- * The first-turn framing. Order is the contract: the callback is the FIRST action and the task
- * follows it, so a sibling that gets stuck in the task has already told the caller who it is.
- *
- * The three prohibitions are not politeness. Each names a detour that was measured to produce a
- * confidently wrong answer or a wasted turn.
- */
-export function buildFreshCallPrompt(params: {
-	backend: FreshCallBackend;
-	task: string;
-	callerGardenId: string;
-	nonce: string;
-}): string {
-	const tool = FRESH_CALL_CALLBACK_TOOL[params.backend];
-	return [
-		"You are a fresh visible citizen that entwurf opened in the operator's tmux session.",
-		"",
-		`FIRST ACTION, before reading files or anything else: call ${tool} with ` +
-			`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
-			`message set to exactly ${params.nonce} — that string alone, nothing added.`,
-		"That call is how the agent that opened you learns your address. Do not skip it, do not",
-		"defer it until the task is done, and do not reword the message.",
-		"",
-		"Do not inspect environment variables, do not call entwurf_self, and do not start an MCP",
-		"server yourself. Your own report of your identity is not the address anyone needs.",
-		"",
-		"After the tool receipt, carry out this task:",
-		"",
-		params.task,
-	].join("\n");
-}
-
 /** A launch that was refused, or a placement that could not be established. Every value is a
  * NAMED refusal — this module has no fallback launch and no fallback directory. The cwd members
  * come from the shared classification leaf and their string values are stable contract. */
 export type FreshCallRejectReason =
+	| FreshCallInputRejectReason
 	| PlacementRejectReason
 	| LaunchRejectReason
 	| TmuxCwdRejectReason
@@ -391,6 +249,8 @@ export type FreshCallRejectReason =
 	| CopilotPreflightRejectReason
 	| OmpPreflightRejectReason
 	| CodexPreflightRejectReason
+	| CodexCallerPreflightRejectReason
+	| CodexCallerSeatRejectReason
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -405,25 +265,41 @@ export interface FreshCallPlacement {
 	tmuxSession: string;
 }
 
-/**
- * Codex's explicit home topology (#95): the operator provides this one existing tmux session
- * and seats the operator-owned app-server plus supported Codex TUIs there. This is a placement
- * convention, not an address axis — `threadId` remains the native delivery address.
+/** Which rule chose the start directory. Mirrors `FreshCallSeatSource` deliberately: one axis,
+ * one NAMED source, and no third value that means "we worked it out". `codex-caller-record` is
+ * the codex caller's own record cwd, consulted only when the caller requested none (#95 lane C).
  */
-export const CODEX_HOME_TMUX_SESSION = "codex" as const;
-export type FreshCallSeatSource = "requested" | "codex-home";
+export type FreshCallCwdSource = "requested" | "codex-caller-record";
+
+export type FreshCallSeatSource = "requested" | "codex-title-anchor";
 export interface FreshCallSeat {
 	tmuxSession: string;
 	source: FreshCallSeatSource;
 }
 
-/** An explicit seat always wins. Only omitted Codex placement gets the fixed home. */
-export function selectFreshCallSeat(
-	backend: FreshCallBackend,
-	placement: FreshCallPlacement | undefined,
-): FreshCallSeat | null {
+/**
+ * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
+ *
+ *   1. an explicit `placement` — the expert override, and it wins over everything below.
+ *   2. a CODEX CALLER with placement omitted — the sibling opens beside the caller's own TUI
+ *      pane, found by the title anchor (#95 lane B). This one is NOT a named seat and is
+ *      therefore not decided here: it resolves to a native `$id` with no name in between, so
+ *      `freshCall` owns it directly (see the anchor step below) and this function answers
+ *      `null` so the name grammar and the name→id lookup stay out of a path that has neither.
+ *   3. anything else — the caller's own session, with no named seat at all.
+ *
+ * THE SEAT FOLLOWS THE CALLER, NEVER THE BACKEND BEING OPENED. #95 first shipped a fourth rule —
+ * an omitted-placement Codex TARGET selected a fixed existing session named `codex`, where the
+ * operator seated the app-server and their TUIs — and #95 D1 retired it (GLG, 2026-09-16). It
+ * was a workaround for a mapping that did not exist yet: nothing could find the pane a Codex
+ * caller was sitting in, so the operator was asked to keep every Codex in one known room. Rule 2
+ * is that mapping, so the room is no longer load-bearing, and keeping it would have meant Codex
+ * alone answering "where does a sibling open?" differently from every other backend. The
+ * operator-owned app-server keeps its own seat wherever the operator puts it; Entwurf still
+ * never creates, moves or supervises it.
+ */
+export function selectFreshCallSeat(placement: FreshCallPlacement | undefined): FreshCallSeat | null {
 	if (placement !== undefined) return { tmuxSession: placement.tmuxSession, source: "requested" };
-	if (backend === "codex") return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: "codex-home" };
 	return null;
 }
 
@@ -433,14 +309,21 @@ export function selectFreshCallSeat(
 export interface FreshCallReceipt extends WindowHandle {
 	backend: FreshCallBackend;
 	model: string;
-	/** The REQUESTED start directory — present only when the caller supplied one. The same kind
-	 * of fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
-	 * landed. */
+	/** The start directory this launch CHOSE — present only when one was chosen: the caller's
+	 * requested cwd, or a codex caller's own record cwd when it requested none. The same kind of
+	 * fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
+	 * landed. ABSENT means no directory was named at all and the pane inherits this process's —
+	 * that inheritance is not invented into a receipt field here. */
 	cwd?: string;
-	/** The selected session name — either caller-requested or Codex's fixed home. The RESOLVED
-	 * target is the inherited `sessionId`, which is the session the window is actually in. */
+	/** Which rule chose `cwd`. Present exactly when `cwd` is. */
+	cwdSource?: FreshCallCwdSource;
+	/** The caller-REQUESTED session name. The RESOLVED target is the inherited `sessionId`, which
+	 * is the session the window is actually in. Absent for `codex-title-anchor`, which has no
+	 * name to echo: a caller's own pane was OBSERVED, not requested by name, and inventing one
+	 * here would report a seat the caller never named. */
 	tmuxSession?: string;
-	/** Why `tmuxSession` was selected. Absent exactly when no named seat was used. */
+	/** Which rule selected the target session. Absent exactly when the caller's own session was
+	 * used with no seat rule at all. */
 	tmuxSessionSource?: FreshCallSeatSource;
 	runtimePath: string;
 	nonce: string;
@@ -448,16 +331,6 @@ export interface FreshCallReceipt extends WindowHandle {
 
 export type FreshCallResult = { ok: true; receipt: FreshCallReceipt } | { ok: false; reason: FreshCallRejectReason };
 
-/** Correlation tag only. Random, never derived from time, cwd or a peer listing — a nonce that
- * encoded any of those would invite exactly the guessing this rail exists to refuse. */
-export function mintNonce(randomHex: () => string = defaultRandomHex): string {
-	return `mux-fresh-call-${randomHex()}`;
-}
-
-function defaultRandomHex(): string {
-	return randomBytes(12).toString("hex");
-}
-
 /**
  * The pi identity carrier, scrubbed at the launch seam for EVERY backend (#87 Bundle C).
  *
@@ -531,6 +404,20 @@ export function buildFreshCallArgs(
  * `callerGardenId` is supplied by the SURFACE that registered this tool, from its own
  * record-backed context. It is not a tool parameter and this module never derives, validates
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
+ *
+ * `callerNativeSessionId` is supplied by the same surface under the same rule, and its PRESENCE
+ * is the whole signal: it is set exactly when the reconciled sender is a record-backed codex
+ * citizen, and it carries that citizen's `nativeSessionId` (the `_meta.threadId` the vendor put
+ * on this very request). This module never resolves it, never reads `_meta`, and never asks a
+ * store who is calling — it only turns a thread id into a pane, and only for placement.
+ *
+ * `callerCwd` rides the same surface rule and the same condition: it is that codex citizen's
+ * RECORD cwd, and it exists because a codex caller's process directory is NOT its own (the
+ * bridge runs as a child of the operator-owned app-server, so the directory that process
+ * reports is the app-server's — #95 lane C §2). It is consulted only when the caller requested
+ * no cwd, so an
+ * explicit request always wins, and this module never looks a cwd up, resolves it, or infers it
+ * from a seat, a workspace map or a project name.
  */
 export function freshCall(
 	params: {
@@ -540,23 +427,38 @@ export function freshCall(
 		cwd?: string;
 		placement?: FreshCallPlacement;
 		callerGardenId: string | null;
+		callerNativeSessionId?: string;
+		callerCwd?: string;
 	},
 	env: NodeJS.ProcessEnv = process.env,
 	nonce: string = mintNonce(),
 ): FreshCallResult {
-	if (typeof params.callerGardenId !== "string" || params.callerGardenId.length === 0) {
-		return { ok: false, reason: "caller-identity-unavailable" };
-	}
-	const model = params.model.trim();
-	if (model.length === 0) return { ok: false, reason: "model-empty" };
-	if (!isSafeFreshCallModel(model)) return { ok: false, reason: "model-invalid" };
-	const task = params.task.trim();
-	if (task.length === 0) return { ok: false, reason: "task-empty" };
-	if (task.length > TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
-	// ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
-	// value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-	// classification below instead of being silently repaired into a different directory.
-	const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	// The caller-facing input contract lives in the composition leaf so BOTH rails answer a
+	// mistyped model or an oversized task with the same words. Order, trimming and the
+	// cwd-omission rule (`undefined` and the exact empty string, and nothing else, mean "no
+	// cwd") are unchanged from when they lived here.
+	const normalized = normalizeFreshCallInputs(params);
+	if (!normalized.ok) return { ok: false, reason: normalized.reason };
+	const { callerGardenId, model, task, cwd: requestedCwd } = normalized.inputs;
+	// The caller's own record directory answers the SAME two-value emptiness rule the leaf
+	// applies to a requested cwd, and is consulted ONLY second: an explicit request always wins,
+	// and a caller that supplies neither leaves the pane to inherit this process's directory
+	// exactly as before — a pi caller's argv is byte-identical, because its process directory IS
+	// its own and a `-c` token would change nothing about where that window lands.
+	const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
+	const chosenCwd: { value: string; source: FreshCallCwdSource } | undefined =
+		requestedCwd !== undefined
+			? { value: requestedCwd, source: "requested" }
+			: callerCwd !== undefined
+				? { value: callerCwd, source: "codex-caller-record" }
+				: undefined;
+	const cwd = chosenCwd?.value;
+	// SEAM (#95 lane C): a caller-record directory is classified by the SAME shared leaf and
+	// answers the same four `cwd-*` reasons, whose hint text says REQUESTED. When a codex
+	// caller's recorded directory has since been deleted, the repair that hint points at is
+	// still the right one — that directory does not exist — but the noun belongs to the caller
+	// rather than to the request. Kept shared on purpose: doubling the reason set for a wording
+	// difference would double the refusal contract two surfaces and one leaf already agree on.
 	if (cwd !== undefined) {
 		const badCwd = classifyTmuxCwd(cwd);
 		if (badCwd) return { ok: false, reason: badCwd };
@@ -565,9 +467,10 @@ export function freshCall(
 	// without tmux, so an unresolvable name is answered before anything else runs. Whether that
 	// session EXISTS is a tmux question and is asked below, after the caller's own context is
 	// proven — a name check that needed a live server would refuse for the wrong reason on a
-	// host with no tmux at all. Codex alone selects its fixed home when the caller omitted a seat;
-	// an explicit seat remains an expert override and is reported as such.
-	const selectedSeat = selectFreshCallSeat(params.backend, params.placement);
+	// host with no tmux at all. An explicit seat is an expert override and is reported as such; a
+	// CODEX CALLER's own pane is deliberately not a name at all, so it is absent here and
+	// resolved after the context proof below — see `selectFreshCallSeat` for the three-rule order.
+	const selectedSeat = selectFreshCallSeat(params.placement);
 	const seat = selectedSeat?.tmuxSession;
 	if (seat !== undefined) {
 		const badSeat = classifyTmuxSessionName(seat);
@@ -606,25 +509,67 @@ export function freshCall(
 	// native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
 	// absent seat refuses with no window anywhere.
 	let targetSessionId = placement.sessionId;
+	let anchoredSeat = false;
 	if (seat !== undefined) {
 		const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
 		if (!resolved.ok) return { ok: false, reason: resolved.reason };
 		targetSessionId = resolved.sessionId;
+	} else if (params.placement === undefined && params.callerNativeSessionId !== undefined) {
+		// Rule 2: the caller is a codex citizen and named no seat, so the sibling belongs beside
+		// the caller's own TUI. The pane is found by the title anchor and ONLY its `$session`
+		// continues — a pane title is forgeable, so it may never become an address, a liveness
+		// claim or a delivery input (Hard Rule 16). `params.placement` is re-read here rather
+		// than inferred from `seat === undefined`: "an explicit seat always wins" is the one
+		// invariant a later edit must not be able to lose by accident.
+		// STILL PRE-MUTATION: 0 or 2+ matching panes refuse with no window anywhere and no
+		// fallback to any other session.
+		const anchor = resolveCodexCallerSeat(params.callerNativeSessionId, (args) => runTmux(args, env));
+		if (!anchor.ok) return { ok: false, reason: anchor.reason };
+		targetSessionId = anchor.seat.sessionId;
+		anchoredSeat = true;
 	}
 
 	const composition: FreshCallComposition = {
 		prompt: buildFreshCallPrompt({
 			backend: params.backend,
 			task,
-			callerGardenId: params.callerGardenId,
+			callerGardenId,
 			nonce,
 		}),
-		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
+		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId, nonce, task }),
 	};
-	const run = runTmux(
-		buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model, env), cwd),
-		env,
-	);
+	const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
+	// THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a
+	// Codex sibling opened into a directory this Codex has no answer for stops on the vendor's
+	// folder-consent screen: no first turn, no rollout, no callback. It is tempting to refuse
+	// that, and refusing is the wrong product. The consent screen is SELF-REPAIRING when a human
+	// is there — one answer and the vendor records the directory, so every later launch runs —
+	// and an operator at the keyboard is exactly who a visible-first rail is built for. A refusal
+	// would replace that one answer with "no window, go run codex yourself, then call again", and
+	// it would have to be right about a decision this process cannot fully see (the vendor merges
+	// system, managed and cloud layers around the file this leaf reads). So the launch proceeds
+	// and says what it saw.
+	//
+	// The UNATTENDED case is not answered here and must not be: a gate with nobody at the keyboard
+	// needs its precondition named before it spends a model turn, which is its own oracle's job —
+	// `smoke-codex-fresh-live` asserts this same leaf up front, so a missing answer reads as a
+	// named precondition instead of a callback timeout.
+	//
+	// The directory asked about is READ BACK off codex's own `-C` token rather than recomputed:
+	// one resolution, one authority, and no way for the note to name a directory the thread will
+	// not start in (this module is deliberately not allowed to resolve the inherited default a
+	// second time — `FRESHCALL-CWD-CALLER-ONLY`).
+	if (params.backend === "codex") {
+		const at = backendArgs.indexOf("-C");
+		const launchCwd = backendArgs[at + 1] ?? "";
+		const unanswered = codexLaunchCwdFreshPreflight(env, launchCwd);
+		if (unanswered) {
+			console.error(
+				`[fresh-call] ${unanswered}: ${launchCwd}\n` + `            ${CODEX_LAUNCH_CWD_PREFLIGHT_HINT[unanswered]}`,
+			);
+		}
+	}
+	const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
 	assertTmuxOk("new-window", run);
 
 	let fields: ReturnType<typeof parseWindowFields>;
@@ -649,9 +594,11 @@ export function freshCall(
 			...fields,
 			backend: params.backend,
 			model,
-			...(cwd === undefined ? {} : { cwd }),
+			...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),
 			...(selectedSeat === null
-				? {}
+				? anchoredSeat
+					? { tmuxSessionSource: "codex-title-anchor" as const }
+					: {}
 				: { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
 			runtimePath,
 			nonce,
@@ -667,6 +614,8 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	...COPILOT_PREFLIGHT_HINT,
 	...OMP_PREFLIGHT_HINT,
 	...CODEX_PREFLIGHT_HINT,
+	...CODEX_CALLER_PREFLIGHT_HINT,
+	...CODEX_CALLER_SEAT_HINT,
 	"no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
 	"anchor-malformed": "TMUX_PANE is not a native pane id",
 	"anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -683,7 +632,7 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	"tmux-session-name-invalid":
 		"the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
 	"tmux-session-missing":
-		"no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again; Codex's omitted-placement home is the exact session name 'codex'",
+		"no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
 	"model-empty": "model is empty after trimming; fresh calls require an explicit model",
 	"model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
 	"task-empty": "task is empty after trimming",
@@ -718,11 +667,15 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`[entwurf fresh call →]\n` +
 			`  backend:  ${r.backend} (${r.runtimePath})\n` +
 			`  model:    ${r.model} (requested on the runtime CLI)\n` +
-			(r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
-			(r.tmuxSession === undefined
+			(r.cwd === undefined
+				? ""
+				: r.cwdSource === "codex-caller-record"
+					? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\n`
+					: `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+			(r.tmuxSessionSource === undefined
 				? ""
-				: r.tmuxSessionSource === "codex-home"
-					? `  seat:     ${r.tmuxSession} (Codex home tmux session, resolved to ${r.sessionId})\n`
+				: r.tmuxSessionSource === "codex-title-anchor"
+					? `  seat:     ${r.sessionId} (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session, not a requested name)\n`
 					: `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
 			`  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
 			`  pane:     ${r.paneId} pid ${r.panePid}\n` +