@junghanacs/entwurf 0.21.0 → 0.23.0

package/DELIVERY.md

@@ -88,7 +88,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
-| **Codex CLI app-server citizen** | supported in 0.21.0; explicit-home acceptance green on Linux at 0.153.4 | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The supported visible topology is one operator-owned existing tmux session named `codex`: the app-server and supported Codex TUIs sit there, omitted Codex fresh placement selects it, and Codex-opened Pi stays beside its caller. Missing home rejects; Entwurf creates/supervises none of it. Exact 0.153.4 source bounds unrestricted attached-TUI placement as unsupported, not as a blocker to this explicit topology. |
+| **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |
 | **Codex embedded TUI** | deferred | D0 partial | At the 2026-09-08 Codex 0.153.4 measurement, standalone mode had no `watchPaths`/`FileChanged`/`asyncRewake` analogue or supported idle receive route. This is dated vendor evidence, not a claim that the current candidate lacks records or fresh. |
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
@@ -152,26 +152,66 @@ operator starts app-server in existing exact tmux session `codex`
 The standalone embedded TUI remains outside this rail: the 2026-09-08 measurement
 found no idle receive route equivalent to the app-server. `turn/steer` is active-turn
 steering, not idle wake. Entwurf does not start, stop, supervise, or health-loop the
-app-server. The operator starts it **inside the existing exact tmux session `codex`**:
+app-server. The operator starts it in a tmux session **of their own choosing**:
 
 ```bash
-# Run from a pane in the operator-owned tmux session named exactly `codex`.
-CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
-mkdir -p "$CODEX_HOME/app-server-control"
-codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+# Run from a pane in the operator-owned tmux session that will hold the app-server.
+# For the LIVE acceptance that session must NOT be the one the Pi/Codex pair runs in.
+entwurf codex-app-server
 ```
 
-This session is the supported home for the app-server and Codex TUIs. Omitted Codex
-fresh placement resolves its exact name from the caller's tmux server; Codex's MCP child
-then inherits the app-server's own `TMUX`/`TMUX_PANE`, so omitted outbound Pi placement
-stays in the home. An attached TUI does not lend its pane to the server, and N arbitrary
-clients in different sessions have no adjacency claim. Missing home/app-server rejects
-rather than guessing a client pane or creating/supervising either resource.
-
-Three ownership atoms remain separate:
-
-1. `entwurf install-codex-birth` owns `$CODEX_HOME/hooks.json` — one whole file, ours or
-   absent — plus its launcher and import closure under `$XDG_DATA_HOME/entwurf/codex-birth`.
+That verb owns the SPELLING of one vendor command and nothing else — it `exec`s
+`codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`
+in the terminal it was typed in, after creating the control directory that address lives in.
+It resolves the socket through the same leaf every other Codex surface reads, so the address a
+consumer gets cannot drift from the one delivery looks for. There is no supervisor, no restart,
+no daemon and no pid file: Ctrl-C is the operator's. A live socket, an unidentifiable one, or a
+second `--listen` are named refusals; a dead socket file is reported and launched over. Passing
+the raw vendor command by hand remains equivalent and is not deprecated.
+
+#95 D1 (GLG, 2026-09-16) retired the requirement that this session be named `codex`, and with it the
+rule that an omitted-placement Codex TARGET selected it. The operator still owns the app-server and
+still chooses its room; Entwurf neither creates nor supervises it, and a missing app-server rejects.
+
+Since #95 lane B the outbound direction no longer rides the app-server's inherited
+`TMUX`/`TMUX_PANE`: a Codex CALLER with no explicit placement opens its sibling beside its own
+pane, found by matching the caller's `_meta.threadId` against the `thread-id` the TUI writes
+into that pane's title. Zero matching panes (`codex-caller-seat-unresolved`), two or more
+(`codex-caller-seat-ambiguous`) and a caller whose `[tui].terminal_title` lacks `thread-id`
+(`codex-caller-title-missing`) are all named refusals with no fallback seat. An attached TUI
+still does not lend its pane to the server, and N arbitrary clients whose threads nobody named
+still have no adjacency claim: the anchor resolves only the pane displaying the thread the
+caller itself put on the request.
+
+The seat order, for all five backends, and it follows the CALLER rather than what is being
+opened: explicit `placement` wins; then a Codex CALLER's own pane (`codex-title-anchor`, no
+session name on the receipt because a session was observed rather than requested); then the
+caller's own session.
+
+The DIRECTORY follows the caller the same way (#95 lane C, 2026-09-16): requested `cwd` wins;
+then a Codex CALLER's own RECORD cwd, because this bridge is the app-server's MCP child and its
+process directory is the app-server's rather than that caller's; then the launching process's
+own, which is what tmux gives a window opened with no `-c`. Codex alone also carries that one
+value into its argv as `-C <dir>`, and omitting it is a wrong answer rather than a neutral one:
+an explicit `--remote` target takes its new thread's cwd from that override ALONE
+(`codex-rs/tui/src/app_server_session.rs:2022-2033` at rust-v0.153.4), so without it the THREAD
+opens in the app-server's repo while its pane sits elsewhere — measured on 2026-09-16 as three
+citizens of one chain recording a directory none of them was in. The receipt names which rule
+chose the directory (`requested` / the Codex caller's own record directory) and invents nothing
+for the inherited case.
+
+Four ownership atoms remain separate:
+
+1. `entwurf install-codex-birth` owns **one `SessionStart` declaration inside**
+   `$CODEX_HOME/hooks.json` — not the file — plus its launcher and import closure under
+   `$XDG_DATA_HOME/entwurf/codex-birth`. The vendor keys trust per
+   `<path>:<event>:<group>:<handler>`, so a neighbouring integration (Herdr's official Codex
+   integration appends its own group) coexists: entwurf certifies the NORMALIZED digest and
+   shape of its own group, requires it exactly once, reads the vendor receipt at the index that
+   group was measured at, and reports every other group as present-but-foreign — certified by
+   nothing, rewritten never. Install appends and uninstall splices by text, so a neighbour's
+   bytes survive both unchanged. The ownership receipt is `codex-birth-install-state/v2`; a v1
+   receipt (whole-file digest) is refused by name and superseded forward by one reinstall.
    No root: every path belongs to the operator. The vendor gates a user-layer declaration on
    ONE interactive "Trust all", which entwurf never answers, pre-seeds or computes; the
    receipt is read as its own doctor axis, and until it exists setup is honestly non-green.
@@ -181,8 +221,17 @@ Three ownership atoms remain separate:
    keeps custom roots and the app-server seat intact without storing their values.
 3. `entwurf install-codex-statusline` owns only `thread-title` within
    `tui.status_line`. Birth calls `thread/name/set`, so the visible title is the garden id.
-
-All three have state-backed doctors and inverses. Symlinked or foreign config is a
+4. `entwurf install-codex-terminal-title` owns only `thread-id` within `tui.terminal_title`
+   — a different key and a different axis from atom 3: `status_line` is what a human reads
+   inside the TUI, `terminal_title` is what the multiplexer reports back as `#{pane_title}`
+   and is the only value a caller seat can be matched against. The seeded list is
+   `["activity", "project-name", "thread-id"]` (`activity` leads because the herdr Codex
+   detector keys on the spinner/action-required prefix) and an existing operator list is
+   appended to, never reordered. A tmux server with `allow-set-title off` replaces every pane
+   title with the hostname, so the seat refuses there even with the atom installed — that is
+   a repair condition the refusal names, not an inference this rail makes.
+
+All four have state-backed doctors and inverses. Symlinked or foreign config is a
 named refusal, not an adoption. Entwurf never installs Codex or its credentials.
 
 Sender identity is request-scoped. The bridge requires the complete Codex metadata
@@ -211,17 +260,44 @@ name its caller and the callback was uncorrelatable.
 Visible fresh runs:
 
 ```text
-existing tmux session: codex
+operator-owned tmux session A (any name — the operator seats it)
   operator-owned app-server + supported Codex TUIs
-  codex --remote unix://<default socket> --model <explicit model>
+  codex --remote unix://<default socket> -C <launch directory> --model <explicit model>
         --dangerously-bypass-approvals-and-sandbox <callback-first prompt>
 ```
 
-With `placement` omitted, the fresh composition resolves the exact existing `codex` session name
-to its native `$id` before mutation. Other backends retain caller-session default placement; an
-explicit seat remains an expert override. The amended preflight must certify the state-backed birth
-closure digests, vendor trust receipt, exact MCP/env boundary, `thread-title`, and app-server socket
-before tmux mutation. The callback spelling is `mcp__entwurf_bridge__entwurf_v2`; the new garden id
+With `placement` omitted the seat follows the CALLER: a Codex citizen's own TUI pane, resolved from
+the `thread-id` in that pane's title to a native `$id` before mutation, with 0 or 2+ matches refused
+and no fallback; every other caller keeps caller-session default placement. An explicit seat remains
+an expert override. The preflight must certify the state-backed birth closure digests, vendor trust
+receipt, exact MCP/env boundary, `thread-title`, `terminal_title`, app-server socket, and a narrow LOCAL
+read of the LAUNCH DIRECTORY's folder consent before tmux mutation — a guard on the cases the user
+config decides, not a certification of the vendor's verdict. That last axis is the vendor's, not ours:
+`[source rust-v0.153.4]` a `--remote` startup always runs `check_directory_trust` on the `-C` value
+(`tui/src/lib.rs:1699-1725`) and nothing on that path reads the approval or sandbox policy
+(`tui/src/onboarding/directory_trust.rs:33-130`), so
+`--dangerously-bypass-approvals-and-sandbox` does not cover it — approvals and folder consent are
+two different gates. A DIRECT decision is keyed to the exact directory: for `ProjectTrustHost::Remote` that lookup is
+`vec![cwd_key]` alone (`tui/src/config_update.rs:290-296`), with no project-root marker, git root or
+parent inheritance. An UNDECIDED directory renders a consent screen, and a TUI waiting on one has started no turn —
+no rollout, no birth, no callback. Entwurf NOTES that as `codex-launch-cwd-undecided` and opens the
+window anyway: the screen is self-repairing for the human this rail exists to put a window in front
+of, and one answer teaches the vendor that directory for good. The unattended case is answered
+where it belongs — `smoke-codex-fresh-live` asserts the same leaf up front, so a gate with nobody
+at the keyboard reads a named precondition instead of a callback timeout. A directory the operator deliberately answered `untrusted`
+is NOT refused: on a remote target the vendor skips that screen
+(`onboarding/directory_trust.rs:94-96`; `uses_remote_workspace()` is `matches!(self, Self::Remote
+{ .. })` at `tui/src/lib.rs:307-309`), so the turn starts and refusing it would be entwurf
+inventing a policy the vendor does not have. A cwd INSIDE an explicitly `untrusted` project is a
+third answer with its own reason, `codex-launch-cwd-untrusted-ancestor`: there the vendor returns
+`pass the repository root explicitly with --cd` (`config_update.rs:357-371`) rather than a screen,
+so answering a prompt at the child would only reproduce that error.
+
+**The preflight leaf is narrower than the vendor's decision and does not claim otherwise.** It
+reads one TOML file while the vendor reads a layered config through its app-server, where an
+enabled project layer can consent with no entry at all (`config_update.rs:346-354`). Every case the
+leaf cannot see resolves to "proceed", so it may fail to catch a hang but never refuses a launch
+the vendor would have run. The callback spelling is `mcp__entwurf_bridge__entwurf_v2`; the new garden id
 comes only from its sender envelope. There is no Codex resume, watcher, session/app-server creator,
 or lifecycle supervisor.
 
@@ -246,7 +322,8 @@ preserved all three records/transcripts, and left operator app-server PID `15516
 
 That receipt established the mechanism of the now-selected deployment, but its initial Pi also sat
 in the app-server session and predates the fixed-home default. The stronger explicit-home acceptance
-passed on 2026-09-12. Receipt `.probe-artifacts/20260912T140745-codex-home-live-green.log`
+passed on 2026-09-12, under the `codex` home topology #95 D1 later retired. Receipt
+`.probe-artifacts/20260912T140745-codex-home-live-green.log`
 (SHA-256 `09e79bd1b62962f8a11d647ee456a71b11965b6792c7972d97ac4992119c91d7`)
 records 57 assertions and exit 0. The operator app-server stayed at `$158/@390/%390`; real initial Pi
 `20260912T140748-355654` opened outside the home at `$150/@397`, omitted-placement Codex
@@ -298,7 +375,8 @@ omitted-placement Codex `20260913T065151-4b6078` (thread `01a0979a-edc4-7570-a29
 `$158/@448`, Codex-opened Pi `20260913T065213-0811e6` at `$158/@449`, against the same operator-owned
 app-server at `$158/@390/%390`. Artifact `.probe-artifacts/codex-fresh-live-2oId4C/` (`run-manifest.json`
 sha256 `2cff6f08…`). Note the fixture seat differs from the standalone run: the aggregate builds its own
-tmux session (`$187`), while the Codex legs still resolve to the exact `codex` home. That gate reported
+tmux session (`$187`), while the Codex legs resolved to the exact `codex` home that was the contract
+at the time. That gate reported
 MUST PASS=24 FAIL=0 SKIP=0 and `cut: OK`. Keep the three Codex acceptances apart — 57-assertion
 pre-amendment first admission, 48-assertion standalone amended (`fZccoK`), and this 48-assertion
 aggregate repeat (`2oId4C`).
@@ -308,6 +386,66 @@ as an observation rather than a defect: a callback nonce arrived one character s
 instruction carried the wrong payload. Joined source receipts showed target, rail, and delivery were all
 correct, so both oracles refused for the right reason and nothing in the product was changed.
 
+**Caller-seat acceptance (#95 lane B), 2026-09-16, Codex 0.153.4 — 56 assertions, exit 0.** This is the
+receipt for the topology that replaced the fixed home: `ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-sol`,
+`ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-luna`, final source audit `codex=3/3 completed exact`.
+On one tmux server (`36728`) the operator-owned app-server `737636` stayed in ITS OWN session
+A = `$30`/`@41`/`%45`, while all three smoke citizens opened in S = `$2`: initial Pi
+`20260916T144205-e876ff` at `@46`, omitted-placement Codex `20260916T144230-d050d7` at `@47`, and the
+Codex-opened outbound Pi at `@48`. **A ≠ S is what makes the run decisive rather than merely green:**
+the app-server's inherited `TMUX` names A, so the pre-#95 environment fallback would have put that
+outbound Pi there. It landed in S, and its receipt names the rule that chose the seat —
+`seat: $2 (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session,
+not a requested name)`, recorded as `seat-source=codex-title-anchor`. Artifact
+`.probe-artifacts/codex-fresh-live-nYcGC1/`, stdout preserved at `run-stdout.log`
+(SHA-256 `ed60c2bdb46c13c51bf1d2dcf147b88c3c9f368a86a2bf17e972d3ecfde5fde9`). Cleanup reclaimed exactly
+`@46`, `@47`, `@48` with no CLEANUP FAILURE, preserved every born record and transcript, and left the
+app-server and `$30` untouched.
+
+**Caller-directory acceptance (#95 lane C), 2026-09-16, Codex 0.153.4 — 65 assertions, exit 0.** Same
+host, same models, same four-coordinate topology (app-server `737636` in A = `$30`/`@41`/`%45`; initial
+Pi `20260916T154902-556eb5` at `$2`/`@58`, omitted-placement Codex `20260916T155037-10ddaa` at `$2`/`@59`,
+Codex-opened outbound Pi `20260916T155102-9add8a` at `$2`/`@61` with `seat-source=codex-title-anchor`),
+final source audit `initial-pi=3/3` and `codex=3/3 completed exact`. **65 and 56 are different
+contracts, not a regression:** lane C added the cwd axis (seven assertions) and the pane-directory
+reader it needs, on top of everything lane B already asserted.
+
+The two decisive receipts, both measured against the app-server's own live directory
+`/home/junghan/repos/gh/entwurf` (read from `/proc/737636/cwd`):
+
+- **hop 1, cwd REQUESTED** (`8b-codex-thread-cwd`): the fresh Codex's pane `#{pane_current_path}`, the
+  vendor's own rollout `session_meta.cwd`, its Entwurf record and the requested scratch are ONE
+  directory — `/tmp/entwurf-codex-fresh-live-db65N2` — and it is not the app-server's. Four authorities
+  that cannot borrow from each other; before `-C` the rollout carried the app-server's path while the
+  pane sat in the scratch.
+- **hop 2, cwd NOT REQUESTED** (`13b-outbound-pi-cwd`): the leg named neither placement nor cwd, and the
+  outbound Pi still opened in `/tmp/entwurf-codex-fresh-live-db65N2` — its pane, its own birth-written
+  record, and the Codex caller's record all agree. Its launch receipt names the rule rather than
+  borrowing the other one's noun: `cwd: /tmp/entwurf-codex-fresh-live-db65N2 (the Codex caller's own
+  record directory, used because no cwd was requested — not an observation)`, while both requested legs
+  still read `requested start directory`.
+
+Artifact `.probe-artifacts/codex-fresh-live-w4yJBw/` (run manifest, mailbox observations/selections and
+a 13-file pre-cleanup snapshot including all three records, both Pi transcripts and the Codex rollout);
+stdout preserved at `.probe-artifacts/lane-c-live-20260916T154900.log`
+(SHA-256 `712050e7a8cf03ece98e7f34029ae98a92e9b2a7fd96aff87d0c1e6ba2ee9af2`). Cleanup reclaimed exactly
+`@58`, `@59`, `@61` with no CLEANUP FAILURE, removed its own scratch and fixture record, preserved every
+born citizen record and transcript, and left the app-server and `$30` untouched.
+
+Two earlier attempts that day are kept as their own receipts, because each stopped at a different
+truth. The FIRST stopped at 26 assertions, before any window opened: `codex-birth-unit-missing`, because
+`~/.codex/hooks.json` carried a second `SessionStart` entry added after install, so the declaration no
+longer matched its recorded digest. The unit was not broken — entwurf's own atom and all six helper
+digests were intact — but this rail owns that file whole, and the preflight refused rather than run
+against bytes it could not vouch for. The SECOND stopped at 43 assertions with hop 1 already green, and
+its log is kept as the D1 measurement: `.probe-artifacts/codex-fresh-live-4aFCDD/run-stdout.log`
+(SHA-256 `8392a603dcfe7e89549942d55e515f97724398fb261bd8873d25806f71086afe`) carries
+`omitted placement opened fresh Codex in the caller's own session S, away from the app-server's A` —
+the retirement of the fixed home, observed on a real host. It then failed on the gate's own defect
+rather than the product's: the source-call oracle compared arguments with `isDeepStrictEqual`, so a
+model that omitted the optional `wants_reply` instead of passing it explicitly read as drift. That
+oracle now normalizes exactly that key to its schema default and nothing else.
+
 Unrestricted attached-TUI parity (**B**) is explicitly outside this support claim. The exact vendor
 checkout `rust-v0.153.4` at `3d2ee51ca2d5db578f328aa75e20aa22c0197c9a` found no public
 request→attached-TUI-seat carrier: process-local `ConnectionId` does not cross into thread/core/MCP/hook
@@ -317,7 +455,7 @@ behaviour remain invalid; explicit `placement.tmuxSession` is an operator-named
 an inferred seat. The gate strips ambient `PI_SESSION_ID`/`PI_AGENT_ID`; a fixture may preserve receipts
 but cannot substitute for the initial visible record-backed Pi turn.
 
-Run the clause-7 invocation from a tmux session other than `codex`; the explicit app-server PID must belong to the operator-owned app-server seated in `codex`, and both models are explicit:
+Run the clause-7 invocation from a tmux session OTHER than the app-server's own; the explicit app-server PID must belong to the operator-owned app-server, and that session's NAME is not a requirement — #95 D1 retired the fixed `codex` home on 2026-09-16, so A ≠ S is the precondition and no particular name is. Both models are explicit, and the launch directory must already be answered in this Codex (`VERIFY.md` owns the derivation and the one-time `Trust`):
 
 ```bash
 LIVE=1 \

package/README.md

@@ -10,7 +10,7 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one adapter, not the project subject. Claude Code, GitHub Copilot CLI, and OMP (`omp`) are shipped self-fetch citizens; Antigravity (`agy`) is shipped native-push. Codex CLI is a **native-push citizen, supported in 0.21.0 on Linux** over the operator-owned app-server: vendor-trusted user-scope birth, strict request-scoped identity, loaded-thread probe, one-shot queue delivery, and visible fresh in one explicit operator-owned tmux home named `codex`. Unrestricted attached-TUI seat inference is not supported or claimed; that non-goal no longer blocks the explicit home topology. Codex remains native so it keeps its vendor tools, delegation, and work context; this is not another way to buy or expose GPT through ACP.
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one adapter, not the project subject. Claude Code, GitHub Copilot CLI, and OMP (`omp`) are shipped self-fetch citizens; Antigravity (`agy`) is shipped native-push. Codex CLI is a **native-push citizen, supported in 0.21.0 on Linux** over the operator-owned app-server: vendor-trusted user-scope birth, strict request-scoped identity, loaded-thread probe, one-shot queue delivery, and visible fresh beside the CALLER's own pane. Unrestricted attached-TUI seat inference is not supported or claimed; #95 D1 retired the fixed `codex` tmux home on 2026-09-16, so the operator seats the app-server wherever they like and a Codex caller opens its sibling beside its own TUI pane. Codex remains native so it keeps its vendor tools, delegation, and work context; this is not another way to buy or expose GPT through ACP.
 
 ```text
 Claude Code / Copilot / Codex / agy / omp / pi
@@ -19,7 +19,7 @@ Claude Code / Copilot / Codex / agy / omp / pi
       → control-socket | meta-mailbox | native-push
 ```
 
-[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation or loaded Codex thread. It starts no process on any rail. `entwurf_fresh_call` is separate lifecycle. With Codex placement omitted, it resolves the exact existing tmux session named `codex`; that operator-owned home holds the app-server and supported Codex TUIs. Missing home or app-server rejects before launch, and Entwurf never creates or supervises either. An explicit `placement.tmuxSession` remains an expert override. Exact 0.153.4 source confirms that arbitrary attached-TUI request→seat inference is unavailable, so Entwurf makes no such claim. Codex has no resume surface.
+[`entwurf_v2`](#entwurf_v2--canonical-dispatch-verb) is the canonical dispatch surface over *existing* garden citizens — live control-socket send, meta-mailbox enqueue, and native-push into a live Antigravity conversation or loaded Codex thread. It starts no process on any rail. `entwurf_fresh_call` is separate lifecycle. With placement omitted the seat follows the CALLER: a Codex citizen opens beside its own TUI pane, found by the `thread-id` in that pane's terminal title, and 0 or 2+ matching panes reject with no fallback; every other caller opens in its own session. A missing app-server rejects before launch, and Entwurf never creates or supervises it. An explicit `placement.tmuxSession` remains an expert override. Exact 0.153.4 source confirms that arbitrary attached-TUI request→seat inference is unavailable, so Entwurf makes no such claim. Codex has no resume surface.
 
 **Garden id is deliberate vocabulary.** It is not a decorative synonym for session id, worker, delegate, or subagent. The unfamiliar word is a guard: each harness keeps its own identity and transcript, while `entwurf` supplies a narrow addressable surface between siblings.
 
@@ -78,6 +78,19 @@ A few words that look unusual for a coding tool.
 
 ## Install
 
+**Two installation routes, and the one you want depends on where you work.**
+
+- **Direct** — `npm install -g @junghanacs/entwurf`, then `entwurf setup <project>`. This is the
+  general route: it composes every harness it FINDS on the host — pi, Claude Code, Codex, Copilot,
+  Antigravity, the ACP rail — and reports each one PASS / SKIP / FAIL. Use it in an ordinary shell,
+  in tmux, anywhere.
+- **Herdr workbench** — `herdr plugin install` from inside a Herdr session. It activates Entwurf for
+  the pi and Claude Code sessions Herdr has integrated, and only those. Contract, evidence grades
+  and its refusals: [plugins/herdr/README.md](plugins/herdr/README.md).
+
+Neither route installs a harness, a subscription, or a login (Hard Rule 17). Everything below this
+paragraph describes the direct route.
+
 **Platform evidence, in one breath.** The Entwurf-only install surface on
 macOS is CERTIFIED (CI) (`macos-install-surface`). On macOS every
 garden-native harness rail, marker/request join, ACP turn, and mux is NOT CERTIFIED —
@@ -152,6 +165,55 @@ entwurf check-bridge
 whatever native harnesses are present. The global install is the easiest path when
 Claude Code's USER-scope MCP registration should work from every cwd.
 
+#### Codex: what you still type by hand
+
+`setup` writes every byte Entwurf owns, and three things are deliberately left to you. They
+are the only manual steps between a fresh install and calling a Codex sibling, and all three are
+answers only you can give:
+
+1. **Trust the birth hook once, in a visible plain Codex.** Answer `Trust all and continue`
+   and send one first turn. Nobody can do this for you: the receipt is the vendor's record of
+   *your* security decision, and writing it ourselves would turn a prompt into a silent
+   install. Until it exists, `setup` and `doctor-codex-birth` stay honestly non-green and say
+   exactly this.
+2. **Start the app-server, in a detached tmux session that is NOT where you work.**
+
+   ```bash
+   entwurf codex-app-server
+   ```
+
+   One command for the vendor string nobody wants to type. It `exec`s
+   `codex app-server --listen unix://<default socket>` right there — so Ctrl-C is yours, and
+   Entwurf neither supervises nor restarts it. The session matters because the MCP bridge is
+   this server's child and inherits its `TMUX`: that tmux server is the one caller-seat
+   lookups read. The launcher prints which seat it got rather than guessing one for you.
+3. **Answer the folder-consent prompt once for each directory you open siblings in.** Codex
+   records a direct decision per EXACT directory — not the parent, not the git root — and a
+   directory with no answer anywhere opens a consent screen instead of running a first turn.
+   `entwurf_fresh_call` prints `codex-launch-cwd-undecided` and opens the window anyway — the
+   screen is self-repairing, and answering it once is the whole fix. (Two neighbours differ: a
+   project `.codex` layer can consent with no entry at all, and a directory inside an explicitly
+   untrusted project is noted as `codex-launch-cwd-untrusted-ancestor` because the vendor answers
+   that one with an error naming the repository root instead of a prompt.) You can also do it up
+   front:
+
+   ```bash
+   codex -C <the directory you will launch siblings in>   # answer the prompt, then quit
+   ```
+
+   Same reason as step 1: it is your security decision, and writing it ourselves would turn a
+   prompt into a silent install.
+
+Then `entwurf_fresh_call` with `backend: "codex"` works. Attaching your own visible Codex TUI
+(`codex --remote "unix://$CODEX_HOME/app-server-control/app-server-control.sock"`) is optional
+and independent — a sibling Entwurf opens brings its own.
+
+> **Observation, not a verb (#95).** That `--remote` string is exactly as unfriendly as the
+> `--listen` one was, and it has no managed spelling. It is deliberately left alone: it is how
+> an operator attaches their OWN terminal, not how a sibling is opened, and `entwurf_fresh_call`
+> already spells it internally for the siblings it launches. Whether the operator-facing half
+> deserves its own verb is open.
+
 ### From npm — project-local install
 
 ```bash
@@ -259,7 +321,7 @@ repair surface: each unit has its own installer, doctor, and inverse.
 - **Antigravity / agy** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — `install-agy-bridge`, `install-agy-statusline`, `install-agy-hooks`, each with a matching `doctor-agy-*`.
 - **GitHub Copilot CLI** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four independent units, four independent failure modes: `install-copilot-bridge` (birth: garden id + who-sent, on the first prompt), `install-copilot-mcp` (the entwurf tool hand, where `entwurf_inbox_read` lives), `install-copilot-receive` (the receiver extension: doorbell + receiver marker), `install-copilot-statusline` (optional for a manual citizen, required for supported fresh) — each with a matching `doctor-copilot-*` and `uninstall-copilot-*`.
 - **OMP (`omp`)** (Linux CERTIFIED; macOS NOT CERTIFIED — pending physical host) — four units, in-process extensions rather than launchers: `install-omp-bridge` (birth: the `mode === "tui"` visible host, its garden id on the status line, and who-sent), `install-omp-mcp` (the omp-native `entwurf-bridge` entry), `install-omp-config` (the one operator setting `tools: xdev: false`, without which the vendor mounts MCP tools as `xd://` devices the model cannot call), `install-omp-receive` (the receiver extension: mailbox watch + announce-only doorbell) — each with a matching `uninstall-omp-*`, and a `doctor-omp-*` for all but the setting, whose runtime axis `doctor-omp-mcp` owns. The setting writer owns exactly the lines it adds and refuses an explicit operator `tools: xdev: true` by name rather than overwriting it.
-- **OpenAI Codex CLI** (supported in 0.21.0 on Linux; macOS NOT CERTIFIED — pending physical host) — `install-codex-birth` publishes the `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`, all operator-owned; the vendor trust receipt for that declaration is the operator's single answer, and `doctor-codex-birth` reports it as its own axis (present, or red with the exact instruction — never computed, never written); `install-codex-mcp` owns `[mcp_servers.entwurf-bridge]`, including the `env_vars` boundary for `CODEX_HOME`, Entwurf garden/control roots, and the app-server's `TMUX`/`TMUX_PANE`; `install-codex-statusline` owns `thread-title`. Each has a matching doctor and inverse. The operator owns one existing tmux session named `codex`, starts the app-server there, and seats supported Codex TUIs there. Omitted Codex fresh placement selects that home; Entwurf never creates or supervises the session/app-server and never discovers arbitrary attached-TUI seats. An explicit placement is an expert override. Exact 0.153.4 source's missing per-client carrier bounds the unsupported topology; it does not block this explicit home deployment.
+- **OpenAI Codex CLI** (supported in 0.21.0 on Linux; macOS NOT CERTIFIED — pending physical host) — `install-codex-birth` publishes the `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`, all operator-owned; it owns **that declaration, not the file** — another integration's `SessionStart` group coexists (the vendor keys trust per `<path>:<event>:<group>:<handler>`), so install appends, uninstall splices only ours out, foreign bytes survive both, and `doctor-codex-birth` reports neighbours in a FOREIGN section it certifies nothing in; the vendor trust receipt is read at the index our declaration was measured at, is the operator's single answer, and `doctor-codex-birth` reports it as its own axis (present, or red with the exact instruction — never computed, never written); `install-codex-mcp` owns `[mcp_servers.entwurf-bridge]`, including the `env_vars` boundary for `CODEX_HOME`, Entwurf garden/control roots, and the app-server's `TMUX`/`TMUX_PANE`; `install-codex-statusline` owns `thread-title` in `tui.status_line`; `install-codex-terminal-title` owns `thread-id` in `tui.terminal_title`. Each has a matching doctor and inverse. **One Codex precondition is the vendor's own and no installer supplies it: the directory a sibling starts in must already be answered in this Codex.** A direct consent decision is recorded per exact directory on this rail — not the parent, not the git root — and a directory the vendor has no answer for at all opens a consent screen instead of running a first turn, so `entwurf_fresh_call` prints `codex-launch-cwd-undecided` and opens the window anyway; that screen is self-repairing, and answering it once teaches the vendor the directory for good. **Nothing here refuses a launch** — the note is a diagnostic, and the one caller that treats it as a precondition is `smoke-codex-fresh-live`, where nobody is at the keyboard. Two neighbouring cases read differently: a directory answered `untrusted` is not noted at all (the vendor skips its screen on this rail, so that turn starts), and a directory INSIDE an explicitly untrusted project is noted as `codex-launch-cwd-untrusted-ancestor` because the vendor answers that one with an error naming the repository root rather than a prompt. The check is a narrow local read of the operator's own config, never the vendor's verdict: the vendor also consents through project layers it reads from its app-server, and everything the check cannot see stays silent. The operator owns the app-server and seats it wherever they like; Entwurf never creates or supervises it. Omitted fresh placement follows the CALLER, never the backend being opened: an explicit `placement` always wins, then a Codex CALLER opens beside its own TUI pane — located by the `thread-id` that pane's terminal title carries, with 0 or 2+ matching panes refused and no fallback — then the caller's own session. (#95 first shipped a fixed `codex` home for omitted-placement Codex TARGETS; #95 D1 retired it on 2026-09-16 once the anchor made the room unnecessary.) A pane title is a placement input only, never an address, liveness or delivery fact. Exact 0.153.4 source's missing per-client carrier still bounds placing a sibling beside a TUI whose thread nobody named as unsupported.
 
 Run them as `entwurf <command>`. Which unit a doctor's refusal names, and the clean-host
 walk-through for each harness, live in [docs/setup-clean-host.md](./docs/setup-clean-host.md).
@@ -454,8 +516,8 @@ The Claude ACP backend keeps its native model / API / tools; entwurf shapes only
 
 Codex is not an ACP backend here. Its native-push lane, supported in 0.21.0, uses `SessionStart`
 for birth, strict request `_meta` for who-sent, and a loaded app-server thread as the live route.
-Its supported visible topology is one operator-owned existing tmux home named `codex`; omitted
-Codex fresh placement selects it, while unrestricted attached-TUI seat inference is not claimed.
+A Codex CALLER with placement omitted opens its sibling beside its own TUI pane, matched by the
+`thread-id` its terminal title carries; a pane whose thread nobody named is never inferred.
 
 Antigravity is also not an ACP backend. It is a native-push citizen: `PreInvocation` supplies birth/sender identity, `entwurf_v2` probes and direct-injects replies into the live conversation, and no mailbox/receiver marker is involved.
 
@@ -473,7 +535,7 @@ pnpm run check:full                     # full deterministic floor (adds the her
 ./run.sh check-agy-sender-identity      # record-backed pid/start-key sender identity
 ./run.sh check-codex-native-push       # deterministic Codex UDS probe + no-replay queue contract
 ./run.sh smoke-codex-config-state      # Codex MCP/status-line install, doctor, and inverse
-./run.sh check-codex-birth-hook        # sandboxed payload + declaration: one V3 per top-level thread, the envelope's own axes, no markers
+./run.sh check-codex-birth-hook        # sandboxed payload + declaration: one V3 per top-level thread, the envelope's own axes, no markers, and the declaration leaf (normalized digest, selection by launcher command, byte-preserving splice)
 
 # source-maintainer only — qualification snapshots the git work surface, and both
 # commands are source-contract gates rather than installed operator checks:
@@ -487,16 +549,18 @@ LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 # Codex loaded-thread probe (pre-amendment evidence; not first-release acceptance):
 LIVE=1 CODEX_LIVE_THREAD_ID=<threadId> ./run.sh smoke-codex-native-push-live
 
-# Codex explicit-home acceptance. Run from a DIFFERENT tmux session; the operator-owned
-# app-server and supported Codex TUIs sit in the existing exact `codex` session. Record
-# initial Pi, app-server, fresh Codex, and outbound Pi coordinates separately:
+# Codex caller-seat acceptance. The operator-owned app-server must sit in a session OTHER than
+# the one the Pi/Codex pair runs in — that separation is what tells the caller-pane anchor apart
+# from the app-server's inherited environment. This smoke ALSO needs its one stable launch
+# directory answered once (manual step 3 above); VERIFY.md's Codex section owns that procedure,
+# including how to derive the exact path instead of retyping it. Record all four coordinates:
 LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid> \
   ENTWURF_CODEX_FRESH_MODEL=<codex-model> \
   ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
   ./run.sh smoke-codex-fresh-live
-# This accepts only a real visible Pi → visible Codex → visible Pi run: initial Pi outside
-# the Codex home, then Codex and its outbound Pi inside it. A fixture or self-fetch first leg
-# may collect receipts but does not satisfy the topology. No arbitrary attached-TUI parity is claimed.
+# This accepts only a real visible Pi → visible Codex → visible Pi run: initial Pi in a session
+# other than the app-server's, then Codex and its outbound Pi beside it. A fixture first leg may
+# collect receipts but does not satisfy the topology. No arbitrary attached-TUI parity is claimed.
 
 # ACP plugin LIVE acceptance — need the operator's local Claude auth/credit:
 LIVE=1 ./run.sh smoke-acp-socket-citizen-live   # turn-free socket citizenship (S1)
@@ -572,7 +636,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server, requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement is now a per-backend policy rather than one rule: `pi`, `claude-code`, `copilot` and `omp` open in the CALLER's own seat, while `codex` resolves the exact existing operator-owned `codex` session (a missing home rejects; nothing is created). 0.21.0 is the first release to carry such a backend-selected default — every backend could already be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — WHERE it opens is a fact about the calling process, not a parameter: inside herdr (`HERDR_ENV=1`) it opens a NEW TAB in the caller's own workspace, without taking focus, and admits only `pi` and `claude-code`, refusing `placement` by name; everywhere else it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server. There is no fallback between the two — an incomplete herdr context is refused by its herdr reason rather than quietly opening a tmux window nobody inside herdr can see. Everything that follows in this paragraph describes the tmux rail; the herdr rail's coordinates, refusals and reclaim are owned by [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md). On tmux it requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement follows the CALLER rather than the backend being opened: a Codex CALLER opens its sibling beside its own TUI pane, located by the `thread-id` that pane's terminal title carries (0 or 2+ matching panes reject with no fallback); every other caller opens in its own seat. (0.21.0 shipped a backend-selected default instead — an omitted-placement `codex` TARGET resolved a fixed operator-owned session named `codex` — and #95 D1 retired it on 2026-09-16.) Any of the five can still be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -591,7 +655,7 @@ In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes sev
 
 **`entwurf_v2` is the canonical surface for garden-id delivery.** When you have a garden id and want to reach whoever it names — message, reply, or hand-off — `entwurf_v2` is the one surface that reads whether the target is live pi, dormant pi, mailbox-backed Claude Code, Copilot or OMP, or native-push Antigravity or Codex, and routes correctly; *when unsure which transport, use `entwurf_v2`*. This prevents callers from guessing a rail from the shape of an id.
 
-What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. It opens one of five fixed runtimes — Pi, Claude Code, Copilot, OMP or Codex — visibly on the caller's tmux server. Omitting placement is a per-backend policy: the first four open in the caller's own session, while Codex resolves the exact EXISTING operator-owned `codex` home and rejects if it is absent. An explicit `placement.tmuxSession` sends ANY of the five to an existing named session instead (see the `entwurf_fresh_call` paragraph above for the owning detail). Each launch carries a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
+What v2 provides is a **deterministic dispatch substrate** that moves the "which transport?" decision out of the fallible caller/model and into the decider, with transport-appropriate locking and an honest reject (no `✓ delivered`, no `.msg` garbage) when a target cannot receive. It still does **not** mint siblings, and it does not relaunch one either: every row above either reaches a citizen that is already running or refuses. Reopening a dormant pi citizen is `entwurf_resume_call`, a separate lifecycle verb that never routes through this decider. Fresh creation is the separate `entwurf_fresh_call` verb. Inside herdr it opens a Pi or Claude Code sibling in a new tab in the caller's own workspace; everywhere else it opens one of five fixed runtimes — Pi, Claude Code, Copilot, OMP or Codex — visibly on the caller's tmux server. The rest of this paragraph is the tmux rail. Omitting placement follows the CALLER rather than the backend being opened: an explicit seat always wins; then a Codex CALLER opens beside its own TUI pane, found by the `thread-id` in that pane's terminal title (0 or 2+ matching panes reject, with no fallback); then the caller's own session. An explicit `placement.tmuxSession` sends ANY of the five to an existing named session instead (see the `entwurf_fresh_call` paragraph above for the owning detail). Each launch carries a required explicit model passed in that runtime's measured CLI dialect and one optional literal absolute `cwd`; omitted or `""` means the caller's cwd. Copilot opens through `entwurf copilot`, never the bare vendor; OMP is the opposite — the bare `omp` runtime with no positional prompt at all, because that vendor connects its MCP tools after the session has started, so the task rides a two-stage `--entwurf-bootstrap` payload the installed birth extension releases once the callback tool has actually answered. It returns only a synchronous launch receipt and lets the sibling report its new address asynchronously through the sender envelope of a nonce callback. Use this cwd input for a new cross-repository sibling; do not resume a dormant citizen as a cwd substitute. The meta-mailbox row requires an **active** self-fetch receiver; native-push requires a record-backed, probe-alive native conversation and never borrows mailbox state. The [mux launch lane](./docs/mux-launch-rail.md) owns placement, fixed-runtime launch, and the two narrow compositions above it (fresh-call and resume-call placement); delivery does not import launch, and mux is not a delivery transport.
 
 A live pi target is *reached* over its control socket, but the socket is dispatch-internal transport, never identity (#50 C4). A control socket that no meta-record claims — a pre-record-era resident, an unreadable store, or a stale/planted file — is refused for **every** intent as `record-less-socket`, and the reject names the fix (restart the resident so `session_start` births its record, or quiesce and run the fresh-cut). `entwurf_peers` reports the same state as an aggregated `record-less-socket` diagnostic rather than a peer row.
 
@@ -605,6 +669,32 @@ A `--entwurf-control` session needs **no special launcher** (#50 C2): pi mints i
 pi --entwurf-control
 ```
 
+**Opening pi inside herdr.** herdr starts a supported agent with its canonical executable and no
+extra argv — measured on herdr 0.9.0, `herdr agent start <name> --kind pi --pane <id>` runs plain
+`pi`. Citizenship is argv-gated (`pi-extensions/entwurf-control.ts`), so a pi opened that way is a
+running pi and *not* a garden citizen: no record, no control socket, no garden id. Pass the flag
+through herdr's own argv passthrough:
+
+```bash
+herdr agent start <name> --kind pi --pane <pane-id> -- --entwurf-control
+```
+
+A sibling that entwurf itself opens already carries the flag; this is only for a pi you start from
+herdr by hand. The claude axis needs nothing extra — its record is minted by the meta-bridge plugin's
+own `SessionStart` hook, which entwurf installs and herdr does not touch. Where such a citizen is
+visible is reported as evidence in `entwurf_peers` (`placement=herdr <pane>`), never as an address:
+[`docs/mux-launch-rail.md`](./docs/mux-launch-rail.md) §7-a.
+
+The wiring those two axes need does not have to be installed by hand on a Herdr host: the Entwurf
+Herdr plugin's install-time build reads Herdr's own `integration status`, and for every harness in
+`{pi, claude-code}` that Herdr reports as integrated it acquires an Entwurf runtime at a stable
+Entwurf-owned address and registers the user-scope wiring against it — no Entwurf clone, no manual
+`npm install`. `herdr plugin install junghan0611/entwurf/plugins/herdr` is the whole command, every
+reinstall is the refresh trigger, and `entwurf herdr-plugin-deactivate` is the explicit inverse
+(Herdr's own uninstall removes only its checkout and calls no cleanup hook).
+[`plugins/herdr/README.md`](./plugins/herdr/README.md) owns that lane, including which acquisition
+source the committed lock names.
+
 **Resuming an existing garden session.** Use `entwurf_resume_call {target}`. It reopens a DORMANT pi citizen under the SAME garden id in a visible window in the caller's own tmux session, resolving the transcript, model, provider and cwd from the record — so it takes only the target id, and it runs no turn: the window comes back with the conversation and waits, and talking to it is still `entwurf_v2`. Two receipts arrive and mean different things: a LAUNCH receipt (tmux made a window and was asked to start pi) and an OBSERVATION receipt (the control socket answered under the same id, or `resume-unobserved`). Unobserved is a real outcome, not an error to retry — the window is visible, so read it. A citizen that is already live is refused; so is a non-pi target (`target-not-pi`), because only pi stands a control socket up. The predecessor, `entwurf_v2 intent=owned-outcome`, resumed by launching a hidden window-less background child and was withdrawn under the visible-first rule; delivery still starts no process. Identity preconditions live in `resume-launch-identity.ts`, gated by `check-resume-launch-identity`.
 
 **Starting a new session in-process — pi's own `/new`.** Since the #50 C2 cut there is nothing to replace it with: `/new`, `/fork`, `/clone` and RPC session replacement are pi's again. The replacement session fires `session_start`, which upserts its own meta-record and rebinds the control socket to that record's garden id; the old socket is dropped. pi's session id (a uuidv7) is recorded as the citizen's `nativeSessionId` and is never an address. Gate: `run.sh smoke-resident-garden-guard` REPLACEMENT section (0-token RPC E2E).