@junghanacs/entwurf 0.21.0 → 0.23.0

package/VERIFY.md

@@ -54,6 +54,12 @@ Verification here is not a benchmark. In production we exchange short turns and
   - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
 
+> **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
+
+> **The Herdr plugin's install-time build has two axes, and one of them needs the network (#116 M3-b3).** `check-herdr-plugin-build` is deterministic and rides `check:hermetic`: the listing reaches the runner through its own spawn seam (there is no fake `herdr` binary in this repo), and the one cell that drives the REAL binary reports a named SKIP on a host without it — `ENTWURF_REQUIRE_HERDR=1` makes that absence red. What it cannot have is the real acquisition: `npm pack git+https://github.com/junghan0611/entwurf.git#<full sha>` builds the bridge through `prepare`, which installs devDependencies from the registry. So `LIVE=1 ./run.sh smoke-herdr-plugin-build-live` owns that axis, and its cells are **two kinds of evidence, labelled as such**: three are the real Herdr journey — a real `herdr plugin install` driving the real `[[build]]`, with the UNCHANGED product remote redirected to a local bare clone by git `insteadOf` (the one substitution, which is what makes an unpushed candidate testable) — covering remote-commit available, the `{pi}` → `{pi, claude-code}` reinstall with OpenCode as a zero-write negative control and exactly ONE counted vendor MCP owner entry, and the post-build Herdr-commit gap (where the ledger has already rebound to the gap commit, so the honest assertion is that transition and not unchanged bytes). The fourth cell — remote-commit **unavailable** — calls the shipped runtime leaf directly with the fixed product argv and is therefore **acquisition-leaf evidence, not a journey**; routing it through Herdr would add a second explanation for one red. Its oracle is the honest one too: active runtime, ledger and harness bytes preserved, while the journal is left as the certified `installing` retry authority the transaction deliberately writes before acquiring, and a normal install afterwards is green. Its Claude cell is where the vendor question the deterministic gates refuse to claim gets answered — whether Claude Code accepts an ABSOLUTE executable as an MCP command — and it reports a named skip on a host without `claude`, never a pass. Like the herdr fresh-call rail, this smoke is **on-demand and not an aggregate MUST**. The release aggregate does not require the plugin build smoke: herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion.
+
+> **Switching the plugin's production acquisition source is a re-proof, not a configuration change (#116 M3-b3).** `runtime-lock.json` carries a closed `source` discriminant: `npm` (exact `name@version` plus the published sha512, compared against the tarball's own bytes) is the production authority, and `herdr-checkout` (the exact commit Herdr checked out, from the fixed remote) is a VERIFICATION-ONLY carrier that exists so a candidate needs no npm release. Evidence does not transfer between them. Before a release that moves the production source — to npm, or to a GitHub Release tarball plus its sha512 — the exact acquisition and integrity comparison, the installed runtime (name@version, compiled entry, three executable bins, a real `check-bridge`), the swap and torn-swap recovery, activation and deactivation, and the package-consumer proof must all be re-run against THAT source. A candidate proof green on the checkout carrier says nothing about a registry artifact, and the reverse is equally true. **Records from before this contract are refused, not migrated:** a v1 runtime journal or activation ledger fails certification by name, and the way forward on such a host is an explicit `entwurf herdr-plugin-deactivate` (or a hand-cleared runtime/ledger state) before the next install — there is no reader that accepts both schemas, because the older shape cannot say WHICH artifact it was.
+
 > **Cortex is an on-demand axis, not an aggregate one.** Its rail needs an external Snowflake connection and login that the host owns, not the repo — so wiring it into the aggregate would block every cut taken on a host without that account. **The release aggregate does not re-certify Cortex**; `LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live` stays a required direct call whenever a cut changes Cortex rail code or an operator elects to certify that host. Its honest-skip behaviour is unchanged: run it without the connection and it reports protocol SKIP, never a pass. **Operator-host limit (2026-08-20, measured):** the source-owning host has no Snowflake subscription, and Cortex Code offers no free tier that a live turn can reach — a direct attempt confirmed it. So on this host `smoke-acp-cortex-live` can only ever report protocol SKIP, and no LIVE Cortex evidence can be produced here until Snowflake supplies a free-usable route or the account is subscribed. Record that SKIP as an absent axis; never soften it into a pass, and never substitute a different backend as Cortex evidence.
 >
 > A cut that touches the prompt-lifecycle contract (no wall clock on a running turn) owes one long-turn acceptance the aggregate floor is too short to carry: `LIVE=1 ./run.sh smoke-acp-long-turn-live` drives a real turn whose tool work outlasts the retired 600s cutoff and requires exactly one cold ACP bootstrap in the transcript. It takes >12 minutes by construction and is on-demand, not part of `release-gate`.
@@ -71,26 +77,62 @@ Verification here is not a benchmark. In production we exchange short turns and
 > The aggregate release gate does not own a live agy conversation id, so agy's real native-push round trip is a separate acceptance axis: three fail-loud doctors plus `LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live`, followed by a fresh-conversation sender/reply check after package install. Its deterministic install/sender gates are already inside `pnpm run check:full`; do not misreport the aggregate gate as live agy evidence. **Cost fence:** the agy conversation this smoke drives runs on a free account, so open it on `gemini-3.6-flash` — never a Pro tier. The model is the operator's choice at conversation-open time; entwurf never selects it, and no assertion reads it (see the shipped-lane note: model display is not part of the agy contract).
 >
 > Aggregate release-gate does not own a loaded Codex thread. Codex native-push remains an
-> on-demand host axis. The final first-admission acceptance passed on 2026-09-12 with the
-> explicit home topology; `DELIVERY.md` owns its 57-assertion receipt and digest. Re-runs start
-> from a tmux session other than `codex`; the operator-owned
-> app-server and supported Codex TUIs sit in the existing exact `codex` session; omitted Codex
-> placement resolves there; and the Codex-opened Pi stays there. Exact `rust-v0.153.4` source
-> exposes no arbitrary request→attached-TUI-seat value, so that wider topology is unsupported
-> and unclaimed rather than a blocker to the explicit home.
+> on-demand host axis. The first-admission acceptance passed on 2026-09-12 under the fixed `codex`
+> home topology #95 D1 later retired; `DELIVERY.md` owns its 57-assertion receipt and digest as
+> history. Re-runs follow the caller-seat topology instead: the operator-owned app-server sits in
+> its own session A, the initial Pi and the Codex it opens both sit in a DIFFERENT session S, and
+> the Codex-opened Pi must land in S. **A ≠ S is a precondition, not a preference** — the
+> app-server's inherited `TMUX` names A, so an outbound Pi in S can only have come from the
+> caller's own pane title, and the receipt must name `codex-title-anchor` as the rule that chose
+> it. Exact `rust-v0.153.4` source still exposes no arbitrary request→attached-TUI-seat value, so
+> placing a sibling beside a TUI whose thread nobody named stays unsupported and unclaimed.
 >
 > The A cell takes no inferred server or models:
 > `LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid>
 > ENTWURF_CODEX_FRESH_MODEL=<codex-model>
 > ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> ./run.sh smoke-codex-fresh-live`.
+> **Both of THIS cell's live-spend defaults are `gpt-5.6-luna` from 2026-09-17**
+> (`openai-codex/gpt-5.6-luna` on the pi side) — the Codex leg came down off `sol`. It is a tier
+> choice and not a gate change; the receipt this cell is accepted on must be the one that actually
+> ran, never a `sol` run inherited from before. This says nothing about other cells: `smoke-omp-
+> fresh-live` keeps `openai-codex/gpt-5.6-sol`, the model its bootstrap callback was measured on.
+>
+> **This cell needs its launch directory ANSWERED, once, and that is a vendor fact rather than a
+> gate setting.** Codex records a direct folder decision per exact directory on this rail, so the smoke
+> launches in one stable path instead of a fresh `mkdtemp`, and it PRINTS that path as
+> `launch-cwd <dir>` on every run. **Do not spell it `$TMPDIR/entwurf-codex-fresh-live`** — the
+> smoke resolves it with `os.tmpdir()`, which is this host's `TMPDIR` when one is set and `/tmp`
+> when it is not, so on a host with no `TMPDIR` that shell expansion names
+> `/entwurf-codex-fresh-live` in the filesystem root: a different directory the vendor would ask
+> about separately. Derive it exactly:
+>
+> ```bash
+> node -e 'console.log(require("node:os").tmpdir() + "/entwurf-codex-fresh-live")'
+> ```
+>
+> Open a plain `codex -C <that path>` once, answer the prompt, and every later run is unattended.
+> Skip it and the smoke says so in its own assertion before anything is launched —
+> `codex-launch-cwd-undecided` with the exact repair command, not a callback timeout twenty
+> assertions later. **That precondition belongs to this gate, not to the product:** an ordinary
+> `entwurf_fresh_call` only prints the same note and opens the window, because a human can answer
+> the screen. Here nobody can, which is the whole reason the gate asserts it.
 >
 > The command name is not proof. The first leg must be a real record-backed visible Pi
-> citizen outside the Codex home opening Codex; if a fixture or self-fetch receipt collector
+> citizen in a session OTHER than the app-server's opening Codex; if a fixture or self-fetch receipt collector
 > is what OPENS Codex, the gate does not satisfy the topology. A fixture that only COLLECTS
 > receipts beside that real Pi leg is not the disqualifier — substituting for the leg is (see
 > `docs/adding-a-harness.md`, the same wording). The receipt must separately name the initial
 > Pi, app-server, fresh Codex, and outbound Pi coordinates.
 >
+> **Running the 37-minute qualification on a memory-pressured host.** `[측정 2026-09-16,
+> thinkpad, 27 GiB]` `check-gate-qualification` took 37m37s and was killed three times by the
+> HARNESS's low-memory watchdog — not by any gate, and not by the kernel OOM killer. Each kill
+> left the checkout intact (the runner restores it) but discarded the run. Detaching it with
+> `setsid` survived, at the cost of the harness no longer tracking it: completion raises no
+> notification, so a separate waiter is needed for the signal. Record this as a host condition
+> rather than a gate property — it says nothing about the candidate, and the same command on a
+> less pressured host needs none of it.
+>
 > Authoritative per-cut counts and digests live in BASELINE/CHANGELOG, not inline
 > here; embedding them in the protocol makes a correct guide stale after every cut.
 
@@ -108,7 +150,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
-| Native Codex host | explicit-home first admission accepted 2026-09-12 | Operator-owned birth/MCP/statusline atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: initial Pi outside the existing exact `codex` home; app-server, omitted-placement fresh Codex, and outbound Pi inside it; exact callbacks and addressed delivery both ways. `DELIVERY.md` owns the 57-assertion receipt and digest. Arbitrary attached-TUI placement is unsupported and unclaimed. |
+| Native Codex host | caller-seat topology accepted 2026-09-16 (56 assertions, exit 0); caller-DIRECTORY axis accepted the same day (65 assertions, exit 0) | Operator-owned birth/MCP/statusline/terminal-title atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: the app-server alone in session A (`$30/@41/%45`, pid 737636), and initial Pi / omitted-placement fresh Codex / Codex-opened outbound Pi all in a different session S (`$2`, `@46`/`@47`/`@48`; `@58`/`@59`/`@61` in the lane C run); exact callbacks and addressed delivery both ways. A ≠ S is the load-bearing half — the app-server's inherited `TMUX` names A, so the outbound Pi landing in S can only have come from the caller's own pane title, and its receipt records `seat-source=codex-title-anchor`. **#95 lane C added the second axis to the same card: WHERE the sibling starts.** Hop 1 joins four authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor rollout's `session_meta.cwd`, the Entwurf record and the requested scratch — and hop 1's leg requests a cwd while hop 2 requests NONE, so hop 2's directory can only come from the Codex caller's own record; both are asserted different from the app-server's live `/proc/<pid>/cwd`. 65 and 56 are different contracts, not a regression. The 2026-09-12 fixed-home chain is PAST CONTRACT (#95 D1); `DELIVERY.md` owns every receipt and digest. Placement beside a TUI whose thread nobody named is unsupported and unclaimed. |
 
 The repo-local `entwurf-release` skill owns the `land → prepare → make → publish`
 state machine. Each mode is a separate GLG authorization. Preserve one candidate,
@@ -137,6 +179,26 @@ The manual `pi --session` path is used only when (a) the entwurf path itself is
 - Execute one command at a time (no `;`-chaining). Preserve full stdout/stderr at each step.
 - On anything wrong, **stop and hold** — preserve session/cache/process state before proceeding.
 
+### Choosing the affected set for an inner loop
+
+The inner loop runs only affected gates, so the cost of that choice is a gap nobody sees until the
+full floor runs. Two rules exist because both gaps were paid for on the #95 lane B candidate, with
+every focused gate green at the time:
+
+- **Mutant manifests are keyed by SUBJECT FILE, not by lane.** Edit a file and check every
+  `scripts/mutants/*.json` whose `subject` names it, not only the lanes you wrote. `[측정
+  2026-09-16]` renaming one local in `mcp/entwurf-bridge/src/index.ts` left
+  `FRESHCALL-CODEX-PREMUTATION-MCP` in a manifest the lane never touched; qualification reported
+  it `MUTANT-STALE` (find matched 0×). **A stale mutant is a claim nobody is testing** — its
+  assertion keeps passing while the mutation that gives it meaning is never applied — which is why
+  this is a red rather than a warning. `check-gate-manifests` validates shape and inventory in
+  seconds but cannot see a find that no longer matches; only the executing body can.
+- **Any `mcp/entwurf-bridge/src/**` edit owes `pnpm run build-bridge` plus
+  `./run.sh check-bridge-delivery` in the same inner loop.** `[측정 2026-09-16]` the same candidate
+  reached `check:full` with a stale compiled entry and failed in 22 seconds on "artifact is not
+  stale". The installed surfaces run compiled JS (Hard Rule 11), so an un-rebuilt `dist` means the
+  focused gates proved the source while every package-shaped gate still judged the previous build.
+
 ### Wording — avoid safety-interpretation contamination
 
 When injecting a fact for a continuity check, use **plaintext that does not trigger model safety interpretation**. Avoid `secret token`, `password`, `API key`, `credential`, and meta-directives like "do not leak" — such wording makes the model treat the prompt as an exfiltration attempt and refuse, which makes **continuity look broken even when it is alive** (this happened once with `test-token-123`, misdiagnosed as a delegation failure). Instead: `The password is owl → reply in one word → owl`; code names / colors / animal names. Do not mix continuity and safety-behavior verification in one prompt.
@@ -171,7 +233,7 @@ The goal is not merely "invoke Claude Code." We want:
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
 6. Copilot four-unit composition (birth → MCP → receiver → visible footer) — only when `copilot` is on PATH (#86 C3b); the units run independently, each keeps its package-owned install-state and inverse, and a failed unit is a named component FAIL. The explicit `install-copilot-*`/`uninstall-copilot-*` surfaces remain the per-unit repair and inverse path
-7. Codex composition — only when `codex` is on PATH: setup publishes all three operator-owned atoms and stays non-green until the vendor's trust receipt for the birth declaration exists; it never invokes sudo, never writes `[hooks.state]`, and never starts the app-server or creates the `codex` tmux home. Its setup cells prove the exact `env_vars` boundary, independent component outcomes, idempotence, the non-green-until-trusted verdict with its named operator repair, and that setup never writes the receipt itself. First-admission qualification follows the separate explicit-home LIVE; unrestricted attached-TUI placement is outside the claim.
+7. Codex composition — only when `codex` is on PATH: setup publishes all four operator-owned atoms (birth, MCP, status line, terminal title) and stays non-green until the vendor's trust receipt for the birth declaration exists; it never invokes sudo, never writes `[hooks.state]`, and never starts or seats the app-server. Its setup cells prove the exact `env_vars` boundary, independent component outcomes, idempotence, the non-green-until-trusted verdict with its named operator repair, and that setup never writes the receipt itself. First-admission qualification follows the separate caller-seat LIVE; unrestricted attached-TUI placement is outside the claim.
 8. `entwurf-bridge` install smoke (`validate_entwurf_bridge`)
 9. computed summary — per-component PASS/SKIP/FAIL; any detected-integration FAIL makes the whole command exit nonzero while valid components stay installed
 
@@ -329,7 +391,7 @@ The minimum passing bar:
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its seven current tools, and presents a backend-native (not normalized) tool surface.
 6. **Carrier separation honored:** engraving vs pi-context-augment kept distinct (§1A.0); no bridge-identity narrative attributed to the engraving carrier.
 7. **agy shipped lane accepted:** all three agy doctors are green; automatic birth/statusline/sender identity and same-gid native-push reply are confirmed in a fresh conversation. `agentId=meta-session/antigravity` is correct; model display is not part of that contract. Same-pid concurrent conversation invocation is not claimed.
-8. **Codex first-admission home topology accepted:** its birth/MCP/status-line doctors are green and the on-demand real visible `Pi → Codex → Pi` cell records four coordinates: initial Pi in a session other than the exact existing `codex` home; operator-owned app-server, omitted-placement fresh Codex, and Codex-opened outbound Pi in that home; exact callbacks and addressed delivery succeed both ways. Missing home/app-server rejects without mutation. Entwurf neither creates nor supervises them, infers attached-TUI panes, nor claims unrestricted client placement. Codex remains outside ACP and has no resume claim.
+8. **Codex caller-seat topology accepted:** its birth/MCP/status-line/terminal-title doctors are green and the on-demand real visible `Pi → Codex → Pi` cell records four coordinates: the operator-owned app-server in its own session A; initial Pi, omitted-placement fresh Codex, and Codex-opened outbound Pi all in a DIFFERENT session S; exact callbacks and addressed delivery succeed both ways. A ≠ S is a precondition, not a preference — the app-server's inherited environment names A, so an outbound Pi in S can only have come from the caller's own pane title, and the receipt must name `codex-title-anchor` as the rule that chose it. 0 or 2+ matching panes, and a caller whose `[tui].terminal_title` lacks `thread-id`, reject without mutation. Entwurf neither creates nor supervises the app-server, infers attached-TUI panes, nor claims placement beside a TUI whose thread nobody named. (The 2026-09-12 fixed-`codex`-home acceptance this condition replaced stays recorded in `DELIVERY.md` as history; #95 D1 retired that room.) Codex remains outside ACP and has no resume claim.
 9. **Boundary preservation across backends/machines:** for every shipped or explicitly probed backend, regardless of install path or host, no cross-backend tool-surface contamination and no confabulation about pi internals.
 10. **Hygiene:** no orphan ACP children; no unexpected persisted session garbage (a turn-scoped `cwd:` fallback is never a persisted reuse).
 11. **New-harness admission closed:** a release that introduces a native harness admitted under the #82 contract has that harness in `FRESH_CALL_BACKENDS` on all three public surfaces, with `check-harness-admission-parity` green and its clause 7 visible-fresh LIVE step green in the MUST tier. That release also owes the cross-harness leg the same release stop names — two dispatch receipts, an existing citizen's live turn delivered into the new citizen and the new citizen's live turn delivered into an existing one — recorded in `DELIVERY.md`; its deterministic half is an owed follow-up, so until that gate lands this half of the condition is prose and is judged by the recorded receipts. Partial evidence is a branch state; an `unsupported` note in `DELIVERY.md` never weakens this stop.

package/docs/external-mcp-host.md

@@ -133,15 +133,19 @@ Use the owned surfaces rather than editing `~/.codex/config.toml`:
 entwurf install-codex-birth
 entwurf install-codex-mcp
 entwurf install-codex-statusline
+entwurf install-codex-terminal-title
 
 entwurf doctor-codex-birth
 entwurf doctor-codex-mcp
 entwurf doctor-codex-statusline
+entwurf doctor-codex-terminal-title
 ```
 
 The birth unit owns a `SessionStart` declaration in `$CODEX_HOME/hooks.json`, which the vendor
-runs only after the operator trusts it once in a visible Codex; the other two units own
-only `[mcp_servers.entwurf-bridge]` and the `thread-title` status-line member. The MCP
+runs only after the operator trusts it once in a visible Codex; the other three units own
+only `[mcp_servers.entwurf-bridge]`, the `thread-title` status-line member, and the `thread-id`
+terminal-title member (that last one is the CALLER seat input: without it a Codex citizen opening
+a sibling is refused with `codex-caller-title-missing`). The MCP
 entry carries `ENTWURF_BRIDGE_NATIVE_HOST=codex`, which tells the bridge to require and
 reconcile Codex request `_meta`. Do not add the anonymous hatch.
 
@@ -149,15 +153,21 @@ Native receive and visible fresh require the operator-owned default app-server.
 does not start or supervise it:
 
 ```bash
-CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
-codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
+entwurf codex-app-server
 ```
 
+`entwurf codex-app-server` owns the spelling of that one vendor command — it `exec`s
+`codex app-server --listen unix://<default socket>` in the terminal it was typed in, resolving
+the address through the same leaf delivery reads. It never supervises, restarts or daemonizes
+what it becomes.
+
 Birth occurs on the first turn, not window open. It mints
 `record.nativeSessionId = threadId` and sets the visible thread title to the garden id.
 `entwurf_v2` probes the loaded-thread list and sends once through `codex queue`; it never
-retries. `entwurf_fresh_call` accepts `backend: "codex"` after all three owned units and
-the default socket pass preflight. Codex remains outside ACP and has no resume surface.
+retries. `entwurf_fresh_call` accepts `backend: "codex"` after the birth, MCP and status-line units
+and the default socket pass preflight; the fourth unit, `install-codex-terminal-title`, is what a
+Codex CALLER needs to open a sibling at all (without it the caller has no resolvable seat and the
+call is refused as `codex-caller-title-missing`). Codex remains outside ACP and has no resume surface.
 
 #### Antigravity CLI (`agy`)
 

package/docs/setup-clean-host.md

@@ -27,7 +27,7 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
-| OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all three operator-owned units (birth/MCP/status-line) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires an operator-owned existing tmux session named `codex`, with its app-server and supported TUIs seated there | native-push and visible fresh, supported in 0.21.0 |
+| OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all four operator-owned units (birth/MCP/status-line/terminal-title) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires the operator-owned app-server, started with `entwurf codex-app-server` in a tmux session of the operator's choosing (#95 D1 retired the fixed `codex` home) | native-push and visible fresh, supported in 0.21.0 |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
 Claude Code >=2.1.217 is required for the managed exec-hook lifecycle. The package
@@ -404,23 +404,58 @@ why `disabledServers` is never the way to hide an import.
 Supported in 0.21.0 with Linux-focused evidence; on macOS it is NOT CERTIFIED —
 pending physical host. It is native, not ACP: the purpose is to preserve the operator's
 Codex tools, delegation, and work context rather than provide another GPT access path.
-Entwurf owns three atoms, not the harness and not a daemon:
+Entwurf owns four atoms, not the harness and not a daemon:
 
 ```bash
-# All three are operator-scope; `entwurf setup` runs them when it detects Codex. No root.
+# All four are operator-scope; `entwurf setup` runs them when it detects Codex. No root.
 entwurf install-codex-birth
 entwurf install-codex-mcp
 entwurf install-codex-statusline
+entwurf install-codex-terminal-title
 
 entwurf doctor-codex-birth
 entwurf doctor-codex-mcp
 entwurf doctor-codex-statusline
+entwurf doctor-codex-terminal-title
 ```
 
+The first three make a Codex session a citizen others can reach. The fourth makes it a CALLER:
+`thread-id` in `[tui].terminal_title` is the only thing that tells the multiplexer which pane is
+this thread's, so without it a Codex citizen opening a sibling is refused with
+`codex-caller-title-missing` (an explicit `placement.tmuxSession` skips that check entirely).
+
+**One thing here is NOT an entwurf atom, and installing everything above does not supply it: the
+directory a sibling starts in must be one this Codex has an answer for.** A DIRECT decision is
+recorded per exact directory on this rail — no parent, no git root — and a directory with no
+answer anywhere opens a consent screen instead of running a first turn, which unattended looks
+exactly like a sibling that never called back; `entwurf_fresh_call` prints
+`codex-launch-cwd-undecided` and opens the window anyway, because that screen is self-repairing and
+answering it once is the whole fix. That is the ordinary outcome and not the only one. Either recorded
+answer passes: a deliberate `untrusted` is skipped by the vendor on this rail and its turn starts.
+A project `.codex` layer can consent with no entry at all. A directory INSIDE an explicitly
+`untrusted` project is noted under a different name (`codex-launch-cwd-untrusted-ancestor`)
+because the vendor answers that with `pass the repository root explicitly with --cd` rather than a
+prompt — launch at that root instead.
+
+The check is a narrow LOCAL read of your own `config.toml`, not the vendor's verdict: the vendor
+merges system, managed and cloud layers around that file, so everything this check cannot see is
+allowed through rather than guessed at. The repair for the ordinary case is the vendor's own, done
+once per directory you launch siblings into: open a plain `codex -C <dir>` there and answer the
+prompt. Name that directory literally — a `$TMPDIR`-style
+spelling silently becomes a different path on a host where `TMPDIR` is unset, and the vendor keys
+its consent to the exact string.
+
 The birth atom publishes a `SessionStart` declaration into `$CODEX_HOME/hooks.json` with its
 launcher closure under `$XDG_DATA_HOME/entwurf/codex-birth`; it mints a V3 record on the
 thread's first turn and sets the thread title to the garden id.
 
+It owns that ONE declaration, not the file. Another integration may declare its own
+`SessionStart` group in the same hooks.json — Herdr's official Codex integration does — and the
+vendor runs both, because trust is keyed per declaration. So installing into a file somebody else
+already wrote is an append, not a refusal; uninstalling takes out only entwurf's group and leaves
+every neighbouring byte where it was; and `doctor-codex-birth` lists the neighbours in their own
+FOREIGN section, certifying none of them and letting none of them move its verdict.
+
 **One step is the operator's, and no command can do it for them.** The vendor will not run a
 user-layer hook until it has been trusted once: open a visible plain Codex, answer
 `Trust all and continue`, then send one first turn. `doctor-codex-birth` reads the receipt the
@@ -433,30 +468,41 @@ answer, later sessions raise no prompt and are born automatically. The MCP write
 `TMUX`, and `TMUX_PANE`.
 The status-line writer owns only `thread-title`. Foreign or symlinked config is refused.
 
-Native delivery requires the operator-owned default app-server and one existing tmux session
-named exactly `codex`. Start the app-server from a pane there and seat supported Codex TUIs there:
+Native delivery requires the operator-owned default app-server. The operator chooses the tmux
+session that holds it: #95 D1 retired the requirement that the session be named `codex`, and Entwurf
+neither creates nor supervises it. For the LIVE acceptance that session must NOT be the one the
+Pi/Codex pair runs in.
 
 ```bash
-# Run these commands inside the operator-owned tmux session named exactly `codex`.
+# Run from a pane in the operator-owned tmux session that will hold the app-server. One
+# command: entwurf spells the vendor's `app-server --listen unix://<default socket>` for you,
+# creates the control directory, and exec()s it here. Ctrl-C is yours; nothing supervises it.
+entwurf codex-app-server
+
+# Attach your own visible Codex TUI from wherever you work — any session, not a reserved room.
 CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
-mkdir -p "$CODEX_HOME/app-server-control"
-codex app-server --listen "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
 codex --remote "unix://$CODEX_HOME/app-server-control/app-server-control.sock"
 ```
 
-Omitted Codex fresh placement resolves exact `codex` on the caller's tmux server. The app-server's
-`TMUX`/`TMUX_PANE` is forwarded to its MCP child, so a Codex citizen's omitted outbound Pi placement
-stays in that home. It is **not** an arbitrary attached-TUI pane join. Exact Codex 0.153.4 source
-exposes no request→attached-TUI-seat carrier, so clients attached from other sessions have no
-adjacency claim; that wider topology is unsupported and unclaimed. Entwurf does not guess panes,
-create the tmux home, expose a generic app-server manager/API, or start/restart the server. Custom
+Omitted fresh placement follows the CALLER on the caller's own tmux server: a Codex citizen opens
+beside its own TUI pane, matched by the `thread-id` that pane's terminal title carries, with 0 or 2+
+matching panes refused and no fallback. The app-server's `TMUX`/`TMUX_PANE` is still forwarded to its
+MCP child, but it locates stores rather than a seat. It is **not** an arbitrary attached-TUI pane
+join: exact Codex 0.153.4 source exposes no request→attached-TUI-seat carrier, so a pane whose thread
+nobody named has no adjacency claim, and that wider topology stays unsupported and unclaimed. Entwurf
+does not guess panes, create a tmux session, expose a generic app-server manager/API, or
+start/restart the server. Custom
 `CODEX_HOME` and Entwurf roots cross the same explicit `env_vars` boundary. Strict request `_meta`
 identifies the thread caller, not its seat. Delivery uses one `codex queue` invocation with no retry.
 
-The 2026-09-11 loaded-thread run remains pre-amendment native-push/identity evidence. The final
-first-admission acceptance passed on 2026-09-12: real initial Pi outside `codex`, then omitted-placement
-Codex and outbound Pi inside it, with exact callbacks and addressed delivery both ways. `DELIVERY.md`
-owns the 57-assertion receipt, four coordinates, and digest.
+The 2026-09-11 loaded-thread run remains pre-amendment native-push/identity evidence. The
+first-admission acceptance passed on 2026-09-12 under the fixed-home topology #95 D1 later retired:
+real initial Pi outside `codex`, then omitted-placement Codex and outbound Pi inside it, with exact
+callbacks and addressed delivery both ways. `DELIVERY.md` owns that 57-assertion receipt, its four
+coordinates, and its digest as history. The caller-seat re-run is **accepted** — 2026-09-16, 56
+assertions for the seat topology and 65 for the caller-DIRECTORY axis, both exit 0 — and it, not the
+fixed home, is the current contract (`DELIVERY.md`, `BASELINE.md:37-38`, `VERIFY.md` release
+acceptance).
 
 `entwurf_fresh_call` accepts backend `codex` — supported in 0.21.0 — and requires an explicit model. Its
 preflight must prove the safe birth closure, exact MCP/env atom, `thread-title`, and app-server
@@ -465,7 +511,11 @@ never the launch receipt. There is no Codex resume surface, watcher, supervisor,
 lifecycle ownership. The accepted LIVE used a real record-backed visible Pi for the first leg;
 release-gate stripped ambient `PI_SESSION_ID`/`PI_AGENT_ID`, and the fixture/self-fetch citizen only
 collected receipts. The smoke reported initial Pi, app-server, fresh Codex, and outbound Pi
-coordinates separately: the initial Pi differed and the latter three matched the exact `codex` home.
+coordinates separately: the initial Pi differed and the latter three matched the exact `codex` home,
+which was the contract at that date. #95 D1 (2026-09-16) retired that room — an omitted seat is now the
+caller's own session for every backend, and the reshaped card requires the app-server to sit in a
+DIFFERENT session from the Pi/Codex pair, because that is what tells the caller-pane anchor apart from
+the app-server's inherited environment.
 Qualification and the frozen full floor are complete for this lane: `check-gate-qualification`
 killed 475/475 across 43 lanes with origin purity green, `check:full` exited 0, and the LIVE release
 gate reported MUST 24/0/0 with `cut: OK`. The bounds above are unchanged — no request→arbitrary
@@ -481,9 +531,10 @@ ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
 entwurf smoke-codex-fresh-live
 ```
 
-Run this from a tmux session other than `codex`. The entrypoint name does not waive the contract
-above. A fixture/self-fetch citizen may collect receipts but cannot replace the real visible Pi leg;
-a Pi that starts inside the Codex home proves only the weaker shared-seat mechanism.
+Run this from a tmux session OTHER than the one the app-server is in. The entrypoint name does not
+waive the contract above. A fixture/self-fetch citizen may collect receipts but cannot replace the real
+visible Pi leg; a Pi that starts in the app-server's own session proves only the weaker shared-seat
+mechanism, because both the anchor and the env fallback would answer the same room.
 
 ## 5. Optional Antigravity native citizen
 

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -64,7 +64,6 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.js";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
@@ -74,9 +73,9 @@ import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contr
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
+import { dispatchFreshCall, renderDispatchedFreshCall } from "../../../pi-extensions/lib/fresh-call-dispatch.js";
 import { probeNativeSenderAlive, reconcileSenderIdentityClaims, resolveCodexRequestSenderIdentity, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
 import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
-import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
@@ -270,7 +269,7 @@ async function resolveAuthoritativeSender(context, cwd = process.cwd()) {
     if (!selected)
         return null;
     if (codex && codex.identity.gardenId === selected.id) {
-        return buildMetaSenderEnvelope(codex.identity, codex.identity.cwd);
+        return { ...(await buildMetaSenderEnvelope(codex.identity, codex.identity.cwd)), codexThreadId: codex.threadId };
     }
     if (marker && marker.identity.gardenId === selected.id) {
         return buildMetaSenderEnvelope(marker.identity, marker.marker.cwd || cwd, marker);
@@ -598,29 +597,29 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Five fixed " +
-    "backends only: pi, claude-code, copilot, omp, codex. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
-    "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
-    "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
-    "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
-    "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
-    "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
-    "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot; a fuzzy model pattern for omp or codex). Copilot, omp, and codex are refused BEFORE " +
-    "any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent. " +
-    "Codex additionally requires the operator-owned default app-server socket; entwurf never starts or supervises it. " +
-    "An optional " +
-    "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
-    "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
-    "An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own tmux server. " +
-    "When omitted, Codex targets the exact existing `codex` home session; other backends target the caller's session. " +
-    "A missing named/home session is tmux-session-missing and NOTHING is created. " +
-    "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
-    "same-user processes on this host. Requires that this agent itself runs " +
-    "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and hand it a first task. WHERE it opens is decided by where THIS " +
+    "agent runs, never by a parameter: inside herdr (HERDR_ENV=1) it opens a NEW UNFOCUSED TAB in your own " +
+    "herdr workspace, pi and claude-code " +
+    "only; everywhere else it opens in the operator's tmux with all five backends (pi, " +
+    "claude-code, copilot, omp, codex). No fallback: an incomplete herdr context is refused by name, " +
+    "never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
+    "is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
+    "address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
+    "coordinates plus that nonce): it does NOT mean the runtime started, the first turn ran, or " +
+    "the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +
+    "a running sibling. Nothing polls. " +
+    "For EXISTING citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the chosen " +
+    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, a pattern for the rest). On tmux, copilot/omp/codex are refused BEFORE any window " +
+    "opens when their birth, MCP, receive or visible-identity units are absent, and codex also needs the " +
+    "operator-owned app-server socket entwurf never starts; in herdr they are refused by name first. " +
+    "Optional placement.tmuxSession is a TMUX-ONLY seat naming ONE EXISTING session and " +
+    "ALWAYS wins; omitted, the seat follows the CALLER, never the backend opened: a CODEX CALLER opens beside " +
+    "its own TUI pane, every other caller in its own session; a missing one is tmux-session-missing and " +
+    "NOTHING is created. In herdr the field is refused by name. Do not put secrets in the task — model and task argv are visible to same-user " +
+    "processes.", {
     backend: z
         .enum(["pi", "claude-code", "copilot", "omp", "codex"])
-        .describe("Which fixed runtime to open. Only these five; there is no arbitrary command."),
+        .describe("Which fixed runtime to open. Only these five, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -643,7 +642,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     cwd: z
         .string()
         .optional()
-        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
+        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start where the CALLER is — this agent's own cwd on BOTH rails, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. Taken exactly as given: no trim, no realpath, no project-name resolution. '#' is refused on the tmux rail only, because tmux format-expands a start directory; inside herdr it is an ordinary path character. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed."),
     placement: z
         .object({
         tmuxSession: z
@@ -651,12 +650,26 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
             .describe("EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid."),
     })
         .optional()
-        .describe("Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server. When omitted, Codex selects the exact existing `codex` home session; other backends use the caller's session. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id."),
+        .describe("Optional expert seat override, TMUX ONLY: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Inside herdr this field is refused by name — placement there belongs to herdr, and a tmux session name would silently place the sibling somewhere else. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id."),
 }, async ({ backend, model, task, cwd, placement }, extra) => {
     let callerGardenId = null;
+    // Present exactly when the reconciled caller is a record-backed codex citizen. Its ONLY
+    // consumer is the placement below: a Codex caller with no explicit seat opens its sibling
+    // beside its own TUI pane, found by that thread's terminal title (#95 lane B).
+    let callerNativeSessionId;
+    // The SAME citizen's record cwd, set under the SAME condition and carrying no further
+    // authority: `envelope.cwd` is only the record's directory when the selected sender is
+    // that codex citizen, so the two are derived from one fact rather than read separately.
+    // It exists because `process.cwd()` here is the operator-owned APP-SERVER's directory —
+    // this bridge is its MCP child — so a codex caller that names no cwd would otherwise open
+    // every sibling in the app-server's repo (#95 lane C §1). The composition consults it only
+    // when the tool call requested no cwd of its own.
+    let callerCwd;
     try {
         const self = await buildAuthoritativeSelfEnvelope({ requestMeta: extra._meta });
         callerGardenId = self.envelope.sessionId;
+        callerNativeSessionId = self.codexThreadId;
+        callerCwd = self.codexThreadId === undefined ? undefined : self.envelope.cwd;
     }
     catch (err) {
         // ONE error is a legitimate answer here: this host has no authoritative identity at all
@@ -671,11 +684,21 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const missing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
-        const result = missing
-            ? { ok: false, reason: missing }
-            : freshCall({ backend, model, task, cwd, placement, callerGardenId });
-        const rendered = renderFreshCall(result);
+        // Rail choice, Codex preflight ordering and rendering all live in the composition root,
+        // so this surface and pi's own cannot drift apart on any of them. The two caller-derived
+        // codex inputs ride with the request: the root consults them only on the tmux rail,
+        // which is where #95 lane B/C measured them.
+        const dispatched = await dispatchFreshCall({
+            backend,
+            model,
+            task,
+            cwd,
+            placement,
+            callerGardenId,
+            callerNativeSessionId,
+            callerCwd,
+        });
+        const rendered = renderDispatchedFreshCall(dispatched);
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {