@junghanacs/entwurf 0.22.0 → 0.23.1

package/AGENTS.md

@@ -82,6 +82,8 @@ Keep at most ten open issues, including at most five implementation issues. Clas
 
 Two independent axes are required: deterministic/package gates and opt-in LIVE evidence. Exact commands, evidence levels, and release acceptance are owned by [VERIFY.md](./VERIFY.md); recorded host evidence by [BASELINE.md](./BASELINE.md). Run LIVE gates from scratch with ambient identity carriers stripped so artifacts and callbacks cannot bleed from the operator session.
 
+A new contract's test goes beside the behavior it certifies — `pi-extensions/**/*.test.ts` or `plugins/herdr/**/*.test.mjs` — and `check-tests-beside-behavior` discovers it by glob, so landing one edits no filename list. `scripts/check-*` stays the home of LIVE, install, spawning and mixed gates; a new hand-built gate there needs a reason the vitest lane could not carry it.
+
 ### Scheduling
 
 ```text
@@ -97,7 +99,7 @@ implement → affected focused gates → independent review → one amendment bu
 
 ## Type and Working Boundaries
 
-- Each `.ts` file belongs to one declared typecheck fence; never hide a file with `exclude`. Root pi extensions use TypeBox through `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS.
+- Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. Root pi extensions use TypeBox through `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
 - Make surgical, one-contract changes. Removal repairs source and its proof together; a green gate never proves retired behavior.
 - Before commit, sweep repository-wide for retired authority vocabulary and landed-plan future tense. Historical tombstones may remain; live docs, source, gates, and usage must agree.
 - Prefer capability-domain language over identity rank. Use tabs unless the project formatter requires otherwise. GLG decides commit, push, and release gates.
@@ -115,6 +117,7 @@ implement → affected focused gates → independent review → one amendment bu
 - [ROADMAP.md](./ROADMAP.md) — direction and deferred work.
 - [docs/adding-a-harness.md](./docs/adding-a-harness.md) — entry route for a new harness.
 - [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) — mux ownership and launch contracts.
+- [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md) — herdr launch rail (#116): two-step placement, the one-line birth argv, and within-generation reclaim. `entwurf_fresh_call` selects it from process context (`HERDR_ENV=1`, pilot `pi | claude-code`), never from a caller parameter and never as a fallback either direction.
 - [docs/acp-backend-rail.md](./docs/acp-backend-rail.md) — ACP adapter contract.
 - [DELIVERY.md](./DELIVERY.md), [VERIFY.md](./VERIFY.md), [BASELINE.md](./BASELINE.md) — delivery coordinates, verification protocol, and evidence.
 - [README.md](./README.md) — operator-facing package contract.

package/BASELINE.md

@@ -34,6 +34,7 @@ not **UNSUPPORTED** — the deliberate never, which today is native Windows only
 | Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
 | Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
 | macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental remains unscheduled; no cut has carried it. |
+| 0.23.1 release acceptance (observer-amended) | accepted by GLG | `pnpm run check:full` P4 exit 0 (577 s); second aggregate `release-gate --cut` at `/tmp/entwurf-release-gate-0.23.1-retry.UIFctR` reached MUST 23/1/0 and BEHAVIOR 1/0, with only `smoke-codex-fresh-live` red because luna dropped `$`/`@` sigils in its relay (`release-gate.log:6156-6157`). The observer-amended standalone cell reran that exact leg with Codex `gpt-5.6-terra`, Pi `openai-codex/gpt-5.6-luna`: 66 assertions, exit 0; A app-server PID `3969303` `$227` ≠ fixture S `$231`; artifact `.probe-artifacts/codex-fresh-live-eZmf6p/`; pipe-pane stdout sha256 `56ee73e046e16fa95ef093fccf037670bf28b53a054bb5eec2a3b3b3ff08d93a`. Luna sigil handling is a post-cut issue, not a production-byte change. |
 | Native Codex Linux caller-DIRECTORY axis (current; #95 lane C) | **certified** | 2026-09-16, Codex 0.153.4: 65-assertion LIVE, exit 0, at `b3e07dc` with a clean worktree. Same host and topology as the lane B row below (app-server `737636` in A `$30/@41/%45`; initial Pi `20260916T154902-556eb5` `$2/@58`, Codex `20260916T155037-10ddaa` `$2/@59`, Codex-opened Pi `20260916T155102-9add8a` `$2/@61`, `seat-source=codex-title-anchor`). **hop 1 (cwd requested):** pane `#{pane_current_path}` = rollout `session_meta.cwd` = record cwd = requested scratch = `/tmp/entwurf-codex-fresh-live-db65N2`, against app-server cwd `/home/junghan/repos/gh/entwurf` read from `/proc/737636/cwd`. **hop 2 (cwd NOT requested):** the outbound Pi's pane, its own birth-written record and the Codex caller's record all read that same scratch, and its receipt names the caller-record rule. Artifact `.probe-artifacts/codex-fresh-live-w4yJBw/`; stdout `.probe-artifacts/lane-c-live-20260916T154900.log` sha256 `712050e7a8cf03ece98e7f34029ae98a92e9b2a7fd96aff87d0c1e6ba2ee9af2`. Cleanup reclaimed `@58`/`@59`/`@61` with no failure; records and transcripts preserved; app-server and `$30` untouched. 65 and 56 are different contracts — lane C added the cwd axis on top of lane B. Long floors (qualification body, frozen `check:full`) NOT run at this SHA; GLG decides host vs CI. |
 | Native Codex Linux caller-seat topology (current; #95 lane B) | **certified** | 2026-09-16, Codex 0.153.4: 56-assertion LIVE, exit 0. App-server `737636` alone in session A `$30/@41/%45`; initial Pi `20260916T144205-e876ff` `$2/@46`, omitted-placement Codex `20260916T144230-d050d7` `$2/@47`, Codex-opened Pi `$2/@48`. A ≠ S is the decisive half: the app-server env names A, so S can only have come from the caller's pane title — receipt `seat-source=codex-title-anchor`. Artifact `.probe-artifacts/codex-fresh-live-nYcGC1/run-stdout.log` sha256 `ed60c2bd…`; the 43-assertion hop-1 run that measured the D1 retirement is kept at `codex-fresh-live-4aFCDD/run-stdout.log` sha256 `8392a603…`. Cleanup reclaimed `@46`/`@47`/`@48` with no failure; app-server and `$30` untouched. |
 | Native Codex Linux home topology (PAST CONTRACT — #95 D1 retired the fixed home 2026-09-16) | **certified** for 0.21.0 as shipped | 2026-09-12, Codex 0.153.4: 57-assertion explicit-home LIVE. Initial Pi `$150/@397`; operator app-server `$158/@390/%390`; omitted-placement Codex `$158/@398`; Codex-opened Pi `$158/@399`; exact callbacks and addressed delivery both ways. Receipt and digest: `DELIVERY.md`. Deterministic closure of that axis: qualification 460/460 across 43 lanes with origin/snapshot purity green, then frozen full floor exit 0 in 506s — both pre-amendment. **Observer-amended acceptance, 2026-09-12:** standalone LIVE 48 assertions exit 0, source audit `initial-pi=3/3`/`codex=3/3` completed exact, initial Pi `$150/@431`, Codex `$158/@432`, Codex-opened Pi `$158/@433`, all three reclaimed by their own source receipts; artifact `.probe-artifacts/codex-fresh-live-fZccoK/`. The 48 and 57 counts are different contracts, not a regression. **Release acceptance at that same fingerprint:** `check:full` exit 0 502s, LIVE release gate `--cut` MUST 24/0/0 · BEHAVIOR 1/0/0 · `cut: OK`, `check-gate-qualification` 475/475 across 43 lanes with origin purity green, and the aggregate's Codex leg repeating the 48-assertion acceptance (artifact `codex-fresh-live-2oId4C`). Unrestricted attached-TUI placement remains unsupported and unclaimed. |

package/CHANGELOG.md

@@ -4,6 +4,520 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.23.1 - 2026-09-19
+
+### Changed
+
+- **The plugin runtime lock names `herdr-checkout` again, for the length of the 0.23.1 candidate
+  window.** This is a state, not a direction: an `npm` lock must name a version that is ALREADY
+  published and coherent with this checkout's `package.json`
+  (`certifyLockCoherence`, asserted on the committed lock by `check-herdr-runtime-bootstrap` 8a,
+  which sits inside `check:hermetic`), and the version bump necessarily lands before the publish.
+  So a cut cannot ride an npm lock naming the version it is about to create. `dd84ac0` is the
+  precedent and the exit: 0.23.0 was tagged on the checkout carrier and pinned to npm afterwards,
+  and 0.23.1 follows the same two steps. While this window is open, `smoke-herdr-raw-install-live`
+  reports the npm acquisition axis as a NAMED SKIP rather than a failure, and still asserts that
+  the runtime came from the source this ref locks.
+
+  **A pin and its inverse move the lock AND `check-herdr-plugin-build` together**, which is a fact
+  worth writing down because it has now been rediscovered twice. That gate reads the COMMITTED lock
+  in three places — the two-stage journey expects one acquisition and the locked `kind@version`, the
+  activation-authority cell seeds its ledger from the committed kind, and the progress cell pins the
+  long-step wording — so `dd84ac0` changed 90 lines of it alongside the eight lines of lock, and
+  this commit is the measured inverse of both halves (14/14 assertions, exit 0). No mutant is
+  disturbed: every claim in `scripts/mutants/herdr-plugin-build.json` names a production file
+  (`herdr-plugin.toml`, `lib/build.mjs`, `lib/build-progress.mjs`), none names the gate, and the
+  `HPB-PROGRESS-NAMED-SEQUENCE` needle re-aimed by `37b81e7` still occurs exactly once in
+  `lib/build.mjs`, which this commit does not touch. Teaching the gate to read either lock kind,
+  so neither direction needs it flipped again, is deferred to its own issue after the cut.
+
+### Added
+
+- **A test written beside the behaviour it certifies is run by public `pnpm check`, and nobody
+  names the file** (#119 V2). `vitest.config.ts` include grows two globs —
+  `pi-extensions/**/*.test.ts` and `plugins/herdr/**/*.test.mjs` — and `check-tests-beside-behavior`
+  expands them every run and hands the resulting paths to `run_vitest`. Both halves were measured
+  the hard way. The first cut passed `pi-extensions plugins/herdr` as vitest POSITIONALS, which are
+  path substrings, so `test/pi-extensions-probe.test.ts` was selected too (measured: it ran);
+  expanding first keeps the selected set exactly the two globs while the shim still contains no
+  filename. And an empty expansion RETURNS rather than calling vitest with no arguments, because a
+  vitest run with no filter runs the whole include. The literal cross-check against
+  `vitest.config.ts` stays, because the shell cannot read vitest's resolved config and a deleted
+  glob would otherwise pass. Proven by three still photos in one public `pnpm check`: two failing
+  beside-behaviour tests turn it red (`selected 2`), and a third file planted under `test/` is not
+  selected.
+- **`entwurf pi`** (#118 hop 2) — `exec pi --entwurf-control "$@"`, a dispatcher case with no new
+  bin. Two things it deliberately does NOT do, both measured on pi 0.85.1: there is no
+  precondition check, because an unregistered host already gets `Error: Unknown option:
+  --entwurf-control` and exit 1 from pi itself; and the flag is added, never deduplicated, because
+  passing it twice was measured byte-identical to passing it once. One recursion fence, not
+  copilot's two — the sentinel closes the real loop, and the case copilot's second fence covers is
+  measured here to be a fail-closed unknown verb rather than a loop. `check-pi-launch` reuses
+  `check-copilot-launch`'s fake-vendor posture and carries the `--entwurf-control` literal
+  cross-check, since the shell cannot import `ENTWURF_CONTROL_FLAG`. Nine mutants, each killed by
+  exactly its own claim; exit-status passthrough is asserted without one, because `set -euo
+  pipefail` couples it to `exec` and a mutant that kills two claims attributes to neither.
+- **`smoke-herdr-raw-install-live`** (#118 hop 1) — the plugin's first user path, on a clean
+  `node:24` container with no host socket/config/cache mounted, no git `insteadOf`, and the public
+  remote spelled as a user would type it. It closes the one npm re-proof axis VERIFY.md demanded
+  and the production lock had left empty since `dd84ac0`. Receipts: **(a)** `--ref main` →
+  `37b81e725cde4d0a548f1c0faab4fcb5c62942b2`, **(b)** `--ref set/119-verify-herdr` →
+  `11ec0c38af36d5cd4a59614c3c8e07c5b5b0f9ae`, both `kind=npm @junghanacs/entwurf@0.23.0` with the
+  ledger widening `["pi"]` → `["pi","claude-code"]` and the pi wiring byte-identical across the
+  reinstall. Three facts it measured rather than assumed: herdr's offline-persist path carries
+  0.9.1, so `plugin install --yes` completes with no server; `herdr integration install` refuses a
+  harness that has never run, because it creates `~/.pi/agent/extensions` only when the parent
+  exists and refuses Claude without `~/.claude`; and `--ref` takes a REMOTE REF, not an arbitrary
+  commit (`--ref <sha>` fails as `couldn't find remote ref`).
+
+### Changed
+
+- **`plugins/herdr` 0.3.0 — the Install path, rewritten as the nine steps a raw box needs.** The
+  eighth and ninth are the ones nobody guesses and they come from the container measurement above:
+  each harness must be started once (`pi --help`, `claude mcp list`) before herdr will integrate
+  it. The release says what it does NOT give you, because the honest combination is this plugin
+  plus the runtime its lock still names: `entwurf pi` exists in the repository and is not in
+  `@junghanacs/entwurf@0.23.0`, so the user command stays `pi --entwurf-control` until the next
+  cut carries the launcher. **`runtime-lock.json` is untouched on purpose** — a pin can only move
+  after the version it names is published, so the 0.23.1 pin is a follow-up commit after that
+  release, the same two-step `dd84ac0` took for 0.23.0.
+- **Thirteen v2-spine gates moved out of `scripts/` and beside the modules they certify** (#119
+  V3), assertion for assertion, with the inventory's denominator fixed FIRST so the move reads as
+  a move. `inventory-verification-surface.ts` now counts both vitest locations; without that, the
+  migration would have subtracted 2,799 lines from the one number that exists to make migration
+  honest. What actually left is 133 lines of plumbing — per-file `ok()` scaffolding, `main()`
+  wrappers, summary trailers — and the combined file count is unchanged, seven out and seven in
+  per slice.
+  - The six mutant-carrying lanes needed four rules the mutant-free seven did not, each learned by
+    getting it wrong: a QK claim must BE an `it` title (attribution reads the failed test title);
+    the token must appear exactly once per file (title keeps the token, assertion keeps the
+    sentence); the `run.sh` case survives as a mutant EXECUTION COORDINATE and keeps its
+    `check:contracts` entry (branch CI caught the removal — a gate a mutant names must run inside
+    `check:full`); and attribution is containment, not exclusivity (vitest runs every test, so one
+    mutation surfaces 1–15 failed titles). 25/25 mutants verified killed and attributed by hand;
+    733 mutants across 58 lanes unchanged, `signatureSource` moved, gate argv did not.
+  - `entwurf-v2-visible-resume.test.ts` grew 445 → 908 lines and the growth is the design:
+    seventeen claims that shared four drives of the subject now each replay their own, because
+    nearly every one is an "X happened BEFORE Y" reading a call-order trace, and a trace polluted
+    by a neighbouring test answers wrongly while staying green.
+  - Three gates stay under `scripts/` with a reason: `check-entwurf-v2-contract` and
+    `check-entwurf-v2-production` are cross-lane (`mux-boundary.json` and `codex-native.json` call
+    them as gate argv), and `check-entwurf-v2-surface` generates its seven QK labels inside shared
+    helpers called twice from `await` blocks, so the established method would either lose
+    attribution or require an async `describe`.
+
+
+- **The bundled Claude ACP adapter is `@agentclientprotocol/claude-agent-acp` 0.79.0** (from
+  0.76.0, crossing 0.77.0/0.78.0/0.79.0; `@anthropic-ai/claude-agent-sdk` 0.3.257 → 0.3.274,
+  ACP wire SDK 1.4.0 and `@anthropic-ai/sdk` 0.100.1 unchanged). Three upstream releases, three
+  changes with a reachable shape, and **no entwurf code change** — each "inert" is a fresh
+  measurement, not the previous bump's argument reused:
+  - 0.77.0's BREAKING removal of `claudeCode.options.agent` misses us twice: our
+    `buildClaudeSessionMeta` never set that key, and we spawn the adapter's binary rather than
+    importing the removed agent-picker exports (repo-wide grep: 0 hits).
+  - 0.77.0's `allowDangerouslySkipPermissions` host opt-out is a NEW lever we do not pull. We set
+    the option nowhere, `ALLOW_BYPASS` is byte-identical across both versions, and the overlay's
+    `permissions.defaultMode: "bypassPermissions"` resolves the same under each, so a sibling's
+    effective permission mode is unchanged.
+  - 0.78.0's `compaction_update` / `compaction_summary_chunk` are the first new `sessionUpdate`
+    kinds since the pin moved, and they are gated off by our `clientCapabilities: {}` — with the
+    mapper's forward-compatible `default` arm as an independent second reason. The `stopReason`
+    axis, where "unknown is an error" actually applies, is unchanged.
+  - 0.79.0's shell-command permission prompts reorder the option array reject-first under the new
+    `defaultToNo` hint. Our approve-all policy selects by option KIND, not position, and every
+    upstream option builder emits an allow option, so the order-sensitive fallback is unreachable.
+  Re-measured and unchanged: the #96 `mcpServerStatus` evidence (2 call sites, now at
+  `v0.79.0 src/acp-agent.ts:1773`/`:1866`, surrounding 200-line window byte-identical) and all four
+  model-forcing/accounting wire calls (`setSessionConfigOption`, `sessionUsage`, `turnQuotaMeta`,
+  `resolveModelPreference` — byte-identical). Full per-change classification with evidence state:
+  [ROADMAP.md](./ROADMAP.md) 2026-09-18 bump entry and
+  [docs/acp-backend-rail.md](./docs/acp-backend-rail.md) capability posture.
+
+- **The Herdr plugin is 0.2.0 and pins its runtime to npm `@junghanacs/entwurf@0.23.0`.** Its
+  committed lock carries the published sha512
+  `sha512-ZR2VCui7JjK3w56rQSDs3AuAJMMuiXCNWH7HB52SQ3E/7p0oPhcxD+fb6Gdzi0VcBnheqxPzvJHMPQQcdYtNiw==`;
+  the 0.1.0 `herdr-checkout` source remains the candidate-verification path.
+
+## 0.23.0 - 2026-09-18
+
+### Added
+
+- **`entwurf_fresh_call` opens a sibling on the herdr rail, beside the tmux one (#116).** A session
+  running inside [herdr](https://github.com/steipete/herdr) has no tmux server to place a window
+  on, so the rail is chosen from PROCESS CONTEXT — `HERDR_ENV=1`, herdr's own marker, read for its
+  exact value — and never from a caller parameter, which would let someone request tmux placement
+  from inside herdr and fail after a mutation instead of before one. There is **no fallback either
+  direction**: an incomplete herdr context is refused by its own herdr reason rather than quietly
+  opening a window the operator cannot see from where they are standing. The pilot backends are
+  `pi` and `claude-code`; `placement` is refused BY NAME there, because placement inside herdr
+  belongs to herdr and a tmux session name would silently relocate the sibling.
+  Coordinates, refusals, reclaim and evidence grades: [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md).
+  - One composition root (`fresh-call-dispatch.ts`) now owns rail choice, the Codex preflights and
+    the render call for BOTH public surfaces, so a defect planted in one surface can no longer
+    survive on the other. The rail-neutral half of the composition (argv dialects, callback tool
+    names, first-turn framing, nonce, input contract) moved to `fresh-call-composition.ts`, which
+    knows nothing about tmux; each rail supplies only what it alone can state.
+  - A sibling is placed in a NEW TAB of the caller's own herdr workspace, without taking focus,
+    with the workspace read from herdr's answer about the caller's own pane — never the focused
+    workspace and never the `w<N>:` prefix of an id this rail treats as opaque. Orphan reclaim is
+    proven within a generation and closes the PANE rather than the tab (`[측정 2026-09-15]`).
+  - `entwurf_peers` carries a read-only `placement` column with four words
+    (`unobserved` / `none` / `ambiguous` / `herdr <pane>`), joined only on an official herdr report
+    for its own backend. A pane coordinate is a VIEW, never an address: the garden id still arrives
+    in the callback envelope (Hard Rule 16).
+- **A herdr plugin that installs entwurf onto a host where nothing entwurf is on `PATH`.**
+  `plugins/herdr/` bootstraps a stable, scoped plugin runtime from an exact checkout candidate,
+  classifies which integrations the host already has, activates only what it owns, and ships a
+  read-only citizen status pane built on the core's own `peer-facts` projection. The install
+  reports NAMED steps on the operator's terminal and ends with one usage example per activated
+  backend, because `[GLG 직접, 2026-09-17]` "정확한 모델명을 모른다" was a real blocker on a clean
+  install. Entwurf still installs only Entwurf bytes — never a harness, subscription or login
+  (Hard Rule 17) — and a clean NixOS host additionally needs `programs.nix-ld.enable = true` for
+  the ACP rail's dynamically linked vendor binary.
+
+- **A gate keeps the typing-call boundary by NAME, not by prose alone.** `[외부 관측 2026-09-17
+  19:35]` an outside reader measured this tree and found the law perfectly kept and nothing keeping
+  it: zero typing calls across `pi-extensions/`, and zero checks and zero mutants that would notice
+  one arriving. Gates here grow on top of incidents, and this boundary was named and REFUSED at
+  design time (`docs/herdr-launch-rail.md` §3 threw the keystroke verb away before it shipped), so
+  it never produced the failure that would have produced a test — and a rule kept since day one is
+  the most defenceless kind, because its green means only that nobody has broken it yet.
+  `check-typing-call-fence` scans every TRACKED AND UNTRACKED production source under
+  `pi-extensions/`, `mcp/`, `plugins/herdr/` and `scripts/herdr-*.mjs` for the names of typing calls
+  — tmux `send-keys` / `paste-buffer` / `load-buffer` and herdr's PTY verbs `agent.prompt` /
+  `agent.send_keys` / `pane.send_text` / `pane.input.set` — with comments blanked and string
+  literals KEPT, because a typing call spelled as a string is the call.
+  - The comment exemption is load-bearing rather than a convenience: the sentence that states the
+    rule contains the very names the rule forbids, so a scanner that read prose would be red on the
+    law itself and the cheapest way to green would be deleting the law.
+  - Three assertions stand in front of the claim for the same reason — the detector is proven to SEE
+    each name planted in code, proven BLIND to the same name in a comment, and the scanned inventory
+    is measured, because without those "zero hits" and "looked at nothing" print identically.
+  - **What it does not catch is named in its own header rather than implied:** it reads SPELLINGS,
+    so a verb assembled at runtime passes it. That limit is accepted rather than closed. This is a
+    tripwire for the slip — a module reaching for the vendor's typing verb because the argv route
+    looked harder that afternoon — not a defence against somebody hiding one, and a gate claiming to
+    be the latter would be the more dangerous object. The claim therefore says CARRIES a typing call
+    spelled out, which is what it measures.
+  - `scripts/` stays out as a whole: this gate lives there, and a gate that scanned itself could
+    only be made green by deleting the names it exists to forbid. Wired into `check:hermetic`;
+    8 checks over 85 production sources, one exact-once mutant.
+- **The framing OFFERS its corroboration in a spelling the sibling can actually use.** The callback
+  tool name goes through a per-backend dialect map; the peer listing the first turn offers did not,
+  and four of the five backends reach that tool under a composed MCP name. The offer was unusable by
+  exactly the siblings it was written for — and it was written to replace a prohibition, removed
+  because a sibling should be able to check who called it. `FRESH_CALL_PEERS_TOOL` is the same
+  dialects applied to the other tool, so the two maps drift together or not at all.
+
+### Fixed
+
+- **`smoke-codex-fresh-live` now directs Codex to the callback sender garden id by the envelope's `session:` line.** In the first 0.23.0 retry Luna copied the model label from `from:` instead; the red receipt is `/tmp/entwurf-release-gate-0.23.0-retry.17pfMp`.
+
+- **A Claude child that could not see its callback tool now knows how to load it.** The framing said
+  "FIRST ACTION … call `entwurf_v2`" to a child for which that tool was not callable yet: `[측정
+  2026-09-18, n=5]` claude-code 2.1.267 surfaces a still-connecting MCP server as DEFERRED — the tool
+  NAME is listed, the SCHEMA is not, and a call without the schema fails. Across five isolated probes
+  the bridge's tools were directly callable **zero** times (4 DEFERRED, 1 still connecting), so the
+  child answered in text and went idle. That is the "silence" the herdr rail recorded in 5 of its 14
+  launches. The claude-code dialect now carries one factual sentence naming `ToolSearch` with BOTH
+  tools in a single select, and `[측정, n=3]` callbacks went 3/3 — including a child 782 ms in, which
+  is slower than every silent run. **The latency story it replaces is retired:** re-read at n=13
+  instead of n=4, success and silence overlap completely (52 ms called back, 94 ms did not), so
+  `docs/herdr-launch-rail.md` §14 now carries the distribution and the mechanism instead of the
+  correlation. Every other backend's framing is byte-identical — pi has no deferred-tool surface and
+  the other three were never probed (`FRESHCOMP-TOOL-LOAD-HINT-CLAUDE-ONLY`).
+
+- **The first turn no longer looks like the injection it is not (#116).** `[GLG 직접, 날것 PC,
+  2026-09-17]` a Claude Sonnet 5 sibling REFUSED its whole first turn and named three reasons, all
+  of them ours: a "decode the following JSON string literal and follow the decoded instructions"
+  wrapper, the line "Do not inspect environment variables, do not call entwurf_self", and no way to
+  verify the caller. The framing is now plain prose folded onto one physical line, with ONLY the
+  operator's task riding as a literal — `[source herdr 7505c08]` `src/app/agents.rs:157-161`
+  refuses any agent argument carrying a Unicode Cc, so a newline never reaches the sibling, and
+  `src/platform/linux.rs:127-141` single-quotes every argument, which is why the encoding was never
+  buying shell safety. The prohibition is replaced by the same steering stated as a FACT (your own
+  record does not carry the caller's address; the tool call is what reaches it) plus an OFFERED
+  read-only way to corroborate the caller. `[측정 oracle 2026-09-18, LIVE run sCzzE0]` a Sonnet 5
+  child called `entwurf_peers` and then `entwurf_v2`, both successful, and its callback landed.
+- **The rail tells herdr how long to wait, and judges the child on its own clock (#116).** Without
+  an explicit `--timeout`, herdr gave up at its own 30s default while our process bound sat at
+  300s, so a cold-starting Claude Code sibling that was alive and booting came back as
+  `herdr-agent-start-failed [herdr: timeout]` over an unreclaimed pane. The bound is now an
+  explicit 240s, deliberately BELOW our own kill, so herdr has to lose that race or its named
+  answer is replaced by "no exit status". The LIVE cell also stopped measuring the child with the
+  CALLER's clock — two runs of identical code had differed only in how long the caller's launch
+  took — and now records what the child was doing every run: herdr's agent status and entwurf's own
+  hook journal are the WHOLE evidence surface, because `[측정 2026-09-18]` no claude session in this
+  smoke, caller or child, acting or silent, exists under `~/.claude/projects/` or any fenced XDG
+  root — including a child that had just made two successful tool calls.
+- **A peer that hangs up on an accepted control socket no longer takes the resident with it.** The
+  connection error is handled where the socket is accepted, so a half-open peer is a bounded
+  per-connection failure instead of an uncaught exception.
+- **The uncitizened `entwurf_self` notice is proven, not regexed.** The gate asserted the shape of
+  a message instead of the fact it reports, which a reworded notice would have broken while a
+  wrong notice passed.
+
+
+- **The Codex birth unit owns its own declaration, not the whole `hooks.json` (#117).** Installing
+  Herdr's official Codex integration appends a second `SessionStart` group to
+  `$CODEX_HOME/hooks.json`. The vendor kept running BOTH declarations — `[source]`
+  `codex-rs/hooks/src/engine/discovery.rs:664-665` hashes a normalized event/matcher/group/handler
+  and keys trust by `<path>:<event>:<group_idx>:<handler_idx>`, so trust was declaration-scoped all
+  along — but entwurf's certification was file-scoped: `install-state` recorded a whole-file
+  sha256 and the fresh preflight additionally required `SessionStart.length === 1`. On a host with
+  both installed, `doctor-codex-birth` was RED and every Codex fresh launch was refused
+  `codex-birth-unit-missing`. **v0.22.0's release LIVE was measured with Herdr's hooks moved
+  aside; this is the debt that names paid.**
+  - Ownership is now exactly one `SessionStart` group holding one handler whose `command` is our
+    quoted launcher path. It is certified by SHAPE (which keys may exist) and by a NORMALIZED
+    digest (recursively sorted keys, no whitespace) — blind to indentation and key order, because
+    `[측정 2026-09-17 oracle]` Herdr re-serializes the entire document through serde, which changed
+    our own handler's key order from `type,command,timeout` to `command,timeout,type`.
+  - The vendor trust receipt is read at the index our declaration was MEASURED at, never at the
+    constant `:0:0`. With a neighbour at index 0 that constant read THEIR approval and reported it
+    as ours — a green for a hook the vendor had never been asked to run.
+  - Neighbours are `present-but-foreign`: reported in the doctor's own FOREIGN section, certified
+    by nothing, never overwritten or absorbed, and no input to any verdict of ours. Editing one
+    moves nothing.
+  - Install into a file somebody else already declares in is an APPEND by text splice (never an
+    adoption and never a refusal), and appending rather than inserting leaves a neighbour's index —
+    and therefore their existing trust receipt — alone. Uninstall splices out only entwurf's group
+    (plus entwurf's own top-level `description`), removing the file only when entwurf was its sole
+    declaration. Every splice is re-parsed and deep-compared to the value it intended before it
+    reaches disk; a splice that lands anywhere else is a zero-write refusal.
+  - Our own declaration missing, edited or DUPLICATED is still a named red, in install, doctor,
+    inverse and preflight alike.
+  - Entwurf still never creates, computes, pre-seeds or bypasses a vendor trust receipt, and
+    deliberately does NOT recompute what that hash should be: the vendor normalizes with its own
+    code, and reimplementing it here would make entwurf a second opinion about somebody else's
+    security decision that drifts with every vendor release.
+  - `install-state` moves to `codex-birth-install-state/v2` (declaration receipt instead of
+    `hooksSha256`). The uninstall, doctor and preflight read v2 only and refuse v1 by name; the
+    installer reads a v1 receipt once, to supersede it forward — it removes nothing and rewrites no
+    foreign byte.
+  - New shared leaf `pi-extensions/lib/codex-declaration.js` is the single definition the
+    installer, inverse, doctor, fresh preflight and gates all decide with.
+  - Gates: `smoke-codex-birth` 102 checks (both orderings green, foreign bytes proven across
+    install and inverse, foreign edits neutral, own-declaration drift/duplication/v1 named red,
+    trust read at the measured index, the shared file's mode carried over, and an unscanned
+    FOREIGN axis reporting NOT READ rather than "none"), `check-codex-birth-hook` 101 checks (the
+    leaf's digest, selection, named refusals, span reader and splice post-condition), six new
+    preflight cells, and 8 exact-once mutants (inventory 520 → 527). Six existing
+    `FRESHCALL-CODEX-*` mutants were re-pointed at the predicates this narrowing moved;
+    `FRESHCALL-CODEX-HOOK-KEYS` moved gate as well, because under the preflight's oracle an extra
+    handler key is caught by the digest anyway — what its predicate still buys is the NAME.
+    Verification receipts at `ac3f1f8`: `pnpm run check:full` exit 0 (403s) and
+    `check-gate-qualification` **527/527 killed**, both in the exact-SHA CI run
+    [35239086438](https://github.com/junghan0611/entwurf/actions/runs/35239086438).
+  - **Not in scope, by decision:** adding Codex to `HERDR_FRESH_CALL_BACKENDS`, Herdr env carriers
+    on the Codex MCP child, plugin supervision of the app-server, and the identical ownership
+    defect in the statusline/terminal-title atoms (recorded as an Observation, its own atom).
+
+- **A sibling herdr has not been introduced to yet is no longer killed for it.** `[측정 oracle
+  2026-09-18, LIVE run XimC19]` a Claude Code child booted, wrote its own birth record at
+  01:53:38.297Z, and 0.585s later this rail closed the pane it was sitting in. The same bytes passed
+  five minutes later (run TCatjF) because that child took 1m27s to become ready instead of 4.9s — so
+  the FAST path was the dangerous one, and every green run before it was luck rather than proof.
+  - The premise was that `agent start` waits for detection before returning. It does not:
+    `[file:line @ c77af189]` `src/cli/agent.rs:592-615` returns on `agent_status ∈ {idle,done}` plus
+    `interactive_ready`, and `agent_session` is not in that condition at all. On the Claude rail that
+    id arrives afterwards from the CHILD's own one-shot hook
+    (`src/integration/assets/claude/herdr-agent-state.sh:60-99`, 0.5s socket deadline, failures
+    swallowed), so "herdr has not been told the id" is a reachable resting state for a healthy
+    sibling.
+  - `settleAgentWitness` re-READS instead of judging on the spot: `agent get <the exact name we
+    started>`, never a listing, bounded and rebound to the create receipt every time. An unreadable
+    or failed read costs one poll, because herdr answers a missing agent and a socket that blinked
+    with the same exit status.
+  - **Expiry buys nothing.** The window closing is a SUCCESSFUL launch carrying a
+    `witness: unavailable` diagnosis that says what it costs (the peers `placement` column has
+    nothing to join) and what it does not (the address was never a pane). The old
+    `witness-missing → reclaim` path is gone; the one failure this stage can still name is a
+    readable reply about a DIFFERENT agent, `herdr-agent-start-vanished`.
+  - The reclaim predicate now reads OCCUPANCY, not the session id: a pane herdr says an agent is in
+    is never closed, whether or not anybody has reported that agent's session. Collapsing those two
+    facts is what made a booted child read as an empty pane, and it would have survived in every
+    other post-create failure branch if only the witness path had been patched.
+  - The settle bound is a PROPOSAL and says so in its own comment: the red run still had nothing
+    585ms after the child's birth record, the reporter's own deadline is 500ms, and the slow run's
+    85s was a race being hidden rather than a ceiling.
+- **The Codex birth unit decides who owns the shared `hooks.json` ONCE, for all four surfaces.** The
+  fresh-call preflight required a plausible owner and refused a group/world-writable mode; the
+  installer and the inverse asked only symlink-and-regular; the doctor read the file's CONTENT
+  without ever asking who owned it. A host could install clean, read GREEN, and have every Codex
+  launch refuse it as `codex-birth-unit-missing` — three surfaces saying yes about bytes the fourth
+  said no about. `classifyOwnedPath` now lives in the shared declaration leaf all four already load,
+  and it is PURE: it judges a stat record, not a path. A neighbour's MODE stays theirs (the install
+  still carries it over untouched); WRITING into a file anyone else can rewrite is the different
+  question, and the answer there is a zero-write refusal, because a receipt cannot bind bytes
+  somebody else controls. Symlink keeps its own verdict — the repair is not a mode change, it is a
+  different file.
+- **The inverse's FILE verdict earns its delete.** It could remove a `hooks.json` this unit never
+  created: the arm asked one question — is our group the last declaration — and that is true of a
+  file we merely APPENDED to. `{"description":"foreign","hooks":{"SessionStart":[]}}` has no foreign
+  GROUP, so after our install it classified FILE and the whole document went, a neighbour's
+  top-level bytes included. The receipt had recorded `hooksExistedBefore` since the installer was
+  written and nothing read it; it does now, with two more proofs beside it (the top-level keys are
+  exactly the two this unit writes, and the description is ours). Anything else SPLICES. An absent
+  field reads as "it was already there", so an older receipt licenses a splice and never a delete.
+- **The herdr LIVE oracle joins the callback it claims to have proved.** Its pi cell compared
+  CHARACTER OFFSETS across the whole transcript, and both strings are already in the birth prompt in
+  that order — so "called back, then worked" and "never called back" read identically. It now wants
+  ONE record carrying the delivered nonce and the `sent` outcome together, with the task token in a
+  later one. Its claude cell asserted only that the first `entwurf_v2` completed, which a call
+  delivering somebody else's nonce also satisfies; the join it can actually make is across two
+  independent artifacts — the delivered message carrying the exact nonce and the child as sender,
+  enqueued inside that call's own window.
+- **Three Codex branches and one peers read stop being claims nobody tests.** An independent
+  coverage audit found the whole production path behind the peers `placement` column — env gate,
+  binary execution, timeout, parse failure — with zero assertions and zero mutants, so a typo in
+  `["pane","list"]` or a deleted timeout would have left the deterministic floor green. It has two
+  claims now, driven through a stub PROCESS (not a fake herdr: every answer-shaped fact still comes
+  from the verbatim 0.9.0 recordings, and what the stub supplies is an exit code, a hang, an
+  absence). The doctor's ORPHAN verdict, the inverse's SPLICE arm and its FILE arm gained the
+  mutants their behaviour cells never had, and the herdr rail's documented cwd asymmetry — `#` is
+  DATA here, because herdr has no format expansion for the tmux refusal to protect against — gained
+  a cell that drives a real directory through to the argv.
+
+- **The herdr rail's two-step `agent prompt` proposal is closed at the VENDOR SOURCE, not with LIVE
+  runs — and not implemented.** §14 proposed starting the agent with no prompt and sending the first
+  turn with `herdr agent prompt`, which would remove the tool-list race. The question standing in
+  front of "does the child call back" is what that verb SENDS, and the vendor answers it:
+  `[source herdr 7505c08]` `api/agents.rs:195` hands the text to `encode_api_submission_parts`,
+  `api_helpers.rs:25-32` wraps it in bracketed paste and writes it to the child pane's PTY, and
+  `:13` / `:208-212` write an encoded Enter 300 ms later. It runs NO control-character check — only
+  a non-empty one, unlike the argv path — so whether a newline pastes or submits is decided by the
+  child terminal's paste mode at that instant rather than by a contract, and what is acknowledged is
+  that input was written (the vendor's own help: "before any input is sent", "It does not track
+  turns"). So the two-step is the keystroke channel §3 already measured and refused, and adopting it
+  would put screen input on the FIRST turn — exactly what Hard Rule 16 keeps out of delivery
+  evidence. The three LIVE runs budgeted for it were NOT spent characterising a path that cannot
+  ship. The remaining legitimate direction for the race is the framing that stands before the tool
+  list, the same axis as omp's `--entwurf-bootstrap`.
+- **Two mutant claims the #116 merge moved now aim at what they were about.** Replaying every lane
+  the merge touched answered 484/486, and both refusals were the merge's own bookkeeping.
+  `FRESHCALL-CWD-SURFACE-PARITY` SURVIVED because the regenerated find was extracted from the FIRST
+  `cwd: z` block in the bridge — which belongs to `entwurf_register_native`, not
+  `entwurf_fresh_call` — so the mutation deleted a required cwd from a DIFFERENT tool and nothing
+  failed; both parity finds are now extracted from inside the `fresh_call` registration span.
+  `FRESHCALL-CWD-CALLER-ONLY` came back WRONG-REASON because the mutation now lands in the
+  composition leaf while the cell carrying its signature read only the tmux module, so three other
+  cells failed instead and the kill could not be attributed.
+
+- **The first turn says where the result goes.** `[GLG 직접, 2026-09-18]` a fresh sibling finished
+  its task, printed the answer in its own window, and the caller never saw it. The investigation
+  found no broken injection: NEITHER framing, the retired one or the current one, had ever said
+  this. It used to work because a hand-written briefing named the target and the tool, and when the
+  briefing stopped doing that the sentence turned out to live nowhere. The framing now ends with two
+  lines — where to send the result (the callback tool, in the same backend dialect) and why sending
+  is needed at all, because a sibling with a visible window has no way to know its window is not the
+  delivery. It is TOPOLOGY, not a command: nothing watches for completion or sends on the sibling's
+  behalf, and a supervisor is what this rail refuses to be.
+- **A LIVE smoke stops taking the operator's `claude` launcher** — #67's failure on a rail born
+  after its fence. The vendor resolves the two halves of its install from different roots: the
+  version store from `XDG_DATA_HOME`, the launcher from `HOME`. This smoke fenced XDG while keeping
+  the real HOME, so each Claude child found an empty store beside a real launcher, installed itself
+  into the fixture, and repointed `~/.local/bin/claude` at `<fixture>/claude/versions/2.1.267`.
+  **That is not a hazard, it happened** — seven preserved fixture roots each hold that install, and
+  the operator's launcher pointed into the newest of them, one `/tmp` sweep away from a `claude`
+  that does not start. The fixture's `xdg-data/claude` is now a symlink to the operator's vendor
+  data dir, which puts store and launcher back in one install while the rest of the tree stays
+  fenced, and the smoke consumes the shared fence: fail-closed preflight, integrity oracle in
+  teardown, cleanup verdict. The gate side stopped naming files — `LAUNCHFENCE-EXPOSED-SMOKE-WIRED`
+  asks the POPULATION (every LIVE smoke that assigns a fixture `XDG_DATA_HOME` either consumes the
+  fence or carries an exemption verified against its own source: four today, three wired, one
+  exempt), because the two claims that listed smokes by name are exactly what the newest rail walked
+  past. `[LIVE 2026-09-18]` the first run in eight to leave zero version copies behind.
+- **The herdr LIVE ordering oracle reads the join pi actually writes.** The claim asked for ONE
+  transcript record carrying both the delivered nonce and the `sent` outcome; pi cannot write that
+  record, because the nonce rides the toolCall and the outcome rides a separate toolResult, joined
+  by `toolCallId`. So the oracle failed a run whose child did exactly what the claim describes
+  (callback 04:15:01.381, `sent` .415, task token .03.728) — the most expensive kind of red: correct
+  product, red gate, and a cut that stops for nothing. The join was what the claim was always about:
+  the `sent` outcome must belong, by that id, to THE call that carried THIS nonce, and the task
+  token must appear after it. Proven on the failing transcript — the real run holds, a forged pair
+  whose `sent` belongs to a different call does not, and a run whose token appears only before the
+  callback does not.
+
+### Changed
+
+- **The two tool descriptions say what the code does.** `entwurf_v2` no longer offers `codex` as an
+  example of a backend with no adapter: Codex is a native-push backend, and that sentence pointed a
+  caller at the wrong dispatch outcome. `entwurf_fresh_call` says it opens a NEW UNFOCUSED TAB in
+  the caller's own herdr workspace rather than "a herdr pane" — the contract has been tab-first
+  since it shipped. Both surfaces lost the top-level cwd sentence the `cwd` parameter description
+  already owns, which is also what kept them inside the 2048-char host cap.
+- **The herdr rail document describes the first turn that actually ships.** §3 still recorded the
+  retired shape — the whole framing wrapped in one JSON literal behind "decode the following" —
+  which a Sonnet 5 sibling refused outright. The current shape is plain prose with only the
+  operator's task as a literal, and the section now says why: the encoding never bought shell
+  safety (herdr single-quotes every argument), and what is left is the vendor's control-character
+  refusal, so only the thing that must carry newlines is encoded.
+- **`ROADMAP.md` and `docs/setup-clean-host.md` stop calling accepted work pending.** The Codex
+  caller-seat and caller-DIRECTORY re-runs were accepted on 2026-09-16 with 56 and 65 assertions;
+  both documents said "pending", and the roadmap's current-package line still read 0.20.1.
+- **`plugins/herdr/README.md` separates an admission floor from a measured supply.** Herdr
+  `>=0.9.0` is the manifest floor; Entwurf's reproducible and CI rail is pinned to exactly 0.9.1,
+  and a different Herdr inside the admission window carries no receipt of ours. Its install-output
+  example uses `<version>` / `<full-commit>` placeholders instead of a frozen `0.21.0` and a frozen
+  commit that no longer reproduce. Both READMEs now name the two installation routes and link to
+  each other.
+
+### Observations — named rather than carried
+
+These were raised by the pre-cut review round and deliberately NOT acted on in this release. Each
+one is recorded here so the next lane inherits the finding instead of rediscovering it.
+
+- **The vendor trust receipt is bound by KEY, not by VALUE.** `doctor-codex-birth` and the fresh
+  preflight read the receipt at the index our declaration was measured at and check that its value
+  has the shape `sha256:<64 hex>` — they do not check that the hash is the one the vendor would
+  compute for the CURRENT declaration, so a stale or arbitrary well-shaped value reads as ready.
+  Closing it would mean reimplementing the vendor's normalization here, which is exactly the second
+  opinion about somebody else's security decision that Hard Rule 9 and the doctor's own prose
+  refuse. The live failure mode is bounded and visible: a stale receipt makes the vendor show its
+  consent screen again to the human sitting there, and an unattended launch reads as a callback
+  timeout.
+- **The typing fence does not detect an assembled typing call** — see its header, and the entry
+  above.
+- **The declaration span fixtures do not pin CRLF, BOM or deeply nested arrays by name.** The parser
+  and its splice post-condition handled all three correctly in a direct memory-only sample; what is
+  missing is a labelled cell, and BOM in particular would read better as an explicit refusal than as
+  an incidental one.
+- **Four more coverage gaps were enumerated and left for their own lane:** the uninstall's v1-state
+  refusal has a behaviour cell but no mutant of its own, the `trustReceiptKey` composition is
+  asserted separately by the doctor and the preflight rather than jointly, and two spawn-seam
+  sub-claims were deliberately not split into their own QKs.
+- **The Claude child's `--allowedTools` names only the callback tool**, so the corroboration the
+  framing offers is not on the auto-approved list. Measured behaviour is unchanged by this release
+  (the bare spelling was not on it either), and widening auto-approval is a decision rather than a
+  repair.
+- **`doctor-codex-birth` FOREIGN 축은 이웃 선언의 trust 부재를 판단하지 않지만 vendor 동의 화면은
+  파일 단위로 첫 턴을 막는다.** `smoke-codex-fresh-live` 전제조건은 폴더 trust만 이름짓고 hook
+  trust는 timeout으로 읽힌다 — 컷 후 atom.
+
+### Verification
+
+- **Land exact-SHA CI.** Push run
+  [`35312087142`](https://github.com/junghan0611/entwurf/actions/runs/35312087142) at
+  `09aea576a80983709a7e2bb7593d6fb546234eee` concluded green for `check`,
+  `install-surface`, `artifact-consumer`, and `macos-install-surface`; the `check` job's
+  `check-gate-qualification` body also concluded green.
+- **LIVE Codex acceptance is a focused rerun, not a final `release-gate --cut` exit 0.** First cut
+  attempt `/tmp/entwurf-release-gate-0.23.0.Ire9Nr` was red because the vendor's Herdr hook trust
+  receipt was absent; the operator answered the vendor consent screen once. Retry
+  `/tmp/entwurf-release-gate-0.23.0-retry.17pfMp` recorded `MUST: PASS=23 FAIL=1 SKIP=0`; its only
+  red cell was `smoke-codex-fresh-live`, where Luna copied the model label from the callback
+  envelope's `from:` line. The frozen-candidate delta afterwards is exactly the two instruction
+  sentences in `scripts/lib/codex-fresh-live-protocol.ts` plus these CHANGELOG records. After
+  `pnpm run build-bridge` and `./run.sh check-bridge-delivery` (19 PASS), the repaired standalone
+  `smoke-codex-fresh-live` passed 66 assertions:
+  `/tmp/entwurf-codex-smoke-0.23.0-amend.BHrPTU/smoke-codex-fresh-live.log`.
+- **Deterministic floor and explicit variance.** `pnpm run check:full` passed before the amendment
+  at `/tmp/entwurf-check-full-0.23.0.Q6GGeI`; it also passed on the amended working bytes in 579 s
+  at `/tmp/entwurf-check-full-0.23.0-amend.zBu9ic/check-full.log`. VERIFY §389 문자 조건 미충족 —
+  GLG 명시 승인 하의 편차, 사유: 통과 스텝 재실행은 자원낭비. The prepared-HEAD exact-SHA CI owns
+  the final deterministic proof.
+
 ## 0.22.0 - 2026-09-17
 
 ### Added

package/DELIVERY.md

@@ -202,8 +202,16 @@ for the inherited case.
 
 Four ownership atoms remain separate:
 
-1. `entwurf install-codex-birth` owns `$CODEX_HOME/hooks.json` — one whole file, ours or
-   absent — plus its launcher and import closure under `$XDG_DATA_HOME/entwurf/codex-birth`.
+1. `entwurf install-codex-birth` owns **one `SessionStart` declaration inside**
+   `$CODEX_HOME/hooks.json` — not the file — plus its launcher and import closure under
+   `$XDG_DATA_HOME/entwurf/codex-birth`. The vendor keys trust per
+   `<path>:<event>:<group>:<handler>`, so a neighbouring integration (Herdr's official Codex
+   integration appends its own group) coexists: entwurf certifies the NORMALIZED digest and
+   shape of its own group, requires it exactly once, reads the vendor receipt at the index that
+   group was measured at, and reports every other group as present-but-foreign — certified by
+   nothing, rewritten never. Install appends and uninstall splices by text, so a neighbour's
+   bytes survive both unchanged. The ownership receipt is `codex-birth-install-state/v2`; a v1
+   receipt (whole-file digest) is refused by name and superseded forward by one reinstall.
    No root: every path belongs to the operator. The vendor gates a user-layer declaration on
    ONE interactive "Trust all", which entwurf never answers, pre-seeds or computes; the
    receipt is read as its own doctor axis, and until it exists setup is honestly non-green.