@junghanacs/entwurf 0.23.0 → 0.24.0

package/scripts/smoke-omp-fresh-live.ts

@@ -434,7 +434,9 @@ ok(
 // callback-only prompt is delivered first, and the task is released only by the exact
 // successful callback result. The transcript is where both are visible, in order, in one
 // native session.
-const bootstrapLine = buildOmpCallbackOnlyPrompt({ target: callerGid, nonce: nonce as string })
+// Since the callback moved out of band (ENTWURF_CALLBACK_TARGET/NONCE in the sibling env), the
+// callback-only prompt carries no address; the receipt is the no-arg first action itself.
+const bootstrapLine = buildOmpCallbackOnlyPrompt()
 	.split("\n")
 	.find((l) => l.includes("FIRST AND ONLY ACTION")) as string;
 const transcript = fs.readFileSync(transcriptPath as string, "utf8");
@@ -442,7 +444,7 @@ const callbackAt = transcript.indexOf(bootstrapLine);
 const taskAt = transcript.indexOf(sceneFact);
 receipts["5-two-stage-order"] = `callback-only prompt @${callbackAt}, task scene fact @${taskAt}`;
 ok(
-	"stage one is in the sibling's own transcript: the extension delivered the callback-ONLY prompt, carrying this call's target and nonce",
+	"stage one is in the sibling's own transcript: the extension delivered the callback-ONLY prompt (no-arg first action; the address rides the sibling env, never this prompt)",
 	callbackAt >= 0,
 	`        expected line: ${bootstrapLine}`,
 );

package/scripts/smoke-omp-mcp-state.sh

@@ -53,7 +53,7 @@ cat > "$SB/bin/entwurf-bridge" <<'FAKE'
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-pi-provider-state.sh

@@ -67,7 +67,7 @@ write_mcp_fake() {   # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE
@@ -93,7 +93,7 @@ write_stale_fake() {  # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"stale-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/tsconfig.json

@@ -28,6 +28,11 @@
 		"./**/*.ts",
 		"../test/**/*.ts",
 		"../pi-extensions/lib/**/*.ts",
+		// The behavior-adjacent tests the root config just excluded (#119 V2). Listed at
+		// pi-extensions/** rather than pi-extensions/lib/** so a test beside an extension
+		// OUTSIDE lib/ lands in a fence too — the root exclude is glob-wide, and a file in
+		// no fence is worse than a file in two.
+		"../pi-extensions/**/*.test.ts",
 		"../pi-extensions/model-lock.ts",
 		"../pi-extensions/meta-bridge-hook.ts",
 		"../pi-extensions/meta-bridge-hook-copilot.ts",

package/scripts/check-entwurf-facts.ts

@@ -1,391 +0,0 @@
-/**
- * check-entwurf-facts — deterministic gate for the fact-provider's pure core
- * (0.11 Stage 0 step 4, slice 1). Locks the FACT shape and the R1/R3b liveness
- * invariant in code BEFORE any IO wiring (gate-first).
- *
- * Proves:
- *   - R1 (out-of-domain → unsupported, NEVER coerced): claude-code / codex /
- *     antigravity resolve to `unsupported` for EVERY socket input (alive, dead,
- *     indeterminate, null) — the socket value is never folded into the fact for a
- *     backend whose liveness predicate is undefined.
- *   - R3b (in-domain 4-value): pi maps alive→alive, dead→dead,
- *     indeterminate→indeterminate, and null→indeterminate (no proof is
- *     `indeterminate`, never `dead`).
- *   - liveness is always a member of FACT_LIVENESSES.
- *   - identity / cwd-history fields pass through verbatim from the meta-record.
- *   - facts-only keyset: PeerFact carries EXACTLY the identity facts + `liveness`
- *     — no verb-routing field (resumable/sendable/transport/dispatch/action) and
- *     no transcriptPath. (동결결정 10: the fact layer must not bake routing.)
- *
- * Pure; no IO, no backend, no API.
- */
-
-import assert from "node:assert/strict";
-import {
-	type FactList,
-	isOutOfSocketDomainGardenIdConflict,
-	type PeerFact,
-	type RecordLessSocketFact,
-	resolveFactList,
-	resolvePeerFact,
-	type SocketProbe,
-} from "../pi-extensions/lib/entwurf-facts.ts";
-import {
-	FACT_LIVENESSES,
-	type FactLiveness,
-	isLivenessSupported,
-	LIVENESS_DOMAIN_BACKENDS,
-} from "../pi-extensions/lib/entwurf-v2-contract.ts";
-import { UNOBSERVED_PLACEMENT } from "../pi-extensions/lib/herdr-placement.ts";
-import {
-	META_CITIZEN_BACKENDS,
-	type MetaCitizenBackend,
-	type MetaIdentity,
-} from "../pi-extensions/lib/meta-session.ts";
-import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
-
-// Derive the backend coverage from the SSOT registry so a NEW backend in
-// META_CITIZEN_BACKENDS auto-extends this gate (Fable/GPT non-blocking suggestion):
-// out-of-domain backends must all resolve to `unsupported`, the in-domain set is
-// the only one with a defined liveness predicate. A drift assertion below pins
-// the in-domain set to ["pi"] so widening the domain forces new R3b coverage.
-const OUT_OF_DOMAIN = META_CITIZEN_BACKENDS.filter((b) => !isLivenessSupported(b));
-const IN_DOMAIN = META_CITIZEN_BACKENDS.filter((b) => isLivenessSupported(b));
-
-let passed = 0;
-function ok(label: string, cond: boolean): void {
-	assert.ok(cond, label);
-	console.log(`  ok    ${label}`);
-	passed++;
-}
-
-function identity(backend: MetaCitizenBackend, over: Partial<MetaIdentity> = {}): MetaIdentity {
-	return {
-		schemaVersion: 3,
-		gardenId: "20260611T093858-14984d",
-		backend,
-		nativeSessionId: "native-abc",
-		cwd: "/home/junghan/repos/gh/entwurf",
-		model: "claude-opus-5",
-		transcriptPath: "/home/junghan/.claude/projects/x/native-abc.jsonl",
-		createdAt: "2026-06-11T00:38:58.000Z",
-		recordUpdatedAt: "2026-06-11T02:40:00.000Z",
-		...over,
-	};
-}
-
-const SOCKET_INPUTS: (SocketLiveness | null)[] = ["alive", "dead", "indeterminate", null];
-
-// ── R1: out-of-domain backend → unsupported for EVERY socket input ──────────
-ok("R1 out-of-domain set is non-empty (gate is actually exercising R1)", OUT_OF_DOMAIN.length > 0);
-for (const backend of OUT_OF_DOMAIN) {
-	for (const socket of SOCKET_INPUTS) {
-		const fact = resolvePeerFact(identity(backend), socket);
-		ok(`R1 ${backend} + socket=${socket ?? "null"} → unsupported (not coerced)`, fact.liveness === "unsupported");
-	}
-}
-
-// Drift guard: the in-domain set is exactly the contract's domain and is ["pi"].
-// If the domain widens, this fails → forces adding R3b value coverage for the
-// new backend instead of silently leaving it untested.
-assert.deepStrictEqual(IN_DOMAIN, [...LIVENESS_DOMAIN_BACKENDS], "IN_DOMAIN ≠ LIVENESS_DOMAIN_BACKENDS");
-assert.deepStrictEqual(IN_DOMAIN, ["pi"], "liveness domain widened — add R3b coverage for the new backend");
-ok("drift guard: in-domain set == LIVENESS_DOMAIN_BACKENDS == ['pi']", true);
-
-// ── R3b: in-domain (pi) 4-value mapping, null = indeterminate (never dead) ──
-const PI_CASES: [SocketLiveness | null, FactLiveness][] = [
-	["alive", "alive"],
-	["dead", "dead"],
-	["indeterminate", "indeterminate"],
-	[null, "indeterminate"],
-];
-for (const [socket, expected] of PI_CASES) {
-	const fact = resolvePeerFact(identity("pi"), socket);
-	ok(`R3b pi + socket=${socket ?? "null"} → ${expected}`, fact.liveness === expected);
-}
-ok(
-	"R3b pi null is indeterminate, NOT dead (no proof ≠ dead)",
-	resolvePeerFact(identity("pi"), null).liveness === "indeterminate",
-);
-
-// ── liveness always ∈ FACT_LIVENESSES ──────────────────────────────────────
-for (const backend of META_CITIZEN_BACKENDS) {
-	for (const socket of SOCKET_INPUTS) {
-		const fact = resolvePeerFact(identity(backend), socket);
-		ok(
-			`liveness ∈ FACT_LIVENESSES (${backend}/${socket ?? "null"} → ${fact.liveness})`,
-			(FACT_LIVENESSES as readonly string[]).includes(fact.liveness),
-		);
-	}
-}
-
-// ── identity / cwd-history pass through verbatim ────────────────────────────
-{
-	const id = identity("pi", {
-		gardenId: "20260611T112732-0f42b6",
-		nativeSessionId: "uuid-xyz",
-		cwd: "/tmp/work",
-		model: null,
-		createdAt: "2026-06-11T01:00:00.000Z",
-		recordUpdatedAt: "2026-06-11T03:00:00.000Z",
-	});
-	const fact = resolvePeerFact(id, "alive");
-	ok("passthrough gardenId", fact.gardenId === id.gardenId);
-	ok("passthrough backend", fact.backend === id.backend);
-	ok("passthrough nativeSessionId", fact.nativeSessionId === id.nativeSessionId);
-	ok("passthrough cwd", fact.cwd === id.cwd);
-	ok("passthrough model (null preserved)", fact.model === null);
-	ok("passthrough createdAt", fact.createdAt === id.createdAt);
-	ok("passthrough recordUpdatedAt", fact.recordUpdatedAt === id.recordUpdatedAt);
-}
-
-// ── facts-only keyset: identity facts + liveness + the three observed axes, and
-// still NO verb-routing / no transcript PATH ────────────────────────────────
-{
-	const fact = resolvePeerFact(identity("pi"), "alive");
-	const keys = Object.keys(fact).sort();
-	const expected = [
-		"backend",
-		"createdAt",
-		"cwd",
-		"gardenId",
-		"liveness",
-		"model",
-		"nativeSessionId",
-		"recordUpdatedAt",
-		"receiver",
-		"transcript",
-		"placement",
-	].sort();
-	assert.deepStrictEqual(keys, expected, `PeerFact keyset drift: got ${keys.join(",")}`);
-	ok("facts-only keyset exact (identity facts + liveness + observed receiver/transcript/placement)", true);
-
-	// #101: an unmeasured row says so. `unobserved` is the default for a caller that
-	// injected no observer — never `none`/`absent`, which would be a fabricated fact.
-	ok(
-		"an observer-less composition reports all three axes as unobserved (never a default fact)",
-		fact.receiver === "unobserved" && fact.transcript === "unobserved" && fact.placement.kind === "unobserved",
-	);
-	const observed = resolvePeerFact(identity("claude-code"), null, {
-		receiver: "inactive",
-		transcript: "absent",
-		placement: UNOBSERVED_PLACEMENT,
-	});
-	ok(
-		"an injected observation rides onto the fact verbatim",
-		observed.receiver === "inactive" && observed.transcript === "absent" && observed.placement.kind === "unobserved",
-	);
-
-	const FORBIDDEN = [
-		"resumable",
-		"sendable",
-		"transport",
-		"dispatch",
-		"action",
-		"transcriptPath",
-		"parentGardenId",
-		"isEntwurf",
-	];
-	for (const k of FORBIDDEN) {
-		ok(`no '${k}' on PeerFact (facts-only, no verb-routing/transcript)`, !(k in fact));
-	}
-}
-
-// Type-level guard: the test references PeerFact so a field rename breaks tsc.
-const _typecheck: (f: PeerFact) => FactLiveness = (f) => f.liveness;
-void _typecheck;
-
-// ════════════════════════════════════════════════════════════════════════════
-// slice 2 — resolveFactList: meta-store ⨯ socket union (설계 동결 2026-06-11,
-// GPT힣 + Fable; #50 C4 demotion). PeerFact for record citizens,
-// RecordLessSocketFact for sockets no record claims — a DIAGNOSTIC subject the
-// provider folds into `record-less-socket`, never a citizen; gardenId is the
-// correlation key.
-// ════════════════════════════════════════════════════════════════════════════
-
-function socketProbe(gardenId: string, liveness: SocketLiveness): SocketProbe {
-	return { gardenId, liveness };
-}
-
-const GID_PI_LIVE = "20260611T115213-3aa371";
-const GID_PI_DORMANT = "20260611T093858-14984d";
-const GID_CLAUDE = "20260611T112732-0f42b6";
-const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
-
-// ── basic union: pi-live citizen + claude citizen + record-less live socket ──
-{
-	const ids = [identity("pi", { gardenId: GID_PI_LIVE }), identity("claude-code", { gardenId: GID_CLAUDE })];
-	const probes = [socketProbe(GID_PI_LIVE, "alive"), socketProbe(GID_SOCKET_ONLY, "alive")];
-	const out = resolveFactList(ids, probes);
-	ok("union: 2 citizens → 2 PeerFacts", out.peers.length === 2);
-	ok("union: 1 record-less socket → 1 RecordLessSocketFact", out.recordLessSockets.length === 1);
-	ok(
-		"union: pi-live citizen liveness = alive (from its probe)",
-		out.peers.find((p) => p.gardenId === GID_PI_LIVE)?.liveness === "alive",
-	);
-	ok(
-		"union: claude citizen liveness = unsupported (out-of-domain, socket ignored)",
-		out.peers.find((p) => p.gardenId === GID_CLAUDE)?.liveness === "unsupported",
-	);
-	ok("union: record-less gardenId surfaced", out.recordLessSockets[0]?.gardenId === GID_SOCKET_ONLY);
-}
-
-// ── dormant trap (Fable): pi citizen probed dead → dead (NOT indeterminate) ──
-{
-	const out = resolveFactList([identity("pi", { gardenId: GID_PI_DORMANT })], [socketProbe(GID_PI_DORMANT, "dead")]);
-	ok(
-		"dormant trap: pi citizen + probe=dead → liveness=dead (resumable, not stranded)",
-		out.peers[0]?.liveness === "dead",
-	);
-	ok("dormant trap: dead pi citizen is a PeerFact, never record-less", out.recordLessSockets.length === 0);
-}
-
-// ── F3 preserve: pi citizen probed indeterminate → not folded to dead ────────
-{
-	const out = resolveFactList([identity("pi", { gardenId: GID_PI_LIVE })], [socketProbe(GID_PI_LIVE, "indeterminate")]);
-	ok(
-		"F3 preserve: pi citizen + probe=indeterminate → indeterminate (never folded)",
-		out.peers[0]?.liveness === "indeterminate",
-	);
-}
-
-// ── wiring invariant: unprobed in-domain citizen → throw (null is unprobed-only) ─
-{
-	let threw = false;
-	try {
-		resolveFactList([identity("pi", { gardenId: GID_PI_LIVE })], []);
-	} catch {
-		threw = true;
-	}
-	ok("wiring invariant: in-domain citizen absent from probes → throw (never silent null/indeterminate)", threw);
-}
-
-// ── fail-loud (동결3): out-of-domain citizen owning a control socket = ambiguity ─
-{
-	let threw = false;
-	try {
-		resolveFactList([identity("claude-code", { gardenId: GID_CLAUDE })], [socketProbe(GID_CLAUDE, "alive")]);
-	} catch {
-		threw = true;
-	}
-	ok("dedup/authority: out-of-socket-domain citizen + same-gid socket → fail-loud", threw);
-}
-
-// ── dedup (동결3): pi citizen + its socket → PeerFact only, never both ────────
-{
-	const out = resolveFactList([identity("pi", { gardenId: GID_PI_LIVE })], [socketProbe(GID_PI_LIVE, "alive")]);
-	ok("dedup: pi citizen consumes its socket (1 PeerFact)", out.peers.length === 1);
-	ok("dedup: consumed gid not also emitted as RecordLessSocketFact", out.recordLessSockets.length === 0);
-	const allGids = [...out.peers.map((p) => p.gardenId), ...out.recordLessSockets.map((s) => s.gardenId)];
-	ok("dedup: no gardenId appears in both sections", new Set(allGids).size === allGids.length);
-}
-
-// ── duplicate inputs → throw ─────────────────────────────────────────────────
-{
-	let dupProbe = false;
-	try {
-		resolveFactList([], [socketProbe(GID_PI_LIVE, "alive"), socketProbe(GID_PI_LIVE, "dead")]);
-	} catch {
-		dupProbe = true;
-	}
-	ok("duplicate socket probe for one gid → throw", dupProbe);
-
-	let dupId = false;
-	try {
-		resolveFactList(
-			[identity("pi", { gardenId: GID_PI_LIVE }), identity("pi", { gardenId: GID_PI_LIVE })],
-			[socketProbe(GID_PI_LIVE, "alive")],
-		);
-	} catch {
-		dupId = true;
-	}
-	ok("duplicate meta-record for one gid → throw", dupId);
-}
-
-// ── RecordLessSocketFact (#50 C4): gid + 3-value liveness, nothing else ──────
-// The demotion is structural: no enrich (cwd/model/idle came from get_info-ing
-// the socket — treating it as a citizen), no kind tag, no synthetic identity.
-{
-	const out = resolveFactList([], [socketProbe(GID_SOCKET_ONLY, "alive")]);
-	const s = out.recordLessSockets[0] as RecordLessSocketFact;
-	ok("record-less: liveness ∈ SocketLiveness 3-value (never unsupported)", s.liveness === "alive");
-	const keys = Object.keys(s).sort();
-	assert.deepStrictEqual(keys, ["gardenId", "liveness"], `RecordLessSocketFact keyset drift: ${keys.join(",")}`);
-	ok("record-less: keyset exact (gardenId + liveness ONLY — enrich is gone with the listing)", true);
-	const FORBIDDEN = [
-		"resumable",
-		"sendable",
-		"transport",
-		"dispatch",
-		"action",
-		"backend",
-		"nativeSessionId",
-		"isEntwurf",
-		"cwd",
-		"model",
-		"idle",
-		"infoError",
-		"kind",
-	];
-	for (const k of FORBIDDEN) {
-		ok(`record-less: no '${k}' (no verb-routing, no synthetic identity, no enrich)`, !(k in s));
-	}
-	// dead/indeterminate stay surfaced too — hiding a dead socket is GC's job.
-	const dead = resolveFactList([], [socketProbe(GID_SOCKET_ONLY, "dead")]);
-	ok("record-less: dead socket stays surfaced (GC hides, the listing never does)", dead.recordLessSockets.length === 1);
-}
-
-// ── determinism: output sorted by gardenId in each section ───────────────────
-{
-	const ids = [
-		identity("pi", { gardenId: "20260611T222222-bbbbbb" }),
-		identity("pi", { gardenId: "20260611T111111-aaaaaa" }),
-	];
-	const probes = [
-		socketProbe("20260611T222222-bbbbbb", "alive"),
-		socketProbe("20260611T111111-aaaaaa", "alive"),
-		socketProbe("20260611T333333-cccccc", "alive"),
-	];
-	const out = resolveFactList(ids, probes);
-	ok("determinism: peers sorted by gardenId", out.peers[0]?.gardenId === "20260611T111111-aaaaaa");
-	ok(
-		"determinism: recordLessSockets sorted by gardenId",
-		out.recordLessSockets[0]?.gardenId === "20260611T333333-cccccc",
-	);
-}
-
-// ── isOutOfSocketDomainGardenIdConflict: shared record-side predicate ──────
-// (fact-provider listing + v2 decider dispatch consume this same fn — 4c 재유도
-// 금지 동형). The union over socketGids ∪ symlinkedGardenIds is the fact-provider:125
-// gap closure: a symlinked socket is never probed, so its gid is absent from
-// socketGids; the predicate must STILL flag an out-of-domain citizen owning it.
-{
-	const G = "20260611T444444-dddddd";
-	const realSockets = new Set([G]);
-	const symlinked = new Set([G]);
-	const empty = new Set<string>();
-	for (const piBackend of IN_DOMAIN) {
-		ok(
-			`conflict-predicate: socket-domain (${piBackend}) is not a record-side conflict`,
-			!isOutOfSocketDomainGardenIdConflict(piBackend, G, realSockets, symlinked),
-		);
-	}
-	ok(
-		"conflict-predicate: out-of-socket-domain + real socket → conflict",
-		isOutOfSocketDomainGardenIdConflict("claude-code", G, realSockets, empty),
-	);
-	ok(
-		"conflict-predicate: out-of-socket-domain + symlinked socket → conflict",
-		isOutOfSocketDomainGardenIdConflict("claude-code", G, empty, symlinked),
-	);
-	ok(
-		"conflict-predicate: out-of-socket-domain + no socket → no conflict",
-		!isOutOfSocketDomainGardenIdConflict("claude-code", G, empty, empty),
-	);
-}
-
-// Type-level guard: reference FactList so a shape rename breaks tsc.
-const _factlist: (f: FactList) => number = (f) => f.peers.length + f.recordLessSockets.length;
-void _factlist;
-
-console.log(`\n[check-entwurf-facts] ${passed} assertions ok`);

package/scripts/check-entwurf-resume-args.ts

@@ -1,122 +0,0 @@
-/**
- * check-entwurf-resume-args — deterministic gate for the resume-argv SSOT (`buildResumePiArgs`).
- *
- * The contract this gate holds changed with S1, and the change is the point: the builder used to
- * emit a HEADLESS child (`--mode json -p … <prompt>`) because its only caller was the detached
- * `spawn-bg` watcher. That transport was withdrawn, and the argv was MEASURED against the runtime
- * before the new consumer was written (2026-08-06, private tmux + fixture): dropped into a tmux
- * window, `-p` is pi's own "non-interactive mode" and the operator gets a JSON stream instead of a
- * session they can type into. The shape that actually reopens a visible citizen carries neither.
- *
- * So this gate pins the ONE shipped posture, and pins the absences as hard as the presences —
- * a re-introduced `-p` would still open a window, still stand a socket up, and still look green
- * to anything that only asserted `--entwurf-control`:
- *
- *   RESUMEARGS-CONTROL-FIRST     `--entwurf-control` leads, so the resumed session is addressable
- *   RESUMEARGS-NO-HEADLESS       no `--mode`, no `-p` — the window is interactive
- *   RESUMEARGS-NO-PROMPT-TAIL    no positional prompt — a resume runs no turn
- *   RESUMEARGS-EXT-ONCE-BEFORE-SESSION  bridge args exactly once, between control and --session
- *   RESUMEARGS-PROVIDER-OPTIONAL a recorded provider is emitted, an absent one emits no flag
- *   RESUMEARGS-SESSION-IS-FILE   `--session <abs path>`, never `--session-id` (which MINTS)
- *
- * Pure string assembly — no IO, no spawn.
- */
-
-import assert from "node:assert/strict";
-import { buildResumePiArgs } from "../pi-extensions/lib/entwurf-resume-args.ts";
-
-let passed = 0;
-function ok(label: string, cond: boolean): void {
-	assert.ok(cond, label);
-	console.log(`  ok    ${label}`);
-	passed++;
-}
-
-// The resume target is a session FILE (#50 C2), not a garden id: the record owns the address, so
-// argv only has to name WHICH transcript to reopen.
-const SESSION_FILE =
-	"/home/op/.pi/agent/sessions/-home-op-repo/2026-06-13T09-10-00-000Z_019e8faa-04ea-7b73-bf2c-1465d525c2e8.jsonl";
-// Production shape, measured: getEntwurfExplicitExtensions emits `-e <path>`, not `--extension`.
-const EXT = ["-e", "/path/to/entwurf/index.ts"] as const;
-
-function valueAfter(args: readonly string[], flag: string): string | undefined {
-	const i = args.indexOf(flag);
-	return i === -1 ? undefined : args[i + 1];
-}
-
-function main(): void {
-	// ── The shipped posture, with a recorded ACP provider (the only shape whose ext args are
-	//    non-empty — measured as `["-e", "<bridge>"]` on a real recorded provider=entwurf record).
-	{
-		const args = buildResumePiArgs({
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: EXT,
-			provider: "entwurf",
-			model: "claude-sonnet-5",
-		});
-
-		// Assertion order is a contract, not a reading preference: each claim must be the FIRST
-		// one a defect against it reaches, or a red would be reported under someone else's name.
-		// The absences come first because a re-introduced headless prefix also displaces the
-		// leading flag, and "the argv is headless again" is the truer diagnosis of that.
-		ok(
-			"[QK:RESUMEARGS-NO-HEADLESS] no --mode and no -p — `-p` is pi's non-interactive mode, so the headless prefix would open a window streaming JSON instead of a session the operator can use",
-			!args.includes("--mode") && !args.includes("-p") && !args.includes("--print"),
-		);
-		ok(
-			"[QK:RESUMEARGS-CONTROL-FIRST] --entwurf-control is the FIRST token — the resumed session stands its control socket up, which is the whole difference between a restored transcript and an addressable citizen",
-			args[0] === "--entwurf-control",
-		);
-		ok(
-			"[QK:RESUMEARGS-NO-PROMPT-TAIL] the argv ends at --model <m> with NO positional prompt — a resume reopens a conversation and runs no turn (measured: the transcript stayed byte-identical)",
-			args[args.length - 2] === "--model" && args[args.length - 1] === "claude-sonnet-5",
-		);
-		ok(
-			"no --no-extensions either: the one-shot posture that let `pi -p` exit is exactly what a resident resume must not emit",
-			!args.includes("--no-extensions"),
-		);
-
-		// SESSION-IS-FILE precedes the ext-args claim because the ext claim is stated RELATIVE to
-		// `--session`: if that flag were renamed, the positional assertion below would go red about
-		// the extensions while the actual defect is the flag that MINTS a session.
-		ok(
-			"[QK:RESUMEARGS-SESSION-IS-FILE] the builder targets an exact FILE via --session and never --session-id, which would CREATE the id when missing and silently mint an empty session instead of resuming one",
-			valueAfter(args, "--session") === SESSION_FILE && !args.includes("--session-id"),
-		);
-		ok(
-			"[QK:RESUMEARGS-EXT-ONCE-BEFORE-SESSION] the bridge args appear EXACTLY once and sit between --entwurf-control and --session — dropping them re-opens the #29 'Unknown provider' footgun, and doubling them is a different broken argv",
-			args.filter((a) => a === "-e").length === 1 &&
-				args.indexOf("--entwurf-control") < args.indexOf("-e") &&
-				args.indexOf("-e") < args.indexOf("--session"),
-		);
-		ok("a recorded provider is laid out as two tokens", valueAfter(args, "--provider") === "entwurf");
-		ok("model is laid out as two tokens", valueAfter(args, "--model") === "claude-sonnet-5");
-		ok(
-			"the full measured argv is reproduced exactly",
-			args.join(" ") ===
-				`--entwurf-control -e /path/to/entwurf/index.ts --session ${SESSION_FILE} --provider entwurf --model claude-sonnet-5`,
-		);
-	}
-
-	// ── The native shape: no recorded provider, no bridge. Measured as explicitExtensionArgs=[].
-	for (const provider of [null, undefined] as const) {
-		const args = buildResumePiArgs({
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: [],
-			provider,
-			model: "gpt-5.6-terra",
-		});
-		ok(
-			`[QK:RESUMEARGS-PROVIDER-OPTIONAL] provider=${provider}: NO --provider flag is emitted — an empty flag value would be a different citizen's launch, not a missing one`,
-			!args.includes("--provider"),
-		);
-		ok(
-			`provider=${provider}: the argv is exactly the four tokens the native shape needs`,
-			args.join(" ") === `--entwurf-control --session ${SESSION_FILE} --model gpt-5.6-terra`,
-		);
-	}
-
-	console.log(`\ncheck-entwurf-resume-args: ${passed} checks passed`);
-}
-
-main();