@junghanacs/entwurf 0.23.1 → 0.25.0

package/CHANGELOG.md

@@ -4,6 +4,634 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.25.0 - 2026-09-23
+
+### Added
+
+- **The Herdr status pane stopped reporting presence and started reporting capability, in four
+  blocks that never merge (#120 P1-A).** `herdr plugin pane open --plugin junghan0611.entwurf
+  --entrypoint status` now draws HERDR INTEGRATION, ACTIVATION, RAILS and CITIZENS, and each block
+  carries three things that do not merge: `owner` (who is speaking — Herdr's listing is Herdr's
+  word about Herdr, the ledger is Entwurf's word about its own install, the rails table is this
+  package's own declaration), `observedAt` (`now`, `install-time`, or `static`) and its own
+  `outcome`. **There is deliberately no aggregate** — no reducer, no `overall`, no readiness word:
+  three of the four blocks answer at different times, so one token over them would have to pick one
+  time and lie about the other two, and a host whose Herdr integration is current, whose ledger was
+  written last week, and whose runtime has since been deleted is exactly the case a summary word
+  erases. A block that could not be read says so in its own voice with the gatherer's named code
+  rather than degrading to an empty section, because an empty section and a failed read look
+  identical on a screen and only one of them is safe to act on. The render is a pure data-to-data
+  leaf (`plugins/herdr/lib/capability-report.mjs`: no `fs`, no `spawnSync`, no `process.env`, no
+  dynamic import, no clock) and the gathering that must open files and import an installed module
+  lives in `activation-evidence.mjs`, so it stays visible WHICH artifact answered — the checkout or
+  the runtime. The measured blocker repaired on the way in: the writer's ledger is XDG **state**,
+  not XDG **data**, and the first candidate crashed before drawing any block on a normal
+  writer-produced ledger. Herdr `outdated|needs-repair` is block [1]'s own named red while
+  `not-installed` stays a reported skip; only `phase=active` grants a runtime fallback, and
+  `activating|deactivating` remain visible install-time receipts that grant no binary. THREE READS
+  / ONE OPEN is restored behind exactly one spawn callsite. Receipts: `check-herdr-plugin` 48
+  assertions, and that lane 24/24 mutants killed in the implementer's scratch mirror and again in
+  the coordinator's body.
+
+### Changed
+
+- **A control-socket send now reports the acceptance boundary it actually got, and that
+  vocabulary is closed (#120 P2).** `entwurf_v2` answered `sent` whether the receiver was idle or
+  busy, and prose in four places called the busy path an interrupt or an immediate delivery.
+  Neither queue is an interrupt: a busy receiver drains steering after each turn and follow-ups
+  only when its inner loop ends, so a later steer overtakes every earlier follow-up and there is no
+  order between the two. Sender-visible acceptance is now its own closed axis — `sent |
+  queued-steer | queued-follow-up | accepted-unknown-boundary` — preserved through send →
+  structured error → runner → surface, while the route/release `SendFinalOutcome` is unchanged.
+  `sent` means the turn was TRIGGERED, not that the model has seen the text, and both queues are
+  volatile process memory an abort drops. A fallback socket preserves that boundary; a fallback
+  mailbox names its own durable enqueue receipt; dirty-lock receipts keep the actual boundary, file
+  and refusal reason instead of flattening them. The receiver wire no longer emits a bare
+  `delivered:true` or the unused `deliveredAs`. The oracle is the installed `pi-agent-core` itself
+  (`test/pi-queue.oracle.test.ts`, now on `check:full` with its exact core pin gated to the pi
+  floor): cross-mode overtaking, one-at-a-time drain, no mid-flight merge, and abort loss, proven
+  with zero model, network or ACP child turn. `DELIVERY.md`, `docs/acp-backend-rail.md`, the demo
+  README and the `entwurf-dev` skill were corrected to those same four words. Three proof holes
+  were closed before acceptance: dirty-lock end-to-end field loss, a `test/**` oracle that was not
+  on the public floor, and a reachability checker a comment could satisfy.
+
+- **pi runtime floor 0.86.0 → 0.87.1 (#120 P4, landed in two measured steps).** Four exact dev
+  pins (including P2's direct `pi-agent-core` queue oracle), three closed peer ranges
+  (`>=0.87.1 <0.88`), the
+  eight-package install/workspace constellation (seven `pi-*` packages plus `chord`), the
+  pack-install version matcher, and the support declarations in README, the Herdr install docs, mux
+  docs, setup docs, VERIFY and the ACP support matrix now name one floor.
+  `[QK:PI-FLOOR-SINGLE-SOURCE]` closes a measured static hole: before this, `check-dep-versions`
+  did not read `pnpm-workspace.yaml`, so one stale release-age row failed only later, during
+  installation. The five declared 0.87 breaking changes were re-measured rather than relabelled and
+  production contact is zero — and the three type fences are what confirm that, not grep
+  (`tsc --noEmit`, `-p scripts`, `-p mcp`, all rc=0). The installed 0.87 extension context still
+  exposes `isIdle()` / `signal` at the same coordinates and still has no `isCompacting`; the
+  `pi-agent-core` queue drain coordinates MOVED (`agent.js` `:98-99` → `:96-97`, `agent-loop.js`
+  steering drain `:159` → `:186`, follow-up drain `:162-166` → `:191-197`) while all four
+  queue-behaviour QKs stayed green; the sandbox CLI still refuses an unregistered
+  `--entwurf-control`. A deterministic gate now writes a REAL 0.87 session JSONL through the
+  installed public `SessionManager` with zero model, network or child process and proves basename
+  id = header id = manager id, so `check-herdr-placement` re-measures that axis on every run rather
+  than carrying a hand-made receipt. **0.86.1 was skipped with a reason:** its coding-agent
+  CHANGELOG has no Breaking Changes section at all and `packages/agent` 0.86.1 is an empty entry,
+  so it touches none of our surfaces and its provider/CLI improvements arrive inside 0.87.0 anyway.
+  ROADMAP's dated ledger carries the per-file sha256 pairs (written with real `packages/...`
+  paths, after a prior entry recorded an empty-file hash for a path that did not exist) and the
+  per-breaking-change contact receipts.
+  **The second step, 2026-09-23: 0.87.0 → 0.87.1, and it is the floor this release declares.**
+  0.87.0 was already superseded on npm (`dist-tags.latest` said 0.87.1) while the prepared
+  candidate still named 0.87.0, and no gate reads upstream `latest`, so a person found the gap
+  rather than a check. The patch carries **no Breaking Changes section in any of the seven
+  package changelogs**, and the contact measurement says why: all six load-bearing files this
+  repo tracks are byte-identical across the two tags (their sha256 pairs match the values the
+  0.87.0 entry above recorded, so the ledger cross-checks itself), `packages/agent` changed only
+  its CHANGELOG and `package.json`, and the whole `coding-agent/src` diff is three files. Each
+  was judged, not skimmed: `--mode` now rejects an invalid value instead of ignoring it, and
+  every `--mode` this repo passes pi is `rpc` or `json` (the other `--mode` hits are OMP's CLI,
+  a different vendor under the same flag name); the xAI default moved to Grok 4.7 and nothing
+  here depends on a provider default; the third is compaction summary wording, which entwurf
+  does not own on any rail (#94). Because `pi-agent-core` shipped no source change, the P2
+  queue coordinates could not move — and that was re-measured on the installed 0.87.1 rather
+  than inferred: `agent.js:96-97`, `agent-loop.js:186` and `:191-197` are where they were. The
+  per-floor hand receipts were re-taken too, additively: the sandbox CLI still refuses an
+  unregistered `--entwurf-control` byte-identically, and the extension context still declares
+  `isIdle()` at `:233` and `signal` at `:237` with no `isCompacting`. **The floor has exactly one
+  knob**, which is what made this a small change: `check-dep-versions` derives the peer range
+  and `check_pi_runtime_version` derives its FLOOR from the same exact devDep pin, so a
+  candidate cannot pin 0.87.1 while advertising 0.87.0. Moving it reddened four surfaces on cue
+  — and the gates named two omissions the author had missed: `[QK:MUTANT-FIND-MATCHES-SUBJECT]`
+  caught two `pack-install` pin-matcher mutants at `matched 0×`, and the prose scan caught
+  `demo/README.md`'s `current floor` and ROADMAP's `pi <version> fence`. The 0.87.0 numbers
+  above and in ROADMAP's two dated ledgers are preserved as the measurements of their own day;
+  one blind pass had rewritten two ledger receipts and was reverted.
+
+- **The Codex first-admission acceptance stays a release MUST, and what a cut must supply to it is
+  now written where a cut is taken from.** Reclassifying its absent prerequisite as a SKIP (see
+  Fixed) could have been read as demoting the step to an on-demand axis; that boundary is decided
+  the other way and gated. #87 made a newly admitted harness's visible-fresh receipt a MUST **after
+  measuring what the on-demand wording permitted** — a harness could be admitted as a full citizen
+  that `entwurf_fresh_call` cannot open and still pass the whole floor — so demoting Codex would
+  reopen exactly that hole. (VERIFY's standing "on-demand host axis" sentence is about
+  `smoke-codex-native-push-live`, the operator-loaded-thread probe, and is unchanged.) A SKIP is
+  therefore not a softening: `--cut` refuses it as `cut: BLOCKED (MUST SKIP)`, asked of the shared
+  shell authority rather than re-implemented, so a cut without this receipt is still impossible and
+  a host with no Codex app-server cannot take one — the intended cost of that release stop rather
+  than an accident. What changed is that the reproducible green is now stated: VERIFY says
+  `release-gate --cut` inherits the operator-supplied triple, and the release skill's P5 carries it
+  on the invocation (measured: `release_gate` exports no scrub and unsets nothing, so an exported
+  triple already reaches the step — no plumbing was added). **The instructions obey the
+  no-inference rule they teach.** The first draft of that P5 derived the pid with
+  `pgrep -f 'codex.*app-server' | head -1`, which is the inference the step exists to refuse,
+  written onto the page an operator follows, and on a host running several app-servers it hands the
+  gate an arbitrary process to verify as "the operator's answer". Each value is now STATED and
+  guarded by an explicit `: "${VAR:?...}"` required-value check before any LIVE cost. Three claims
+  keep the boundary from drifting back, one per direction, each with its own exact-once mutant:
+  `[QK:CODEX-OPERATOR-PREREQ-ABSENT-SKIPS]` (which pins the filter → guard → `skipLive` shape as one
+  contiguous sequence, reading the source with comments stripped — a promise in prose is precisely
+  where this defect hid for a release, and a first candidate mutant SURVIVED a weaker regex before
+  that cell was tightened), `[QK:CODEX-OPERATOR-PREREQ-WRONG-FAILS]`, and
+  `[QK:CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED]`. The installed-config preflights are
+  deliberately OUTSIDE this split and still FAIL on absence: a missing Codex birth, user
+  MCP/status/terminal-title config, runtime, bridge, tmux seat or an unanswered launch directory is
+  host state `setup` and the Codex doctors own, not a per-invocation input.
+
+- **The Herdr plugin manifest version moves 0.4.1 → 0.5.0 for this cut, and nothing else reads
+  that literal.** `plugins/herdr/herdr-plugin.toml` is the sole declaration (measured: one hit
+  repository-wide); `check-herdr-plugin` asserts semver SHAPE, not a value
+  (`scripts/check-herdr-plugin.ts:82`), and `min_herdr_version` stays the measured 0.9.0 floor.
+  `plugins/herdr/runtime-lock.json` returns to the `herdr-checkout` candidate carrier for the cut,
+  because `certifyLockCoherence` requires an npm lock to name a version that is BOTH already
+  published and equal to this checkout's `package.json` — and the version bump lands before the
+  publish. That is the same order `dd84ac0`/`3c3a67d`/`47f6d36` recorded: `v0.23.1` and `v0.24.0`
+  were both tagged on that carrier and the npm pin returned afterwards. The lock never moves onto an
+  unpublished version, and the 0.25.0 npm pin plus its published sha512 is a follow-up commit, not
+  part of this cut. The build gate and the README's release sentence move with it, because they read
+  the committed lock beside it.
+
+- **The Herdr plugin README is rebuilt around the two questions a visitor actually
+  arrives with: which route do I want, and what do I type first.** It now opens by saying what the
+  plugin is *not* (a second workbench), then a route chooser, the Herdr built-ins this plugin
+  depends on versus what Entwurf adds, a quick start that runs from a raw box in nine steps to the
+  first status pane, and only then the direct/mux comparison, boundaries, runtime and developer
+  detail. Four facts were repaired against source while re-reading it: the install narration is
+  four usage notes, not two (`lib/build.mjs:217-227,292-294`); the receipt section named the
+  superseded npm 0.23.1 pin instead of the 0.24.0 lock at `deb73f1`; `check-bridge` asserts
+  **eight** garden verbs, not seven (`run.sh:4708` `EXPECT_TOOLS`); and an unmeasured "~45 s,
+  hundreds of MB" claim was dropped. The route paragraph no longer says the two routes install the
+  same *runtime* — they install the same capability package, but this plugin pins an exact
+  `@junghanacs/entwurf@<version>` plus its published sha512 while a direct `npm install -g`
+  follows whatever version npm is asked for. The neighbouring-plugin table is now explicitly
+  "observed mechanism families, not a census or a compatibility matrix", and every family-wide
+  property assertion in it (pane-bound addresses, workspace-scoped identity, receipts as a
+  non-goal, "structurally the closest to Entwurf") was narrowed to implementation-specific: the
+  differentiator stated in prose is Entwurf's record-backed garden id and the no-argument same-id
+  `entwurf_resume_call`, not a uniqueness claim about durable addresses. Docs ship with the
+  plugin, so the manifest moves with them. Receipts: `check-herdr-plugin` 32 ok,
+  `check-herdr-plugin-build` 14 ok, `check-herdr-plugin-profile` 14 ok, `check-dep-versions` ok
+  (pi 0.86.0 across 9 ranges, unchanged), `check-node-floor-coherence` ok, all four relative links
+  resolve, `git diff --check` clean.
+- **The plugin runtime lock is pinned to npm `@junghanacs/entwurf@0.24.0`** and its published
+  sha512, closing the candidate window 0.24.0 shipped in — the second of the two steps the 0.24.0
+  entry below names. The integrity was measured here twice, independently: `npm view
+  @junghanacs/entwurf@0.24.0 dist.integrity` and `openssl dgst -sha512` over the preserved
+  candidate `make` accepted (`/tmp/entwurf-release-candidate-0.24.0.LXYL1S`, sha256
+  `fd750bcb…`) agree, and the registry tarball's sha256 equals the candidate's, so the lock names
+  the exact bytes the release gate consumed. Lock and `check-herdr-plugin-build` moved together
+  (the measured forward of `47f6d36`, version literals and the `IDENTITY` fixture's sha512 moved
+  to 0.24.0), the plugin README drops the candidate sentence, and `herdr-plugin.toml` already says
+  0.4.0. Receipts: `check-herdr-plugin-build` 14/14, `check-herdr-runtime-bootstrap` 31 ok with
+  `source=npm … version 0.24.0 … npm-coherent=true`, `check-herdr-plugin` 32 ok,
+  `check-gate-manifests` 739/59 unchanged, `pnpm check` exit 0 (57 s). Registry smoke: a
+  sandboxed `pi install npm:@junghanacs/entwurf@0.24.0` resolves the bridge to the registry
+  install and `--list-models entwurf` lists the curated Claude and Cortex anchors; dist-tags
+  `latest=0.24.0`, `repair=0.12.8-repair.1` preserved.
+- **`smoke-herdr-raw-install-live` says the eighth verb too.** Its verb cell keeps an
+  independent copy of the shipped `EXPECT_TOOLS` set on purpose, so an upstream verb reddens it
+  until somebody says so there — and `entwurf_callback` had not been said. First run on the
+  public remote at `deb73f1` with the npm 0.24.0 runtime: every acquisition, identity, [7]/[8a]
+  0-token citizen and teardown/reinstall cell green, only that copy red; with the eighth verb
+  named the smoke is PASS (`ref=main`, runtime `@junghanacs/entwurf@0.24.0`, observed sha256
+  `fd750bcb…`). The comment's stale `run.sh:5187` line reference now names the constant instead.
+
+### Removed
+
+- **The sender-side `entwurf-sent` transcript box, which had no producer (#120 P3).** Repository
+  measurement found one definition, one renderer registration and **zero** producers, while two
+  live comments named producers that did not exist. The shipped `ENTWURF_SENT_MESSAGE_TYPE` export
+  and the dead `SentBoxData` / builder / renderer / registration are gone; the independent
+  receive-side `entwurf-message` producer and renderer are untouched. The remaining receive-side
+  comment now states the true boundary — a sender receives an acceptance-boundary text receipt, and
+  only a receiver can claim a transcript box was rendered. Two claims keep it retired: AST-based
+  `[QK:NO-RENDERER-WITHOUT-PRODUCER]`, so a comment or a string literal cannot satisfy the producer
+  proof, and `[QK:RETIRED-SENT-SURFACE-ABSENT]`, which seals both identifiers and the stale
+  `entwurf sent` / `sender-side UI box` prose. The two mutants went into their own
+  `retired-sent-surface` lane rather than mixing into P2 receipt semantics, and historical
+  ROADMAP/demo evidence was kept as history with a dated correction rather than rewritten.
+
+### Fixed
+
+- **`showTurnDuration` was never ours, and entwurf had been forcing the operator's own display
+  off.** The native meta-bridge install owned a list of Claude Code policy scalars that close
+  background autonomy and suggestion surfaces — and this one had been sitting in it, pinned to
+  `false`. It closes nothing: it reports how long a turn took, which is operator INFORMATION, so the
+  policy reason the rest of that list stands on never applied to it. GLG's ruling is that the
+  operator owns the scalar and entwurf must neither own it nor force it. The symptom had been
+  misread as drift: `./run.sh doctor-meta-bridge` was FAIL on the source host for exactly one
+  managed scalar, with `~/.claude/settings.json` saying `true` and the writer requiring `false`, and
+  the install-state carries no per-scalar provenance to say whose value that was. The actual cause
+  is measurable and is **two owners on one key**: `check-keyset-overlap` against the operator's own
+  `agent-config` settings fragment failed on `showTurnDuration` and on nothing else, because both
+  sides claimed it. Dropping our claim is what resolves that collision, with **zero change to
+  agent-config**. The key is RETIRED rather than deleted, through the same one-shot path #94 built
+  for compaction, because an existing install-state already carries its entry — measured on the
+  source host, `original {existed: true, value: false}` under a live `true`, i.e. the operator
+  turned the display on after our install — and `uninstall()` walks every ledger entry through
+  `restore_entry`, so deleting the constant would have written `false` back over that choice.
+  `[QK:META-RETIRE-TURN-DURATION-OPERATOR-OWNED]` measures the premise instead of quoting it: it
+  asks the SSOT whether the key is claimed, pins the retired comparison value by type as well as
+  equality, drives the real relinquish leaf on the exact host shape above, and proves the ledger row
+  is consumed so no later inverse can reach the key. Its mutant drifts the scalar back under
+  management. **The migration ran on the host and was measured on both sides:** before
+  `showTurnDuration=true`, after `showTurnDuration=true`, the ledger entry gone (15 managed keys
+  → 14), and `doctor-meta-bridge` now PASS with 33 ok where it had been exit 1 on that one axis.
+
+- **A release MUST step reported a missing operator input as a FAILURE, so the aggregate gate was
+  structurally red on every host at every cut.** `smoke-codex-fresh-live` takes three values only
+  the operator can supply — the app-server pid and two model tiers — and `release_gate()` supplies
+  none of them, by design: entwurf neither starts nor supervises that app-server. Its own skip line
+  promised four prerequisites in one breath (`LIVE=1` plus the three env names), but only the first
+  could produce a SKIP; the other three were `ok()` assertions, and `ok()` throws. So the step
+  declined as a defect. `scripts/lib/step-outcome.sh` had already written the rule this broke —
+  *"a step that RAN AND BROKE and a step that NEVER RAN are different facts, and a release record
+  that blurs them is worthless: the first is a defect to fix, the second is a prerequisite to
+  supply"* — and the candidate receipt below shows the cost: `MUST PASS=23 FAIL=1`,
+  `cut: BLOCKED (MUST FAIL)`, with a prose classification standing in for a floor. **The repair is
+  the classification, not the requirement.** An ABSENT input is now a protocol SKIP naming each
+  missing one; a PRESENT but wrong one — a malformed or dead pid, a process whose argv is not a
+  Codex app-server, a foreign uid, an app-server sharing the gate's own session — stays a FAIL.
+  Both arms were measured, and neither opens a window or spends a turn: unset triple under `LIVE=1`
+  exits 97 with its `[entwurf:skip]` line, `ENTWURF_CODEX_APP_SERVER_PID=abc` exits 1 naming the
+  value. No inference was added and no default invented for a value nobody gave.
+
+- **The Herdr status pane died before drawing a single block on the carrier every candidate window
+  rides.** `plugins/herdr/lib/activation-evidence.mjs` located the installed ledger reader by
+  reading the package directory name off `runtime-lock.json` — but that file is a discriminated
+  union and only its `npm` arm carries a `name`, so on the `herdr-checkout` arm
+  (`{source, repository}`) the name was `undefined` and `path.join` answered it with a `TypeError`
+  raised OUTSIDE the `try` that was supposed to name every failure this module can have. Measured on
+  this cut: with that lock committed, `check-herdr-plugin` reported `block was ""` and every one of
+  its 48 assertions stood on a pane that had crashed. The carrier is not an edge case — `v0.23.1`
+  and `v0.24.0` were both tagged on it. The gatherer now takes `checkoutRoot` and asks
+  `readCheckoutPackageSpec`: the manifest is the one name both lock arms already agree about, since
+  the npm arm is certified coherent with it and the checkout arm packs that very manifest. The join
+  moved inside the same `try`, so a locator that ever yields a non-string is a named
+  `activation-reader-unavailable` rather than a process death. `VERIFY.md` had already written this
+  rule down for `smoke-herdr-raw-install-live`; the lesson had not crossed to the gatherer `79391fb`
+  added. `[QK:HPL-PACKAGE-NAME-FROM-MANIFEST]` measures the premise instead of quoting it — it
+  writes a checkout-arm lock and asks the real reader what `.name` is — then requires the module to
+  ask the manifest and never the lock, with comments stripped first so prose cannot satisfy it; its
+  mutant drifts the call back to `readRuntimeLock`.
+
+- **`doctor-pi-provider` called every Herdr-plugin host red while its bridge booted and served all
+  eight verbs (#120 P1-B).** The install-state's `ownership` field is a PREIMAGE classification —
+  what stood at the key BEFORE that install — so `absent` means "we created it", not "nobody owns
+  it"; reading it as an ownership verdict is what produced the false red. The doctor now reads the
+  recorded `command` beside it, because that string and not the bare name is the canonical managed
+  command (`register-pi-provider.py` writes the same string into the settings entry and into the
+  record), and in plugin mode it is an absolute bridge under the certified stable runtime, since a
+  Herdr-plugin host has nothing `entwurf` on PATH. For a known managed preimage carrying a recorded
+  command the comparison now runs REGARDLESS of whether the effective command happens to be the
+  bare name: keeping that decision inside a `!isBare` branch is how real drift escaped — a record
+  naming the absolute plugin bridge with the settings repointed at bare `entwurf-bridge` is drift,
+  and a bare bridge that boots would otherwise have carried it to green. A record that names no
+  command, or one whose ownership is a word this doctor does not know, falls through to the
+  original logic unchanged; the state is rewritten by `./run.sh setup`, never by its reader.
+
+- **Three qualification control reds, which were gate defects rather than product ones (#120).**
+  The first committed body at `bad2677` ran 69m42s and ended 746/777, with the remaining 31 voided
+  only by baseline-red controls. `[QK:MUTANT-GATES-INSIDE-FULL-FLOOR]`: `check-control-send-receipt`
+  and `check-entwurf-v2-runner` were valid narrow mutant coordinates but absent from `check:full`,
+  so they are now wired into `check:contracts` (~1.5 s combined, measured) while keeping their
+  source-adjacent discovery. `[QK:LAUNCHFENCE-EXPOSED-SMOKE-WIRED]`: P1's new XDG data-root cell
+  moved `smoke-herdr-raw-install-live.sh` into launcher-fence scrutiny, and the fence's env-block
+  parser understood only TypeScript object literals, not a continued shell `env` command — it now
+  reads that actual invocation and grants the exemption only when `HOME=` is relocated in the same
+  block, with a negative cell deleting that assignment to prove the exemption disappears.
+  `smoke-setup-verdict` S-8's intermittent second-run idempotence red had its output discarded by a
+  `| grep -q`, leaving no causal receipt; the second setup output is now captured and printed on
+  failure. No retry, sleep, enlarged timeout or speculative behaviour change was added, and S-8 is
+  explicitly NOT claimed fixed — it did not recur in the accepted body, and if it returns the next
+  receipt carries the output instead of one context-free FAIL line.
+
+- **Two stale oracles in `smoke-codex-fresh-live`, both surfaced by the LIVE floor of this cut.**
+  (a) The step read a control-socket receipt as successful only when it said `sent|delivered`.
+  `6d90d73` widened two sibling LIVE smokes to the closed four-value axis and named the reason in
+  `smoke-herdr-fresh-call-live.ts:89` — *"the old literal `→ sent` pin would have gone red on the
+  common case and passed only when the caller happened to be idle"* — and this third one was missed.
+  Measured on this exact step: the fixture addresses the initial Pi mid-turn, the rail answered
+  `queued-follow-up`, and a release-gate MUST went red on a delivery that had succeeded. Before P2
+  it passed on the busy path only because the rail said `sent` either way, which is the dishonesty
+  P2 removed; `delivered` was never a member of the set. (b) The initial-Pi exact-once audit still
+  expected the PRE-0.24.0 callback shape — an `entwurf_v2` carrying the nonce as arguments — while a
+  pi sibling's first action has been the zero-argument `entwurf_callback` since 0.24.0, as this
+  smoke's own launch receipt says in the same run: *"its first action is the zero-argument callback
+  verb (codex is the one arm that still sends the nonce as arguments)"*. A sibling obeying the
+  shipped framing was therefore reported as an unexpected call. Only the pi branch moved; the Codex
+  audit keeps `entwurf_v2`, because codex really is still the argument-carrying arm
+  (`codex-callback-env-unsupported`). This is the class `e506716` closed for
+  `smoke-herdr-raw-install-live`, and it stayed hidden in 0.24.0 because that cut's run died earlier
+  at the Pi→Codex template relay. Neither repair weakens an assertion: `{}` is matched by
+  `isDeepStrictEqual`, so it pins the verb's zero-argument contract rather than accepting any
+  arguments, the exact-once count is unchanged, a refusal still fails, and the callback-nonce
+  correlation was never carried by that audit — it is proven earlier and from the DELIVERED body by
+  `the initial Pi callback carries the exact launch nonce`, which reads the fixture's own mailbox,
+  requires exactly one exact match and refuses duplicates.
+
+### Verification
+
+Frozen candidate `69a6f1d`, host `oracle`, 2026-09-23 KST. Two receipts, kept apart on purpose.
+
+- **Deterministic floor:** `pnpm run check:full` exit 0, 607 s.
+- **Aggregate LIVE floor**, `LIVE=1 ./run.sh release-gate <scratch> --cut` with ambient identity
+  carriers stripped, scratch `/tmp/entwurf-release-gate-0.25.0-final.HghiXh`:
+  **MUST PASS=23 FAIL=1 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: BLOCKED (MUST FAIL)`.
+  Inside it, `check-gate-qualification` killed **778/778** with `[gate-qualification] ok` and both
+  purity axes green — measured on these exact bytes, which is why the aggregate was re-run after the
+  two gate commits above: `scripts/smoke-codex-fresh-live.ts` is the subject of three committed
+  mutants (`CODEX-LIVE-EVIDENCE-RECORD-PATH`, `CODEX-LIVE-EVIDENCE-RECOVERY-FAILSAFE`,
+  `CODEX-LIVE-RECOVERY-SOURCE-ONLY`), and all three killed at `sha256=40c7852fc273…`.
+- **The one MUST red is the shape of that step, not a defect.** `release_gate()` supplies no
+  `ENTWURF_CODEX_APP_SERVER_PID`, and `smoke-codex-fresh-live` refuses to infer one — VERIFY: *"The A
+  cell takes no inferred server or models"* — so it declines inside every aggregate on every host.
+  Its pair is the standalone run on the SAME frozen `69a6f1d`: `LIVE=1
+  ENTWURF_CODEX_APP_SERVER_PID=3969303 ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna
+  ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-terra ./run.sh smoke-codex-fresh-live` →
+  **66 assertions ok, exit 0**, `initial-pi=3/3 completed exact`, `codex=3/3 completed exact`.
+  The Pi tier is terra rather than luna, and that is a recorded tier choice, not a gate change: the
+  0.23.1 follow-up already measured luna losing relay fidelity where terra preserves it, and on this
+  cut luna pre-substituted the `<placeholder>` template the smoke audits for byte equality
+  (ROADMAP 0.24.0 follow-up 3). The receipt this cell is accepted on is the run that actually ran.
+- **Host residue (P9, run at the gate's verdict and again at the end of prepare):** 588 → 586 dirs,
+  2 roots / 112 K reclaimed, by prefix `entwurf-s2b-overlay` and `check-probe-ordering`. One
+  reparented process holds a `/tmp` path and was named rather than killed: pid 489788, the
+  operator's own `emacs --init-directory=/tmp/agent-emacs-init --daemon`, which no gate mints.
+- **Open, pre-cut, not resolved by this candidate:** `./run.sh doctor-meta-bridge` is FAIL on this
+  host for exactly one managed scalar — `settings showTurnDuration missing/drifted`, where
+  `~/.claude/settings.json` says `true` and `scripts/meta-bridge-state.py:90` requires `false`.
+  Every other axis of that doctor reads ok (hook launch form, doorbell static contract, statusline,
+  user-scope MCP reachability, cached artifact). The install-state carries no per-scalar provenance,
+  so whether this is drift from our write or the operator's own UI choice is not decided here, and
+  the host was deliberately left untouched.
+
+- **Resolved 2026-09-23, after the paragraph above was written.** That doctor red was not drift and
+  not undecidable: the key had two owners, and GLG ruled the operator owns it. The scalar is retired
+  (see Fixed), and the host migration was measured on both sides — `showTurnDuration=true` before
+  and after, the install-state ledger entry consumed (15 managed keys → 14), and
+  `./run.sh doctor-meta-bridge` now **exit 0, PASS, 33 ok**. The paragraph above is kept as what was
+  true when the frozen candidate was measured.
+
+**Post-prepare release-fix candidate (2026-09-23, host `oracle`) — source, focused and host
+receipts only.** This is not a cut receipt. `check-gate-qualification`'s body (`782/782` killed,
+`[gate-qualification] ok`) and `pnpm run check:full` (`total elapsed 603s exit 0`) ran on the earlier
+frozen seal (`git diff --cached --binary | sha256sum` =
+`ee478d4eac77aae6db187eeb5da2d357ab275c00e6d1eb9463ca04f29bf42425`), before this paragraph and two
+documentation lines were amended; they are not re-attributed to the amended bytes. When this
+paragraph was written (2026-09-23, before 09:44 KST) the LIVE release gate (`--cut`) had not been run
+on this candidate, so this paragraph by itself does not speak to releasability; the LIVE receipt is
+the dated addendum below, and it belongs to the `00264f…` seal only. What was measured:
+
+- **Focused gates, green on the working candidate:** `check-dep-versions`
+  (`ok — pi 0.87.1 is coherent … 9 range + 1 exact + 3 prose declarations`), `check-gate-manifests`
+  (**782** committed mutants across 62 lanes, every `find` still matching its subject exactly once,
+  lane inventory matching its declared contract), `check-release-gate-outcomes`,
+  `smoke-meta-install-state`, `smoke-meta-keyset-guard`, `check-keyset-overlap` against the
+  operator's own agent-config fragment (exit 1 → exit 0, `keyset disjoint ok: 1 fragment vs 15
+  pi-owned key(s)`), `check-meta-doctor-oracle`, `check-meta-manifest-schema`, `smoke-meta-honesty`,
+  `smoke-setup-verdict`, `smoke-user-scope-citizen`, `smoke-meta-prune`, `check-pi-runtime-version`,
+  `check-pi-import-surface`, `check-model-lock`, `check-node-floor-coherence`, `check-pi-preflight`,
+  `check-pi-launch`, `check-pack-pin-matcher`, `check-pack` (540 files), `check-herdr-activation`,
+  `check-herdr-placement`, `check-pi-queue-oracle`, `check-entwurf-v2-surface`,
+  `check-control-send-receipt`, `check-compaction-send-guard`, `check-mux-launcher-fence`,
+  `check-codex-bridge-identity`, `check-codex-native-push`, `check-env-namespace`,
+  `check-shell-quote`, `check-tests-beside-behavior`, `check-install-surface`,
+  `smoke-agy-install-state`, `check-acp-sdk-surface`, `check-mux-fresh-call`. Three type fences
+  `tsc --noEmit` / `-p scripts` / `-p mcp` rc=0, and `pnpm lint` at 0 errors / 22 warnings — the
+  same counts a pristine HEAD produces, measured in its own snapshot for the comparison.
+- **Four new mutants, each killed at its own claimed signature** in a scratch snapshot mirror with
+  control-pre and control-post green, because the shared checkout is never mutated in place:
+  `META-RETIRE-TURN-DURATION-OPERATOR-OWNED`, `CODEX-OPERATOR-PREREQ-ABSENT-SKIPS`,
+  `CODEX-OPERATOR-PREREQ-WRONG-FAILS`, `CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED`. The
+  release-gate lane inventory moves 19 → 22 and meta-retire 3 → 4.
+- **`check-install-surface` was re-run the only way it can tell the truth about an unstaged
+  edit, and that mattered.** It reads the candidate through `git show :<file>`, so a first run over
+  a working-tree-only change is a false green — a trap `NEXT.md` already documented from the
+  previous release. Two U+2014 em dashes had in fact landed in the ASCII-only release skill at
+  `(334,64)` and `(347,9)`. They are gone, and the proof was taken in a scratch snapshot where the
+  whole candidate was `git add -A`ed (**exit 0**, S7e and S6's 494 NUL-free sources included), with
+  a negative control planting one em dash back to confirm S7e really reddens rather than passing
+  vacuously. No staging was performed in the shared checkout.
+- **Host receipts (operator-owned steps, run by the coordinator under GLG's authority and verified
+  independently here):** the retired-scalar migration applied with the operator's `true` intact and
+  the ledger entry consumed; `doctor-meta-bridge` PASS; the global pi CLI moved 0.87.0 → **0.87.1**
+  and this repo's installed `pi-coding-agent` reads **0.87.1**. The running pi coordinator process
+  may predate that upgrade, so it is not used as evidence for it — the versions above were read from
+  the CLI and the installed package.
+
+**LIVE release gate on the amended candidate (2026-09-23 09:44–11:15 KST, host `oracle`) — dated
+addendum.** Candidate seal: HEAD `61cde06755c1eb353c2338c314cdf1eed384b26e`, `git diff HEAD --binary |
+sha256sum` = `git diff --cached --binary | sha256sum` =
+`00264f9177cfc2fde16d468299f12a4d00abc8d54fad1fd3c6c70df06d56478f`, unstaged 0, untracked 0. The
+coordinator's launcher refused to start unless HEAD and both seals matched, and printed them again
+after the run: pre and post identical. That seal is the bytes with the D1/D2/O2 documentation
+amendment above and WITHOUT this addendum; the result is not re-attributed to the documentation-only
+seal that adds these lines. The 69a6f1d `FAIL=1` receipt and the `ee478d…` seal receipts above stay
+as history.
+
+- **Command:** `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID LIVE=1
+  ENTWURF_CODEX_APP_SERVER_PID=3067196 ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna
+  ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-terra ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.25.0-00264f --cut`, exit 0. The app-server pid is the pane pid of the
+  one the coordinator started (on GLG's direct instruction) in its own tmux session
+  `entwurf025_codex_server`; it was stated, not searched. Its uid and exact `app-server --listen`
+  argv were checked through `/proc`, and its session differs from the gate's.
+- **Log (cross-host artifact):** `/tmp/entwurf-release-gate-0.25.0-00264f/release-gate.log`, sha256
+  `100c61a5721dee3e693a5f6d4851138d52172ad5301a231431a10478237bf20d`. The decisive lines, verbatim:
+
+  ```text
+  [check:full] total elapsed 621s exit 0
+  [gate-qualification] origin checkout: HEAD + work-surface content hash identical before/after
+  [gate-qualification] qualified claims: 782/782 killed — …
+  [gate-qualification] ok
+  [smoke-codex-fresh-live] 64 assertions ok — fixture -> initial visible Pi -> visible Codex/exact callback -> Pi-addressed native-push v2 -> Codex outbound v2 -> visible Pi/exact callback
+      MUST: PASS=24  FAIL=0  SKIP=0
+      BEHAVIOR: PASS=1  FAIL=0  SKIP=0
+    mode: --cut (a MUST SKIP is a BLOCKER — this run is being read as release acceptance)
+    cut: OK
+  ```
+
+- **Claude Code host:** `claude --version` = 2.1.280, which is above the `>=2.1.217` floor. Host
+  doctor log `/tmp/entwurf-0251-claude-280-doctor.log`, sha256
+  `568f73883a60025e370b5f45cba111620a60c45af351165bab25ddfa0d5be1e7`, exit 0, PASS.
+- **P9, run right after the verdict:** the prefix-blind census found one reparented process holding
+  a `/tmp` path (pid 489788, the operator's own emacs). It is not gate residue and was left alone.
+  `OWNED` derived 107 prefixes. Idle roots older than 60 minutes: 3 (128K). Two were
+  `check-probe-ordering` and one `entwurf-s2b-overlay`; they were inspected, then removed. After P9,
+  the operator owned 592 directories under `/tmp`.
+
+## 0.24.0 - 2026-09-20
+
+### Added
+
+- **`entwurf_callback` — the eighth garden verb, and it takes no arguments.** The fresh-call
+  callback was the one place in the garden where the transcript was the address axis: the caller
+  garden id and the launch nonce reached a new sibling only as prose in its first prompt, and the
+  sibling had to retype both into `entwurf_v2`. Three releases of symptoms were one cause — 0.23.1
+  dropped `$`/`@` sigils, this lane's first release gate filled in `<placeholders>` early, its second lost the
+  trailing character of a garden id (`…-26428c` → `…-26428`, refused correctly by the decider) —
+  and the protocol had no error-detecting property: a mangled id is indistinguishable from a
+  different one, so the decider could only refuse, never repair. GLG's ruling: "luna만 못하는게
+  아니라 구조적 문제". Now both launch rails inject `ENTWURF_CALLBACK_TARGET` and
+  `ENTWURF_CALLBACK_NONCE` beside the identity scrub (tmux `-e` in `mux-fresh-call`,
+  `tab create --env` in `herdr-fresh-call`), computed by the rail and never caller-chosen;
+  `callback-env.ts` is the single leaf that formats and parses the pair, so a drifted regex cannot
+  inject what the verb rejects; and `entwurf_callback {}` reads the pair from its own process,
+  validates garden-id and nonce grammar (exactly what `mintNonce` emits), and dispatches through
+  the existing v2 runner so the target is still re-resolved by record and decider (Hard Rule 2).
+  Absent or malformed env is a named refusal with no fallback to a model-supplied target (Hard
+  Rule 5). Framing for pi, claude-code, copilot and omp now says only "call the callback with no
+  arguments"; a separate `FRESH_CALL_DELIVERY_TOOL` names the v2 dialect for the task result, and
+  Claude's `--allowedTools` and ToolSearch hint carry callback, delivery and peers together (the
+  review found the first cut loaded only two, which would have left a claude-code sibling unable
+  to send its result). OMP's bootstrap payload moves to v2 with the closed shape `{v, task}`; a
+  leftover `target`/`nonce` key is refused. Measured before the seam was written: the
+  entwurf-bridge MCP child inherits the pane env for claude-code, copilot and omp (canary in
+  `/proc/<child>/environ`, private tmux, fixture roots); pi is in-process. **Codex is the named
+  exception:** the bridge serving a Codex tool call is the operator app-server's child (ppid
+  measured) and its identity is request-scoped `_meta.threadId`, so a window env never reaches
+  it; `entwurf_callback` refuses there as `codex-callback-env-unsupported`, the Codex framing
+  keeps the argument form and says why, and a per-thread carrier is a follow-up after a
+  measurement that does not exist yet. The separate Pi→Codex template relay in
+  `codex-fresh-live-protocol.ts` (a semantic `<placeholder>` template pushed through a model and
+  audited for byte equality) is recorded, not fixed. Surface gates moved with the verb
+  (`check-entwurf-bridge-boot` exact eight-verb set + `QK:BRIDGEBOOT-CALLBACK-ZERO-ARG`,
+  `check-probe-bridge-command`, `check-bridge`, install/state smokes, README/VERIFY); manifests
+  735 → 739 mutants, 59 lanes. Commits `cb86d44`, `ff09522`, `ca04c1b`; designs by
+  `claude-opus-5` and `openai-codex/gpt-5.6-terra`, Codex verdict and implementation by
+  `xai/grok-4.6`, closing review by a fresh `claude-opus-5`.
+- **`plugins/herdr` 0.4.0.** The plugin's install-time build now reaches a pi range check
+  (`install-user-scope`, above), its README installs pi at the published peer range, and its
+  runtime lock rides the 0.24.0 candidate window. A minor rather than a patch because a host that
+  activated 0.3.1 against an out-of-range pi was silently accepted and is now refused by name.
+
+### Changed
+
+- **pi floor moves to 0.86.0 (`>=0.86.0 <0.87`), and the ACP provider reads the 0.86 shape
+  honestly.** pi 0.86 hands a custom provider a branded `TranscriptContext`: `systemPrompt`
+  and `tools` are folded into a leading `role:"system"` message (`normalizeContext`,
+  pi-mono `model-runtime.ts:639-642`, `v0.86.0` = `ecac0a9c`). The ACP preflight read
+  `context.tools`, which is always `undefined` there, and fell back to the full builtin set —
+  so `assertExcludeToolsHonored` could never fire, while `tsc` (the old parameter type is
+  assignable) and `check-acp-backend-preflight` (a 0.85-shaped literal fed straight to
+  `streamAcpTurn`) both stayed green. Measured on real `pi-ai@0.86.0`: raw Context with `bash`
+  excluded → THROW; the same input through `normalizeContext` → PASS with no throw. The adapter
+  now replays the transcript (`getCurrentTools(context.messages)`, no fallback — an empty
+  replayed list is "the operator excluded everything" and is rejected as such),
+  `renderMessage` drops system messages by an explicit `case` so the never-forward-systemPrompt
+  invariant is a decision rather than a `default`, and every provider-path gate builds its
+  fixture through `normalizeContext()`. New lane `acp-backend-preflight`
+  (`[QK:ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS]`, exact-once mutant = the old fallback).
+  Session-reuse signatures now hash the folded leading system message, so a record persisted
+  under 0.85.1 is not a prefix of a 0.86 turn and falls back to `new` (the designed safe path).
+- **Pin move, with every mirror.** devDeps 0.86.0; peers `>=0.86.0 <0.87`; the eight explicit
+  `check-pack-install` pins and its leak regex (`@0\.86\.0(_|$)`, boundary lookalike now the
+  prefix-extended `0.86.0-beta.1`); lockfile (typebox resolves to a single 1.3.27); baseline
+  docs; ROADMAP bump ledger. `check-dep-versions` now excludes dated ledger entries from its
+  baseline scan (`stripBumpLedger`, guarded both ways), because a ledger line is a receipt of
+  the range that landed THAT day and the first bump after an entry is written is what exposed
+  it. Vendor floors were re-measured rather than carried: a real 0.86.0 session file
+  (`herdr-placement.ts`), the installed `types.d.ts` (`compaction-send-guard.ts`), the
+  unregistered `--entwurf-control` refusal (`check-pi-launch.ts:18`); the registered-host
+  duplicate-flag receipt at `check-pi-launch.ts:29` stays dated 0.85.1 with the reason.
+  Constellation shrank for the first time (`pi-client`/`pi-protocol` left pi-coding-agent's
+  direct deps at 0.86.0); all eight pins are kept on purpose — a retired pin is how a caret
+  re-enters unwatched.
+- **The two doors onto one pi registration tell the same truth (#119).** `entwurf setup`
+  refused an out-of-range pi by name, but `run.sh install-user-scope` — the verb herdr plugin
+  activation actually reaches (`build.mjs` → `herdr-plugin-activate.mjs`) — had no range check
+  and wrote the citizen in silence. It now enforces the same closed range through the same
+  helpers (`pi_supported_range`/`pi_version_in_range`, one parser), refuses with
+  `[install-user-scope] pi: FAIL … outside the supported range` and zero bytes written; absent
+  pi is deliberately unchanged (this verb invents no presence verdict). `check-herdr-activation`
+  gains `[QK:HAC-PI-FLOOR-BOTH-DOORS]` (24 → 25, the out-of-range/in-range PAIR, fixtures
+  derived from the package.json pin) and pins `PI_BIN` in its sandbox `world()` — without that
+  the gate's verdict depended on the operator's installed pi. `plugins/herdr/README.md` now
+  installs pi at the published peer range and joined `check-dep-versions` BASELINE_DOCS, so
+  the number cannot drift. Since 0.86.0 published (2026-09-19T23:15Z) the old unpinned line
+  installed a pi the shipped range rejects; the plugin had no known installs, so the repair is
+  a correction, not a migration.
+- **Provider-path fixtures are built through `normalizeContext`, and a cast past the brand is
+  now a red gate.** The full floor on the bump commit went red in four ACP gates
+  (`check-acp-stop-reason`, `-prompt-lifecycle`, `-stream-hooks`, `-usage-accounting`) as
+  `'error' !== 'done'` — the new preflight correctly rejecting seven fixture helpers that cast a
+  tool-less literal `as Context`, which is exactly the operation that silences the
+  `TranscriptContext` brand at typecheck time. Every helper now declares the four pi builtins
+  through `normalizeContext`; no production source or assertion text changed.
+  `check-acp-backend-preflight` gains a static sweep (`[QK:ACP-FIXTURE-NO-CONTEXT-CAST]`) over
+  `scripts/check-acp-*.ts` and the lib tests so that class cannot come back silently; no mutant
+  by decision (the claim is the absence of a token and has no production subject — its
+  kill-proof is an injected offender named by `file:line`). Full floor on `5d3140c`:
+  `check:full` exit 0 in 598s. Manifests: 733 → 735 mutants, 58 → 59 lanes.
+- **The first release gate of this lane (then numbered 0.23.2) was red on three MUST steps, and
+  two of them were this lane's own holes** (`/tmp/entwurf-release-gate-0.23.2.3s5A0o`, `MUST: PASS=21 FAIL=3 SKIP=0`).
+  `check-gate-qualification` 733/735: both `pack-install` mutants still quoted the old run.sh
+  `@0\.85\.1(_|$)` line after the pin mirror moved it (MUTANT-STALE), and nothing in
+  `check:full` looks at whether a `find` still matches — `check-gate-manifests` proved the
+  subject was tracked but never opened it. The finds now mirror run.sh byte-exact and the head
+  gains `[QK:MUTANT-FIND-MATCHES-SUBJECT]` (every `find` matches its subject exactly once, using
+  the body's own `countOccurrences`), which would have caught this at commit time instead of
+  fifty minutes into the gate. `smoke-acp-session-reuse-live`: `turn1`/`turn2` were annotated
+  `: Context` with no tools and the preflight rejected them — the third fixture of this class,
+  and the sweep written to stop it had globbed only `check-acp-*` and only the cast spelling.
+  Both turns build through `normalizeContext`; the sweep now covers `scripts/smoke-*.ts` and the
+  annotation form (indexed-access types such as `Context["messages"]` excluded), and retyped
+  `startTurn` in `check-acp-prompt-lifecycle` on the way (`5aeb8d4`). The third red,
+  `smoke-codex-fresh-live`, was a host prerequisite: the gate shell did not export
+  `ENTWURF_CODEX_APP_SERVER_PID` / `ENTWURF_CODEX_FRESH_MODEL` / `ENTWURF_CODEX_FRESH_PI_MODEL`
+  (the app-server was alive, PID 3969303); the rerun carries them. An independent audit
+  (`openai-codex/gpt-5.6-terra`, read-only) re-measured every mutant `find` against its subject
+  (0 stale), every direct provider-path fixture (0 tool-less), and named four stale declarations
+  fixed before the rerun: `docs/acp-backend-rail.md` support table, `pnpm-workspace.yaml`
+  release-age exclusions for pi-client/pi-protocol, `check-pack-install` diagnostic wording, and
+  the filename-floor sentence in `docs/mux-launch-rail.md`.
+  The qualification body on `ca04c1b` then reported 737/739 with two WRONG-REASON verdicts —
+  mutants dying at a neighbouring claim: `check-herdr-fresh-call` asserted the umbrella
+  whole-argv cell before the callback-pair cell, and the `pack-install` COVERS-CLOSURE `replace`
+  still carried the 0.85.1 pin. Both fixed in `3a9ae38`; a lane-scoped replay through the real
+  `qualifyMutants` runner (herdr-fresh-call + pack-install, 40/40 killed, 504s) is the fix
+  receipt, and the exact-SHA full body is read from `release-gate --cut`. Bridge source changes
+  need `pnpm run build-bridge` before any gate: `check-bridge-delivery` compares the gitignored
+  `dist` against source and reports staleness as red, which it did once in this lane.
+  The standalone LIVE pass that followed (each smoke once, ambient identity stripped) found the
+  one surface the verb move had not reached: `smoke-herdr-fresh-call-live` still joined both of
+  its cells on `entwurf_v2` as the callback — the pi cell on an argument predicate the
+  zero-argument verb can never satisfy, the claude cell on `indexOf("entwurf_v2")`, which landed
+  on the result delivery and reported the real callback as forbidden work before the callback.
+  The same red run is the receipt that production was right: the claude child's MCP activity
+  log reads `entwurf_peers → entwurf_callback (completed) → entwurf_v2 (completed)`, the pi
+  child's own tool result says the callback was delivered, and every delivery/fence cell passed
+  (2 FAILED / 30 ok, preserved fixture `/tmp/entwurf-opus2/herdr-live-fixture-red`). The oracle
+  now joins on the bare `entwurf_callback` the observing surfaces spell and on the ABSENCE of an
+  address in the pi call (`149bef7`); no deterministic gate covers this on-demand axis, which is
+  why it surfaced only here.
+  The same pass found the host behind the tree: `smoke-omp-fresh-live` timed out waiting for the
+  callback because the INSTALLED omp birth unit still spoke bootstrap v1 (no
+  `entwurf_bridge_entwurf_callback`, `{v:1}`), so the v2 payload the checkout launcher sent was
+  refused as `version-unsupported` — the exact condition `doctor-omp-bridge` exists to name, and
+  it did (runtime FAIL / ownership PASS). `install-omp-bridge` with no omp session open, doctor
+  green on both axes, re-run 21/21. The herdr re-run on `149bef7` is 31/32: the two repaired
+  cells pass; the remaining red is a claude-code child that called back and then never attempted
+  the delivery verb, recorded in ROADMAP as a follow-up rather than patched on n=2.
+- **The plugin runtime lock names `herdr-checkout` again, for the length of the 0.24.0
+  candidate window** — the same two steps 0.23.0 (`dd84ac0`) and 0.23.1 (`3c3a67d`/`194e800`)
+  took: an `npm` lock must name a version that is already published and coherent with this
+  checkout's `package.json` (`certifyLockCoherence`, `check-herdr-runtime-bootstrap` 8a), and the
+  version bump lands before the publish. Lock and `check-herdr-plugin-build` moved together
+  (`47f6d36`, the measured inverse of `194e800`); the npm pin returns with its published sha512
+  once 0.24.0 is on the registry.
+
+- **`plugins/herdr` 0.3.1 leads with the workbench a visitor is looking at.** Its manifest and
+  README now say that Entwurf brings sibling AI sessions into Herdr, then name its actual narrow
+  integration scope: the install-time build activates only Herdr-integrated pi and Claude Code,
+  while the pane is read-only. This is an affordance correction, not a new runtime claim.
+- **The plugin runtime lock is pinned to npm `@junghanacs/entwurf@0.23.1`** and its published
+  sha512, closing the candidate window 0.23.1 shipped in. The pair moves together, as that entry
+  says it must: the lock and `check-herdr-plugin-build`'s committed-lock expectations, with the
+  `IDENTITY` fixture's sha512 travelling with its version rather than being left on the previous
+  release's bytes. The integrity was read from the registry in this session
+  (`npm view @junghanacs/entwurf@0.23.1 dist.integrity`) rather than copied from another
+  session's report, which is the whole point of a pin.
+
 ## 0.23.1 - 2026-09-19
 
 ### Changed