@junghanacs/entwurf 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -4,6 +4,461 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.25.0 - 2026-09-23
+
+### Added
+
+- **The Herdr status pane stopped reporting presence and started reporting capability, in four
+  blocks that never merge (#120 P1-A).** `herdr plugin pane open --plugin junghan0611.entwurf
+  --entrypoint status` now draws HERDR INTEGRATION, ACTIVATION, RAILS and CITIZENS, and each block
+  carries three things that do not merge: `owner` (who is speaking — Herdr's listing is Herdr's
+  word about Herdr, the ledger is Entwurf's word about its own install, the rails table is this
+  package's own declaration), `observedAt` (`now`, `install-time`, or `static`) and its own
+  `outcome`. **There is deliberately no aggregate** — no reducer, no `overall`, no readiness word:
+  three of the four blocks answer at different times, so one token over them would have to pick one
+  time and lie about the other two, and a host whose Herdr integration is current, whose ledger was
+  written last week, and whose runtime has since been deleted is exactly the case a summary word
+  erases. A block that could not be read says so in its own voice with the gatherer's named code
+  rather than degrading to an empty section, because an empty section and a failed read look
+  identical on a screen and only one of them is safe to act on. The render is a pure data-to-data
+  leaf (`plugins/herdr/lib/capability-report.mjs`: no `fs`, no `spawnSync`, no `process.env`, no
+  dynamic import, no clock) and the gathering that must open files and import an installed module
+  lives in `activation-evidence.mjs`, so it stays visible WHICH artifact answered — the checkout or
+  the runtime. The measured blocker repaired on the way in: the writer's ledger is XDG **state**,
+  not XDG **data**, and the first candidate crashed before drawing any block on a normal
+  writer-produced ledger. Herdr `outdated|needs-repair` is block [1]'s own named red while
+  `not-installed` stays a reported skip; only `phase=active` grants a runtime fallback, and
+  `activating|deactivating` remain visible install-time receipts that grant no binary. THREE READS
+  / ONE OPEN is restored behind exactly one spawn callsite. Receipts: `check-herdr-plugin` 48
+  assertions, and that lane 24/24 mutants killed in the implementer's scratch mirror and again in
+  the coordinator's body.
+
+### Changed
+
+- **A control-socket send now reports the acceptance boundary it actually got, and that
+  vocabulary is closed (#120 P2).** `entwurf_v2` answered `sent` whether the receiver was idle or
+  busy, and prose in four places called the busy path an interrupt or an immediate delivery.
+  Neither queue is an interrupt: a busy receiver drains steering after each turn and follow-ups
+  only when its inner loop ends, so a later steer overtakes every earlier follow-up and there is no
+  order between the two. Sender-visible acceptance is now its own closed axis — `sent |
+  queued-steer | queued-follow-up | accepted-unknown-boundary` — preserved through send →
+  structured error → runner → surface, while the route/release `SendFinalOutcome` is unchanged.
+  `sent` means the turn was TRIGGERED, not that the model has seen the text, and both queues are
+  volatile process memory an abort drops. A fallback socket preserves that boundary; a fallback
+  mailbox names its own durable enqueue receipt; dirty-lock receipts keep the actual boundary, file
+  and refusal reason instead of flattening them. The receiver wire no longer emits a bare
+  `delivered:true` or the unused `deliveredAs`. The oracle is the installed `pi-agent-core` itself
+  (`test/pi-queue.oracle.test.ts`, now on `check:full` with its exact core pin gated to the pi
+  floor): cross-mode overtaking, one-at-a-time drain, no mid-flight merge, and abort loss, proven
+  with zero model, network or ACP child turn. `DELIVERY.md`, `docs/acp-backend-rail.md`, the demo
+  README and the `entwurf-dev` skill were corrected to those same four words. Three proof holes
+  were closed before acceptance: dirty-lock end-to-end field loss, a `test/**` oracle that was not
+  on the public floor, and a reachability checker a comment could satisfy.
+
+- **pi runtime floor 0.86.0 → 0.87.1 (#120 P4, landed in two measured steps).** Four exact dev
+  pins (including P2's direct `pi-agent-core` queue oracle), three closed peer ranges
+  (`>=0.87.1 <0.88`), the
+  eight-package install/workspace constellation (seven `pi-*` packages plus `chord`), the
+  pack-install version matcher, and the support declarations in README, the Herdr install docs, mux
+  docs, setup docs, VERIFY and the ACP support matrix now name one floor.
+  `[QK:PI-FLOOR-SINGLE-SOURCE]` closes a measured static hole: before this, `check-dep-versions`
+  did not read `pnpm-workspace.yaml`, so one stale release-age row failed only later, during
+  installation. The five declared 0.87 breaking changes were re-measured rather than relabelled and
+  production contact is zero — and the three type fences are what confirm that, not grep
+  (`tsc --noEmit`, `-p scripts`, `-p mcp`, all rc=0). The installed 0.87 extension context still
+  exposes `isIdle()` / `signal` at the same coordinates and still has no `isCompacting`; the
+  `pi-agent-core` queue drain coordinates MOVED (`agent.js` `:98-99` → `:96-97`, `agent-loop.js`
+  steering drain `:159` → `:186`, follow-up drain `:162-166` → `:191-197`) while all four
+  queue-behaviour QKs stayed green; the sandbox CLI still refuses an unregistered
+  `--entwurf-control`. A deterministic gate now writes a REAL 0.87 session JSONL through the
+  installed public `SessionManager` with zero model, network or child process and proves basename
+  id = header id = manager id, so `check-herdr-placement` re-measures that axis on every run rather
+  than carrying a hand-made receipt. **0.86.1 was skipped with a reason:** its coding-agent
+  CHANGELOG has no Breaking Changes section at all and `packages/agent` 0.86.1 is an empty entry,
+  so it touches none of our surfaces and its provider/CLI improvements arrive inside 0.87.0 anyway.
+  ROADMAP's dated ledger carries the per-file sha256 pairs (written with real `packages/...`
+  paths, after a prior entry recorded an empty-file hash for a path that did not exist) and the
+  per-breaking-change contact receipts.
+  **The second step, 2026-09-23: 0.87.0 → 0.87.1, and it is the floor this release declares.**
+  0.87.0 was already superseded on npm (`dist-tags.latest` said 0.87.1) while the prepared
+  candidate still named 0.87.0, and no gate reads upstream `latest`, so a person found the gap
+  rather than a check. The patch carries **no Breaking Changes section in any of the seven
+  package changelogs**, and the contact measurement says why: all six load-bearing files this
+  repo tracks are byte-identical across the two tags (their sha256 pairs match the values the
+  0.87.0 entry above recorded, so the ledger cross-checks itself), `packages/agent` changed only
+  its CHANGELOG and `package.json`, and the whole `coding-agent/src` diff is three files. Each
+  was judged, not skimmed: `--mode` now rejects an invalid value instead of ignoring it, and
+  every `--mode` this repo passes pi is `rpc` or `json` (the other `--mode` hits are OMP's CLI,
+  a different vendor under the same flag name); the xAI default moved to Grok 4.7 and nothing
+  here depends on a provider default; the third is compaction summary wording, which entwurf
+  does not own on any rail (#94). Because `pi-agent-core` shipped no source change, the P2
+  queue coordinates could not move — and that was re-measured on the installed 0.87.1 rather
+  than inferred: `agent.js:96-97`, `agent-loop.js:186` and `:191-197` are where they were. The
+  per-floor hand receipts were re-taken too, additively: the sandbox CLI still refuses an
+  unregistered `--entwurf-control` byte-identically, and the extension context still declares
+  `isIdle()` at `:233` and `signal` at `:237` with no `isCompacting`. **The floor has exactly one
+  knob**, which is what made this a small change: `check-dep-versions` derives the peer range
+  and `check_pi_runtime_version` derives its FLOOR from the same exact devDep pin, so a
+  candidate cannot pin 0.87.1 while advertising 0.87.0. Moving it reddened four surfaces on cue
+  — and the gates named two omissions the author had missed: `[QK:MUTANT-FIND-MATCHES-SUBJECT]`
+  caught two `pack-install` pin-matcher mutants at `matched 0×`, and the prose scan caught
+  `demo/README.md`'s `current floor` and ROADMAP's `pi <version> fence`. The 0.87.0 numbers
+  above and in ROADMAP's two dated ledgers are preserved as the measurements of their own day;
+  one blind pass had rewritten two ledger receipts and was reverted.
+
+- **The Codex first-admission acceptance stays a release MUST, and what a cut must supply to it is
+  now written where a cut is taken from.** Reclassifying its absent prerequisite as a SKIP (see
+  Fixed) could have been read as demoting the step to an on-demand axis; that boundary is decided
+  the other way and gated. #87 made a newly admitted harness's visible-fresh receipt a MUST **after
+  measuring what the on-demand wording permitted** — a harness could be admitted as a full citizen
+  that `entwurf_fresh_call` cannot open and still pass the whole floor — so demoting Codex would
+  reopen exactly that hole. (VERIFY's standing "on-demand host axis" sentence is about
+  `smoke-codex-native-push-live`, the operator-loaded-thread probe, and is unchanged.) A SKIP is
+  therefore not a softening: `--cut` refuses it as `cut: BLOCKED (MUST SKIP)`, asked of the shared
+  shell authority rather than re-implemented, so a cut without this receipt is still impossible and
+  a host with no Codex app-server cannot take one — the intended cost of that release stop rather
+  than an accident. What changed is that the reproducible green is now stated: VERIFY says
+  `release-gate --cut` inherits the operator-supplied triple, and the release skill's P5 carries it
+  on the invocation (measured: `release_gate` exports no scrub and unsets nothing, so an exported
+  triple already reaches the step — no plumbing was added). **The instructions obey the
+  no-inference rule they teach.** The first draft of that P5 derived the pid with
+  `pgrep -f 'codex.*app-server' | head -1`, which is the inference the step exists to refuse,
+  written onto the page an operator follows, and on a host running several app-servers it hands the
+  gate an arbitrary process to verify as "the operator's answer". Each value is now STATED and
+  guarded by an explicit `: "${VAR:?...}"` required-value check before any LIVE cost. Three claims
+  keep the boundary from drifting back, one per direction, each with its own exact-once mutant:
+  `[QK:CODEX-OPERATOR-PREREQ-ABSENT-SKIPS]` (which pins the filter → guard → `skipLive` shape as one
+  contiguous sequence, reading the source with comments stripped — a promise in prose is precisely
+  where this defect hid for a release, and a first candidate mutant SURVIVED a weaker regex before
+  that cell was tightened), `[QK:CODEX-OPERATOR-PREREQ-WRONG-FAILS]`, and
+  `[QK:CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED]`. The installed-config preflights are
+  deliberately OUTSIDE this split and still FAIL on absence: a missing Codex birth, user
+  MCP/status/terminal-title config, runtime, bridge, tmux seat or an unanswered launch directory is
+  host state `setup` and the Codex doctors own, not a per-invocation input.
+
+- **The Herdr plugin manifest version moves 0.4.1 → 0.5.0 for this cut, and nothing else reads
+  that literal.** `plugins/herdr/herdr-plugin.toml` is the sole declaration (measured: one hit
+  repository-wide); `check-herdr-plugin` asserts semver SHAPE, not a value
+  (`scripts/check-herdr-plugin.ts:82`), and `min_herdr_version` stays the measured 0.9.0 floor.
+  `plugins/herdr/runtime-lock.json` returns to the `herdr-checkout` candidate carrier for the cut,
+  because `certifyLockCoherence` requires an npm lock to name a version that is BOTH already
+  published and equal to this checkout's `package.json` — and the version bump lands before the
+  publish. That is the same order `dd84ac0`/`3c3a67d`/`47f6d36` recorded: `v0.23.1` and `v0.24.0`
+  were both tagged on that carrier and the npm pin returned afterwards. The lock never moves onto an
+  unpublished version, and the 0.25.0 npm pin plus its published sha512 is a follow-up commit, not
+  part of this cut. The build gate and the README's release sentence move with it, because they read
+  the committed lock beside it.
+
+- **The Herdr plugin README is rebuilt around the two questions a visitor actually
+  arrives with: which route do I want, and what do I type first.** It now opens by saying what the
+  plugin is *not* (a second workbench), then a route chooser, the Herdr built-ins this plugin
+  depends on versus what Entwurf adds, a quick start that runs from a raw box in nine steps to the
+  first status pane, and only then the direct/mux comparison, boundaries, runtime and developer
+  detail. Four facts were repaired against source while re-reading it: the install narration is
+  four usage notes, not two (`lib/build.mjs:217-227,292-294`); the receipt section named the
+  superseded npm 0.23.1 pin instead of the 0.24.0 lock at `deb73f1`; `check-bridge` asserts
+  **eight** garden verbs, not seven (`run.sh:4708` `EXPECT_TOOLS`); and an unmeasured "~45 s,
+  hundreds of MB" claim was dropped. The route paragraph no longer says the two routes install the
+  same *runtime* — they install the same capability package, but this plugin pins an exact
+  `@junghanacs/entwurf@<version>` plus its published sha512 while a direct `npm install -g`
+  follows whatever version npm is asked for. The neighbouring-plugin table is now explicitly
+  "observed mechanism families, not a census or a compatibility matrix", and every family-wide
+  property assertion in it (pane-bound addresses, workspace-scoped identity, receipts as a
+  non-goal, "structurally the closest to Entwurf") was narrowed to implementation-specific: the
+  differentiator stated in prose is Entwurf's record-backed garden id and the no-argument same-id
+  `entwurf_resume_call`, not a uniqueness claim about durable addresses. Docs ship with the
+  plugin, so the manifest moves with them. Receipts: `check-herdr-plugin` 32 ok,
+  `check-herdr-plugin-build` 14 ok, `check-herdr-plugin-profile` 14 ok, `check-dep-versions` ok
+  (pi 0.86.0 across 9 ranges, unchanged), `check-node-floor-coherence` ok, all four relative links
+  resolve, `git diff --check` clean.
+- **The plugin runtime lock is pinned to npm `@junghanacs/entwurf@0.24.0`** and its published
+  sha512, closing the candidate window 0.24.0 shipped in — the second of the two steps the 0.24.0
+  entry below names. The integrity was measured here twice, independently: `npm view
+  @junghanacs/entwurf@0.24.0 dist.integrity` and `openssl dgst -sha512` over the preserved
+  candidate `make` accepted (`/tmp/entwurf-release-candidate-0.24.0.LXYL1S`, sha256
+  `fd750bcb…`) agree, and the registry tarball's sha256 equals the candidate's, so the lock names
+  the exact bytes the release gate consumed. Lock and `check-herdr-plugin-build` moved together
+  (the measured forward of `47f6d36`, version literals and the `IDENTITY` fixture's sha512 moved
+  to 0.24.0), the plugin README drops the candidate sentence, and `herdr-plugin.toml` already says
+  0.4.0. Receipts: `check-herdr-plugin-build` 14/14, `check-herdr-runtime-bootstrap` 31 ok with
+  `source=npm … version 0.24.0 … npm-coherent=true`, `check-herdr-plugin` 32 ok,
+  `check-gate-manifests` 739/59 unchanged, `pnpm check` exit 0 (57 s). Registry smoke: a
+  sandboxed `pi install npm:@junghanacs/entwurf@0.24.0` resolves the bridge to the registry
+  install and `--list-models entwurf` lists the curated Claude and Cortex anchors; dist-tags
+  `latest=0.24.0`, `repair=0.12.8-repair.1` preserved.
+- **`smoke-herdr-raw-install-live` says the eighth verb too.** Its verb cell keeps an
+  independent copy of the shipped `EXPECT_TOOLS` set on purpose, so an upstream verb reddens it
+  until somebody says so there — and `entwurf_callback` had not been said. First run on the
+  public remote at `deb73f1` with the npm 0.24.0 runtime: every acquisition, identity, [7]/[8a]
+  0-token citizen and teardown/reinstall cell green, only that copy red; with the eighth verb
+  named the smoke is PASS (`ref=main`, runtime `@junghanacs/entwurf@0.24.0`, observed sha256
+  `fd750bcb…`). The comment's stale `run.sh:5187` line reference now names the constant instead.
+
+### Removed
+
+- **The sender-side `entwurf-sent` transcript box, which had no producer (#120 P3).** Repository
+  measurement found one definition, one renderer registration and **zero** producers, while two
+  live comments named producers that did not exist. The shipped `ENTWURF_SENT_MESSAGE_TYPE` export
+  and the dead `SentBoxData` / builder / renderer / registration are gone; the independent
+  receive-side `entwurf-message` producer and renderer are untouched. The remaining receive-side
+  comment now states the true boundary — a sender receives an acceptance-boundary text receipt, and
+  only a receiver can claim a transcript box was rendered. Two claims keep it retired: AST-based
+  `[QK:NO-RENDERER-WITHOUT-PRODUCER]`, so a comment or a string literal cannot satisfy the producer
+  proof, and `[QK:RETIRED-SENT-SURFACE-ABSENT]`, which seals both identifiers and the stale
+  `entwurf sent` / `sender-side UI box` prose. The two mutants went into their own
+  `retired-sent-surface` lane rather than mixing into P2 receipt semantics, and historical
+  ROADMAP/demo evidence was kept as history with a dated correction rather than rewritten.
+
+### Fixed
+
+- **`showTurnDuration` was never ours, and entwurf had been forcing the operator's own display
+  off.** The native meta-bridge install owned a list of Claude Code policy scalars that close
+  background autonomy and suggestion surfaces — and this one had been sitting in it, pinned to
+  `false`. It closes nothing: it reports how long a turn took, which is operator INFORMATION, so the
+  policy reason the rest of that list stands on never applied to it. GLG's ruling is that the
+  operator owns the scalar and entwurf must neither own it nor force it. The symptom had been
+  misread as drift: `./run.sh doctor-meta-bridge` was FAIL on the source host for exactly one
+  managed scalar, with `~/.claude/settings.json` saying `true` and the writer requiring `false`, and
+  the install-state carries no per-scalar provenance to say whose value that was. The actual cause
+  is measurable and is **two owners on one key**: `check-keyset-overlap` against the operator's own
+  `agent-config` settings fragment failed on `showTurnDuration` and on nothing else, because both
+  sides claimed it. Dropping our claim is what resolves that collision, with **zero change to
+  agent-config**. The key is RETIRED rather than deleted, through the same one-shot path #94 built
+  for compaction, because an existing install-state already carries its entry — measured on the
+  source host, `original {existed: true, value: false}` under a live `true`, i.e. the operator
+  turned the display on after our install — and `uninstall()` walks every ledger entry through
+  `restore_entry`, so deleting the constant would have written `false` back over that choice.
+  `[QK:META-RETIRE-TURN-DURATION-OPERATOR-OWNED]` measures the premise instead of quoting it: it
+  asks the SSOT whether the key is claimed, pins the retired comparison value by type as well as
+  equality, drives the real relinquish leaf on the exact host shape above, and proves the ledger row
+  is consumed so no later inverse can reach the key. Its mutant drifts the scalar back under
+  management. **The migration ran on the host and was measured on both sides:** before
+  `showTurnDuration=true`, after `showTurnDuration=true`, the ledger entry gone (15 managed keys
+  → 14), and `doctor-meta-bridge` now PASS with 33 ok where it had been exit 1 on that one axis.
+
+- **A release MUST step reported a missing operator input as a FAILURE, so the aggregate gate was
+  structurally red on every host at every cut.** `smoke-codex-fresh-live` takes three values only
+  the operator can supply — the app-server pid and two model tiers — and `release_gate()` supplies
+  none of them, by design: entwurf neither starts nor supervises that app-server. Its own skip line
+  promised four prerequisites in one breath (`LIVE=1` plus the three env names), but only the first
+  could produce a SKIP; the other three were `ok()` assertions, and `ok()` throws. So the step
+  declined as a defect. `scripts/lib/step-outcome.sh` had already written the rule this broke —
+  *"a step that RAN AND BROKE and a step that NEVER RAN are different facts, and a release record
+  that blurs them is worthless: the first is a defect to fix, the second is a prerequisite to
+  supply"* — and the candidate receipt below shows the cost: `MUST PASS=23 FAIL=1`,
+  `cut: BLOCKED (MUST FAIL)`, with a prose classification standing in for a floor. **The repair is
+  the classification, not the requirement.** An ABSENT input is now a protocol SKIP naming each
+  missing one; a PRESENT but wrong one — a malformed or dead pid, a process whose argv is not a
+  Codex app-server, a foreign uid, an app-server sharing the gate's own session — stays a FAIL.
+  Both arms were measured, and neither opens a window or spends a turn: unset triple under `LIVE=1`
+  exits 97 with its `[entwurf:skip]` line, `ENTWURF_CODEX_APP_SERVER_PID=abc` exits 1 naming the
+  value. No inference was added and no default invented for a value nobody gave.
+
+- **The Herdr status pane died before drawing a single block on the carrier every candidate window
+  rides.** `plugins/herdr/lib/activation-evidence.mjs` located the installed ledger reader by
+  reading the package directory name off `runtime-lock.json` — but that file is a discriminated
+  union and only its `npm` arm carries a `name`, so on the `herdr-checkout` arm
+  (`{source, repository}`) the name was `undefined` and `path.join` answered it with a `TypeError`
+  raised OUTSIDE the `try` that was supposed to name every failure this module can have. Measured on
+  this cut: with that lock committed, `check-herdr-plugin` reported `block was ""` and every one of
+  its 48 assertions stood on a pane that had crashed. The carrier is not an edge case — `v0.23.1`
+  and `v0.24.0` were both tagged on it. The gatherer now takes `checkoutRoot` and asks
+  `readCheckoutPackageSpec`: the manifest is the one name both lock arms already agree about, since
+  the npm arm is certified coherent with it and the checkout arm packs that very manifest. The join
+  moved inside the same `try`, so a locator that ever yields a non-string is a named
+  `activation-reader-unavailable` rather than a process death. `VERIFY.md` had already written this
+  rule down for `smoke-herdr-raw-install-live`; the lesson had not crossed to the gatherer `79391fb`
+  added. `[QK:HPL-PACKAGE-NAME-FROM-MANIFEST]` measures the premise instead of quoting it — it
+  writes a checkout-arm lock and asks the real reader what `.name` is — then requires the module to
+  ask the manifest and never the lock, with comments stripped first so prose cannot satisfy it; its
+  mutant drifts the call back to `readRuntimeLock`.
+
+- **`doctor-pi-provider` called every Herdr-plugin host red while its bridge booted and served all
+  eight verbs (#120 P1-B).** The install-state's `ownership` field is a PREIMAGE classification —
+  what stood at the key BEFORE that install — so `absent` means "we created it", not "nobody owns
+  it"; reading it as an ownership verdict is what produced the false red. The doctor now reads the
+  recorded `command` beside it, because that string and not the bare name is the canonical managed
+  command (`register-pi-provider.py` writes the same string into the settings entry and into the
+  record), and in plugin mode it is an absolute bridge under the certified stable runtime, since a
+  Herdr-plugin host has nothing `entwurf` on PATH. For a known managed preimage carrying a recorded
+  command the comparison now runs REGARDLESS of whether the effective command happens to be the
+  bare name: keeping that decision inside a `!isBare` branch is how real drift escaped — a record
+  naming the absolute plugin bridge with the settings repointed at bare `entwurf-bridge` is drift,
+  and a bare bridge that boots would otherwise have carried it to green. A record that names no
+  command, or one whose ownership is a word this doctor does not know, falls through to the
+  original logic unchanged; the state is rewritten by `./run.sh setup`, never by its reader.
+
+- **Three qualification control reds, which were gate defects rather than product ones (#120).**
+  The first committed body at `bad2677` ran 69m42s and ended 746/777, with the remaining 31 voided
+  only by baseline-red controls. `[QK:MUTANT-GATES-INSIDE-FULL-FLOOR]`: `check-control-send-receipt`
+  and `check-entwurf-v2-runner` were valid narrow mutant coordinates but absent from `check:full`,
+  so they are now wired into `check:contracts` (~1.5 s combined, measured) while keeping their
+  source-adjacent discovery. `[QK:LAUNCHFENCE-EXPOSED-SMOKE-WIRED]`: P1's new XDG data-root cell
+  moved `smoke-herdr-raw-install-live.sh` into launcher-fence scrutiny, and the fence's env-block
+  parser understood only TypeScript object literals, not a continued shell `env` command — it now
+  reads that actual invocation and grants the exemption only when `HOME=` is relocated in the same
+  block, with a negative cell deleting that assignment to prove the exemption disappears.
+  `smoke-setup-verdict` S-8's intermittent second-run idempotence red had its output discarded by a
+  `| grep -q`, leaving no causal receipt; the second setup output is now captured and printed on
+  failure. No retry, sleep, enlarged timeout or speculative behaviour change was added, and S-8 is
+  explicitly NOT claimed fixed — it did not recur in the accepted body, and if it returns the next
+  receipt carries the output instead of one context-free FAIL line.
+
+- **Two stale oracles in `smoke-codex-fresh-live`, both surfaced by the LIVE floor of this cut.**
+  (a) The step read a control-socket receipt as successful only when it said `sent|delivered`.
+  `6d90d73` widened two sibling LIVE smokes to the closed four-value axis and named the reason in
+  `smoke-herdr-fresh-call-live.ts:89` — *"the old literal `→ sent` pin would have gone red on the
+  common case and passed only when the caller happened to be idle"* — and this third one was missed.
+  Measured on this exact step: the fixture addresses the initial Pi mid-turn, the rail answered
+  `queued-follow-up`, and a release-gate MUST went red on a delivery that had succeeded. Before P2
+  it passed on the busy path only because the rail said `sent` either way, which is the dishonesty
+  P2 removed; `delivered` was never a member of the set. (b) The initial-Pi exact-once audit still
+  expected the PRE-0.24.0 callback shape — an `entwurf_v2` carrying the nonce as arguments — while a
+  pi sibling's first action has been the zero-argument `entwurf_callback` since 0.24.0, as this
+  smoke's own launch receipt says in the same run: *"its first action is the zero-argument callback
+  verb (codex is the one arm that still sends the nonce as arguments)"*. A sibling obeying the
+  shipped framing was therefore reported as an unexpected call. Only the pi branch moved; the Codex
+  audit keeps `entwurf_v2`, because codex really is still the argument-carrying arm
+  (`codex-callback-env-unsupported`). This is the class `e506716` closed for
+  `smoke-herdr-raw-install-live`, and it stayed hidden in 0.24.0 because that cut's run died earlier
+  at the Pi→Codex template relay. Neither repair weakens an assertion: `{}` is matched by
+  `isDeepStrictEqual`, so it pins the verb's zero-argument contract rather than accepting any
+  arguments, the exact-once count is unchanged, a refusal still fails, and the callback-nonce
+  correlation was never carried by that audit — it is proven earlier and from the DELIVERED body by
+  `the initial Pi callback carries the exact launch nonce`, which reads the fixture's own mailbox,
+  requires exactly one exact match and refuses duplicates.
+
+### Verification
+
+Frozen candidate `69a6f1d`, host `oracle`, 2026-09-23 KST. Two receipts, kept apart on purpose.
+
+- **Deterministic floor:** `pnpm run check:full` exit 0, 607 s.
+- **Aggregate LIVE floor**, `LIVE=1 ./run.sh release-gate <scratch> --cut` with ambient identity
+  carriers stripped, scratch `/tmp/entwurf-release-gate-0.25.0-final.HghiXh`:
+  **MUST PASS=23 FAIL=1 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: BLOCKED (MUST FAIL)`.
+  Inside it, `check-gate-qualification` killed **778/778** with `[gate-qualification] ok` and both
+  purity axes green — measured on these exact bytes, which is why the aggregate was re-run after the
+  two gate commits above: `scripts/smoke-codex-fresh-live.ts` is the subject of three committed
+  mutants (`CODEX-LIVE-EVIDENCE-RECORD-PATH`, `CODEX-LIVE-EVIDENCE-RECOVERY-FAILSAFE`,
+  `CODEX-LIVE-RECOVERY-SOURCE-ONLY`), and all three killed at `sha256=40c7852fc273…`.
+- **The one MUST red is the shape of that step, not a defect.** `release_gate()` supplies no
+  `ENTWURF_CODEX_APP_SERVER_PID`, and `smoke-codex-fresh-live` refuses to infer one — VERIFY: *"The A
+  cell takes no inferred server or models"* — so it declines inside every aggregate on every host.
+  Its pair is the standalone run on the SAME frozen `69a6f1d`: `LIVE=1
+  ENTWURF_CODEX_APP_SERVER_PID=3969303 ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna
+  ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-terra ./run.sh smoke-codex-fresh-live` →
+  **66 assertions ok, exit 0**, `initial-pi=3/3 completed exact`, `codex=3/3 completed exact`.
+  The Pi tier is terra rather than luna, and that is a recorded tier choice, not a gate change: the
+  0.23.1 follow-up already measured luna losing relay fidelity where terra preserves it, and on this
+  cut luna pre-substituted the `<placeholder>` template the smoke audits for byte equality
+  (ROADMAP 0.24.0 follow-up 3). The receipt this cell is accepted on is the run that actually ran.
+- **Host residue (P9, run at the gate's verdict and again at the end of prepare):** 588 → 586 dirs,
+  2 roots / 112 K reclaimed, by prefix `entwurf-s2b-overlay` and `check-probe-ordering`. One
+  reparented process holds a `/tmp` path and was named rather than killed: pid 489788, the
+  operator's own `emacs --init-directory=/tmp/agent-emacs-init --daemon`, which no gate mints.
+- **Open, pre-cut, not resolved by this candidate:** `./run.sh doctor-meta-bridge` is FAIL on this
+  host for exactly one managed scalar — `settings showTurnDuration missing/drifted`, where
+  `~/.claude/settings.json` says `true` and `scripts/meta-bridge-state.py:90` requires `false`.
+  Every other axis of that doctor reads ok (hook launch form, doorbell static contract, statusline,
+  user-scope MCP reachability, cached artifact). The install-state carries no per-scalar provenance,
+  so whether this is drift from our write or the operator's own UI choice is not decided here, and
+  the host was deliberately left untouched.
+
+- **Resolved 2026-09-23, after the paragraph above was written.** That doctor red was not drift and
+  not undecidable: the key had two owners, and GLG ruled the operator owns it. The scalar is retired
+  (see Fixed), and the host migration was measured on both sides — `showTurnDuration=true` before
+  and after, the install-state ledger entry consumed (15 managed keys → 14), and
+  `./run.sh doctor-meta-bridge` now **exit 0, PASS, 33 ok**. The paragraph above is kept as what was
+  true when the frozen candidate was measured.
+
+**Post-prepare release-fix candidate (2026-09-23, host `oracle`) — source, focused and host
+receipts only.** This is not a cut receipt. `check-gate-qualification`'s body (`782/782` killed,
+`[gate-qualification] ok`) and `pnpm run check:full` (`total elapsed 603s exit 0`) ran on the earlier
+frozen seal (`git diff --cached --binary | sha256sum` =
+`ee478d4eac77aae6db187eeb5da2d357ab275c00e6d1eb9463ca04f29bf42425`), before this paragraph and two
+documentation lines were amended; they are not re-attributed to the amended bytes. When this
+paragraph was written (2026-09-23, before 09:44 KST) the LIVE release gate (`--cut`) had not been run
+on this candidate, so this paragraph by itself does not speak to releasability; the LIVE receipt is
+the dated addendum below, and it belongs to the `00264f…` seal only. What was measured:
+
+- **Focused gates, green on the working candidate:** `check-dep-versions`
+  (`ok — pi 0.87.1 is coherent … 9 range + 1 exact + 3 prose declarations`), `check-gate-manifests`
+  (**782** committed mutants across 62 lanes, every `find` still matching its subject exactly once,
+  lane inventory matching its declared contract), `check-release-gate-outcomes`,
+  `smoke-meta-install-state`, `smoke-meta-keyset-guard`, `check-keyset-overlap` against the
+  operator's own agent-config fragment (exit 1 → exit 0, `keyset disjoint ok: 1 fragment vs 15
+  pi-owned key(s)`), `check-meta-doctor-oracle`, `check-meta-manifest-schema`, `smoke-meta-honesty`,
+  `smoke-setup-verdict`, `smoke-user-scope-citizen`, `smoke-meta-prune`, `check-pi-runtime-version`,
+  `check-pi-import-surface`, `check-model-lock`, `check-node-floor-coherence`, `check-pi-preflight`,
+  `check-pi-launch`, `check-pack-pin-matcher`, `check-pack` (540 files), `check-herdr-activation`,
+  `check-herdr-placement`, `check-pi-queue-oracle`, `check-entwurf-v2-surface`,
+  `check-control-send-receipt`, `check-compaction-send-guard`, `check-mux-launcher-fence`,
+  `check-codex-bridge-identity`, `check-codex-native-push`, `check-env-namespace`,
+  `check-shell-quote`, `check-tests-beside-behavior`, `check-install-surface`,
+  `smoke-agy-install-state`, `check-acp-sdk-surface`, `check-mux-fresh-call`. Three type fences
+  `tsc --noEmit` / `-p scripts` / `-p mcp` rc=0, and `pnpm lint` at 0 errors / 22 warnings — the
+  same counts a pristine HEAD produces, measured in its own snapshot for the comparison.
+- **Four new mutants, each killed at its own claimed signature** in a scratch snapshot mirror with
+  control-pre and control-post green, because the shared checkout is never mutated in place:
+  `META-RETIRE-TURN-DURATION-OPERATOR-OWNED`, `CODEX-OPERATOR-PREREQ-ABSENT-SKIPS`,
+  `CODEX-OPERATOR-PREREQ-WRONG-FAILS`, `CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED`. The
+  release-gate lane inventory moves 19 → 22 and meta-retire 3 → 4.
+- **`check-install-surface` was re-run the only way it can tell the truth about an unstaged
+  edit, and that mattered.** It reads the candidate through `git show :<file>`, so a first run over
+  a working-tree-only change is a false green — a trap `NEXT.md` already documented from the
+  previous release. Two U+2014 em dashes had in fact landed in the ASCII-only release skill at
+  `(334,64)` and `(347,9)`. They are gone, and the proof was taken in a scratch snapshot where the
+  whole candidate was `git add -A`ed (**exit 0**, S7e and S6's 494 NUL-free sources included), with
+  a negative control planting one em dash back to confirm S7e really reddens rather than passing
+  vacuously. No staging was performed in the shared checkout.
+- **Host receipts (operator-owned steps, run by the coordinator under GLG's authority and verified
+  independently here):** the retired-scalar migration applied with the operator's `true` intact and
+  the ledger entry consumed; `doctor-meta-bridge` PASS; the global pi CLI moved 0.87.0 → **0.87.1**
+  and this repo's installed `pi-coding-agent` reads **0.87.1**. The running pi coordinator process
+  may predate that upgrade, so it is not used as evidence for it — the versions above were read from
+  the CLI and the installed package.
+
+**LIVE release gate on the amended candidate (2026-09-23 09:44–11:15 KST, host `oracle`) — dated
+addendum.** Candidate seal: HEAD `61cde06755c1eb353c2338c314cdf1eed384b26e`, `git diff HEAD --binary |
+sha256sum` = `git diff --cached --binary | sha256sum` =
+`00264f9177cfc2fde16d468299f12a4d00abc8d54fad1fd3c6c70df06d56478f`, unstaged 0, untracked 0. The
+coordinator's launcher refused to start unless HEAD and both seals matched, and printed them again
+after the run: pre and post identical. That seal is the bytes with the D1/D2/O2 documentation
+amendment above and WITHOUT this addendum; the result is not re-attributed to the documentation-only
+seal that adds these lines. The 69a6f1d `FAIL=1` receipt and the `ee478d…` seal receipts above stay
+as history.
+
+- **Command:** `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID LIVE=1
+  ENTWURF_CODEX_APP_SERVER_PID=3067196 ENTWURF_CODEX_FRESH_MODEL=gpt-5.6-luna
+  ENTWURF_CODEX_FRESH_PI_MODEL=openai-codex/gpt-5.6-terra ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.25.0-00264f --cut`, exit 0. The app-server pid is the pane pid of the
+  one the coordinator started (on GLG's direct instruction) in its own tmux session
+  `entwurf025_codex_server`; it was stated, not searched. Its uid and exact `app-server --listen`
+  argv were checked through `/proc`, and its session differs from the gate's.
+- **Log (cross-host artifact):** `/tmp/entwurf-release-gate-0.25.0-00264f/release-gate.log`, sha256
+  `100c61a5721dee3e693a5f6d4851138d52172ad5301a231431a10478237bf20d`. The decisive lines, verbatim:
+
+  ```text
+  [check:full] total elapsed 621s exit 0
+  [gate-qualification] origin checkout: HEAD + work-surface content hash identical before/after
+  [gate-qualification] qualified claims: 782/782 killed — …
+  [gate-qualification] ok
+  [smoke-codex-fresh-live] 64 assertions ok — fixture -> initial visible Pi -> visible Codex/exact callback -> Pi-addressed native-push v2 -> Codex outbound v2 -> visible Pi/exact callback
+      MUST: PASS=24  FAIL=0  SKIP=0
+      BEHAVIOR: PASS=1  FAIL=0  SKIP=0
+    mode: --cut (a MUST SKIP is a BLOCKER — this run is being read as release acceptance)
+    cut: OK
+  ```
+
+- **Claude Code host:** `claude --version` = 2.1.280, which is above the `>=2.1.217` floor. Host
+  doctor log `/tmp/entwurf-0251-claude-280-doctor.log`, sha256
+  `568f73883a60025e370b5f45cba111620a60c45af351165bab25ddfa0d5be1e7`, exit 0, PASS.
+- **P9, run right after the verdict:** the prefix-blind census found one reparented process holding
+  a `/tmp` path (pid 489788, the operator's own emacs). It is not gate residue and was left alone.
+  `OWNED` derived 107 prefixes. Idle roots older than 60 minutes: 3 (128K). Two were
+  `check-probe-ordering` and one `entwurf-s2b-overlay`; they were inspected, then removed. After P9,
+  the operator owned 592 directories under `/tmp`.
+
 ## 0.24.0 - 2026-09-20
 
 ### Added

package/DELIVERY.md

@@ -27,7 +27,7 @@ API. The levels compare capabilities, not implementation shapes.
 
 | State | Meaning |
 |---|---|
-| `queued` | A message is durable; the backend may not have seen it. |
+| `queued` | A receiver queue accepted the message; the backend may not have seen it. Durability is a property of the RAIL, not of this word — see the acceptance table below. |
 | `triggered` | A supported event/API accepted the signal. |
 | `woke` | An idle interactive session began a turn without user typing. |
 | `injected` | The message reached model-visible context. |
@@ -36,6 +36,29 @@ API. The levels compare capabilities, not implementation shapes.
 
 Avoid bare `delivered`; name the observed boundary.
 
+### Control-socket acceptance boundaries (#120)
+
+A control-socket send answers with ONE of these, and the sender renders that word rather than the
+internal route it took. They are not four spellings of success: they differ on every axis an
+operator has to reason about.
+
+| Boundary | Order | Durability | Visibility | Rejection |
+|---|---|---|---|---|
+| `sent` | n/a — the receiver was idle and the turn was TRIGGERED directly | none needed; the turn started | the turn is running, but the model has NOT necessarily read the text yet, and nothing here says the turn completed | an in-band refusal is `rejected`, never this |
+| `queued-steer` | drained after each turn; overtakes every `queued-follow-up` already waiting | **none** — volatile receiver process memory | nothing shows it: it is not in the TUI's pending-message count | an abort clears the queue and the message is gone, silently |
+| `queued-follow-up` | drained only when the receiver's inner loop ends; a steer arriving later still goes first | **none** — volatile receiver process memory | same: invisible in the receiver's own queue display | same: an abort drops it |
+| `accepted-unknown-boundary` | unknown | unknown | unknown | the receiver ACCEPTED; this names our inability to classify its answer (version skew), and it must never be retried or rendered as `sent` |
+
+`[측정 2026-09-22, pi-agent-core 0.87.0; 재측정 2026-09-23, 0.87.1 — 좌표 동일]` `dist/agent.js:60-71,96-97,137-138`
+(two independent `one-at-a-time` queues, no FIFO between them)
+and `dist/agent-loop.js:85,186,191-197`
+(steering drained every turn, follow-ups only once the inner loop ends).
+
+The **meta-mailbox** rail is the contrast, not a fifth boundary: it writes a durable `*.msg` before
+ringing any doorbell, its filenames are ISO stamps so a drain is a global FIFO, an undrained inbox
+is an honest `mailbox-undeliverable` refusal, and its receipt is that FILE. A mailbox enqueue is a
+durable file receipt; a control-socket queue is process memory.
+
 ## Levels (D0–D8)
 
 These are independent of VERIFY's `L0–L5` evidence levels and BASELINE's question

package/README.md

@@ -254,7 +254,7 @@ cd ~/repos/gh/entwurf
 
 The full source setup requires Node 24, pnpm, and Python 3 on PATH. Harnesses are
 optional-by-presence: `setup` runs the frozen dependency install, then composes what the operator
-already installed — a compatible `pi` (`>=0.86.0 <0.87`), Claude Code, agy, and the Copilot CLI
+already installed — a compatible `pi` (`>=0.87.1 <0.88`), Claude Code, agy, and the Copilot CLI
 each get their wiring completed when detected, an absent harness is an explicit zero-state SKIP,
 and a detected harness that cannot be completed (including a below-floor `pi`) is a named FAIL
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
@@ -288,7 +288,7 @@ This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
 physical host (control sockets, mux, ACP plugin hosting).
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.86.0 <0.87`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.87.1 <0.88`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash

package/VERIFY.md

@@ -132,6 +132,24 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 > `LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid>
 > ENTWURF_CODEX_FRESH_MODEL=<codex-model>
 > ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> ./run.sh smoke-codex-fresh-live`.
+>
+> Those three values are the step's operator-supplied prerequisite, and
+> **`release-gate --cut` inherits that triple** — it is exported onto the aggregate invocation (the
+> release skill's P5 carries it), never inferred by the gate, so the no-inference rule above holds
+> unchanged inside the aggregate. **An ABSENT value is a protocol SKIP naming what was missing; a PRESENT but wrong one
+> stays a FAIL.** That split is the honest reading of the step-outcome protocol — a step that never
+> ran and a step that ran and broke are different facts — and it is what makes this MUST reproducible
+> at every cut instead of inviting a standing exception: before 2026-09-23 all three were assertions, so their
+> absence threw, and because the aggregate supplied none of them this step went red inside every
+> cut on every host (0.25.0's candidate receipt, `MUST PASS=23 FAIL=1`, is that shape). A SKIP is
+> **not** a softening: `--cut` refuses it as `cut: BLOCKED (MUST SKIP)`, so a cut without this
+> receipt is still impossible — the operator supplies the triple and re-runs. A host with no Codex
+> app-server therefore cannot take a cut, which is the intended cost of #87's release stop
+> (「A visible-fresh receipt outside the MUST tier is no longer the general rule」above) rather than
+> an accident. The installed-config preflights are deliberately NOT in that split and remain FAIL
+> on absence — a missing Codex birth, user MCP/status/terminal-title config, runtime, bridge, tmux
+> seat, or an unanswered launch directory is host state `setup` and the Codex doctors own, not a
+> per-invocation input.
 > **Both of THIS cell's live-spend defaults are `gpt-5.6-luna` from 2026-09-17**
 > (`openai-codex/gpt-5.6-luna` on the pi side) — the Codex leg came down off `sol`. It is a tier
 > choice and not a gate change; the receipt this cell is accepted on must be the one that actually
@@ -269,7 +287,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.86.0 <0.87`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.87.1 <0.88`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -46,7 +46,10 @@ a background driver types the scene prompts into the sender pane.
 1. **Spawn** a sonnet sibling (memory write — "tempered indigo").
 2. **Resume** that same sibling (memory recall — identity preservation,
    the #9 regression guard).
-3. **Cross-session greeting** via `entwurf_send` (sent box ↔ received box).
+3. **Cross-session greeting** via `entwurf_send`. *(Historical: `entwurf_send` was retired in the
+   0.12 cutover, and the "sent box" half of that pairing was never actually reachable — the
+   sender-side renderer had zero producers and was removed in #120 P3. What the recording shows on
+   the receive side is real; the send side is a box the operator could not have seen.)*
 
 Run:
 
@@ -139,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.86.0)
+- `pi` on PATH (current floor 0.87.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)