@junghanacs/entwurf 0.31.0 → 0.33.0

package/AGENTS.md

@@ -31,7 +31,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 3. **One identity contract, capability domains.** Branch on rail/liveness capability, not a privileged citizen class.
 4. **Live-fact dispatch.** Never store liveness or infer send/resume before resolving the record and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguity, and indeterminate probe reject without mutation or fallback.
-6. **MCP is explicit.** Only explicit `mcpServers`; no ambient configuration scan or automatic retrieval.
+6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`; native extension modules use operator-declared paths through the owning bootstrap. Neither discovers ambient configuration, scans extension directories, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
 7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; redeploy a stale unknown-backend reader. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
@@ -42,7 +42,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 14. **Native-hook ownership is structural.** Use shipped exec launchers and provenance, shared plausible-owner-pid policy, no shell fallback or ancestry guess. Version floors belong to their package source and are enforced there; hook contract/docs own the changing detail.
 15. **Crash, don’t warn.** Invalid config/path/model/store state throws. Empty catches are only bounded environment probes; diagnostics go to stderr.
 16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. A Codex caller's seat is the pane whose title carries its own thread-id, a placement input only; it is never an address, and never a pane nobody named. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
-17. **Entwurf installs itself; setup composes.** Installation supplies Entwurf bytes and development fixtures, never a harness binary, subscription, credential, or login. Setup detects existing harness capability; absence is explicit skip and detected incompleteness is non-green. Portability evidence and rail/runtime support remain separate.
+17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf may carry that pinned, removable app/TUI with its declared overlay and deterministic emit/import relocation, against one coherent published-library version set. Native execution, auth, queues, storage, transcript and recovery remain upstream-owned (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
 
 History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue threads, [BASELINE.md](./BASELINE.md), or source-adjacent comments. When prose and behavior disagree, repair the owning source or document.
 
@@ -91,6 +91,7 @@ implement → affected focused gates → independent review → one amendment bu
           → qualification once if gate/mutant/matrix changed → full floor once on frozen candidate → commit
 ```
 
+- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: required changed qualification, frozen FULL and native/LIVE/release floors remain mandatory before landing/shipment, never inherited from an interim commit.
 - Inner loop runs only affected gates; review and its corrections finish before the full floor.
 - A changed contract names a production subject and independent oracle; its focused assertion has a stable QK and exact-once mutant. Matrices change by their declared axes/cells, not appended anecdotes.
 - Qualification body is scheduled once when its surface changes; its manifest/head checks remain in the deterministic floor. A release requires the exact-SHA qualification evidence required by VERIFY, never a nearby green run.

package/CHANGELOG.md

@@ -4,6 +4,134 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.33.0 - 2026-10-08
+
+### Release coordination
+
+- **First cut coordinated by a pi-durable citizen (#132).** This cut is coordinated by the
+  pi-durable citizen `20261008T113104-801621`, implemented by Claude Code Opus, and independently
+  scrutinized by Grok. Per GLG's direct report (carried here as that report, not as a source
+  receipt), an earlier durable-coordination attempt during the 0.31.0 process broke down; 0.31.0
+  itself shipped with the accepted receipts recorded in its own section below, and neither that
+  report nor 0.32.0's snapshot-loss incident is restated here as a package-publication failure.
+  This section is written at prepare time: the prepared-SHA CI, the preserved artifact and the tag
+  that close the cut are recorded in the GitHub release and the #132 thread, not claimed here.
+- **Verified for this cut.** The Pi SDK 1.1.0 implementation landed at `aceba59` with exact-SHA CI
+  run 37739273349 green on all four required jobs and its qualification body (898/898 killed),
+  after a local body of 898/898 and a frozen `check:full` on that candidate. The prepared tree
+  (scheduling policy, ASCII fix, version metadata) passed a frozen `check:full`. The policy's
+  affected 22-mutant partial run killed 22/22, and its later format/doc amendments re-ran their
+  focused gates. After the operator-owned Codex app-server was restarted, the Codex and
+  Antigravity native doctors were green.
+- **Not run for this cut — GLG's direct cost/deadline decision, one cut only** ("아니야 30분 내로
+  npm publish 전까지 끝내줘. 이 부랜치 핵심은 검증했지? 그럼 됬어. … 시간 아끼자.";
+  [authority record](https://github.com/junghan0611/entwurf/issues/132#issuecomment-6057425161)). The LIVE
+  `release-gate --cut` was started and then aborted inside its `check:full`, before any LIVE step;
+  that is not a verdict, so the live MUST floor is unproven here. Also not run: the pre-commit
+  native acceptance (provider-instruction wire observation, warm/cold retention, the Codex
+  caller-seat cell), the second `check:full` before the push, and waiting for the prepared SHA's CI
+  qualification body before the candidate was packed. That CI run continues and its outcome is
+  recorded with the release; a red result is new scope. Antigravity criterion 7 stays NOT
+  CERTIFIED. VERIFY's release floor is unchanged — this is not a standing waiver.
+
+### Changed
+
+- **Pi SDK 1.1.0 (#132).** The nine exact production SDK members move to `1.1.0` and the
+  pi-durable carrier pin to upstream `v1.1.0` (`abe508e`); the emitter's `--check` reproduces the
+  existing carrier bytes at that commit, so only the pin's tag/commit/SDK set change. The supported
+  ordinary Pi host range follows the pin to `>=1.1.0 <1.2`. The installed-consumer previous-host
+  control moves from a real pi 1.0.2 to 1.0.4 — the immediately prior generation is now the refused
+  host — while the L3/L4 mixed and depth-3 controls keep their real 1.0.3 packages.
+- **A cut runs its qualification body once, at the prepared SHA (#132, #133).** `release-gate` no
+  longer runs a local `check-gate-qualification` body; the release's one body is the exact-SHA CI
+  step at the prepared SHA, which the release oracle already required. The scheduling assertion now
+  keeps `release-gate` at zero invocations and its mutant plants the call back. The development rule
+  of one local run when a gate or mutant changes is unchanged; retiring it stays with #133. For this
+  cut alone GLG granted two exceptions: the policy commit rides the prepared push without its own
+  pre-version CI, and its local whole body was replaced by its affected 22-mutant partial run.
+
+## 0.32.0 - 2026-10-08
+
+### Added
+
+- **One npm installation unit for native `pi-durable` (#130).** The package
+  supplies the omitted experimental app/TUI as a pinned Pi1.0.4 carrier, with the
+  declared contact overlay, deterministic emit/import relocation, MIT license
+  and rebuild contract. Nine exact published SDK dependencies supply the native
+  library set. The operator no longer clones, patches or builds a separate
+  fixed-XDG source runtime; there is no old-route fallback, downloader or repair.
+  Native runtime/TUI/models/auth/queues/SQLite/transcripts/recovery remain upstream-owned.
+- **One explicit native extension ingress.** `--native-module <absolute file>`
+  loads ordinary ESM, including top-level await, before TUI/runtime imports;
+  its default native durable Extension is installed by reference after the
+  contact. Reserved extension/contact names and identity/cwd changes refuse by
+  name. These are trusted-code mistake guards, not a sandbox or rollback. No
+  ambient discovery, classic ExtensionAPI shim, persistent module profile or
+  fresh-call propagation. Synthetic node:* development fixtures prove the
+  contact, module tool and native bash child; real dotenv policy stays downstream
+  in agent-config after release.
+
+### Changed
+
+- **Pi host floor and native SDK set are separate subjects.** Host CLI range is
+  `>=1.0.4 <1.1`; native SDK members are exact1.0.4 production dependencies,
+  with `proper-lockfile`4.1.2. The installed verifier walks reachable physical
+  member edges by name/version, allows coherent sharing and cycles, and refuses
+  incomplete, drifted or mixed-version supply even when imports work.
+- **Known ordinary-Pi manifest warning retained.** The host warns that its
+  extension packages belong in peer dependencies; the exact installed SDK copies
+  intentionally serve the separate native process. GLG accepted this manifest
+  constraint for0.32, not a universal harmlessness or peer-contract certification.
+
+### Fixed
+
+- **Qualification preserves prior-run evidence.** Retire the ambient dead-pid /
+  prefix sweep and its marker-based authority. Full/group execution share only
+  invocation-owned snapshot creation/teardown; prior names and bytes survive
+  green, red and collection fixture cases. No replacement GC or cleanup manager.
+  Repair the malformed-carrier oracle's discriminator and run the actual rebuilt
+  verifier inside its own copied package so the READ-ONLY mutant cannot contaminate
+  the checkout. The production refusal and read-only contracts remain unchanged.
+- **Installed-gate host fixtures keep their SDK generation closed.** Derive the
+  aligned host's complete exact SDK roots from the owning pin, and the same
+  member names at1.0.2 for the previous-host control. The first prepared CI's
+  coinstalled host tried pi-ai1.1.0 and received npm404 through its caret edges;
+  its RED is preserved. Product pins/overrides and native assertions are unchanged.
+- **Fresh-call tool description fits the existing host cap.** One clause was
+  shortened from2068 to2021 characters; callable schema, cap2048, named refusals
+  and the installed-carrier contract are unchanged.
+
+### Verification and evidence boundaries
+
+- **Frozen source/native candidate:** `b220b20c1b95f0ecafe8e679668bda3c5678be81`
+  accepted FULL716s/exit0, all898 committed mutant IDs exactly once KILLED,
+  178 green controls, unchanged origin, MUST25/0/0 and BEHAVIOR1/0/0/cutOK.
+  Explicit installed `check-pack-install` passed separately; FULL/aggregate do
+  not contain that gate or the container gate. Saved official Codex65/Pi-durable36
+  snapshots were independently rejudged through their shipped receipt oracles.
+  [Owning #130 receipt](https://github.com/junghan0611/entwurf/issues/130#issuecomment-6043744944).
+- **Pre-version landing:** main `78c917ae2dbec01281c41287db14ed8d008a3c82`,
+  [push CI37679372365](https://github.com/junghan0611/entwurf/actions/runs/37679372365),
+  all four required jobs plus qualification BODY success, exact898/898 KILLED,
+  controls178green/origin unchanged and Linux artifact-consumer exit0. Its
+  temporary tarball retained package version0.31.0; it is neither the published
+  0.31.0 artifact nor a preserved accepted0.32 candidate.
+- **Independent pre-prepare consistency review:** Grok Blocker0/Defect2; the
+  two stale pending underclaims were corrected as prose, not a gate restart.
+  GLG explicitly approved version metadata preparation, new prepared-SHA CI and
+  one preserved exact artifact without repeating local FULL/LIVE for documentation
+  changes. Source/native receipts retain their original fingerprints; prepared-SHA
+  qualification, versioned artifact and registry equality remain independent
+  evidence. This preparation text does not assert a tag, GitHub release or npm publish.
+- **Historical RED retained.** R3 aggregate remains RED despite FULL714s/exit0.
+  Its protected36MB snapshot was irreversibly deleted by the retired sweep;
+  wider deletion extent and the vendor `-32603` cause remain unknown. Original
+  raw/confirmation/review erratum are preserved. Prior-run preservation is a
+  private-fixture proof: r4 had no prior root in actual tmp, so no in-situ claim.
+  Original0.31 release/tag/artifact/archive are immutable. Native agy1.2 remains
+  NOT CERTIFIED and its historical1.1 pin is unchanged; no new native agy acceptance
+  or permanent exception is inferred.
+
 ## 0.31.0 - 2026-10-07
 
 ### Added

package/README.md

@@ -15,7 +15,7 @@ Git branches, worktrees, file isolation and internal delegation remain their con
 [Short answers: FAQ](./FAQ.md).
 
 ```text
-pi / Claude Code / Copilot / OMP / Antigravity / Codex
+pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
   → record-backed garden id
     → entwurf_v2
       → control-socket | self-fetch mailbox | native-push
@@ -27,24 +27,23 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
-**Native durable contact (`pi-durable`) is accepted in the 0.31.0 candidate (#129).**
-It is a separate native harness contact, not ordinary Pi's control-socket adapter.
-The contact attaches one durable host to a garden id, adds visible identity and
-two-way mailbox contact, while the upstream harness keeps its TUI, models/auth,
-SQLite storage and recovery. First native admission passed on one Linux host;
-release/artifact acceptance is separate. The
-[installation requirements](#optional-native-durable--0310) differ from installing
-the ordinary Pi CLI.
+> **Current release: [0.32.0](https://github.com/junghan0611/entwurf/releases/tag/v0.32.0)**
+> ([`80d66f4`](https://github.com/junghan0611/entwurf/commit/80d66f4ca66f0be674b2d2bfbe20c49717c0340e)).
+> Includes the pinned Pi 1.0.4 native durable app/TUI and one explicit native-module ingress.
+> npm publication and registry byte equality are [verified](https://github.com/junghan0611/entwurf/issues/130#issuecomment-6049936030).
+> Release history and detailed evidence belong in [CHANGELOG](./CHANGELOG.md).
 
 ## Install
 
-**Choose by where you work. Neither route installs a harness, subscription or login.**
+**Choose by where you work. Bring your own harnesses, subscriptions and login.**
+The native durable route below additionally supplies the upstream app/TUI missing from its npm
+release; it does not supply credentials or take ownership of the harness.
 
 ### Direct — ordinary shell or tmux
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.0.2 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.1.0 <1.2`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -72,33 +71,28 @@ Detected harness wiring on Darwin can therefore be written while setup stays
 non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
 restriction; that is not certification of every platform's harness rails.
 
-### Optional native durable — 0.31.0
+### Native durable (pi-durable)
 
-**Entwurf's npm installation does not change. Enabling durable additionally needs
-an operator-provided native runtime; installing ordinary Pi from npm is not enough.**
+**The package supplies the pinned upstream app/TUI and nine exact Pi 1.1.0 SDK
+members.** No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
+The launch verifies carrier integrity and every reachable SDK edge's name/version;
+incomplete, drifted or mixed supply refuses by name.
 
-| Component | How it is supplied | What it does not supply |
-|---|---|---|
-| Entwurf | Existing npm or source-checkout route above | A harness binary, source runtime, subscription or login |
-| `@earendil-works/pi-durable` | npm **library** | The experimental app/TUI or Entwurf citizen attachment |
-| Native experimental durable app | Pinned upstream **source checkout**, with Entwurf's narrow runtime-contact overlay | A replacement ordinary Pi CLI or an Entwurf-owned harness |
-
-This lane retains Pi 1.0.2/source `cd32f77`; a newer global Pi installation does
-not provision that experimental runtime. Existing non-durable users do not need
-a Pi source checkout. Native auth and sessions stay upstream-owned: Entwurf does
-not copy credentials or convert ordinary Pi sessions into durable SQLite sessions.
-
-The package ships the compiled adapter and bootstrap: `entwurf setup` reports the
-operator runtime as PASS/SKIP/FAIL without writing durable wiring, and
-`entwurf pi-durable` is the managed launch. First native admission passed on
-2026-10-06: visible fresh/callback, addressed receive and real Pi ↔ pi-durable
-LIVE36 on one Linux host ([receipts](./DELIVERY.md)). Installed-bootstrap import
-proof does not supply or certify the native runtime; npm installation alone is
-not a durable readiness verdict. #129 closed at reviewed main; release acceptance
-remains its own floor.
-See [setup: native durable](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
-and [#130](https://github.com/junghan0611/entwurf/issues/130) for runtime-supply,
-Pi-upgrade, ACP and UI follow-ups.
+```bash
+entwurf pi-durable --provider <provider> --model <model-id> --width task-wide
+entwurf pi-durable --continue
+```
+
+The contact adds garden identity and two-way mailbox communication. Runtime/TUI,
+models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
+[Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
+
+Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
+imports, then installs its default native Extension after the contact. No automatic
+module discovery or classic Pi API shim; guards are not a sandbox or rollback.
+Ordinary Pi's known `peerDependencies` warning reflects the separate native SDK supply.
+[Native setup](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
+owns flags, refusals and the extension contract.
 
 ### Herdr workbench
 
@@ -106,13 +100,11 @@ Pi-upgrade, ACP and UI follow-ups.
 herdr plugin install junghan0611/entwurf/plugins/herdr --yes
 ```
 
-This is a separate consumer path: it activates only Herdr-integrated **pi and
-Claude Code**, acquires the locked Entwurf runtime, and adds an observation pane.
-It puts no Entwurf bins on PATH. The
-[Herdr integration guide](https://github.com/junghan0611/entwurf/blob/main/plugins/herdr/README.md)
-owns its prerequisites, first install → first use, evidence and explicit removal.
-The plugin does not own delivery or the Herdr launch rail; a direct-installed
-citizen inside Herdr selects that rail from its own process context too.
+This separate path activates Herdr-integrated **pi and Claude Code** with an
+independently locked runtime and an observation pane; it puts no Entwurf bins on PATH.
+An Entwurf release does not automatically re-pin that runtime.
+[Herdr guide](./plugins/herdr/README.md) owns install, use, evidence and removal;
+the plugin does not own delivery or the Herdr launch rail.
 
 ### Garden launcher
 
@@ -169,9 +161,9 @@ Liveness is read at dispatch time; an id's shape does not tell you its transport
 | Reopen a dormant pi citizen under its own id | `entwurf_resume_call {target}` | Separate LAUNCH and socket OBSERVATION receipts; no turn is run |
 
 **Delivery starts no process.** A live pi receives over its record-addressed Unix
-control socket; an armed self-fetch citizen (Claude Code, Copilot, OMP) through its
-mailbox; a probe-alive native-push citizen (Antigravity, Codex) through its native
-conversation/thread. Dormant pi, undeliverable mailboxes, dead/indeterminate native
+control socket; an armed self-fetch citizen (Claude Code, Copilot, OMP, pi-durable)
+through its mailbox; a probe-alive native-push citizen (Antigravity, Codex) through
+its native conversation/thread. Dormant pi, undeliverable mailboxes, dead/indeterminate native
 push and record-less sockets reject honestly. Only control-socket dispatch takes
 the per-target lock; the other rails use their own deliverability/probe evidence.
 
@@ -185,9 +177,10 @@ is a live rail fact, not merely a consequence of trusted identity.
 
 **Mux launches; it never delivers.** Inside Herdr, fresh opens a new unfocused tab
 in the caller's workspace, pi/Claude Code only, with no tmux fallback. Outside,
-it opens pi/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux server.
-The model is required; optional `cwd` is a literal absolute directory, omitted or
-empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
+it opens pi/pi-durable/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux
+server. pi-durable runs the installed carrier on its exact SDK set described above and
+refuses by name before any window when that verdict is not green; Herdr does not fresh-open it. The model is required; optional `cwd` is a literal
+absolute directory, omitted or empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
 tmux session (not permitted inside Herdr), never a new session or a cwd lookup.
 Omitted tmux placement follows the caller: Codex beside its own TUI pane matched
 by thread-id, everyone else in their own session. Missing/ambiguous context refuses.
@@ -197,74 +190,26 @@ a live or non-pi target refuses, and an unobserved window stays visible without
 Exact boundaries: [tmux launch](https://github.com/junghan0611/entwurf/blob/main/docs/mux-launch-rail.md)
 and [Herdr launch](https://github.com/junghan0611/entwurf/blob/main/docs/herdr-launch-rail.md).
 
-## Concept primer
-
-- **Entwurf** (기투, projection-of-self): opening and addressing independent visible
-  siblings, not turning them into workers of a second orchestrator.
-- **Garden / garden id:** the shared address space and stable id of one V3
-  record-backed citizen. Native harnesses keep their own identity and transcript.
-- **ACP:** a plugin that exposes backend turns as pi provider/models under the
-  operator's own auth. The host pi is already a citizen; ACP mints no second one.
-- **MCP:** tool-call ingress to the same compiled `entwurf-bridge`, not a general
-  MCP platform or the pi receive rail. ACP uses explicit `mcpServers` declarations;
-  no ambient config scan or automatic retrieval. Plain anonymous hosts have no
-  authoritative reply address and sends are refused by default.
-- **Engraving:** optional short operator text in the backend's identity carrier,
-  not rich project context or a hidden tool catalog.
-
-## Pi 1.0 and a short history
-
-**We welcome Pi's built-in MCP:** [You Said No MCP!](https://earendil.com/posts/you-said-no-mcp/)
-(Earendil, 2026-09-29). The 0.30.0 cut targets Pi 1.0 admission and ACP basics.
-Instead of keeping native pi copies of the verbs, the adapter registers the same
-compiled bridge after record birth, under the citizen's identity, and Pi supervises
-that MCP child. **MCP is ingress; pi receive remains the record-addressed Unix
-control socket.** Garden identity and dispatch stay Entwurf's. That 0.30.0 cut
-did not adopt or certify `pi-durable` or codemode. Native durable support is now
-accepted as a separate 0.31.0 candidate contact, as described above; codemode remains a
-harness-internal capability, not another garden citizen. The 0.30.0 follow-up
-separately measured Herdr supply 0.9.3 and
-re-pinned the plugin runtime to published npm 0.30.0 with manifest 0.30.0; its
-public consumer and CI receipts live in the #126 thread. That dated alignment is
-not a permanent version-equality rule. 0.30.1 is published (npm, 2026-10-04); at its tag the
-plugin's runtime lock is still the closed `herdr-checkout` verification carrier. Publication did
-not re-pin it: the measured npm re-pin and its source-specific proof are separate, still-open
-work that the [plugin source contract](./plugins/herdr/README.md) owns.
-
-Entwurf is the 0.12+ successor to
-[`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp):
-the work was renamed around the dispatch substrate rather than the pi adapter.
-The pre-0.12 [two-pane demo](./demo/README.md) is **archived evidence**, including
-retired resume behaviour, not current instructions. [CHANGELOG](./CHANGELOG.md)
-keeps the release history; dated Codex topology and qualification receipts remain
-in [DELIVERY](./DELIVERY.md) and [BASELINE](./BASELINE.md), not rewritten as today's acceptance.
-
-## Detailed operation
-
-### Settings
-
-[Setup — settings and backend-specific keys](./docs/setup-clean-host.md#settings-reference-and-backend-specific-keys)
-owns configuration, including billing-safe carrier choices and pi-versus-backend keys.
-
-### External MCP registration
-
-[Setup — external hosts](./docs/setup-clean-host.md#stable-bins-and-external-mcp-hosts)
-and [manual wiring](./docs/external-mcp-host.md) own paths, env and identity prerequisites.
-
-### Custom skills
-
-[Setup — custom skills](./docs/setup-clean-host.md#custom-skills) owns the Claude ACP
-plugin layout and validation; other harnesses keep their native skill mechanisms.
-
-### Context carriers
-
-[Setup — carriers](./docs/setup-clean-host.md#context-carriers) separates short
-engraving from the rich first-user augment and the actual callable schema.
-
-### Compaction policy
-
-[Setup — reuse and compaction](./docs/setup-clean-host.md#session-reuse-and-compaction):
-Entwurf does not implement backend compaction or hydrate another harness's transcript.
+## Concepts
+
+**Entwurf** (기투, projection-of-self) connects independent visible siblings;
+**garden id** names a record-backed citizen, not its pane or native transcript.
+[FAQ](./FAQ.md) explains ACP, MCP and context carriers.
+
+## Pi integration
+
+The pi adapter registers the compiled bridge with Pi's built-in MCP after record
+birth; Pi supervises the MCP child. **MCP is ingress; pi receive remains the
+record-addressed Unix control socket.** Garden identity and dispatch stay Entwurf's.
+Codemode is harness-internal, not another garden citizen.
+
+## Operation guides
+
+- [Settings and backend keys](./docs/setup-clean-host.md#settings-reference-and-backend-specific-keys)
+- [External MCP registration](./docs/setup-clean-host.md#stable-bins-and-external-mcp-hosts) · [manual wiring](./docs/external-mcp-host.md)
+- [Custom skills](./docs/setup-clean-host.md#custom-skills)
+- [Context carriers](./docs/setup-clean-host.md#context-carriers)
+- [Reuse and compaction](./docs/setup-clean-host.md#session-reuse-and-compaction) — native harness-owned; no transcript hydration
 
 ## What this repo owns, and does not
 

package/VERIFY.md

@@ -86,12 +86,12 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 ### The canonical floor — two entry points
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. One core member assumes a build output: the beside test `pi-extensions/entwurf-control.test.ts` (reached through `check-tests-beside-behavior`) registers the COMPILED bridge and refuses by name when it is absent. `prepare` normally builds it at install; after an `--ignore-scripts` install or a bridge source change, run `pnpm run build-bridge` (in the sandbox candidate when verifying one) before the core. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and — for a cut — at the prepared SHA, where the exact-SHA release oracle requires that CI step (#132: `release-gate` no longer runs a second, local BODY; this moves only the release-mode owner — the development rule of one local run when a gate/mutant/matrix changes stays in force until #133 retires it, and the 0.33.0 cut skips it only by a one-cut exception) — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
   - **The snapshot is source-only (#125).** It replicates the git work surface and never copies an ignored artifact from the checkout. A gate that consumes an ignored build output — the compiled `entwurf-bridge` a pi citizen registers — declares it on each of its mutants (`"build": {"argv": [...], "output": "<dir>"}`, one declaration per gate group). For that group only, the runner builds the output from the snapshot's own bytes before the control, rebuilds it after every mutation and from the restored bytes before the post-control (which must reproduce the baseline digest), never counts a build red as a kill, voids a run whose gate writes into the output, and removes the output when the group ends. The runner self-test owns this as `[QK:QUALIFY-BUILD-*]`.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
-  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
+  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
-  - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
+  - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The non-skippable static step (`pnpm run check:full`) is inline: 0 = PASS, nonzero = FAIL, no SKIP arm — it has no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
 
 > **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
@@ -200,25 +200,44 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 Do not collapse source, package, fixture, and native-host evidence into one “green.”
 
-**Native durable contact (#129).** `check-pi-durable-beside` is the deterministic
-beside-test/mutant coordinate in `check:contracts`. The separate
-`check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive`
-are CHECKOUT-ONLY SDK/contact gates: they require the provisioned pinned overlay
-runtime (`ENTWURF_PI_DURABLE_RUNTIME`) and a private compiled bridge emitted from
-this candidate (`ENTWURF_PI_DURABLE_BRIDGE_ENTRY`). Missing inputs report SKIP 97,
-never PASS; present invalid inputs fail. Installed packages refuse these developer
-gates. Contact is adapter-direct/harness-bypassed; send/receive exercise scripted
-loopback S plus actual native harness H, not vendor V. Their scoped raw records,
-wire, native view and SQLite oracles do not certify every queue/crash window.
-The installed-bootstrap import in `check-pack-install` proves package closure,
-not runtime supply or native admission. First-release visible fresh/callback and
-native caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a
-release-gate MUST (LIVE=1; vendor V on a real Pi and a real pi-durable host, operator
-runtime required); SDK or package green does not waive it.
+**Native durable contact (#129, #130 carrier).** `check-pi-durable-beside` is the deterministic
+beside-test/mutant coordinate in `check:contracts`: the adapter, the installed carrier/SDK-set
+verifier, the preflight, the owner join, the carrier's relocation grammar, resolver and
+maintainer emitter (its source reads refuse replace refs), and the bootstrap's explicit
+`--native-module` ingress (#130 P2), driven through the packaged `main`'s own seams: initialization
+before the TUI and the open, named refusals, the identity and directory guards, the contact-first
+order by reference, and the bridge spawn *spec* (not the child's inheritance). `check-pi-runtime-version` asks the
+same verifier whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
+host is setup's subject), and `check-pi-import-surface` asserts the carrier fence. The separate
+`check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive` are
+CHECKOUT-ONLY SDK/contact gates: they run the checkout's own carrier — verified first, refused by
+name — and require a private compiled bridge emitted from this candidate
+(`ENTWURF_PI_DURABLE_BRIDGE_ENTRY`). A missing bridge input reports SKIP 97, never PASS; a
+refused carrier fails. Installed packages refuse these developer gates. Contact is
+adapter-direct/harness-bypassed; send/receive exercise scripted loopback S plus actual native
+harness H, not vendor V. `check-pi-durable-send` with `ENTWURF_PI_DURABLE_SEND_CELL=native-module`
+runs the whole packaged `main` with the synthetic module (`test/fixtures/pi-durable-native-module/`):
+its initialization lands before the host's first `@earendil-works`/`entwurf-pi-dist:` resolution
+(one receipt file, observing resolve hook), and one scripted answer calls the module's tool, the
+native `bash` (whose child sees the module's value) and the contact's `entwurf_self`. Their scoped
+raw records, wire, native view and SQLite oracles do not certify every queue/crash window. `check-pack-install` proves the INSTALLED carrier on actual npm
+consumers (Entwurf-only, aligned host, isolated global): the installed verifier, a consumer oracle
+whose every resolved product file lies inside that consumer's own `node_modules` (with a
+same-sandbox neighbour as the rejected control), every reachable physical SDK edge at the pinned
+version and declared name, a mixed-version tree refused by name although it still imports, a
+constructed depth-3 mismatch refused by the verifier and seen by the oracle, the public launch reaching the
+app's own model refusal before any birth — also with one installed `--native-module` initialized
+first, and a reserved extension name refused before anything opens — and the HOST kept a separate subject — a real pi 1.0.4
+binary (the previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
+PASSes — not native admission. The maintainer's rebuild
+equality is `emit-pi-durable-carrier --check` against a supplied upstream clone; without one it is
+a named SKIP, not acceptance. First-release visible fresh/callback and native
+caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a release-gate MUST
+(LIVE=1; vendor V on a real Pi and a real pi-durable host); SDK or package green does not waive it.
 
 | Axis | Required proof | Limit |
 |---|---|---|
-| Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
+| Source | `pnpm run check:full` + the prepared SHA's CI `./run.sh check-gate-qualification` step | Does not prove an installed consumer. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
@@ -306,7 +325,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.2 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.1.0 <1.2`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
@@ -463,7 +482,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 
 The minimum passing bar:
 
-1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus a `./run.sh check-gate-qualification` green on the same candidate.
+1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus the `./run.sh check-gate-qualification` step green in the exact-SHA CI run of the same prepared candidate (criterion 2's run).
 2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.

package/demo/README.md

@@ -142,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 1.0.2)
+- `pi` on PATH (current floor 1.1.0)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | devDep exact `1.0.2`, peer `>=1.0.2 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Unshipped candidate floor: the published 0.30.0 and 0.30.1 declare floor 1.0.0 with the same next-minor ceiling (`[측정 2026-10-05]` `npm view @junghanacs/entwurf@0.30.1 peerDependencies`; acceptance record CHANGELOG 0.30.0, #125 branch evidence). The 1.0.2 move and its receipts are ROADMAP's 2026-10-05 bump entry |
+| pi runtime | SDK exact `1.1.0`, host `>=1.1.0 <1.2` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #132's 1.1.0 move (ROADMAP's 2026-10-08 bump entry) has its own acceptance still owed. Historical: the published 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |