@junghanacs/entwurf 0.35.0 → 0.36.0

package/pi-extensions/lib/acp/model-ids.js

@@ -0,0 +1,77 @@
+// ACP plugin — the curated model IDs, and nothing else (#128).
+//
+// This leaf imports NOTHING. `models.ts` builds the registry rows from the pi-ai
+// catalog; the launch seams (`fresh-call-dispatch.ts`, `resume-launch-identity.ts`)
+// only need to know which IDs exist, and they ride the pi-free bridge closure, so
+// they read the IDs here rather than load a vendor catalog to learn them.
+//
+// WHY `.js`: the same reason as `protocol.js`. Both the emit-capable root program
+// (allowJs) and Node --experimental-strip-types resolve an explicit `.js` import
+// literally to this file, so `models.ts` (root fence, `.js` specifiers) and the
+// strip-types gates that load `models.ts` directly reach one SSOT. A `.ts` leaf
+// would need a `.ts` specifier the root config cannot allow.
+//
+// WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
+// case-insensitive substring match among the provider's rows and prefers the
+// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
+// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
+// silently open on the Snowflake Cortex rail instead of the Claude subscription.
+// An exact match against this list is the only admission; nothing is aliased,
+// substituted or rewritten.
+
+/** The single ACP provider id under which every curated row is registered. */
+export const PROVIDER_ID = "entwurf";
+
+// The curated Claude ids. Adding one here is a commitment to verify it across
+// both axes (protocol smoke + agent interview) — do not extend casually.
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
+	"claude-sonnet-5-5",
+	"claude-opus-5-5",
+	"claude-fable-5-1",
+]);
+
+/** The anchor model whose absence is a hard registry regression, not a soft skip. */
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
+
+// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
+// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+export const CORTEX_MODEL_PREFIX = "cortex-";
+export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+	"cortex-auto",
+	"cortex-claude-opus-5",
+	"cortex-claude-sonnet-5",
+	"cortex-openai-gpt-5.4",
+]);
+
+/** @type {ReadonlySet<string>} */
+const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+
+/**
+ * Exact membership only — no trim, no case folding, no prefix.
+ * @param {string} model
+ * @returns {boolean}
+ */
+export function isCuratedAcpModelId(model) {
+	return CURATED_ACP_MODEL_IDS.has(model);
+}
+
+/** The named refusal both launch seams answer with. */
+export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curated");
+
+export const ACP_MODEL_NOT_CURATED_HINT =
+	`an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
+	"Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
+	"so nothing was opened, and nothing is aliased or rewritten";
+
+/** Carries `reason` so callers match a FIELD, never the wording. */
+export class AcpModelNotCuratedError extends Error {
+	/** @param {string} model */
+	constructor(model) {
+		super(`${ACP_MODEL_NOT_CURATED}: ${JSON.stringify(model)} is not an exact curated ${PROVIDER_ID} model id`);
+		this.name = "AcpModelNotCuratedError";
+		/** @readonly */
+		this.reason = ACP_MODEL_NOT_CURATED;
+		/** @readonly */
+		this.model = model;
+	}
+}

package/pi-extensions/lib/acp/models.ts

@@ -33,9 +33,18 @@
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
 import { getModels } from "@earendil-works/pi-ai/compat";
+import { CURATED_ANCHOR_MODEL_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./model-ids.js";
 
-/** Provider id — current pre-rename surface; S1 renames this load-bearing id to `entwurf`. */
-export const PROVIDER_ID = "entwurf";
+// The provider id and the curated ID lists live in the dependency-free
+// `model-ids.js` leaf, shared with the launch seams (#128); this file is the only
+// one that loads the upstream catalog to turn them into registry rows.
+export {
+	CORTEX_MODEL_PREFIX,
+	CURATED_ANCHOR_MODEL_ID,
+	PROVIDER_ID,
+	SUPPORTED_ANTHROPIC_MODEL_IDS,
+	SUPPORTED_CORTEX_MODEL_IDS,
+} from "./model-ids.js";
 
 // #26 auth-boundary sentinel. `pi.registerProvider` requires an apiKey when a
 // provider defines custom models, but the ACP plugin consumes NO key: backend
@@ -49,17 +58,8 @@ export const PROVIDER_ID = "entwurf";
 // check-auth-boundary gate pins this.
 export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 
-// The curated Claude ids. Adding one here is a commitment to verify it across
-// both axes (protocol smoke + agent interview) — do not extend casually.
-// Exported so the claude backend adapter (backend-adapter.ts) can answer
-// `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"] as const;
-
-/** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-
-// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
-// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5.5, Opus 5.5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window was the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.
@@ -92,7 +92,7 @@ function claudeContextWindow(model: { id: string; contextWindow: number }): numb
 // carries the reserved `cortex-` prefix: the prefix is the SINGLE routing
 // authority (backend-adapter.ts `routeModel`) and keeps the ids off the Claude
 // native ids Cortex routes to (`cortex-claude-sonnet-5` vs the unprefixed
-// `claude-sonnet-5` the claude adapter owns). `routeModel` strips the prefix to
+// `claude-sonnet-5-5` the claude adapter owns). `routeModel` strips the prefix to
 // recover the native id, which is enforced per-turn via
 // session/set_config_option — never a launch `-m` pin (CP0-M).
 //
@@ -101,14 +101,7 @@ function claudeContextWindow(model: { id: string; contextWindow: number }): numb
 // the running cortex no longer serves fails LOUD at set-model, before the
 // prompt (measured: `Unsupported model: …` names the live set). Adding an id
 // here is the same verify-both-axes commitment as the Claude set — do not
-// extend casually.
-export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = [
-	"cortex-auto",
-	"cortex-claude-opus-5",
-	"cortex-claude-sonnet-5",
-	"cortex-openai-gpt-5.4",
-] as const;
+// extend casually. The prefix and the four ids are declared in model-ids.js.
 
 // Hand-set conservative context window. Cortex reports the LIVE window via its
 // own ACP session config, not this curated metadata — this is a floor for the

package/pi-extensions/lib/codex-fresh-preflight.ts

@@ -624,11 +624,12 @@ export async function codexFreshPreflight(
 	if (config === null || trustReceiptMissing(config, key)) return "codex-birth-trust-missing";
 	if (mcpMissing(config)) return "codex-mcp-hand-missing";
 	if (visibleIdentityMissing(config)) return "codex-visible-identity-missing";
-	const socketPath = resolveCodexDefaultSocketPath(env);
-	const socket = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+	const socket = (deps.checkSocket ?? checkCodexSocketFile)(resolveCodexDefaultSocketPath(env));
 	if (!socket.ok) return "codex-app-server-unavailable";
+	// The protocol exchange goes to the endpoint the check verified, never the advertised path
+	// again (on Codex 0.162.1 that path is an alias; see `checkCodexSocketFile`).
 	const live = await appServerIsLive(
-		socketPath,
+		socket.connectPath,
 		deps.openProtocol ?? realCodexProtocolOpener,
 		deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS,
 	);

package/pi-extensions/lib/entwurf-v2-visible-resume.ts

@@ -47,6 +47,7 @@
  * outcome for this module to claim.
  */
 
+import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.ts";
 import {
 	type AcquireLockResult,
@@ -93,6 +94,7 @@ export const RESUME_OBSERVE_INTERVAL_MS = 500;
 export type VisibleResumeRejectReason =
 	| "target-invalid"
 	| "target-not-pi"
+	| "acp-model-not-curated"
 	| "target-locked"
 	| "target-live"
 	| "target-indeterminate"
@@ -227,6 +229,15 @@ export async function visibleResume(targetGardenId: string, deps: VisibleResumeD
 		try {
 			identity = deps.resolveIdentity(targetGardenId);
 		} catch (err) {
+			// #128: the recorded model is not an exact curated ACP id, so Pi would pick another row
+			// by substring. Same shape as `target-not-pi`: a named refusal matched on its FIELD.
+			if (err instanceof AcpModelNotCuratedError) {
+				return {
+					ok: false,
+					reason: err.reason,
+					detail: `${targetGardenId} would launch model ${JSON.stringify(err.model)} under the entwurf provider (the resolved launch pair, which may differ from the recorded provider)`,
+				};
+			}
 			if (err instanceof ResumeBackendUnsupportedError) {
 				return {
 					ok: false,
@@ -321,6 +332,7 @@ export async function observeSameGidSocket(
 const REJECT_HINT: Record<VisibleResumeRejectReason, string> = {
 	"target-invalid": "no citizen has that id; discover targets with entwurf_peers",
 	"target-not-pi": "that citizen's backend has no same-id resume — reach it with entwurf_v2, or open a fresh sibling",
+	"acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
 	"target-locked": "another resume or dispatch holds this citizen's lock right now",
 	"target-live": "that citizen is already running — this verb only reopens dormant ones",
 	"target-indeterminate": "the socket probe could not prove the citizen is dormant, so nothing was started",

package/pi-extensions/lib/fresh-call-dispatch.ts

@@ -25,8 +25,9 @@
  */
 
 import { spawn as spawnChildProcess } from "node:child_process";
+import { ACP_MODEL_NOT_CURATED, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-preflight.ts";
-import { mintNonce } from "./fresh-call-composition.ts";
+import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.ts";
 import {
 	createHerdrRunner,
 	type HerdrFreshCallResult,
@@ -67,6 +68,23 @@ export type DispatchedFreshCall =
 	| { readonly rail: "tmux"; readonly result: FreshCallResult }
 	| { readonly rail: "herdr"; readonly result: HerdrFreshCallResult };
 
+/**
+ * #128: a pi sibling asked for under the `entwurf` provider must name an EXACT curated ACP id. Pi
+ * resolves `--model` by substring among that provider's rows, so a retired `entwurf/claude-sonnet-5`
+ * would open on `cortex-claude-sonnet-5` — another vendor and billing rail — with a receipt that
+ * still names the requested id. Asked here, at the one root both rails share, so neither rail can
+ * forget it. It reads the model the way the rails will (trimmed), and only a model that already
+ * passes their grammar: a malformed one keeps its own `model-invalid` answer from the rail.
+ */
+export function isUncuratedEntwurfPiModel(backend: string, model: string): boolean {
+	if (backend !== "pi") return false;
+	const trimmed = model.trim();
+	if (!isSafeFreshCallModel(trimmed)) return false;
+	const slash = trimmed.indexOf("/");
+	if (slash < 0 || trimmed.slice(0, slash) !== PROVIDER_ID) return false;
+	return !isCuratedAcpModelId(trimmed.slice(slash + 1));
+}
+
 /**
  * Open a sibling on whichever rail this process is actually standing in.
  *
@@ -88,6 +106,12 @@ export async function dispatchFreshCall(
 	spawn?: SpawnFn,
 	nonce: string = mintNonce(),
 ): Promise<DispatchedFreshCall> {
+	// Before either rail is asked anything: both would open a pane on the wrong row.
+	if (isUncuratedEntwurfPiModel(request.backend, request.model)) {
+		return selectFreshCallRail(env) === "herdr"
+			? { rail: "herdr", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } }
+			: { rail: "tmux", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } };
+	}
 	if (selectFreshCallRail(env) === "herdr") {
 		const context = resolveHerdrContext(env);
 		if (!context.ok) {

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -119,6 +119,7 @@ export type HerdrFreshCallRejectReason =
 	// The caller-facing input contract, shared with the tmux rail so a mistyped model or an
 	// oversized task is answered with the SAME word on either placement owner.
 	| FreshCallInputRejectReason
+	| "acp-model-not-curated"
 	| "herdr-context-missing"
 	| "herdr-caller-pane-missing"
 	/** herdr would not tell us where the CALLER is sitting. Three separate names because the
@@ -1102,6 +1103,10 @@ const HERDR_REJECT_HINT: Record<HerdrFreshCallRejectReason | HerdrLaunchFailureR
 		"this surface has no record-backed identity, so a sibling would have nowhere to call home",
 	"model-empty": "pass the model you want the sibling opened with — it is never inherited from this process",
 	"model-invalid": "the model is not in the accepted grammar (no whitespace, no leading dash)",
+	// #128: decided at the dispatch root (`fresh-call-dispatch.ts`), worded here because this rail's
+	// import fence admits no ACP module. The curated list itself lives in `acp/model-ids.js`.
+	"acp-model-not-curated":
+		"an entwurf model must be one exact curated ACP id — Pi would otherwise pick another row by substring (a retired claude-sonnet-5 lands on cortex-claude-sonnet-5), so nothing was opened and nothing was aliased",
 	"task-empty": "a sibling opened with nothing to do is a window nobody asked for",
 	"task-too-long": `the task is over the ${TASK_MAX_CHARS}-character interface bound this verb shares with entwurf_v2`,
 	"herdr-context-missing":

package/pi-extensions/lib/mux-fresh-call.ts

@@ -86,6 +86,7 @@
  *     there is no "session created" field because nothing here creates one.
  */
 
+import { ACP_MODEL_NOT_CURATED_HINT } from "./acp/model-ids.js";
 import { callbackEnvAssignments } from "./callback-env.ts";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
@@ -265,6 +266,7 @@ export type FreshCallRejectReason =
 	| CodexPreflightRejectReason
 	| CodexCallerPreflightRejectReason
 	| CodexCallerSeatRejectReason
+	| "acp-model-not-curated"
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -678,6 +680,7 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 		"no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
 	"model-empty": "model is empty after trimming; fresh calls require an explicit model",
 	"model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
+	"acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
 	"task-empty": "task is empty after trimming",
 	"task-too-long": `task exceeds ${TASK_MAX_CHARS} characters`,
 	"runtime-unresolved": "the backend's runtime is not installed on PATH",

package/pi-extensions/lib/native-push/codex-ws-client.ts

@@ -23,30 +23,135 @@ export function resolveCodexDefaultSocketPath(env: CodexSocketEnv): string {
 	return path.join(resolveCodexHome(env), "app-server-control", "app-server-control.sock");
 }
 
-export type CodexSocketFileCheck = { ok: true } | { ok: false; status: "dead" | "indeterminate"; reason: string };
+/**
+ * What the advertised control-socket path is, and the one endpoint a caller may connect to.
+ *
+ * `connectPath` is a transport endpoint for one exchange: the socket this check verified. It is
+ * not an address, a record field or a replacement for `resolveCodexDefaultSocketPath`. `dead`
+ * names which absence it is, because the managed launcher treats them differently: an absent
+ * path is a first launch, and a dangling rendezvous alias is the leftover of a crashed server
+ * that the vendor removes on its next start.
+ */
+export type CodexSocketFileCheck =
+	| { ok: true; connectPath: string }
+	| { ok: false; status: "dead"; layout: "absent" | "dangling-alias"; reason: string }
+	| { ok: false; status: "indeterminate"; reason: string };
+
+/** Test seam only: the gate points these at a sandbox. Production callers pass nothing. */
+export interface CodexSocketFileDeps {
+	readonly daemonRoot?: string;
+	readonly euid?: number;
+}
 
-export function checkCodexSocketFile(socketPath: string): CodexSocketFileCheck {
+/**
+ * The advertised path is exactly one of two layouts, and anything else is refused.
+ *
+ * (A) A plain socket owned by the effective uid: Codex up to 0.153.4 binds the advertised
+ *     path itself. `connectPath` is that path.
+ * (B) Codex's rendezvous alias. From 0.162.1 the advertised path "is only an alias": the
+ *     server binds a 0600 socket under `realpath(/tmp)/codex-daemon-<euid>/` named by the
+ *     sha256 of the canonical advertised path, then symlinks the advertised path to it
+ *     (`[source]` rust-v0.162.1 `app-server-transport/src/transport/unix_socket.rs:43-131,
+ *     290-304`; `uds/src/daemon_directory.rs:1-38`). Upstream's reason is a privileged
+ *     rendezvous root that sandboxes hide; the alias also keeps an over-long advertised path
+ *     usable (`uds/src/lib.rs:167-174`). The alias is accepted only when every hop is the
+ *     vendor's own: the link is owned by the effective uid; its target is BYTE-EQUAL to the
+ *     path Codex derives (a relative, foreign, re-hashed or chained target is refused); the
+ *     daemon directory is a real directory owned by the effective uid with `mode & 0o777`
+ *     exactly 0700, the vendor's own rule; and the target is a socket owned by the effective
+ *     uid that no group or other user can open. `connectPath` is the verified target, so the
+ *     alias is never re-resolved between this check and the connect. A same-euid process can
+ *     still replace the verified socket file itself; that residual is named, not locked.
+ *
+ * Only `lstat` and one `readlink` touch the alias; it is never followed or `realpath`ed.
+ * The effective uid is the vendor's (`libc::geteuid`), not the real uid.
+ */
+export function checkCodexSocketFile(socketPath: string, deps: CodexSocketFileDeps = {}): CodexSocketFileCheck {
+	const euid = deps.euid ?? process.geteuid?.();
+	let stat: fs.Stats;
 	try {
-		const stat = fs.lstatSync(socketPath);
-		if (stat.isSymbolicLink()) {
-			return { ok: false, status: "indeterminate", reason: `app-server socket is a symlink: ${socketPath}` };
-		}
-		if (!stat.isSocket()) {
-			return { ok: false, status: "indeterminate", reason: `app-server path is not a socket: ${socketPath}` };
+		stat = fs.lstatSync(socketPath);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") {
+			return { ok: false, status: "dead", layout: "absent", reason: `app-server socket is absent: ${socketPath}` };
 		}
-		if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+		return { ok: false, status: "indeterminate", reason: error instanceof Error ? error.message : String(error) };
+	}
+	if (stat.isSymbolicLink()) return checkCodexRendezvousAlias(socketPath, stat, euid, deps);
+	if (!stat.isSocket()) {
+		return { ok: false, status: "indeterminate", reason: `app-server path is not a socket: ${socketPath}` };
+	}
+	if (euid !== undefined && stat.uid !== euid) {
+		return {
+			ok: false,
+			status: "indeterminate",
+			reason: `app-server socket is owned by uid ${stat.uid}, not the effective uid ${euid}`,
+		};
+	}
+	return { ok: true, connectPath: socketPath };
+}
+
+function checkCodexRendezvousAlias(
+	socketPath: string,
+	link: fs.Stats,
+	euid: number | undefined,
+	deps: CodexSocketFileDeps,
+): CodexSocketFileCheck {
+	const refuse = (reason: string): CodexSocketFileCheck => ({ ok: false, status: "indeterminate", reason });
+	if (euid === undefined) {
+		return refuse(`app-server socket is a symlink and this platform has no effective uid to verify it: ${socketPath}`);
+	}
+	if (link.uid !== euid) {
+		return refuse(`app-server socket symlink is owned by uid ${link.uid}, not the effective uid ${euid}`);
+	}
+	let daemonRoot: string;
+	let expected: string;
+	let target: string;
+	try {
+		daemonRoot = deps.daemonRoot ?? path.join(fs.realpathSync("/tmp"), `codex-daemon-${euid}`);
+		const canonical = path.join(fs.realpathSync(path.dirname(socketPath)), path.basename(socketPath));
+		expected = path.join(daemonRoot, crypto.createHash("sha256").update(canonical).digest("hex"));
+		target = fs.readlinkSync(socketPath);
+	} catch (error) {
+		return refuse(
+			`could not verify the app-server socket symlink ${socketPath}: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+	if (target !== expected) {
+		return refuse(`app-server socket is a symlink that is not Codex's rendezvous alias: ${socketPath} -> ${target}`);
+	}
+	let directory: fs.Stats;
+	try {
+		directory = fs.lstatSync(daemonRoot);
+	} catch (error) {
+		return refuse(`Codex's socket directory cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!directory.isDirectory() || directory.uid !== euid || (directory.mode & 0o777) !== 0o700) {
+		return refuse(
+			`Codex's socket directory ${daemonRoot} must be a real directory owned by uid ${euid} with mode 0700`,
+		);
+	}
+	let physical: fs.Stats;
+	try {
+		physical = fs.lstatSync(expected);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
 			return {
 				ok: false,
-				status: "indeterminate",
-				reason: `app-server socket is owned by uid ${stat.uid}, not ${process.getuid()}`,
+				status: "dead",
+				layout: "dangling-alias",
+				reason: `app-server socket is a dangling rendezvous alias: ${socketPath} -> ${expected}`,
 			};
 		}
-		return { ok: true };
-	} catch (error) {
-		const code = (error as NodeJS.ErrnoException).code;
-		if (code === "ENOENT") return { ok: false, status: "dead", reason: `app-server socket is absent: ${socketPath}` };
-		return { ok: false, status: "indeterminate", reason: error instanceof Error ? error.message : String(error) };
+		return refuse(error instanceof Error ? error.message : String(error));
 	}
+	if (!physical.isSocket() || physical.uid !== euid || (physical.mode & 0o077) !== 0) {
+		return refuse(
+			`Codex's physical socket ${expected} must be a socket owned by uid ${euid} that no group or other user can open`,
+		);
+	}
+	return { ok: true, connectPath: expected };
 }
 
 export interface CodexRpcProtocol {
@@ -315,6 +420,7 @@ async function initialize(protocol: CodexRpcProtocol): Promise<void> {
 
 export interface CodexRoute {
 	readonly backend: "codex";
+	/** The endpoint `checkCodexSocketFile` verified for this probe, which the send also uses. Not an address. */
 	readonly socketPath: string;
 }
 
@@ -359,9 +465,14 @@ export async function probeCodexThread(
 	nativeSessionId: string,
 	deps: CodexAdapterDeps = {},
 ): Promise<CodexProbeResult> {
-	const socketPath = resolveCodexDefaultSocketPath(deps.env ?? process.env);
-	const socketCheck = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+	const socketCheck = (deps.checkSocket ?? checkCodexSocketFile)(
+		resolveCodexDefaultSocketPath(deps.env ?? process.env),
+	);
 	if (!socketCheck.ok) return { status: socketCheck.status, reason: socketCheck.reason };
+	// The probe, and the queue send its route carries, both use the endpoint just verified. The
+	// advertised path is not resolved again: on 0.162.1 it is an alias that could be retargeted
+	// between the check and a second transport.
+	const socketPath = socketCheck.connectPath;
 	let protocol: CodexRpcProtocol;
 	try {
 		protocol = await (deps.openProtocol ?? realCodexProtocolOpener).open(socketPath);

package/pi-extensions/lib/pi-durable-runtime.ts

@@ -3,9 +3,9 @@
  * under (#129 W, #130).
  *
  * The experimental durable app is source-only upstream: published `@earendil-works/pi-coding-agent`
- * ships no `dist/experimental`. Entwurf therefore ships the app itself as a CARRIER — the pinned
- * upstream files, type-stripped and relocated (pi/pi-durable/carrier/, emitted only by the
- * maintainer's scripts/emit-pi-durable-carrier.ts) — and declares the published SDK set it runs
+ * ships no `dist/experimental`. Entwurf therefore ships the app itself as a CARRIER — its owned
+ * source (pi/pi-durable/src, #141), type-stripped and relocated (pi/pi-durable/carrier/, emitted only
+ * by scripts/emit-pi-durable-carrier.ts) — and declares the published SDK set it runs
  * against as exact production dependencies. Nothing is provisioned beside the package: there is no
  * runtime directory, no source checkout and no model data to copy (it rides the published pi-ai).
  *
@@ -47,7 +47,7 @@ export type PiDurableRuntimeRejectReason =
 export interface PiDurablePackageLayout {
 	readonly root: string;
 	readonly overlayDir: string;
-	/** The emitted upstream app files and their license. */
+	/** The app files emitted from the owned source, and their license. */
 	readonly carrierDir: string;
 	/** The `--import` resolver the launcher runs the bootstrap under. */
 	readonly resolver: string;

package/pi-extensions/lib/resume-launch-identity.ts

@@ -20,12 +20,13 @@
 
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { AcpModelNotCuratedError, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { getEntwurfExplicitExtensions, readSessionIdentity } from "./entwurf-core.ts";
 import { readAddressableMetaIdentity } from "./meta-session.ts";
 
 /**
- * The ONE expected refusal on this leaf: the target is a citizen of a backend that has no
- * same-id resume at all.
+ * One of the TWO expected refusals on this leaf: the target is a citizen of a backend that has no
+ * same-id resume at all. The other is `AcpModelNotCuratedError` (#128, `acp/model-ids.js`).
  *
  * Everything else this function throws is a defect in the record, the transcript or the
  * environment — a stale path, a foreign session file, an unrecorded model, an unresolvable
@@ -152,11 +153,18 @@ export function resolveResumeLaunchIdentity(gardenId: string): LaunchIdentity {
 	if (!identity.cwd) {
 		throw new Error(`resume-launch-identity: ${gardenId} header has no cwd (the cold-resume authority, #9).`);
 	}
+	// #128: the pair checked is the one the launch will EMIT, not the recorded provider alone —
+	// `getEntwurfExplicitExtensions` also routes a bare Claude model id to `entwurf`. Under that
+	// provider Pi resolves `--model` by substring, so a retired `claude-sonnet-5` would reopen on
+	// `cortex-claude-sonnet-5`. The record and transcript stay as they are; the resume is refused.
+	const provider = explicitExtensions.provider ?? identity.provider;
+	const model = explicitExtensions.modelOverride ?? resumeModel;
+	if (provider === PROVIDER_ID && !isCuratedAcpModelId(model)) throw new AcpModelNotCuratedError(model);
 	return {
 		sessionFile,
 		cwd: identity.cwd,
 		explicitExtensionArgs: explicitExtensions.args,
-		provider: explicitExtensions.provider ?? identity.provider,
-		model: explicitExtensions.modelOverride ?? resumeModel,
+		provider,
+		model,
 	};
 }