@junghanacs/entwurf 0.35.1 → 0.36.0

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md — Maintainer Guidelines for entwurf
 
-For agents who own this repository: durable invariants and the documents that own the changing evidence. This is the **entwurf capability package**: garden-citizen dispatch substrate, native-harness bridges, ACP plugin, and pi adapter. Entwurf is the subject; pi is one adapter. ACP is a plugin, not the boundary. V2 addresses existing citizens; `entwurf_fresh_call` creates a new sibling.
+For agents who own this repository: durable invariants and the documents that own the changing evidence. This is the **entwurf capability package**: visible sibling lifecycle and garden-id delivery — the v2 dispatch core, native-harness bridges, ACP plugin, and pi adapter. Entwurf is the subject; pi is one adapter. ACP is a plugin, not the boundary. V2 addresses existing citizens; `entwurf_fresh_call` creates a new sibling.
 
 ## North Star — One Forged Screwdriver
 
@@ -42,7 +42,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 14. **Native-hook ownership is structural.** Use shipped exec launchers and provenance, shared plausible-owner-pid policy, no shell fallback or ancestry guess. Version floors belong to their package source and are enforced there; hook contract/docs own the changing detail.
 15. **Crash, don’t warn.** Invalid config/path/model/store state throws. Empty catches are only bounded environment probes; diagnostics go to stderr.
 16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. A Codex caller's seat is the pane whose title carries its own thread-id, a placement input only; it is never an address, and never a pane nobody named. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
-17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf may carry that pinned, removable app/TUI with its declared overlay and deterministic emit/import relocation, against one coherent published-library version set. Native execution, auth, queues, storage, transcript and recovery remain upstream-owned (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
+17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf owns that thin, removable app/TUI composition as canonical source and ships its deterministic emission (type strip + import relocation) as a carrier, against one coherent published-library version set. The engine — native execution, auth, queues, storage, transcript, compaction, cancellation and recovery — remains the upstream SDK (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
 
 History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue threads, [BASELINE.md](./BASELINE.md), or source-adjacent comments. When prose and behavior disagree, repair the owning source or document.
 

package/CHANGELOG.md

@@ -4,6 +4,215 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.36.0 - 2026-10-13
+
+### pi-durable
+
+- **The thin app/TUI composition is Entwurf-owned source (#141).** The six carrier files
+  are emitted from `pi/pi-durable/src/experimental/durable/*.ts` (with `src/LICENSE`), which
+  folds in the retired `runtime-contacts.patch`, and run on the 1.2.0 SDK set (below). Net
+  against 0.35.1, three carrier files change: `runtime.js` `60c2965e…118403`, `tui.js`
+  `0f9ebaf8…b3abc5` and `subagent.js` `1cb2390b…a64220`. `harness-setup.js`, `prompt.js`,
+  `sessions.js` and LICENSE keep their 0.35.1 bytes. The source checkpoint `86d4b65` left the
+  package version at 0.35.1; this release sets 0.36.0. The first step (S0) moved ownership
+  alone: no carrier byte, no LICENSE and no SDK version (then 1.1.0) changed, only the pin's
+  carrier source blob ids. The upstream SDK still owns
+  execution, auth, queues, storage/transcript, compaction, cancellation and recovery (Rule 17).
+- **Pin schema 3.** `pi/pi-durable/overlay/upstream-pin.json` keeps its path and the shapes
+  installed readers use. A frozen `origin` holds the upstream commit, its recorded blobs, the
+  retired patch's digest and the 0.35.1 carrier digests. Only `carrier` is generated.
+- **Emitter.** `scripts/emit-pi-durable-carrier.ts --check` reads only in-repo source, and a
+  missing file is a named refusal. A host running a different Node gets the byte proof plus a
+  named emitter-identity SKIP, not a PASS. `--write` names every generated field it changes.
+  `--origin <clone>` checks provenance only. The CI `check` job runs the pinned emitter Node
+  exactly, with `ENTWURF_REQUIRE_EMITTER_NODE=1`; other jobs float the major.
+- **Typecheck fence.** `pi/pi-durable/tsconfig.json` is the fourth `pnpm typecheck` program:
+  strict, `erasableSyntaxOnly` / `verbatimModuleSyntax`, and `rootDirs` onto the installed
+  `pi-coding-agent/dist`, so internals are typed by their published declarations. Its explicit
+  empty `exclude` receives what the root program excludes. The exact devDependency
+  `@types/proper-lockfile@4.1.4` supplies the one missing declaration.
+- **Formatting.** The owned source uses upstream width (indentWidth 3), with no per-file
+  exception. Formatting `tui.ts` wrapped its one Entwurf-written dock line and added one trailing
+  comma, so `tui.js` was re-emitted (sha256 `63600d4b…095b`, the S1-B1 intermediate; the S1-B3
+  changes below produce the current `0f9ebaf8…b3abc5`). A parser-derived token/AST
+  comparison found nothing else changed. The `PI-DURABLE-FOOTER-BADGE-PROTECTED` mutant follows
+  the wrapped line and plants the same fault.
+- **Proof.** New claims: `PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL`, `-EMIT-NODE-EXACT`,
+  `PI-DURABLE-SOURCE-FENCE-RESOLVES`, `PI-DURABLE-SOURCE-NOT-SHIPPED` (the source, the fence and the
+  retired patch stay out of the JS-only tarball; proved on npm's own file list with
+  `--ignore-scripts` beside the carrier, while check-pack keeps the same tripwire on the floor), and
+  `PI-DURABLE-EMITTER-NODE-CI-BOUND` / `-CI-REQUIRED`. These two read the check job's active
+  setup-node input and its actual `check:full` step env, never comment text or another step.
+  Retired with the patch: `PI-DURABLE-CARRIER-PATCH-SECTIONS`.
+- **SDK set 1.2.0 (#141 S1-B2).** The nine published `@earendil-works/*` production dependencies
+  move from 1.1.0 to 1.2.0, with the pin's `sdk.members`, the install constellation, the pin-leak
+  matcher and the declared ranges (`>=1.2.0 <1.3`). `pi-client` and `pi-protocol` leave the set (not
+  published at 1.2.0); the only new third-party package is `@silvia-odwyer/photon@0.3.3`.
+- **1.2.0 tool output (#141 S1-B3).** On the 1.2.0 SDK set a native durable tool result's model
+  channel is `output`, which the SDK renamed from 1.1's `content`. When a result omits `output`, the
+  model gets the text the tool retained through `api.output()`. `content` is not read, so a result
+  naming only `content` that retained no output reaches the model as nothing. The subagent tool (now
+  `satisfies ToolExecutionResult`), the contact's bridge tools and the synthetic native-module
+  fixture retain none, so they answer in `output`. The ordinary Pi
+  `ToolExecutionComponent.updateResult` and `InputSubmissionDraft` keep `content`.
+- **Fatal session.** The carrier runtime takes the Session's own close listener and the report that
+  follows it: a session that failed and closed itself is on screen at once (`Session failed: <cause>.
+  It takes no more input, and a tool still running may take a while to stop. Close this session,
+  then reopen it with --continue.`) and input to it is refused by name, without waiting for
+  `closed`, which a tool ignoring its abort can hold off. A normal `close()` unsubscribes first and
+  is no failure. A failure listener subscribed after the failure is told at once, once. On that
+  signal the contact retires its receiver as `session-failed` before the next doorbell — also when
+  the session had already failed before the contact attached, so no receiver marker is left behind;
+  a normal close still retires it as `closed`, and a cleanup failure is thrown, not swallowed.
+- **Compaction failure.** The TUI draws the conversation's retained `pi.live.compactionFailure`
+  (`Compaction failed (<reason>): <error>`) for as long as the SDK keeps it. A failed background
+  compaction the SDK starts on its own (`threshold`) had no other report; the manual one keeps its
+  existing notice beside the line.
+- **Proof (S1-B3).** New claims `PI-DURABLE-SUBAGENT-OUTPUT-MODEL-VISIBLE`,
+  `-BRIDGE-TOOL-OUTPUT-MODEL-VISIBLE`, `-FATAL-SESSION-VIEW`, `-FATAL-SESSION-SHOWN`,
+  `-FATAL-SUBMIT-REFUSED`, `-RECEIVER-RETIRE-ON-FATAL`, `-SELF-CLOSE-NOT-FAILURE` and
+  `-COMPACTION-FAILURE-SHOWN` run the real bootstrap and carrier on the published 1.2.0 SDK with a
+  faux model and an injected storage failure; each mutant plants its fault in the generated carrier
+  or the bridge source.
+
+### Codex
+
+- **The 0.162.1 control endpoint is accepted as its exact alias (#141).** Codex 0.162.1 binds its
+  0600 control socket under `realpath(/tmp)/codex-daemon-<euid>/`, named by the sha256 of the
+  canonical advertised path, and makes the advertised path a symlink to it. One classifier,
+  `checkCodexSocketFile`, accepts a plain socket or exactly that alias (link owner, byte-equal
+  target, a 0700 socket directory owned by the same euid, a socket no other user can open) and
+  refuses every other symlink. The delivery probe, `codex queue --remote` and the fresh-call
+  preflight connect to the socket it verified. The managed launcher runs the same classifier's
+  compiled twin (`mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`) and keeps no copy of
+  its own: a missing twin is an incomplete installation, refused as
+  `codex-app-server-classifier-missing` (reinstall the package, or run `pnpm run build-bridge` in
+  a source checkout), and an answer it does not recognise is refused by name. This is measured
+  on the 0.162.1 layout only and promises nothing about a later Codex. The plain-socket layout is
+  kept; its native acceptance remains the dated 0.153.4 record, not a claim about every older or
+  newer version.
+- **Stated limits.** The launcher reports a dangling exact alias as the dead leftover the vendor
+  removes on start and launches over it, but its alias and dangling-alias paths have no LIVE
+  observation; they are proven on the classifier in a sandbox. The birth hook's thread naming,
+  the fresh Codex TUI's `--remote` endpoint and the fresh-call smoke's thread reads still hand the
+  advertised path to a connect without classifying it. Those connections worked in the named
+  diagnostic on this host; they remain unclassified. That is recorded as an Observation: not
+  every Codex connection goes through the classifier. A same-euid process can still replace the
+  verified socket file; that residual is named, not locked.
+
+### Docs
+
+- **Open, reopen and message lead the one-line surfaces.** The README, FAQ, CONTRIBUTING,
+  AGENTS, the Herdr plugin README and manifest description, and the package description and
+  keywords name the three verbs and where each lands, instead of describing Entwurf as
+  garden-id messaging alone. The README gains an open/reopen/message table with each verb's
+  harness scope. FAQ's tmux list includes pi-durable again, and CONTRIBUTING no longer calls
+  the shipped Codex native-push citizen an unreleased candidate.
+
+### Release boundary and verification
+
+- **Review.** The source checkpoint `86d4b65` and its amendment `d1c9103` were reviewed by
+  the #141 coordinator, Fable advisory reviews (no Blocker; their Defects were fixed before
+  the checkpoint) and a read-only Grok review of `86d4b65`. Grok's eight documentation and
+  live-authority findings were closed in `d1c9103`, and its recheck found no new Defect. The
+  Codex fix `90fa8bb` follows a coordinator-approved design with a read-only Grok design
+  review; a Fable advisory review of its pre-commit bytes found no Blocker, and its one Defect,
+  the missing Codex entry above, is closed in this section.
+- **Local evidence before this preparation is focused, not a whole pass.** Each affected
+  qualification wave (PARTIAL) measured its own candidate and none is carried to another. S0
+  killed 70/70 in two groups; 891 of its 961 committed claims were not run. The S1-B3 source
+  bytes killed 82/82 in three groups (dep-versions 4, pin-matcher 2, pi-durable beside 76), each
+  with a green control; 887 of the 969 committed claims were not run there, nor was the
+  node-floor coherence group. The Codex fix bytes, verified content-identical to `90fa8bb`,
+  killed 219/219 in six groups (app-server launch 10, native push 8, admission parity 2,
+  attribution self-test 1, gate manifests 52, mux fresh call 146), each with a green control;
+  752 of the 971 committed claims were not run. An earlier wave over that fix stopped at its
+  first group with 9 killed and one WRONG-REASON; it is kept as it was, not relabelled. The
+  vitest results cache drifting outside the dependency seal and one socket fixture temp root
+  observed during the native-push group are recorded, not waived. A fresh Entwurf-only npm
+  consumer of the `86d4b65` source bytes (packed with 0.35.1 metadata) proved graph and load
+  only: nine SDK members at 1.2.0, 24/24 carrier dist targets inside the consumer, and the
+  public launch reaching the SDK's own model refusal before any birth. A store migrated by a
+  1.2.0 run and reopened on 1.1.0 kept its version-2 tool task blocked as `task_too_old`: a
+  one-time fixture receipt, not a supported downgrade.
+- **Codex 0.162.1 diagnostic is not a cut.** On the pre-amendment candidate, one Linux
+  `smoke-codex-fresh-live` diagnostic against a live 0.162.1 app-server passed 65 assertions,
+  native push included, with `gpt-5.6-sol` on the Codex side and `openai-codex/gpt-6.1-sol` for
+  the Pi sibling only. It is not release-gate acceptance and covers no other model. The earlier
+  local FULL and LIVE `--cut` were taken on the pre-fix candidate (the cut was BLOCKED when the
+  advertised alias was refused) and are not evidence for this one. The frozen FULL and the final
+  LIVE `--cut` passed on this candidate (below); the installed-consumer proof
+  (`check-pack-install`, run by the CI `install-surface` job, not by `check:full`) and the
+  prepared SHA's CI body are pending.
+- **Final frozen floor on this candidate.** One frozen tree, HEAD `90fa8bb` plus this release's
+  metadata, with the same work-surface fingerprint before and after both runs.
+  `pnpm run check:full` passed once (817 s, exit 0; 599 files in the dry-run pack).
+  `LIVE=1 ./run.sh release-gate <scratch> --cut` passed once: **MUST PASS=24 FAIL=0 SKIP=0**,
+  **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Its own static FULL (814 s) means this floor ran
+  FULL twice. The Codex step named the operator-owned 0.162.1 app-server by pid (851181) with
+  `gpt-5.6-sol` on the Codex side and `openai-codex/gpt-6.1-sol` for the Pi siblings, and passed
+  65 assertions, native push included; it attaches to an existing server, so the managed
+  launcher's alias and dangling-alias paths remain unobserved. Scratch
+  `/tmp/entwurf-release-gate-0.36.0.lw5Xju`, log SHA-256
+  `17a2bd54efaaeba2899bf9bbd3c13c0e68749d9d03367347c4872d6f4126ad30`; FULL log SHA-256
+  `184ea443326a72858d25b70ba25b44e804307205586d8a03d4af7c5b07ee1288`. A read-only host census
+  afterwards found one `entwurf-chain-*` and one `smoke-pi-durable-fresh-live-*` root from this
+  run, the same per-run residue earlier LIVE runs left; it is recorded and was not cleaned. This
+  is local acceptance only: not the exact CI, not a whole qualification pass.
+- **Exact CI pending.** The prepared SHA's exact CI (the four required jobs and the
+  qualification body) is the next checkpoint and is not presumed PASS.
+- **Unpublished candidate carrier.** As in 0.35.1, `plugins/herdr/runtime-lock.json`
+  temporarily names the closed `herdr-checkout` source: an npm-source lock must agree with
+  the checkout's core version, and 0.36.0 has no published integrity yet. The Herdr
+  manifest stays 0.35.1. After the operator publishes core 0.36.0, a separate Herdr snapshot
+  re-pins the measured registry bytes.
+- **Publication boundary.** No make artifact, core tag, GitHub Release or npm publication
+  is claimed; they wait for the exact CI, the make decision and the operator.
+
+## v2026.10.13-herdr.0.35.1 — Herdr Entwurf plugin 0.35.1
+
+A separate Herdr plugin snapshot, not another core release: core package 0.35.1 and
+its `v0.35.1` tag remain unchanged. The operator has published the core to npm.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.35.1 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns to production npm source
+  `@junghanacs/entwurf@0.35.1` with the registry's measured sha512
+  (`sha512-cZZaGfNP…EIchcQ==`). The plugin manifest moves 0.35.0 → 0.35.1;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged.
+- **The same core capability through Herdr.** The runtime this snapshot acquires carries
+  core 0.35.1: the Claude 5.5 curation with its set-model readback and the pi-durable inbox
+  repair (#140). The core release also adds an English, source-only checkout menu. The
+  plugin changes no rail, gate or mutant.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.35.0
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed the intervening `herdr-checkout` candidate must explicitly deactivate by
+  its own absolute runtime path before reinstalling the npm-source snapshot.
+  No operator installation or active session is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports version/latest 0.35.1, repair 0.12.8-repair.1. The downloaded
+  tarball is 11101943 bytes, SHA256
+  `6edbcf9fbf31a6df1aff04f34b28ac279a071917d13916410bf466fd33a44eae`, equal to the preserved
+  core release candidate. Independently computed sha512 equals `dist.integrity`;
+  the registry-shipped runtime helper is byte-equal to this checkout's.
+- Required exact-registry-tarball Docker consumer passed without repacking. Real-npm
+  0.35.0 → 0.35.1 swap and harness-seeded torn-swap recovery passed: the product restored
+  the last-good tree before reacquisition, certified the new registry digest, then
+  performed an exact-request no-op and owned-fixture removal. Seven focused
+  Herdr/manifest gates passed with HEAD, index and work surface unchanged.
+  `check-herdr-sandbox` was not run locally for this snapshot because it reads the
+  operator's own herdr panes; it rides the pushed SHA's FULL floor in CI.
+- At preparation time, the public-ref install/use/deactivate/reinstall journey and the
+  pushed plugin SHA's ordinary four-job CI are still pending. Their actual outcomes belong
+  to the release checkpoint; this paragraph is not their acceptance. Earlier npm or
+  checkout-carrier receipts cannot certify these source-specific axes.
+- Core 0.35.1's native Codex LIVE remains an explicit per-cut unmeasured exception, not a
+  PASS or a standing waiver. Its whole qualification body ran at the core release SHA;
+  this plugin-only metadata change does not borrow that body as its own.
+
 ## 0.35.1 - 2026-10-13
 
 ### ACP

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` is a **garden-citizen dispatch bridge** — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail** — that lets already-running harnesses address one another by garden id; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is an unreleased native-push candidate with record birth and delivery-probe evidence (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.
 

package/DELIVERY.md

@@ -193,6 +193,21 @@ no daemon and no pid file: Ctrl-C is the operator's. A live socket, an unidentif
 second `--listen` are named refusals; a dead socket file is reported and launched over. Passing
 the raw vendor command by hand remains equivalent and is not deprecated.
 
+**The control endpoint from Codex 0.162.1 (#141).** `[source rust-v0.162.1]` The advertised path is
+now only an alias: the vendor binds a 0600 socket under `realpath(/tmp)/codex-daemon-<euid>/`, named
+by the sha256 of the canonical advertised path, and symlinks the advertised path to it
+(`app-server-transport/src/transport/unix_socket.rs:43-131, 290-304`; `uds/src/daemon_directory.rs:1-38`).
+One classifier, `checkCodexSocketFile`, accepts exactly a plain socket or that exact alias — link
+owner, byte-equal target, a 0700 socket directory, a socket no other user can open — and refuses
+every other symlink. The delivery probe, `codex queue --remote` and the fresh-call preflight connect
+to the socket it verified, never to the alias again. The launcher runs the same classifier's
+compiled twin (`mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`) directly, refuses any
+answer it does not recognise, and reports a dangling exact alias as the dead leftover the vendor
+removes on start. A same-euid process can still replace the verified socket file; that residual is
+named, not locked. The alias layout is certified on the classifier in a sandbox; the 0.162.1
+app-server protocol itself requires a named LIVE observation; a diagnostic is not release-cut
+acceptance, which separately requires the official release gate.
+
 #95 D1 (GLG, 2026-09-16) retired the requirement that this session be named `codex`, and with it the
 rule that an omitted-placement Codex TARGET selected it. The operator still owns the app-server and
 still chooses its room; Entwurf neither creates nor supervises it, and a missing app-server rejects.

package/FAQ.md

@@ -8,7 +8,7 @@ No. Entwurf is closer to a workshop than a factory: it connects independently ow
 
 ## What does Entwurf do?
 
-It gives an existing session a stable **garden id** and routes a message, reply, or visible sibling launch through the rail that session actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
+It opens, reopens and messages visible sibling sessions across independent harnesses, each under a stable **garden id**. `entwurf_fresh_call` opens a new sibling in the caller's Herdr workspace or tmux session by default, `entwurf_resume_call` reopens a dormant pi sibling under the same id, and `entwurf_v2` delivers a message, reply or hand-off to an existing one through the rail it actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
 
 ## What is a garden id?
 
@@ -28,11 +28,11 @@ No. [`entwurf_v2`](./README.md#entwurf_v2--canonical-dispatch-verb) only address
 
 ## Where do visible siblings open?
 
-Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, Claude Code, Copilot, OMP, or Codex runtimes in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
+Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, pi-durable, Claude Code, Copilot, OMP, or Codex runtimes in a new window of the caller's tmux session, or of an existing session the caller names; without an explicit tmux placement, a Codex caller opens beside its own TUI pane. A dormant pi sibling reopens under the same id in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
 
 ## Does Entwurf replace Herdr or tmux?
 
-No. Herdr and tmux provide visible seats. Entwurf provides identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
+No. Herdr and tmux provide visible seats. Entwurf opens siblings into them, reopens dormant pi siblings, and carries identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
 
 ## How do I install it?
 

package/README.md

@@ -1,10 +1,12 @@
 # entwurf
 
-`entwurf` is a garden-citizen dispatch substrate: a thin bridge that lets independent
-agent harnesses address one another by **garden id**, without owning each other's
-transcript, authentication, tools, or runtime.
+`entwurf` connects independent agent harnesses as visible siblings: open a new session,
+reopen a dormant pi session in tmux, or reach an existing sibling by **garden id**. Fresh
+sessions open in the caller's Herdr workspace or tmux session by default; explicit tmux
+placement can name another existing session. Each harness keeps its own runtime,
+authentication, tools and transcript.
 
-![entwurf — a forged screwdriver for garden-citizen dispatch](docs/assets/entwurf-hero.jpg)
+![entwurf — a forged screwdriver for visible sibling sessions](docs/assets/entwurf-hero.jpg)
 
 **Pi ↔ native Claude Code inside the [Herdr workbench](#herdr-workbench).**
 A recorded source-checkout demo: callback → task → native Bash → reply.
@@ -21,12 +23,15 @@ receipts and named lifecycle verbs; the operator and native harnesses keep steer
 Git branches, worktrees, file isolation and internal delegation remain their concern.
 [Short answers: FAQ](./FAQ.md).
 
-```text
-pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
-  → record-backed garden id
-    → entwurf_v2
-      → control-socket | self-fetch mailbox | native-push
-```
+| Verb | Tool | Where it lands | Harnesses |
+|---|---|---|---|
+| **Open** a new sibling | `entwurf_fresh_call` | Herdr: a new unfocused tab in the caller's workspace. tmux: a new window in the caller's session, or an existing session named by `placement.tmuxSession`; without an explicit tmux placement, a Codex caller opens beside its own TUI pane | Herdr: pi, Claude Code. tmux: pi, pi-durable, Claude Code, Copilot, OMP, Codex |
+| **Reopen** a dormant sibling | `entwurf_resume_call` | A visible tmux window under the same garden id, with the transcript, model, provider and cwd its record names; no turn is run | pi |
+| **Message** an existing sibling | `entwurf_v2` | Its own rail: control socket, self-fetch mailbox or native push; delivery starts no process | pi, pi-durable, Claude Code, Copilot, OMP, Antigravity, Codex |
+
+Antigravity is message-only: an existing conversation registers itself, and Entwurf never
+launches one. A launch receipt is neither the new sibling's address nor proof that it
+processed its task; the sibling's own callback envelope supplies its garden id.
 
 The package holds the v2 core, native-harness bridges, a pi adapter and an ACP
 plugin. ACP is one ingress, not the boundary; pi is one adapter, not the center.
@@ -40,14 +45,15 @@ receipts; [CHANGELOG](./CHANGELOG.md) records source history.
 ## Install
 
 **Choose by where you work. Bring your own harnesses, subscriptions and login.**
-The native durable route below additionally supplies the upstream app/TUI missing from its npm
-release; it does not supply credentials or take ownership of the harness.
+The native durable route below additionally supplies an app/TUI, Entwurf's own thin composition of
+the durable app upstream omits from its npm release; it does not supply credentials or take
+ownership of the harness.
 
 ### Direct — ordinary shell or tmux
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.1.0 <1.2`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.2.0 <1.3`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -77,7 +83,7 @@ restriction; that is not certification of every platform's harness rails.
 
 ### Native durable (pi-durable)
 
-**The package supplies the pinned upstream app/TUI and nine exact Pi 1.1.0 SDK
+**The package supplies Entwurf's owned app/TUI carrier and nine exact Pi 1.2.0 SDK
 members.** No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
 The launch verifies carrier integrity and every reachable SDK edge's name/version;
 incomplete, drifted or mixed supply refuses by name.
@@ -87,8 +93,9 @@ entwurf pi-durable --provider <provider> --model <model-id> --width task-wide
 entwurf pi-durable --continue
 ```
 
-The contact adds garden identity and two-way mailbox communication. Runtime/TUI,
-models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
+The contact adds garden identity and two-way mailbox communication. Entwurf owns the
+thin app/TUI composition (shipped as an emitted JS carrier); execution, models/auth, queues,
+SQLite, transcripts and recovery remain the upstream SDK's:
 [Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
 
 Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
@@ -161,6 +168,13 @@ Liveness is read at dispatch time; an id's shape does not tell you its transport
 
 ### `entwurf_v2` — canonical dispatch verb
 
+```text
+pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
+  → record-backed garden id
+    → entwurf_v2
+      → control-socket | self-fetch mailbox | native-push
+```
+
 | What you want | Tool | What its receipt means |
 |---|---|---|
 | Message, reply or hand off to an existing garden id | `entwurf_v2 {target, intent:"fire-and-forget", message}` | Receiver acceptance boundary, mailbox enqueue or native injection; not completion |

package/VERIFY.md

@@ -213,8 +213,8 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 **Native durable contact (#129, #130 carrier).** `check-pi-durable-beside` is the deterministic
 beside-test/mutant coordinate in `check:contracts`: the adapter, the installed carrier/SDK-set
 verifier, the preflight, the owner join, the carrier's relocation grammar, resolver and
-maintainer emitter (its source reads refuse replace refs; its one patch carries exactly one
-section per patched carrier file, #134), and the bootstrap's explicit `--native-module` ingress
+maintainer emitter (its `--check` reads only the owned in-repo source, #141; the overlay patch is
+retired, and `--origin <clone>` checks provenance only), and the bootstrap's explicit `--native-module` ingress
 (#130 P2) with its paired `--native-module-dir` (#134), driven through the packaged `main`'s own
 seams: initialization before the TUI and the open, named refusals, the identity and directory
 guards, the top-level `*.extension.mjs` filter and byte-wise order, cross-module name refusals, the
@@ -250,11 +250,13 @@ constructed depth-3 mismatch refused by the verifier and seen by the oracle, the
 app's own model refusal before any birth — also with one installed `--native-module` initialized
 first, a reserved extension name refused before anything opens, one installed `--native-module-dir`
 initializing only its top-level `*.extension.mjs` (#134) and a directory without a module refused
-before anything opens — and the HOST kept a separate subject — a real pi 1.0.4
+before anything opens — and the HOST kept a separate subject — a real pi 1.1.0
 binary (the previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
-PASSes — not native admission. The maintainer's rebuild
-equality is `emit-pi-durable-carrier --check` against a supplied upstream clone; without one it is
-a named SKIP, not acceptance. First-release visible fresh/callback and native
+PASSes — not native admission. The carrier's rebuild
+equality is the owned source's emission (#141): the beside claim `PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL`
+on every floor, `emit-pi-durable-carrier --check` as its CLI. The emitter's exact Node is red in the CI
+`check` job (`ENTWURF_REQUIRE_EMITTER_NODE=1`) and a named SKIP on a host running another Node, not
+acceptance there. First-release visible fresh/callback and native
 caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a release-gate MUST
 (LIVE=1; vendor V on a real Pi and a real pi-durable host); SDK or package green does not waive it.
 
@@ -348,7 +350,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.1.0 <1.2`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.2.0 <1.3`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -24,7 +24,7 @@ takes/helpers/tests are maintainer tooling and are deliberately excluded from th
 
 - Node at the `package.json#engines.node` floor; the checkout's pinned dependencies and
   current compiled bridge. After a source/bootstrap change, build with `pnpm run build-bridge`.
-- Pi at the checkout's supported floor (**current floor 1.1.0**); `entwurf` on PATH must be
+- Pi at the checkout's supported floor (**current floor 1.2.0**); `entwurf` on PATH must be
   the intended source stable-bin. Source evidence is not registry-package acceptance.
 - `herdr` on PATH at exactly `scripts/fixtures/herdr-supply.json#version`; `asciinema` v3.
 - Herdr's existing Pi integration at

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | SDK exact `1.1.0`, host `>=1.1.0 <1.2` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #132's 1.1.0 move (ROADMAP's 2026-10-08 bump entry) has its own acceptance still owed. Historical: the published 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
+| pi runtime | SDK exact `1.2.0`, host `>=1.2.0 <1.3` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #141's 1.2.0 move has its own acceptance still owed. Historical: the published 0.33.0 through 0.35.1 ship SDK exact 1.1.0, 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |

package/docs/setup-clean-host.md

@@ -28,8 +28,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.1.0 <1.2` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
-| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): a pinned upstream v1.1.0 app carrier plus the exact 1.1.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
+| pi | optional-by-presence, `>=1.2.0 <1.3` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.2.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -209,7 +209,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.1.0
+npm install -g @earendil-works/pi-coding-agent@1.2.0
 pi --version
 
 cd ~/entwurf-smoke
@@ -217,7 +217,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.1.0 <1.2`. It is a hard minimum: installing this
+The supported range is `>=1.2.0 <1.3`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -313,23 +313,22 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
 What the Entwurf package supplies:
 
 1. **The pi SDK set** — `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
-   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.1.0`, plus
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.2.0`, plus
    `proper-lockfile`, as Entwurf's own production dependencies (declared once in
    `pi/pi-durable/overlay/upstream-pin.json` `sdk`). Model data rides the published
    `pi-ai`; there is no catalog copy.
 2. **The native app/TUI carrier** — upstream does not publish the experimental durable
    app (`pi-coding-agent` excludes `dist/experimental`; `pi-durable` on npm is the
-   library). Entwurf ships the six pinned app files from upstream tag `v1.1.0`
-   (`abe508e1b89912adde45528136c3221eb69acdd7`), its narrow runtime-contact overlay
-   applied to `runtime.ts`, type-stripped and relocated, in `pi/pi-durable/carrier/`
+   library). Entwurf owns the six app files as canonical source (`pi/pi-durable/src`,
+   first taken from upstream tag `v1.1.0` `abe508e1b89912adde45528136c3221eb69acdd7`) and ships them type-stripped and relocated in `pi/pi-durable/carrier/`
    with upstream's MIT license. Each file's source blob and emitted digest are in the pin.
    The carrier reaches pi-coding-agent's internals only through its resolver
    (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
    own `dist/` as installed — never through a source checkout.
 
-The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/durable/README.md)
-and [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
-describe what the carrier is. Running the bare upstream app does not attach Entwurf's
+The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.2.0/packages/durable/README.md)
+and the [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
+(last published at v1.1.0) describe what the carrier is. Running the bare upstream app does not attach Entwurf's
 garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
 proxy a subscription; native execution, models, auth, queues, SQLite and recovery stay
 upstream-owned.
@@ -411,7 +410,7 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
   not a claim that every load path is harmless.
 
-The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.1.0 <1.2`): a host Pi is
+The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.2.0 <1.3`): a host Pi is
 not needed to run pi-durable, and a host inside the range need not be the same copy as the
 carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
 in place rather than copying credentials or migrating ordinary Pi transcripts. Native
@@ -424,19 +423,28 @@ proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
 ### Maintainer: re-emitting the carrier
 
-Only a maintainer moving the pin runs `scripts/emit-pi-durable-carrier.ts`. It reads the
-pinned commit's objects (`<commit>:<path>`, `--no-replace-objects`) from a repository the
-maintainer names, applies the overlay patch with `git apply` in a private scratch tree,
-type-strips with Node's own strip-only TypeScript, relocates, and checks that the six files
-import exactly the pin's declared `distTargets`:
+Only a maintainer changing the pi-durable app runs `scripts/emit-pi-durable-carrier.ts`. Its
+input is Entwurf's own source in this repository (`pi/pi-durable/src`, #141, typechecked by
+`pi/pi-durable/tsconfig.json` against the installed SDK's declarations): it type-strips with
+Node's own strip-only TypeScript, relocates, and checks that the six files import exactly the
+pin's declared `distTargets`:
 
 ```bash
-node scripts/emit-pi-durable-carrier.ts --source <clone holding the pinned commit> --write
-node scripts/emit-pi-durable-carrier.ts --source <clone holding the pinned commit> --check  # rebuild equality
+node scripts/emit-pi-durable-carrier.ts --write   # names every generated field it changes
+node scripts/emit-pi-durable-carrier.ts --check   # rebuild equality
+node scripts/emit-pi-durable-carrier.ts --origin <clone holding origin.commit>  # provenance only
 ```
 
-`--check` without such a repository is a named SKIP, never rebuild acceptance; the emitter
-version (Node) is part of the pin.
+A missing source file is a named refusal, never a skip. The byte comparison also runs as a
+beside claim on every floor. The emitter's Node is part of the pin: under another Node,
+`--check` compares the bytes and then reports the identity as a named SKIP, never rebuild
+acceptance; the CI `check` job runs the pinned Node with `ENTWURF_REQUIRE_EMITTER_NODE=1`, where
+a mismatch is red. `--origin` checks the frozen `origin` record against the upstream objects
+it names (`<commit>:<path>`, `--no-replace-objects`) and never feeds a rebuild.
+
+The owned source is formatted at upstream width (`biome.json` override, indentWidth 3), with no
+per-file exception. A formatting change to an owned file changes its emitted bytes. So it is
+re-emitted with `--write`, and its generated digest is reviewed like any other carrier change.
 
 ## 3. Optional Claude Code native citizen
 
@@ -601,7 +609,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.1.0 <1.2`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.2.0 <1.3`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/mcp/entwurf-bridge/dist/pi-extensions/lib/codex-fresh-preflight.js

@@ -549,10 +549,11 @@ export async function codexFreshPreflight(env, deps = {}) {
         return "codex-mcp-hand-missing";
     if (visibleIdentityMissing(config))
         return "codex-visible-identity-missing";
-    const socketPath = resolveCodexDefaultSocketPath(env);
-    const socket = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+    const socket = (deps.checkSocket ?? checkCodexSocketFile)(resolveCodexDefaultSocketPath(env));
     if (!socket.ok)
         return "codex-app-server-unavailable";
-    const live = await appServerIsLive(socketPath, deps.openProtocol ?? realCodexProtocolOpener, deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS);
+    // The protocol exchange goes to the endpoint the check verified, never the advertised path
+    // again (on Codex 0.162.1 that path is an alias; see `checkCodexSocketFile`).
+    const live = await appServerIsLive(socket.connectPath, deps.openProtocol ?? realCodexProtocolOpener, deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS);
     return live ? null : "codex-app-server-unavailable";
 }