@junghanacs/entwurf 0.39.0 → 0.41.0

package/CHANGELOG.md

@@ -4,6 +4,563 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.41.0 - 2026-10-22
+
+A sibling's garden id is its birthday, and this cut lets it rest and come back under it. A
+sibling can now be opened, spoken to, retired when the human operator names it, and reopened
+under the same id with its conversation intact. That holds for ordinary Pi and native Claude
+Code. Retirement is a pause in a long session, not cleanup: it is never autonomous, a paired
+requested/outcome record beside the target's record is attempted for every request with any
+recording failure reported on its own axis, and the record and transcript stay.
+A durable pi-durable sibling can drive both verbs. Each was measured once on real sessions, which
+is recorded as dated evidence, not as a release gate.
+
+### Fresh call
+
+- **A Pi-dialect model names its provider, and never OpenRouter (#76).** The dispatch root both
+  rails share now refuses, before either rail is asked anything, a pi or pi-durable model whose
+  provider segment is `openrouter` in any letter case (`model-openrouter-forbidden`) and a pi
+  model that names no provider at all (`pi-model-not-provider-qualified`). The second replaces
+  the 2026-08-13 non-goal that allowed a bare id: GLG decided on 2026-10-21 that the provider is
+  stated explicitly, because a bare alias resolves to whichever catalog row Pi prefers (the
+  2026-09-17 bare `terra` opened on an OpenRouter row). It is a call-time input contract, not a
+  version pin: no model list, catalog copy, resolved-row or endpoint check was added, so a later
+  model name passes this provider check once it is written `<provider>/<id>` (not a promise
+  that it launches, nor a bypass of #128). Other backends' model names
+  (a claude-code `opus` alias) are not judged; resume and #128 curation are unchanged. The
+  refusal checks the name a caller wrote, not the endpoint a provider name reaches. The
+  `entwurf_fresh_call` model description says both rules. Proof:
+  `pi-extensions/lib/fresh-call-dispatch.test.ts` (three QKs) and three mutants in the
+  `fresh-call-dispatch` lane (12 → 15), executed through `./run.sh check-fresh-call-provider`.
+
+### pi-durable
+
+- **The durable contact offers `entwurf_resume_call` (#147 L1).** A pi-durable citizen (the
+  coordinator's host) could not call the existing same-id resume verb: its contact exposed six bridge
+  tools and resume was not among them. It now registers a seventh, under the bridge's own
+  single-`target` schema, and forwards the call to the bridge unchanged. The verb itself is
+  unchanged by L1: at that checkpoint pi-only targets (L2 below widens the domain), a live target
+  refused, no turn, the record supplies the launch facts. Nothing new authorises who may resume, a
+  retire verb is not here, and a running durable host offers the tool only after it is restarted onto a build that
+  carries it. Because the bootstrap reserves every contact tool name, an operator native module
+  that registers a tool named `entwurf_resume_call` is now refused as `native-module-name-reserved`.
+  Proof: two QKs in `pi-extensions/meta-bridge-pi-durable.test.ts` — the tool is offered and hands
+  the bridge exactly `{target}`, and a faux model's call on the published runtime reaches this
+  package's compiled bridge through the contact's production connector and reads the bridge's named
+  refusal for a test-owned record of a backend with no same-id resume (codex since L2; no citizen is
+  resumed). Two mutants
+  in the `pi-durable` lane (84 → 86), executed through `./run.sh check-pi-durable-beside`. The
+  independent tool lists of `check-pi-durable-contact`, `check-pi-durable-send` and
+  `smoke-pi-durable-fresh-live` now name seven tools. One default-cell `check-pi-durable-send` run
+  (scripted loopback endpoint and the carrier app's native tool path; no vendor model turn) offered
+  `entwurf_resume_call` in the app's first model request, and its parameters there equal the
+  bridge's own listed schema — read from that run's raw wire receipt, because the default cell's
+  QK judges only self, peers and v2; the seven-tool `native-module` cell was not run. A running
+  coordinator host offering seven tools, and any operator rollout, remain unmeasured.
+
+### Operator-requested retirement (#147)
+
+- `entwurf_retire_call {target}` makes one explicitly human-requested Pi or Claude Code attempt. Development, coordinator status and record-backed attribution are not standing permission. Where a host provides or is configured with an approval step, that step applies as well; Pi and pi-durable 1.3.0 have no built-in approval prompt by default. MCP annotations and caller identity are hints and attribution, not permission. No autonomous cleanup, roster expansion or automatic replay.
+- The per-request production binding captures its directories and cancellation signal. Requested/outcome events share an id in a target-gid append-only sidecar with explicit actor/target fields. Action, record-write failure and lock cleanup stay independent; an append failure cannot turn a possibly effective action into a safe retry. The source bridge lists nine tools, ordinary Pi seven active plus two hidden, and the durable contact eight.
+- Independent review repaired a metadata-test oracle, random-id privacy-test flakiness and snapshot/file-target consistency. A private `node_modules` compiled consumer passed29 assertions over anonymous/self refusal, existing resume refusal, inert Node RPC and two-line attribution. Operator dist hashes stayed unchanged. That consumer is not real Pi/Claude Code retirement, Native/LIVE, G4 rollout or release acceptance; final candidate floors and exact-SHA CI are still owed.
+- 2026-10-22, source `a9c9459`: one operator-requested, test-owned Native round trip per backend — a fresh pi-durable caller (actual offering of all eight contact tools) retired and same-id resumed a fresh ordinary Pi and a native Claude Code 2.1.307 target once each, with dormant delivery refused, identity and transcript preserved across the promptless resume, and blind recall. n=1; not a MUST gate, ACP, Herdr, Windows, release-artifact or flush/descendant claim ([BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1)). The five stale on-disk Codex/Copilot/OMP reader copies were rolled forward with their owning installers; Copilot birth's doctor runtime axis remains RED on a historical hook error. GLG explicitly deferred its Native runtime validation for this landing: the current free `auto` account, not a subscription, is impractical to test (GLG reports a greeting taking over a minute; not re-benchmarked here). On-disk reader compatibility is closed with that named runtime deferral; resident-process reloads and broader runtime/release acceptance remain unmeasured. Earlier component receipts below do not become this candidate's kill-power.
+
+### Internal retirement checkpoints (#147; before public composition)
+
+- **Pi's control server now serves an internal `retire` RPC.** A Pi started from this
+  checkout can already receive it; this is not a claim about the published 0.40.0 package.
+  Immutable garden/native identity, TUI, idle and no-pending guards precede one SDK shutdown
+  request. The shared production response envelope and strict one-shot client keep
+  `shutdown-requested` distinct from exit, flush or model silence. Busy work is refused, not
+  aborted or queued for a later shutdown.
+- **Claude Code has a fixed Linux pidfd helper and request adapter.** The helper is copied
+  beside the compiled adapter; it pins a process, checks its start key, accepts one complete
+  go/cancel frame and requests one fd SIGTERM with bounded exit observation. Fresh
+  record/receiver/sender birth, arm binding, owner domain and pid/key joins run before helper
+  spawn and after ready. Unknown is not safe-retry permission. A fd-process exit does not
+  prove conversation identity, descendant termination or transcript flush.
+- **A private dispatcher preserves action and cleanup independently.** Trusted caller
+  attribution/self refusal, fresh target and liveness checks, one adapter and one lock release
+  are composed through mandatory seams. It creates no grant/role database. At these component
+  checkpoints there was no accepted production host composition or public retirement MCP/contact
+  registration. The later candidate composition above owns its separate binding and runtime proof.
+- **Proof remains candidate-local:** owned receiver/helper fixtures; independent review;
+  primitive PARTIAL Pi9 + CC11, later request-adapter PARTIAL9+6+15+40, then pure-dispatcher
+  PARTIAL10 on different candidates; private compiled consumer28 and a missing-Pi-entry
+  negative on the adapter candidate. These are not release-SHA kill-power, installed retirement
+  runtime or four-cell native lifecycle evidence. Actual host composition, G4 reader rollout,
+  public caller integration and the preserved #106 B append-only attribution record remain
+  open. Existing live/release floors are not waived by these checkpoints.
+
+### Resume
+
+- **`entwurf_resume_call` reopens a dormant Claude Code citizen under its own garden id (#147 L2).**
+  The verb's domain is now pi and claude-code, a closed set; every other backend is the named
+  `target-backend-unsupported` (the retired `target-not-pi` has no alias). A Claude Code target is
+  launched as the fixed `claude --resume <record nativeSessionId>` at the record's cwd — no model or
+  permission flag it was once started with is restored, and no transcript is read; the record's
+  session id must be a lowercase UUID and its recorded transcript an existing file. Dormancy means
+  the LAST VALIDATED owner the Entwurf hook armed is proven gone AND that arm is still the record's
+  last one: the receiver marker, read through the no-follow fd reader (`readStoreRecordFile`: a
+  symlink or non-regular entry is corrupt, never followed) and judged by the shared
+  `classifyMarkerOwner`, must name this record's session and an owner proven DEAD, and the record
+  re-read after that verdict must carry the same non-null `attachIncarnation` the marker copied.
+  No marker, an unreadable or mismatched one, a live owner, an inconclusive one and an unbound one
+  each refuse by name (`target-receiver-absent` / `-corrupt` / `-mismatch` / `-unbound`,
+  `target-live`, `target-indeterminate`) with no window; the launch uses the re-read record, and no
+  marker or record is removed or rewritten. The observation succeeds only when a NEW live owner in
+  the pane this call opened re-arms the marker for the same session with a fresh binding the
+  current record also carries (same createdAt); a record defect stops it at once as
+  `record-unreadable` with its cause (window kept), and an unseen re-arm is `resume-unobserved`.
+  The verb submits no prompt; for Claude Code what the runtime does after it comes back (a doorbell
+  on unread mail may wake a turn) is unmeasured. Both backends' resume windows now carry the fixed
+  identity scrub fresh-call already had (`-e PI_SESSION_ID= -e PI_AGENT_ID=`, shared from
+  `mux-launch.ts`), because a resumed Claude Code never re-exports its own. Inside herdr the tmux
+  resume rail refuses as `herdr-resume-unsupported` instead of using an ambient `TMUX` (this also
+  applies to pi). The receipt names the caller from the same authoritative identity fresh_call reads,
+  as attribution only: an anonymous caller is `unattributed`, never refused, while a defect in the
+  caller's own store fails the call loud — for pi resume too — exactly as fresh_call does.
+- **The arm binding: one new V3 key, `attachIncarnation` (#147 L2 B1).** A dead receiver marker
+  used to be resume evidence even when a LATER attach of the same session had committed but could
+  not re-arm the marker (owner unproven, marker write failed), so a second window could open on a
+  live session. Now the Claude Code hook mints a clock-independent 128-bit value (`randomBytes(16)`)
+  on every arm-capable event (SessionStart, CwdChanged, FileChanged — an arm revision, so one live
+  process mints many), commits it in the same atomic record upsert and copies it into the receiver
+  marker; UserPromptSubmit and every other writer preserve it, and nothing fills it by inference.
+  Every write the hook makes to an existing record runs under a per-gid record-arm lock in its own
+  directory (`meta-record-arm-locks`, beside the receivers dir; never the v2 dispatch lock visible
+  resume holds across its observation): the garden id is learned by a read-only certified lookup,
+  an absent record is published create-only (`upsertMetaSession` `expectAction` refuses a raced
+  create instead of turning it into an unlocked attach), an arm waits at most 2 s for the lock and
+  otherwise writes NOTHING and logs ERROR, and a busy UserPromptSubmit skips its backfill. A marker
+  write failure after the record committed is an ERROR logged after `INFO armed watch`, and resume
+  then refuses that garden as unbound. **Schema:** the same V3, one key wider — absent reads as
+  `null` ("no binding observed"), every serialize emits it, a present value must be 32 lowercase
+  hex, every other stray key is still refused; gardenId, nativeSessionId and createdAt keep their
+  values and no record is rewritten. `meta-facts` citizens carry the key verbatim. **One-way per host:** a reader that predates the key refuses
+  every record that carries it, and an old writer certifies the whole store first, so once one new
+  write lands every old reader and writer on that host refuses — a mixed-reader incident on oracle
+  on 2026-10-21 (records written by a Pi loaded from the development checkout) took the CC hook
+  and the pi-durable contact down until the checkout dist and the CC hook bundle were re-deployed.
+  Codex birth, the Copilot extension/receiver, the OMP bridge/receiver and the external
+  `entwurf-peek` mirror still carried the old reader there at L2; the on-disk copies were rolled
+  forward on 2026-10-22 (see the retirement section).
+  Old dormant Claude Code citizens whose record has no binding stay `target-receiver-unbound` until
+  a human reopens them once under a new hook. **Accepted boundary (GLG, 2026-10-21, current live
+  Pi/CC cohort scope):** only committed hook attaches are guarded — a process that holds the session
+  without one (hooks disabled, a record-arm lock timeout or a store failure at its start) is
+  invisible to the proof. The installed CC hook bundle now carries `lib/entwurf-v2-lock`, and the
+  doctor's writer-version parity checks it beside the writer.
+- **Claude Code floor `>=2.1.306`** (`package.json` `entwurf.claudeCodeFloor`, GLG 2026-10-21):
+  same-id resume runs `claude --resume` from the record's last observed cwd, and the vendor CLI
+  reference says the session-id search covers other projects only from v2.1.223. 2.1.306 is the
+  version GLG relayed as running here; it is a declared floor with no LIVE receipt at 2.1.306 itself
+  (the 2026-10-22 n=1 round trip ran on 2.1.307). The
+  exec-form observations at 2.1.217 stand as observations.
+- Proof: QKs beside the composition (`entwurf-v2-visible-resume.test.ts`), in
+  `check-resume-launch-identity`, `check-mux-resume-call`, `check-meta-v3-record`,
+  `check-meta-session`, `check-meta-hook-session-switch` (binding pair, UPS preserve, unproven owner,
+  lock busy/wait/own-dir, two overlapping successful schedules, and an install-closure check that
+  compares the hook's static double-quoted `from` imports with what the installer copies and then
+  runs the staged compiled hook) and `check-meta-doctor-oracle` (installed binding; lock module
+  missing/drifted). Mutants: v2-visible-resume 18 → 40, mux-resume-call 10 → 13,
+  resume-launch-identity 7 → 10, meta-hook-session-switch 17 → 25, meta-identity 4 → 9, existing
+  ones re-anchored. At the L2 checkpoint the LIVE dormant→resume journey for Claude Code had not
+  been measured, and `smoke-mux-lifecycle-live`'s Claude Code cell, which expects the still-live
+  sibling's resume to be refused as `target-live`, had not been run. Retire (G3) and the caller's
+  four cells were not part of L2; the later 2026-10-22 n=1 round trip is recorded in the
+  retirement section. The Claude Code dormant leg is still not a release-gate MUST.
+
+### Team bookmarks
+
+- **`team.json.example` shows one way to keep long-lived siblings in view.** It is a fictional,
+  caller-maintained bookmark: each member's name, the descriptive form of address
+  `coordinating sibling` or `sibling`, backend, garden id and native session id. The real
+  `team.json` at a repository root stays ignored. No program loads either file; the record stays
+  the address authority, liveness is re-read from `entwurf peer-facts`, and membership is not
+  permission to send, resume or retire.
+
+### Herdr plugin
+
+- **Back to the checkout carrier for this unpublished candidate.** `plugins/herdr/runtime-lock.json`
+  moves from the published `@junghanacs/entwurf@0.40.0` npm pin to the closed `herdr-checkout`
+  source, as the 0.40.0 preparation did; no npm integrity is invented and the plugin manifest
+  version is not bumped. The npm re-pin follows publication in its own Herdr snapshot. Inside
+  Herdr, `entwurf_resume_call` still refuses as `herdr-resume-unsupported`; retirement from a
+  Herdr pane was not measured.
+
+### Upgrade notes
+
+- A running process keeps the bytes it loaded. Ordinary Pi's built-in MCP bridge and pi-durable
+  load the compiled `dist`, `start.sh` hosts load the source in a checkout, and installed
+  hook/extension copies change only through their owning installers; restart the session after
+  that ([setup](./docs/setup-clean-host.md#applying-new-source-to-a-running-host)). A reader that
+  predates `attachIncarnation` refuses records carrying it, so roll every installed reader forward.
+- Claude Code needs `>=2.1.306` for same-id resume. Its retirement uses a Linux pidfd helper and is
+  refused elsewhere. The native-Windows preview has no resume, and retirement was not
+  measured there. Copilot's Native
+  runtime validation is deferred by GLG's decision on the free `auto` account.
+
+### Evidence boundary
+
+- **One real round trip per backend, at `a9c9459`, not at this release's SHA.** A fresh pi-durable
+  caller retired and same-id resumed a fresh ordinary Pi and a native Claude Code 2.1.307 target
+  once each: dormant delivery refused, native identity and transcript preserved across the
+  promptless resume, blind recall correct. n=1; not a release-gate MUST, ACP, Herdr, Windows,
+  release-artifact or flush/descendant claim
+  ([BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1),
+  [#147](https://github.com/junghan0611/entwurf/issues/147#issuecomment-6329217980)).
+- Kill-power re-measured at this shipped SHA: none (all 1173 committed claims not re-proved,
+  #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-entwurf-v2-retire"]` 32/32 receipt fc08567fb8d3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-retirement-event"]` 16/16 receipt 948a9661fdc0
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-pi-durable-beside"]` 44/44 receipt 61e5b0552648
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","smoke-agy-install-state"]` 12/12 receipt deccfdbf3990
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","scripts/smoke-pi-provider-state.sh"]` 5/5 receipt 9de492738ef4
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a9c945921a7e surface
+  80a4f8a7b942 -- `["bash","run.sh","check-entwurf-v2-surface"]` 17/17 receipt b4c765bd35b7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a9c945921a7e surface
+  80a4f8a7b942 -- `["bash","run.sh","check-pi-durable-beside"]` 44/44 receipt b6751a543d7a
+- **Local static and LIVE floor, measured on this preparation's candidate:** head `c318f30` plus
+  the three release-prep files (this evidence line excepted); the HEAD/index/worktree fingerprint
+  and the 94-file compiled `dist` were unchanged before and after each run. `pnpm run check:full`
+  PASS (exit 0, 882 s) with the host herdr at the supply pin 0.9.5, where `check-herdr-sandbox`
+  passed its 12 assertions on a private server and left the operator's panes and Pi trust store
+  untouched. Two earlier local attempts stayed RED and are kept, each at its own head: at
+  `bf24e17`, a `dist` built 35 s before the last `.ts` commit (the managed rebuild then produced
+  byte-identical output); at `c318f30`, the host herdr 0.9.4 against the 0.9.5 pin. `LIVE=1 ./run.sh release-gate <scratch> --cut`:
+  **MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0, cut OK**, 11:59:15–12:19:05 KST, with the
+  caller identity carriers stripped. The Codex step ran against a test-owned app-server started
+  for this run in its own tmux session (pid named from its own launch, start ticks recorded,
+  stopped by one TERM afterwards) from a different gate session, with the requested tiers
+  `gpt-6-luna` and `openai-codex/gpt-6-luna` — the request, not a billing or model-identity
+  proof. Receipts on the operator host: `.tmp-verify/release-0.41.0/` (`full-r3/full.log`
+  `44332ee7fd78`, `live/release-gate.log` `6f56fffab3da`).
+- **Still owed before the tag.** This prepared SHA's exact push CI (four required jobs). This
+  release is carrier-bearing, so its candidate is the native-Windows preview workflow's pack at
+  the prepared SHA, never a local `npm pack`. The strict `doctor-meta-bridge` on an installed
+  0.41.0 Claude host in a new post-install session, the agy shipped-lane cell and the Codex
+  caller-seat cell (VERIFY release acceptance 4, 7, 8) follow that candidate. Tag, GitHub
+  release and npm publication each need their own approval.
+
+## v2026.10.20-herdr.0.40.0 — Herdr Entwurf plugin 0.40.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.40.0 and its
+`v0.40.0` tag remain unchanged. The operator has published the core to npm.
+
+**Reading guide (2026-10-20).** The `## 0.40.0` section below and the body of the
+[v0.40.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.40.0) are
+prepare-time text: their "still owed before the tag" lines and their npm wording predate the
+cut. The cut-time acceptance (exact-SHA CI, the Windows preview candidate, the Linux consumer,
+the installed remote-pair gate, VERIFY §3.4, and §3.7 (agy) excluded for that cut only by the
+operator's decision, not a PASS) is recorded in the
+[#107 cut receipt](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6281283301).
+The publish is the later registry fact recorded in this section (`latest` 0.40.0, published
+2026-10-20T01:49:33Z, registry bytes equal to the accepted candidate). Neither the published
+tarball's CHANGELOG nor the release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.40.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.40.0
+  rode to production npm source `@junghanacs/entwurf@0.40.0` with the registry's measured
+  sha512 (`sha512-y9HgQIcm…bQnZUW/g==`). The plugin manifest moves 0.39.0 → 0.40.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From the
+  `v2026.10.19-herdr.0.39.0` snapshot to `v0.40.0`, the only change under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` was that lock's return
+  to `herdr-checkout`.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`; core 0.40.0
+  keeps the Pi 1.3.0 SDK set.
+- **Not a remote-pair certification.** Core 0.40.0's remote pair (#107) is carried in the
+  acquired runtime's bytes, but this snapshot measures no remote delivery, no SSH and no second
+  host through Herdr. The one real exchange remains the core section's L4 trial.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.39.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.40.0 and `repair` 0.12.8-repair.1, 621 files, published
+  2026-10-20T01:49:33Z. The downloaded registry tarball is byte-equal to the preserved accepted
+  core candidate (SHA256 `4a6906ac38ff5024b9e07f7a092cc54a7686696082893293dfa653036f87fa55`,
+  11292707 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge`. No model turn.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.39.0 runtime was seeded from its own committed lock (`ba46dec`); the swap to
+  0.40.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.39.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.39.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-dep-versions`, `check-install-surface` and `check-gate-manifests` (1034 committed
+  mutants across 79 lanes validated, none executed). `check-herdr-plugin-build` and
+  `check-herdr-sandbox` were not run locally because they run the operator's own herdr; they
+  ride the pushed SHA's FULL floor in CI.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
+## 0.40.0 - 2026-10-20
+
+The bridge is crossed and the questions are carried forward. A person laid a bridge
+between two machines, and a message sent across it to an existing sibling came back. That
+crossing happened once, at pre-release branch commit `e632294`. This cut carries that
+capability and its open questions, not a new two-host LIVE measurement at its own SHA. It
+does not solve remote trust or remote visibility; the questions it leaves open are listed
+below as questions, not as features.
+
+### Remote pair (#107)
+
+- **One operator-declared pair across two hosts.** An opt-in `entwurf-remote-pair.json`
+  beside each host's meta-record store has exactly four keys: `remoteGardenId`, `ssh` (an
+  existing alias), `localGardenId` and `remotePairFile` (the other host's own file). One
+  file serves both directions. An absent file is off. A symlink, non-regular, unreadable
+  or invalid file is refused. The file is read at every send and receive and never cached.
+  The operator owns the connection between the hosts (a private network such as Tailscale
+  is recommended, not required) and SSH authentication. Entwurf installs, configures,
+  discovers and retries none of it.
+- **Send.** `entwurf_v2` to the declared `remoteGardenId` makes exactly one `ssh -o
+  BatchMode=yes -o ConnectTimeout=10 <alias> entwurf remote-pair-receive --pair <file>`
+  call, with no shell and the claim on stdin. A declared target that also has a local
+  trace is refused as `remote-route-local-conflict`. A sender other than `localGardenId`
+  is refused as `remote-sender-not-declared`. Both refusals make zero SSH calls. An
+  undeclared target takes the unchanged local path. The send ends in one of three ways.
+  The first is the other host's receipt, quoted verbatim: an acceptance, or an error it
+  reported while processing (`remote-reported-error`). The second is its named refusal
+  before any mutation. The third is `remote-indeterminate`. A result is decided only when
+  the exit code and JSON kind agree. There is no retry.
+- **Receive.** `entwurf remote-pair-receive` accepts only its own canonical file path
+  (normalized, not realpath). It refuses a `from` or `target` outside the declared pair
+  before any mailbox mutation and hands a match to that host's existing local `entwurf_v2`
+  dispatch. The compiled twin ships in the tarball
+  (`dist/scripts/remote-pair-receive.js`). The received envelope names the remote origin,
+  marks the sender's cwd as a sender-host path and carries `replyable=false`, with "reply
+  route declared, not probed". This display is proven for the self-fetch mailbox body
+  only. `entwurf_callback` stays local.
+- **Trust and visibility, as built.** The trust model is same-operator SSH account trust.
+  The receiving host checks the declared pair. It does not cryptographically authenticate
+  a citizen, and it says nothing about whether the content deserves trust. The route has
+  no launch, fresh or resume path. For the measured self-fetch pair an OFF citizen is
+  undeliverable, and every other target keeps its own rail's admission. The code does not
+  check that the target's screen is open; owner pids, TTYs and garden-id labels are not
+  visibility. Delivery to an active, armed pi-durable can start a turn at once.
+- **A reported error is not read as non-delivery.** When the other host's dispatch reports
+  an error (exit 4), the sender's first line says that an error was reported, that
+  delivery is not inferred from that line and that nothing was retried, and it quotes the
+  other host's text verbatim. That text includes its own `retry-safe: false` after a
+  possible write. An external source review on #107 raised this before the cut.
+- **Docs.** DELIVERY ("Remote pair (#107)") owns the contract. `docs/setup-clean-host.md`
+  gains the operator steps (§2c) and "Applying new source to a running host": a pi-durable
+  host runs the compiled bridge even from a checkout, and a running bridge keeps the
+  modules it loaded, so neither a pull nor a green setup line shows which bytes are live.
+  `docs/remote-sibling-principles.md` is new; it holds the boundaries kept across hosts
+  and the questions below.
+
+### Questions carried forward
+
+- **Is a connection the same as trust?** Today's boundary is an operator-owned SSH account
+  and one exactly declared pair. How should the reach of an account be told apart from
+  trusting the sibling that sent a message?
+- **Does visibility survive a machine boundary?** Locally, the operator's visible-first
+  policy keeps conversation turns to siblings the user has open; that is a policy, not a
+  technical screen check. Across hosts, the first exchange relied on the user's own
+  confirmation that both sessions were open. What would observe and keep visible-first
+  remotely, without a hidden turn or a watcher?
+- **How much can a sender know?** Acceptance is not a read, and a reply does not tell its
+  sender that the reply was read. How should that uncertainty be shown honestly without
+  retries, a third ACK, read tracking or a conversation manager?
+
+None of these is a hidden backlog item;
+[remote-sibling-principles](./docs/remote-sibling-principles.md) keeps them as open
+questions. Automatic discovery, reconnection, OFF wake, hidden model turns, remote
+callbacks and support for every backend or platform are not claimed.
+
+### Evidence boundary
+
+- **Deterministic and installed.** T1 executor-in and T2 surface-in cells sit beside the
+  behavior: the real bridge over MCP stdio, with a stand-in `ssh` running the other host's
+  real entry under a separate HOME. `./run.sh check-remote-pair-installed --tgz <abs>`
+  (checkout-only) runs T2 against installed bytes and audits module realpaths, with a
+  checkout negative control. Six new mutant lanes (remote-pair display 3, receive 8,
+  roundtrip 5, send 12, transport 4, installed-audit 2): the committed set is now 1034
+  mutants across 79 lanes. `check:vitest` runs `check-remote-pair-installed-audit`.
+- **One real exchange, at `e632294`, not at this release's SHA.** On 2026-10-20 B's native
+  `entwurf_v2` went over one SSH call to A's mailbox
+  (`2026-10-19T22-19-47-662Z-13c897.msg`). A's one reply carried nonce
+  `107-live-20261020T071937-B-A-6e42d1`, and B read it at `2026-10-19T22:20:24.837Z`. The
+  pair was two already-open pi-durable siblings on two Linux hosts, which the user
+  reopened visibly beforehand. Before the send, the selected compiled bridge hash, the
+  bridge start time after the build and the record/owner/sender joins were checked on both
+  hosts. That check first caught one host still on a pre-feature build, so the trial was
+  held until a manual build and visible resume. This is L4 (one pair, one run). It is not
+  a release-gate MUST and was not re-measured at this release's SHA. Unmeasured: an OFF
+  target, negative paths over real SSH, other rails, more than one pair, non-Linux hosts,
+  GUI rendering, and SSH's own known-hosts side effects. Receipt:
+  [#107](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6278665895).
+- Kill-power re-measured at this shipped SHA: none (all 1034 committed claims not re-proved,
+  #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 6ac477d944c6 surface
+  974e264f5879 -- `["bash","run.sh","check-tests-beside-behavior"]` 38/38 receipt
+  c8d59ba79b6a
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3afbfb660562 surface
+  bc925701184b -- `["bash","run.sh","check-tests-beside-behavior"]` 37/37 receipt
+  4e324810643d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3afbfb660562 surface
+  bc925701184b -- `["bash","run.sh","check-remote-pair-installed-audit"]` 2/2 receipt
+  bfa5031abc54
+- **An earlier RED is kept as history.** The `check-tests-beside-behavior` group at the R2
+  candidate (head a7aaac7390d8 surface 07625e040df9, receipt b5d681a291f5) killed 34 of
+  37: three mutants failed type-checking rather than the claim. Their replacements were
+  repaired and the group re-ran on the next candidate. No kill-power was carried over from
+  that run.
+- **Static/LIVE split.** Local `check:full` is not run on this operator host and is not
+  counted as passed. The whole static floor is owed to this prepared SHA's exact push CI.
+  The earlier branch commit `e632294` passed all four jobs in run 39202248407; that is not
+  this SHA. The remote-pair installed gate is owed against this release's own candidate
+  tarball. The installed 11/11 on an earlier manually produced tarball is not this
+  release's evidence.
+- **Local LIVE r1, this release's non-static LIVE: MUST (non-static 23) PASS=23 FAIL=0
+  SKIP=0 UNRUN=0; BEHAVIOR PASS=1 FAIL=0.** It ran once, 09:40:03–09:44:49 KST on
+  2026-10-20, on head `de0bf03` plus this preparation's four metadata files (diff
+  `22d0a8b856ae`), with the candidate fingerprint (`22053b62bc0e`) equal at freeze, before
+  and after. The one-off driver (`15d7fb9dd49f`) ran the release gate's non-static steps
+  in its own order, command, environment and working directory; its 24 step lines equal
+  `release_gate()`'s by kind, name and argv, and that body is byte-identical to 0.39.0's.
+  GLG approved this shape for this cut: test-owned scratch sessions only, including
+  headless model turns and the gates' own close/resume, with no existing user or OFF
+  session as a target
+  ([#107](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6280460022)). The
+  Codex step ran against a test-owned app-server in its own tmux session A (named pane pid
+  with its recorded start ticks, stopped by one TERM afterwards) from gate session S, with
+  the requested tiers `gpt-6-luna` and `openai-codex/gpt-6-luna`; that is the request, as
+  the step's own assertions check it, not a billing or model-identity proof. The compiled
+  bridge those steps spawned was rebuilt once beforehand, with GLG's approval, and matched
+  a private emit of this source 87/87. Receipts on the operator host:
+  `.tmp-verify/release-0.40.0/live-r1/` (`live.log` `4ced6b51ec03`, `steps.SHA256SUMS`
+  `f1b7e7b79d97`, 24 logs). It is not a local `release-gate --cut` PASS: the static step
+  did not run locally.
+- **Still owed before the tag.** The static floor is this prepared SHA's exact push CI
+  (four required jobs). This release is carrier-bearing, so its candidate is the
+  native-Windows preview workflow's pack at the prepared SHA (release skill M3w), accepted
+  by the eight Windows cells and the Linux container, never a local `npm pack`; the
+  remote-pair installed gate runs against that same candidate. VERIFY §3.4 (the strict
+  `doctor-meta-bridge` on an installed 0.40.0 Claude host in a new post-install session)
+  follows the accepted candidate. Tag, GitHub release and npm publication each need their
+  own GO.
+- **agy excluded from this cut.** VERIFY §3.7 (three agy doctors and a same-gid
+  native-push reply in a new operator conversation) is excluded by GLG's explicit decision
+  of 2026-10-20: unmeasured, not a PASS. It is a new decision for this cut only, not the
+  0.39.0 exclusion carried over and not a standing waiver
+  ([#107](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6280460022)).
+- **Host residue after LIVE (P9).** The census counted 1934 directories owned by this
+  operator under `/tmp` after one stale, unused root of this repo's own prefix (16K) was
+  reclaimed, from 1935. The largest groups (`acp-cache-test`, `render-take-test`,
+  `caption-take-test`) do not match the prefixes this repo's gates mint, so their
+  ownership is not certified by that extractor; they were not deleted. One reparented
+  holder of a `/tmp` path is an unrelated editor daemon, untouched. Observation: the
+  memory-containment and chain gates left fresh roots of their own prefixes
+  (`entwurf-memguard-overlay-*`, `entwurf-chain-*`); that is a finding about those gates,
+  not fixed in this cut.
+- **Herdr follows core.** `plugins/herdr/runtime-lock.json` returns from the published npm
+  0.39.0 pin to the closed `herdr-checkout` source for this unpublished candidate, as
+  0.38.1 and 0.39.0 did; the comment is re-dated only. The runtime-bootstrap gate requires
+  an npm-source lock to equal the checkout's package version, so an npm 0.39.0 pin cannot
+  sit beside package 0.40.0. There are no plugin manifest, registry pin or snapshot
+  changes; re-pinning the measured 0.40.0 registry bytes is a separate Herdr snapshot
+  after publication.
+
+## v2026.10.19-herdr.0.39.0 — Herdr Entwurf plugin 0.39.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.39.0 and its
+`v0.39.0` tag remain unchanged. The operator has published the core to npm.
+
+**Reading guide (2026-10-19).** The `## 0.39.0` section below and the appendix of the
+[v0.39.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.39.0) are
+prepare- and cut-time text. The appendix records the tag, VERIFY §3.4 met, and §3.7 (agy)
+excluded for that cut only by the operator's decision, not a PASS. Both still say npm was not
+published. The publish is the later registry fact recorded in this section (`latest` 0.39.0,
+published 2026-10-18T21:24:39Z, registry bytes equal to the accepted candidate). Neither the
+published tarball's CHANGELOG nor the release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.39.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.39.0
+  rode to production npm source `@junghanacs/entwurf@0.39.0` with the registry's measured
+  sha512 (`sha512-xTRMQkSi…JY+1A==`). The plugin manifest moves 0.38.0 → 0.39.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. Core 0.38.1 got
+  no Herdr snapshot, so the previous npm pin is 0.38.0.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.38.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.39.0 and `repair` 0.12.8-repair.1, 605 files, published
+  2026-10-18T21:24:39Z. The downloaded registry tarball is byte-equal to the preserved accepted
+  core candidate (SHA256 `1d5693241b8cd5fa827869cf15ecbf0048215c7f0b4ebb0422650b6ae2773578`,
+  11254616 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge`.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.38.0 runtime was seeded from its own committed lock (`beb5925`); the swap to
+  0.39.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.38.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.38.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45)
+  and `check-gate-manifests` (1000 committed mutants across 73 lanes validated, none executed).
+  `check-herdr-plugin-build` and `check-herdr-sandbox` were not run locally because they run
+  the operator's own herdr; they ride the pushed SHA's FULL floor in CI.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
 ## 0.39.0 - 2026-10-18
 
 ### Native Windows (experimental preview, #78)

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi or Claude Code siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.