@junghanacs/entwurf 0.39.0 → 0.41.0

package/scripts/mutants/v2-visible-resume.json

@@ -73,8 +73,16 @@
 			"claim": "V2RESUME-OBSERVE-IS-BOUNDED-WAIT",
 			"title": "the observation becomes a single immediate probe, which reports every real resume as unobserved (the socket answers ~2-4s later)",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\tawait deps.sleep(intervalMs);"],
-			"replace": ["\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"find": [
+				"\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };",
+				"\t\t}",
+				"\t\tawait deps.sleep(intervalMs);"
+			],
+			"replace": [
+				"\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };",
+				"\t\t}",
+				"\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
+			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-OBSERVE-IS-BOUNDED-WAIT]",
@@ -106,8 +114,8 @@
 			"claim": "V2RESUME-ARGV-FROM-RECORD",
 			"title": "the launcher is handed the caller's own directory instead of the record's, so the citizen returns in the wrong project",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\tconst launched = deps.launch({ cwd: identity.cwd, runtimeArgs });"],
-			"replace": ["\t\tconst launched = deps.launch({ cwd: process.cwd(), runtimeArgs });"],
+			"find": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"replace": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: process.cwd(), runtimeArgs });"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-ARGV-FROM-RECORD]",
@@ -117,9 +125,11 @@
 			"claim": "V2RESUME-RECEIPTS-SEPARATE",
 			"title": "the launch receipt absorbs the observation, so 'a window opened' and 'the citizen is back' become one claim",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },"],
+			"find": [
+				"\t\t\tlaunch: { backend: \"pi\", targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },"
+			],
 			"replace": [
-				"\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle, kind: observation.kind } as ResumeLaunchReceipt,"
+				"\t\t\tlaunch: { backend: \"pi\", targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle, kind: observation.kind } as ResumeLaunchReceipt,"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
@@ -156,7 +166,8 @@
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": ["\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
 			"replace": [
-				"\t\t\t(deps as VisibleResumeDeps).launch({ cwd: \"/tmp\", runtimeArgs: [] });\n\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
+				"\t\t\t(deps as VisibleResumeDeps).launch({ backend: \"pi\", cwd: \"/tmp\", runtimeArgs: [] });",
+				"\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
@@ -175,29 +186,29 @@
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
-			"claim": "V2RESUME-NOT-PI-REFUSED",
+			"claim": "V2RESUME-BACKEND-UNSUPPORTED-REFUSED",
 			"title": "an out-of-domain backend is reported as an error instead of a named refusal, so a fine record reads as a broken one",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": ["\t\t\tif (err instanceof ResumeBackendUnsupportedError) {"],
 			"replace": ["\t\t\tif (false && err instanceof ResumeBackendUnsupportedError) {"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
-			"signature": "[QK:V2RESUME-NOT-PI-REFUSED]",
+			"signature": "[QK:V2RESUME-BACKEND-UNSUPPORTED-REFUSED]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
-			"claim": "V2RESUME-NOT-PI-BY-FIELD",
+			"claim": "V2RESUME-BACKEND-UNSUPPORTED-BY-FIELD",
 			"title": "the backend is re-derived instead of taken from the typed error, which is the second read this rail refuses",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": [
-				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi citizens stand a control socket up, ` +"
+				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi and Claude Code citizens can be reopened ` +"
 			],
 			"replace": [
-				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi citizens stand a control socket up, ` +"
+				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi and Claude Code citizens can be reopened ` +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
-			"signature": "[QK:V2RESUME-NOT-PI-BY-FIELD]",
+			"signature": "[QK:V2RESUME-BACKEND-UNSUPPORTED-BY-FIELD]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
@@ -221,6 +232,265 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-ACP-MODEL-REFUSED]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-DEAD-OWNER-LAUNCHES",
+			"title": "a Claude Code resume is launched as `claude --continue`, which reopens whichever session the vendor picks rather than the one the record names",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\truntimeArgs: [\"--resume\", current.nativeSessionId],"],
+			"replace": ["\t\truntimeArgs: [\"--continue\"],"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-DEAD-OWNER-LAUNCHES]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-LIVE-REFUSED",
+			"title": "a live Claude Code owner stops being refused as live, so the caller is told to wait on an inconclusive probe instead of sending to the running session",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.owner === \"live\") {"],
+			"replace": ["\tif (before.owner === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-LIVE-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNCERTAIN-REFUSED",
+			"title": "an owner the shared rule cannot judge is treated as dormant, which can open a second process on a session that is still running",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.owner !== \"dead\") {"],
+			"replace": ["\tif (before.owner === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNCERTAIN-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-ABSENT-REFUSED",
+			"title": "a Claude Code citizen with no receiver marker is not refused by name, so a session nothing proves dormant falls through the dormancy proof",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.kind === \"absent\") {"],
+			"replace": ["\tif (before.kind === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-ABSENT-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-CORRUPT-REFUSED",
+			"title": "an unreadable receiver marker is not refused by name, so a marker whose owner cannot be judged falls through the dormancy proof",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.kind === \"corrupt\") {"],
+			"replace": ["\tif (before.kind === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-CORRUPT-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-MISMATCH-REFUSED",
+			"title": "a dead marker for ANOTHER native session is accepted as this session's dormancy proof",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tmarker.backend !== \"claude-code\" ||", "\t\tmarker.nativeSessionId !== identity.nativeSessionId"],
+			"replace": ["\t\tmarker.backend !== \"claude-code\" ||", "\t\tfalse"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-MISMATCH-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVES-NEW-OWNER",
+			"title": "the observation accepts the previous owner's marker as the resumed session coming back",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t(seen.marker.ownerPid !== previous.ownerPid || seen.marker.ownerStartKey !== previous.ownerStartKey) &&"
+			],
+			"replace": ["\t\t\ttrue &&"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVES-NEW-OWNER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-RECORD-DRIFT-UNOBSERVED",
+			"title": "the observation stops checking that the record still names the same session with the same createdAt",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\t\tcurrent.createdAt === identity.createdAt &&"],
+			"replace": ["\t\t\t\ttrue &&"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-RECORD-DRIFT-UNOBSERVED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-MARKER-READ-RAW",
+			"title": "the receiver marker is read through a path that follows symlinks instead of the no-follow fd reader, so a link to another citizen's marker answers for this one",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tbytes = readStoreRecordFile(markerPath);"],
+			"replace": ["\t\tbytes = process.getBuiltinModule(\"node:fs\").readFileSync(markerPath, \"utf8\");"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-MARKER-READ-RAW]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PI-NEVER-READS-RECEIVER",
+			"title": "the pi path consults a Claude Code receiver marker, mixing the two backends' dormancy proofs",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"replace": [
+				"\t\tdeps.inspectReceiver(targetGardenId);",
+				"\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PI-NEVER-READS-RECEIVER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-RENDER",
+			"title": "the Claude Code launch receipt stops saying it asked for claude --resume, so a reader cannot tell which session the window was asked to open",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t\t`LAUNCH receipt: tmux created that window and was asked to start claude --resume on the session above.\\n` +"
+			],
+			"replace": ["\t\t\t\t`LAUNCH receipt: tmux created that window.\\n` +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-RENDER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-HELPER-BOUNDED",
+			"title": "the Claude Code observation's deadline reports the previous owner as re-armed instead of unobserved",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\treturn { kind: \"resume-unobserved\", waitedMs: deps.now() - started };"],
+			"replace": [
+				"\t\t\treturn { kind: \"receiver-armed\", ownerPid: previous.ownerPid, waitedMs: deps.now() - started };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-HELPER-BOUNDED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-BINDING-REREAD",
+			"title": "the binding is compared against the FIRST record read, so an arm committed between that read and the dead verdict is bound by a stale value",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tconst current = deps.resolveIdentity(targetGardenId);"],
+			"replace": ["\tconst current = identity;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-BINDING-REREAD]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNBOUND-LEGACY",
+			"title": "a record or marker with no binding (null) passes the binding check, so null == null reads as a match",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (current.attachIncarnation === null || marker.attachIncarnation === null) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNBOUND-LEGACY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNBOUND-STALE",
+			"title": "a dead marker whose binding is older than the record's still authorises a launch",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (current.attachIncarnation !== marker.attachIncarnation) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNBOUND-STALE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNBOUND-RECORD-MOVED",
+			"title": "a record whose createdAt changed between the two reads is still bound",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tcurrent.createdAt !== identity.createdAt"],
+			"replace": ["\t\tfalse"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNBOUND-RECORD-MOVED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-PANE-JOIN",
+			"title": "the observation accepts a live owner anywhere, not only the pane this call opened",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tString(seen.marker.ownerPid) === panePid &&"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-PANE-JOIN]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-BACKEND",
+			"title": "the observation accepts a live receiver marker of another backend",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tseen.marker.backend === \"claude-code\" &&"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-BACKEND]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-FRESH-BINDING",
+			"title": "the observation accepts a new owner still showing the binding the dormancy proof bound",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tseen.marker.attachIncarnation !== previous.attachIncarnation"],
+			"replace": ["\t\t\ttrue"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-FRESH-BINDING]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-RECORD-BINDING",
+			"title": "the observation stops requiring the current record to carry the marker's binding",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\t\tcurrent.attachIncarnation === seen.marker.attachIncarnation"],
+			"replace": ["\t\t\t\ttrue"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-RECORD-BINDING]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-RECORD-UNREADABLE",
+			"title": "a record defect during the observation is swallowed into the bounded wait instead of stopping it as record-unreadable",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t\treturn {",
+				"\t\t\t\t\tkind: \"record-unreadable\",",
+				"\t\t\t\t\tcause: err instanceof Error ? err.message : String(err),",
+				"\t\t\t\t\twaitedMs: deps.now() - started,",
+				"\t\t\t\t};"
+			],
+			"replace": ["\t\t\t\tcurrent = identity;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-RECORD-UNREADABLE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-MARKER-BINDING-READ",
+			"title": "the receiver-marker validator drops the marker's binding, so every marker reads as unbound",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": [
+				"\t\tattachIncarnation: requireAttachIncarnation(raw.attachIncarnation === undefined ? null : raw.attachIncarnation),"
+			],
+			"replace": ["\t\tattachIncarnation: null,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-MARKER-BINDING-READ]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }

package/scripts/probe-bridge-command.ts

@@ -67,6 +67,7 @@ export const EXPECTED_TOOLS = [
 	"entwurf_register_native",
 	"entwurf_fresh_call",
 	"entwurf_resume_call",
+	"entwurf_retire_call",
 	"entwurf_callback",
 ] as const;
 const DEFAULT_TIMEOUT_MS = 10_000;

package/scripts/remote-pair-receive.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+/**
+ * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1).
+ *
+ * The receiving host's entry for one declared remote pair. The sending host runs it over one
+ * SSH call and writes one JSON claim to stdin. This entry reads the operator-named pair
+ * declaration once, applies the pair scope check, and hands a matching claim to the existing
+ * v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
+ *
+ * Scope: `--pair` must name THIS host's own opt-in file (`remotePairOptInPath()`), absolute and
+ * normalized-equal; any other path — even a valid declaration — is exit 2. That one file is the pair
+ * this host accepts and, because it names the sender's host as its route, the declared route back.
+ * The sender's declaration carries the path only so the argv shape is explicit; it selects nothing.
+ *
+ * EXIT CONTRACT (stdout carries a JSON receipt line only where named):
+ *   0 dispatched, the dispatch did not report an error — receipt on stdout
+ *   4 dispatched, the dispatch reported an error (its text says what is known, e.g. a
+ *     rejection or `retry-safe: false` after a possible write) — receipt
+ *   3 refused by the pair scope check, no dispatch ran — receipt
+ *   2 --pair is not this host's opt-in, the opt-in is absent/broken, or the claim is invalid; no
+ *     dispatch ran — `{kind:"invalid"}` receipt;
+ *     wrong argv is ALSO 2 but prints usage on stderr only, with no receipt
+ *   1 an uncaught dispatch/store throw (crash, don't warn) — no receipt; stderr carries the
+ *     error. The sending host reads that as indeterminate.
+ */
+
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { runAndRenderEntwurfV2FromSurface } from "../pi-extensions/lib/entwurf-v2-surface.ts";
+import {
+	parseRemoteClaim,
+	type RemotePairDeclaration,
+	type RemoteReceiveReceipt,
+	receiveRemoteClaim,
+} from "../pi-extensions/lib/remote-pair-receive.ts";
+import { readRemotePairOptIn, remotePairOptInPath } from "../pi-extensions/lib/remote-pair-send.ts";
+
+function emit(receipt: RemoteReceiveReceipt | { kind: "invalid"; detail: string }, code: number): never {
+	process.stdout.write(`${JSON.stringify(receipt)}\n`);
+	process.exit(code);
+}
+
+const args = process.argv.slice(2);
+if (args.length !== 2 || args[0] !== "--pair") {
+	console.error("usage: entwurf remote-pair-receive --pair <this host's opt-in file>  (claim JSON on stdin)");
+	process.exit(2);
+}
+const pairFile = args[1];
+
+let decl: RemotePairDeclaration;
+let claim: ReturnType<typeof parseRemoteClaim>;
+try {
+	// The scope is THIS host's own opt-in, never a file the sender picks: `--pair` must name it
+	// exactly (absolute, normalized), and that one file is read for this receive.
+	const own = remotePairOptInPath();
+	if (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {
+		throw new Error(`--pair must be this host's opt-in file ${own} (got ${pairFile})`);
+	}
+	const route = readRemotePairOptIn(own);
+	if (route === null) throw new Error(`this host has no remote pair opt-in (${own} is absent)`);
+	decl = { remoteGardenId: route.remoteGardenId, ssh: route.ssh, localGardenId: route.localGardenId };
+	claim = parseRemoteClaim(readFileSync(0, "utf8"));
+} catch (err) {
+	emit({ kind: "invalid", detail: err instanceof Error ? err.message : String(err) }, 2);
+}
+
+const receipt = await receiveRemoteClaim(claim, decl, {
+	dispatch: (params, sender) => runAndRenderEntwurfV2FromSurface(params, { senderProvider: () => sender }),
+	// The scope file IS this host's own opt-in, and it names the sender's host as its route: a
+	// matching claim always has a declared route back. Declared, not probed.
+	replyRoute: "declared",
+});
+emit(receipt, receipt.kind === "rejected" ? 3 : receipt.isError ? 4 : 0);

package/scripts/smoke-agy-install-state.sh

@@ -67,7 +67,7 @@ write_mcp_fake() {   # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE
@@ -89,7 +89,7 @@ if [ "${REVIEW_ENV:-}" = "fail" ]; then echo configured-env-failure >&2; exit 24
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-copilot-mcp-state.sh

@@ -26,7 +26,7 @@ write_mcp_fake() {
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-herdr-raw-install-live.sh

@@ -490,8 +490,8 @@ for (const name of ["entwurf", "entwurf-bridge", "entwurf-statusline"]) {
 }
 
 // The REAL subcommand, from the installed bin, under node_modules — which is the branch of
-// start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (`EXPECT_TOOLS` in run.sh check-bridge), so a
-// zero exit here is the artifact listing all eight garden verbs and no ninth.
+// start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (`expected` in run.sh `validate_entwurf_bridge`, which check-bridge runs), so a
+// zero exit here is the artifact listing all nine garden verbs and no tenth.
 const run = spawnSync(path.join(binDir, "entwurf"), ["check-bridge"], { encoding: "utf8" });
 const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
 // [a-z0-9_] and not [a-z_]: the first draft of this line printed `entwurf_v` for entwurf_v2
@@ -502,7 +502,7 @@ const verbs = (said.match(/entwurf_[a-z0-9_]+/g) ?? []).filter((v, i, a) => a.in
 // A SECOND, INDEPENDENT COPY OF THE SET, ON PURPOSE (A5 D1). The exit code alone used to be
 // the oracle here, which left the printed list as decoration a parser bug could quietly
 // corrupt — and did, see the regex note just above. The package under test carries the
-// expectation of run.sh:5187 in its own bytes, so reading the answer from there would let
+// `validate_entwurf_bridge` expectation of run.sh in its own bytes, so reading the answer from there would let
 // the artifact grade itself. The literal below is a copy that must AGREE with the shipped
 // one; the two disagreeing is the signal, and a verb genuinely added upstream reddens this
 // smoke until somebody says so here too.
@@ -513,6 +513,7 @@ const EXPECTED_VERBS = [
   "entwurf_peers",
   "entwurf_register_native",
   "entwurf_resume_call",
+  "entwurf_retire_call",
   "entwurf_self",
   "entwurf_v2",
 ];
@@ -520,7 +521,7 @@ console.log(`  VERBS ${verbs.join(",") || "<none>"}`);
 if (run.status === 0) ok(`entwurf check-bridge exit 0 from the installed bin (${verbs.length} verbs listed)`);
 else no(`entwurf check-bridge exit ${run.status}: ${said.trim().slice(0, 400)}`);
 JSON.stringify(verbs) === JSON.stringify(EXPECTED_VERBS)
-  ? ok(`the receipt names EXACTLY the eight garden verbs (${EXPECTED_VERBS.length}), parsed from what the installed bin answered`)
+  ? ok(`the receipt names EXACTLY the nine garden verbs (${EXPECTED_VERBS.length}), parsed from what the installed bin answered`)
   : no(`verb set mismatch — want ${JSON.stringify(EXPECTED_VERBS)} got ${JSON.stringify(verbs)}`);
 process.exit(bad);
 ' "$ACTIVE" "$REGISTRY" "$PLUGIN_ID" || fail=1

package/scripts/smoke-meta-install-state.sh

@@ -46,7 +46,7 @@ cat > "$INS_BIN/claude" <<'SH'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
 case "$1${2:+ $2}" in
-  "--version")   echo "2.1.217 (Claude Code)" ;;
+  "--version")   echo "2.1.306 (Claude Code)" ;;
   "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
   "mcp get")     printf '%s\n' "Scope: User config" "Status: Connected" ;;
   *) : ;;
@@ -95,7 +95,7 @@ case "$1${2:+ $2}" in
     # Keep writing well past the pipe buffer: a reader that leaves early SIGPIPEs us.
     cat "$FAKE_MCP_TAIL"
     exit $? ;;
-  "--version")   echo "2.1.217 (Claude Code)" ;;
+  "--version")   echo "2.1.306 (Claude Code)" ;;
   "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
   *) : ;;
 esac
@@ -710,7 +710,7 @@ FAKE_BIN="$TMP/fake-bin"; mkdir -p "$FAKE_BIN"
 cat > "$FAKE_BIN/claude" <<'SH'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "$FAKE_CLAUDE_LOG"
-[ "$1" = "--version" ] && echo "2.1.217 (Claude Code)"
+[ "$1" = "--version" ] && echo "2.1.306 (Claude Code)"
 exit 0
 SH
 chmod +x "$FAKE_BIN/claude"
@@ -1027,7 +1027,7 @@ if [ "${1:-} ${2:-} ${3:-}" = "plugin list --json" ]; then
   exit 0
 fi
 case "$1${2:+ $2}" in
-  "--version") echo "2.1.217 (Claude Code)" ;;
+  "--version") echo "2.1.306 (Claude Code)" ;;
   "plugin list") printf '%s\n' "entwurf-meta-receive@meta-bridge-local" "  Status: enabled" ;;
   "mcp get") printf '%s\n' "Scope: User config" "Status: ✔ Connected" ;;
   *) : ;;

package/scripts/smoke-mux-lifecycle-live.ts

@@ -34,11 +34,11 @@
  * re-injects a bridge extension (#29), and a resume that silently lost its history would look
  * identical from the socket axis.
  *
- * Claude Code runs the same first half and then STOPS where its capability stops: callback id,
- * mailbox delivery, mailbox read receipt — and a resume that is REFUSED as `target-not-pi`, with
- * no window opened and no lock residue after the per-gid coordination lock is released. Only pi
- * stands a control socket up, so only pi has a same-id
- * resume; the refusal is the proof, not an omission.
+ * Claude Code runs the same first half: callback id, mailbox delivery, mailbox read receipt — and a
+ * resume of that still-LIVE sibling that is REFUSED as `target-live` (its receiver marker names a
+ * live owner), with no window opened and no lock residue after the per-gid coordination lock is
+ * released. Claude Code's DORMANT same-id resume (#147 L2) is certified deterministically; its LIVE
+ * close→resume leg is not in this smoke yet, and this cell does not stand in for it.
  *
  * ── Isolate the WRITES, keep the runtimes real ──
  *
@@ -1035,20 +1035,20 @@ async function main(): Promise<void> {
 				`--- response ---\n${ccRead.text}`,
 			);
 
-			// No resume is invented for a backend that never stands a control socket up. The refusal is
-			// the proof: it opens no window, and its per-gid coordination lock leaves no residue.
+			// A live Claude Code sibling is not reopened: its receiver marker names a live owner. The refusal
+			// is the proof: it opens no window, and its per-gid coordination lock leaves no residue.
 			const ccWindowsBefore = windowCount(cc.socket, cc.env);
 			const ccResume = await ccBridge.call("entwurf_resume_call", { target: ccCitizen }, RESUME_CALL_TIMEOUT_MS);
 			ok(
-				"claude-code: entwurf_resume_call is REFUSED as target-not-pi — a capability boundary named as itself, not an error about a record that is perfectly fine",
-				ccResume.isError && ccResume.text.includes("target-not-pi"),
+				"claude-code: entwurf_resume_call of the still-live sibling is REFUSED as target-live — its receiver marker names a live owner, so a second window would put two processes on one session",
+				ccResume.isError && ccResume.text.includes("target-live"),
 				`--- response ---\n${ccResume.text}`,
 			);
 			ok(
 				"claude-code: that refusal opened no window and left no lock behind",
 				windowCount(cc.socket, cc.env) === ccWindowsBefore && lockResidue(cellRoots(REAL_HOME), ccCitizen).length === 0,
 			);
-			receipts["claude-code/5-resume-refused-not-pi"] = ccResume.text;
+			receipts["claude-code/5-resume-refused-live"] = ccResume.text;
 		}
 
 		await runClaudeCell();

package/scripts/smoke-omp-mcp-state.sh

@@ -53,7 +53,7 @@ cat > "$SB/bin/entwurf-bridge" <<'FAKE'
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE