@junghanacs/entwurf 0.40.0 → 0.41.0

package/AGENTS.md

@@ -32,7 +32,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 4. **Live-fact dispatch.** Never store liveness or infer send/resume before resolving the record and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguity, and indeterminate probe reject without mutation or fallback.
 6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`. Native extension modules enter only through the owning bootstrap, from an operator-named absolute file or an operator-named absolute directory read once at launch: top level only, exact suffix filter, deterministic order, every selected entry a regular file. Neither discovers ambient or default locations, takes module paths from settings or environment, recurses, watches, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
-7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; redeploy a stale unknown-backend reader. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
+7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; roll forward a stale reader that rejects a newly known backend or V3 key. Reader-version skew is not a generation change: preserve identities and records, and verify every participating reader before claiming rollout complete. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
 10. **Native-push is distinct.** It is neither mailbox nor pi socket. Native-push citizens are record-backed plus probe-alive, with no receiver/watch state or resume authority. Antigravity retries only after bounded re-probe; Codex never replays queue acceptance. Codex sender identity is request-scoped metadata; app-server environment carries root/placement, never citizen identity.
@@ -66,8 +66,10 @@ History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue thre
 
 A pi control session and native bridge session are citizens for the same reason: each has a V3 record.
 
+**Retirement is operator-requested, never autonomous.** A real citizen may be retired only when the operator explicitly requests that target/action, like the separate approval needed for a push. Development, tool exposure, a coordinator role, record-backed attribution or delegated release judgement is not a standing retirement grant. No timer, idle heuristic, roster cleanup or agent initiative substitutes for that request. Preserve request attribution without inventing a self-signed permission boolean or role database. Test-owned lifecycle gates require their own named execution scope; working siblings are never incidental test targets.
+
 - Pi owns its native session lifecycle; `birthPiCitizen` attaches `(backend: "pi", nativeSessionId)` to the stable garden id. Socket and env values are record-derived carriers.
-- `entwurf_resume_call {target}` is a separate pi-only lifecycle verb, not delivery intent. It reopens the same dormant id visibly, runs no turn, and receives transcript/model/provider/cwd solely from the record. A launch receipt and socket observation are distinct; an unobserved window stays visible. No watcher, retry, or supervisor.
+- `entwurf_resume_call {target}` is a separate lifecycle verb for pi and Claude Code targets, not delivery intent. It reopens the same dormant id visibly, submits no prompt, and uses the record as the sole address authority (Pi: the record selects an absolute transcript whose native id must match; its session-header cwd and first `model_change` provider/model feed the launch resolver, with no record/host cwd fallback; Claude Code: record session id and cwd, with no model or permission flag restored). Dormancy is rail-specific: a dead pi control socket, or — for Claude Code — the last validated owner the Entwurf hook armed is proven gone (`classifyMarkerOwner` dead) AND the record, re-read after that verdict, still carries the same non-null `attachIncarnation` (arm revision) the marker copied; an absent, unreadable, mismatched, inconclusive or unbound marker refuses. That guarantees only committed hook attaches: a process holding the session without one (hooks disabled, a record-arm lock timeout or store failure at its start) is invisible to it — a boundary GLG accepted on 2026-10-21. A launch receipt and the observation (same-id socket, or a NEW live owner in the opened pane re-arming the marker with a fresh binding the record carries) are distinct; an unobserved window stays visible. The caller is attributed, never authorised by that. Inside herdr it refuses; there is no herdr resume rail. No watcher, retry, or supervisor.
 - **control-socket:** live send under per-target lock; dormant rejects.
 - **self-fetch:** active receiver plus deliverable mailbox; no resume authority. Sender/receiver joins are owner-kind specific and must not be generalized across vendors.
 - **native-push:** probe-alive direct injection; no mailbox and no resume authority.

package/BASELINE.md

@@ -30,7 +30,7 @@ outside the experimental preview (rows below).
 |---|---|---|
 | Node 24 Linux package consumer | shape-only | Required `artifact-consumer` CI |
 | Node 24 macOS package consumer (GitHub Actions runner, not a physical Mac) | shape-only · CERTIFIED (CI) | Required `macos-install-surface` CI run 34303884286 @ `70eda03` (`macos-latest`, 65 s, 10/10 steps): pack → clean consumer install → bin links → `entwurf --help` → `check-bridge` (7 tools) → harness-absent `setup` (all SKIP, computed green, zero no-write-axis writes, `auth.json` byte-identical). Certifies no harness rail. |
-| Claude Code >=2.1.217 exec form | **certified** — supported floor | Topology + floor gates, doctor oracle; B2 live NixOS session |
+| Claude Code exec form (observed at 2.1.217) | **certified** at 2.1.217; the supported floor is now `>=2.1.306` (#147 same-id resume), declared with no LIVE receipt at 2.1.306 itself; the dated n=1 lifecycle round trip below ran on 2.1.307 | Topology + floor gates, doctor oracle; B2 live NixOS session |
 | Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
 | Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
 | Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
@@ -52,6 +52,59 @@ outside the experimental preview (rows below).
 | Remote pair: OFF target, negative paths over real SSH, other rails, more than one pair, non-Linux hosts, GUI rendering of the received envelope | unverified | No receipt. The deterministic and installed cells (VERIFY) do not stand for these. |
 | native Windows: other harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over 16 MiB, reparse-backed store folders | UNSUPPORTED | Outside the preview's scope by decision; the preview loader refuses an install without the Windows addon by name. |
 
+### #147 candidate host boundary (2026-10-21; not a certification row)
+
+A checkout-started Pi wrote the new V3 `attachIncarnation` field while older hook/bridge
+readers still rejected it. The observed mixed-reader failures were rolled forward under a
+specific operator-approved repair, preserving the same garden/native identity; no manual
+record deletion, id rewrite, fresh-cut or old-shape rollback was used. Normal attach writes
+continued. Other installed native readers and the external Python mirror were identified as
+stale by source inspection; that is predicted impact, not a measured failure on every rail,
+and the complete G4 host rollout remains open. See [upgrade policy](./docs/fresh-cut-policy.md#upgrade-order).
+
+The candidate's internal Pi control `retire`, pidfd helper, request adapters and private
+injected dispatcher have source/fixture and candidate-local proof, not new native-host
+certification. Pi ACK is not exit/flush; CC fd-process exit is not conversation/children/flush.
+The current `>=2.1.306` floor and a historical B2 delivery receipt do not certify this
+lifecycle. A later CI green also cannot certify the operator's mixed-reader deployment.
+These two paragraphs are the 2026-10-21 state; the next section records what 2026-10-22 measured.
+
+### #147 Native round trip, 2026-10-22 (n=1)
+
+Not a certification row and not a release gate. One Linux host, source `a9c9459` (exact-SHA push
+CI green on its four required jobs), checkout compiled output rebuilt once under the dist lock
+after its previous bytes were preserved. The operator requested this bounded test-owned
+measurement; no working sibling was retired or restarted. Public record:
+[#147 checkpoint comment](https://github.com/junghan0611/entwurf/issues/147#issuecomment-6329217980).
+
+| Axis | Measured |
+|---|---|
+| caller | a fresh pi-durable citizen, identity from its exact nonce callback; its native store (read from an online read-only backup) offered all eight contact tools, the actual model was `openai-codex/gpt-6.1-sol`, and it made exactly four settled lifecycle calls — one retire and one resume per target |
+| ordinary Pi target | fresh, callback-identified. Retire returned `shutdown-requested`; separately, the original pane and control socket were gone, the record unchanged and the paired requested/outcome events present. Dormant `entwurf_v2` rejected. Resume returned separate LAUNCH and OBSERVATION; native session, `createdAt`, cwd and backend kept; transcript byte-identical across the promptless resume; a question omitting the answer recovered the pre-retirement fact |
+| native Claude Code target (CLI 2.1.307) | fresh, callback-identified, bound arm before retirement. Retire returned `exited`; separately, the last bound receiver owner was dead, the original pane gone, the record unchanged and the paired events present. Dormant delivery rejected as an undeliverable mailbox. Resume observed a NEW live owner with a new record-matched arm for the same native session and `createdAt`; transcript byte-identical across the promptless resume; blind recall succeeded |
+
+It does not show: conversation flush, descendant exit or model silence; the `>=2.1.306` floor
+itself (2.1.307 was the measured CLI); ACP-provider Pi, Herdr, pi-durable as a target, Windows or
+macOS; a release artifact; the `smoke-mux-lifecycle-live` MUST; or that any resident process
+reloaded new reader bytes.
+
+**G4 the same day (reader scope closed with Copilot runtime deferral; resident/runtime acceptance separate).** The five stale on-disk reader copies (Codex
+birth, OMP birth and receive, Copilot birth and receive) were preserved and rolled forward with
+their owning installers; their installed meta modules are byte-identical to the current source or
+compiled twin. Codex birth, both OMP units and Copilot receive passed install and doctor. Copilot
+birth passed install and doctor ownership but its doctor runtime axis is RED on a historical
+unrecovered hook error from 2026-10-14; that RED is retained, not cleared or counted as PASS.
+On 2026-10-22 GLG explicitly deferred Copilot Native runtime validation for this landing: Copilot
+is currently a free `auto` account, not a subscription, and GLG reports even a greeting taking over
+a minute to answer, making practical runtime validation unavailable. That latency is an operator
+report, not a benchmark re-measured here. No new Copilot model turn or log-clearing recovery was
+performed. This landing closes the on-disk reader/field-compatibility scope with that explicit
+Copilot runtime deferral; it does not certify Copilot runtime or resident-process reloads.
+The external Python mirror's nullable-field delta has a reviewed local checkpoint (not yet pushed),
+and its owner's one installed schema certification accepted 1,847 records with zero defects — field
+acceptance, not whole-parser equivalence. Resident processes remain unmeasured; broader runtime
+and release acceptance are not silently waived.
+
 Notes the table cannot carry without becoming prose again:
 
 - **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
@@ -253,7 +306,7 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 ### Q-MCP — MCP enumerate
 - **PASS** — Exactly one: `entwurf-bridge`.
 - **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes eight tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
+- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current bridge lists nine tools (since 0.41.0), including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
 
 ---
 

package/CHANGELOG.md

@@ -4,6 +4,327 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.41.0 - 2026-10-22
+
+A sibling's garden id is its birthday, and this cut lets it rest and come back under it. A
+sibling can now be opened, spoken to, retired when the human operator names it, and reopened
+under the same id with its conversation intact. That holds for ordinary Pi and native Claude
+Code. Retirement is a pause in a long session, not cleanup: it is never autonomous, a paired
+requested/outcome record beside the target's record is attempted for every request with any
+recording failure reported on its own axis, and the record and transcript stay.
+A durable pi-durable sibling can drive both verbs. Each was measured once on real sessions, which
+is recorded as dated evidence, not as a release gate.
+
+### Fresh call
+
+- **A Pi-dialect model names its provider, and never OpenRouter (#76).** The dispatch root both
+  rails share now refuses, before either rail is asked anything, a pi or pi-durable model whose
+  provider segment is `openrouter` in any letter case (`model-openrouter-forbidden`) and a pi
+  model that names no provider at all (`pi-model-not-provider-qualified`). The second replaces
+  the 2026-08-13 non-goal that allowed a bare id: GLG decided on 2026-10-21 that the provider is
+  stated explicitly, because a bare alias resolves to whichever catalog row Pi prefers (the
+  2026-09-17 bare `terra` opened on an OpenRouter row). It is a call-time input contract, not a
+  version pin: no model list, catalog copy, resolved-row or endpoint check was added, so a later
+  model name passes this provider check once it is written `<provider>/<id>` (not a promise
+  that it launches, nor a bypass of #128). Other backends' model names
+  (a claude-code `opus` alias) are not judged; resume and #128 curation are unchanged. The
+  refusal checks the name a caller wrote, not the endpoint a provider name reaches. The
+  `entwurf_fresh_call` model description says both rules. Proof:
+  `pi-extensions/lib/fresh-call-dispatch.test.ts` (three QKs) and three mutants in the
+  `fresh-call-dispatch` lane (12 → 15), executed through `./run.sh check-fresh-call-provider`.
+
+### pi-durable
+
+- **The durable contact offers `entwurf_resume_call` (#147 L1).** A pi-durable citizen (the
+  coordinator's host) could not call the existing same-id resume verb: its contact exposed six bridge
+  tools and resume was not among them. It now registers a seventh, under the bridge's own
+  single-`target` schema, and forwards the call to the bridge unchanged. The verb itself is
+  unchanged by L1: at that checkpoint pi-only targets (L2 below widens the domain), a live target
+  refused, no turn, the record supplies the launch facts. Nothing new authorises who may resume, a
+  retire verb is not here, and a running durable host offers the tool only after it is restarted onto a build that
+  carries it. Because the bootstrap reserves every contact tool name, an operator native module
+  that registers a tool named `entwurf_resume_call` is now refused as `native-module-name-reserved`.
+  Proof: two QKs in `pi-extensions/meta-bridge-pi-durable.test.ts` — the tool is offered and hands
+  the bridge exactly `{target}`, and a faux model's call on the published runtime reaches this
+  package's compiled bridge through the contact's production connector and reads the bridge's named
+  refusal for a test-owned record of a backend with no same-id resume (codex since L2; no citizen is
+  resumed). Two mutants
+  in the `pi-durable` lane (84 → 86), executed through `./run.sh check-pi-durable-beside`. The
+  independent tool lists of `check-pi-durable-contact`, `check-pi-durable-send` and
+  `smoke-pi-durable-fresh-live` now name seven tools. One default-cell `check-pi-durable-send` run
+  (scripted loopback endpoint and the carrier app's native tool path; no vendor model turn) offered
+  `entwurf_resume_call` in the app's first model request, and its parameters there equal the
+  bridge's own listed schema — read from that run's raw wire receipt, because the default cell's
+  QK judges only self, peers and v2; the seven-tool `native-module` cell was not run. A running
+  coordinator host offering seven tools, and any operator rollout, remain unmeasured.
+
+### Operator-requested retirement (#147)
+
+- `entwurf_retire_call {target}` makes one explicitly human-requested Pi or Claude Code attempt. Development, coordinator status and record-backed attribution are not standing permission. Where a host provides or is configured with an approval step, that step applies as well; Pi and pi-durable 1.3.0 have no built-in approval prompt by default. MCP annotations and caller identity are hints and attribution, not permission. No autonomous cleanup, roster expansion or automatic replay.
+- The per-request production binding captures its directories and cancellation signal. Requested/outcome events share an id in a target-gid append-only sidecar with explicit actor/target fields. Action, record-write failure and lock cleanup stay independent; an append failure cannot turn a possibly effective action into a safe retry. The source bridge lists nine tools, ordinary Pi seven active plus two hidden, and the durable contact eight.
+- Independent review repaired a metadata-test oracle, random-id privacy-test flakiness and snapshot/file-target consistency. A private `node_modules` compiled consumer passed29 assertions over anonymous/self refusal, existing resume refusal, inert Node RPC and two-line attribution. Operator dist hashes stayed unchanged. That consumer is not real Pi/Claude Code retirement, Native/LIVE, G4 rollout or release acceptance; final candidate floors and exact-SHA CI are still owed.
+- 2026-10-22, source `a9c9459`: one operator-requested, test-owned Native round trip per backend — a fresh pi-durable caller (actual offering of all eight contact tools) retired and same-id resumed a fresh ordinary Pi and a native Claude Code 2.1.307 target once each, with dormant delivery refused, identity and transcript preserved across the promptless resume, and blind recall. n=1; not a MUST gate, ACP, Herdr, Windows, release-artifact or flush/descendant claim ([BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1)). The five stale on-disk Codex/Copilot/OMP reader copies were rolled forward with their owning installers; Copilot birth's doctor runtime axis remains RED on a historical hook error. GLG explicitly deferred its Native runtime validation for this landing: the current free `auto` account, not a subscription, is impractical to test (GLG reports a greeting taking over a minute; not re-benchmarked here). On-disk reader compatibility is closed with that named runtime deferral; resident-process reloads and broader runtime/release acceptance remain unmeasured. Earlier component receipts below do not become this candidate's kill-power.
+
+### Internal retirement checkpoints (#147; before public composition)
+
+- **Pi's control server now serves an internal `retire` RPC.** A Pi started from this
+  checkout can already receive it; this is not a claim about the published 0.40.0 package.
+  Immutable garden/native identity, TUI, idle and no-pending guards precede one SDK shutdown
+  request. The shared production response envelope and strict one-shot client keep
+  `shutdown-requested` distinct from exit, flush or model silence. Busy work is refused, not
+  aborted or queued for a later shutdown.
+- **Claude Code has a fixed Linux pidfd helper and request adapter.** The helper is copied
+  beside the compiled adapter; it pins a process, checks its start key, accepts one complete
+  go/cancel frame and requests one fd SIGTERM with bounded exit observation. Fresh
+  record/receiver/sender birth, arm binding, owner domain and pid/key joins run before helper
+  spawn and after ready. Unknown is not safe-retry permission. A fd-process exit does not
+  prove conversation identity, descendant termination or transcript flush.
+- **A private dispatcher preserves action and cleanup independently.** Trusted caller
+  attribution/self refusal, fresh target and liveness checks, one adapter and one lock release
+  are composed through mandatory seams. It creates no grant/role database. At these component
+  checkpoints there was no accepted production host composition or public retirement MCP/contact
+  registration. The later candidate composition above owns its separate binding and runtime proof.
+- **Proof remains candidate-local:** owned receiver/helper fixtures; independent review;
+  primitive PARTIAL Pi9 + CC11, later request-adapter PARTIAL9+6+15+40, then pure-dispatcher
+  PARTIAL10 on different candidates; private compiled consumer28 and a missing-Pi-entry
+  negative on the adapter candidate. These are not release-SHA kill-power, installed retirement
+  runtime or four-cell native lifecycle evidence. Actual host composition, G4 reader rollout,
+  public caller integration and the preserved #106 B append-only attribution record remain
+  open. Existing live/release floors are not waived by these checkpoints.
+
+### Resume
+
+- **`entwurf_resume_call` reopens a dormant Claude Code citizen under its own garden id (#147 L2).**
+  The verb's domain is now pi and claude-code, a closed set; every other backend is the named
+  `target-backend-unsupported` (the retired `target-not-pi` has no alias). A Claude Code target is
+  launched as the fixed `claude --resume <record nativeSessionId>` at the record's cwd — no model or
+  permission flag it was once started with is restored, and no transcript is read; the record's
+  session id must be a lowercase UUID and its recorded transcript an existing file. Dormancy means
+  the LAST VALIDATED owner the Entwurf hook armed is proven gone AND that arm is still the record's
+  last one: the receiver marker, read through the no-follow fd reader (`readStoreRecordFile`: a
+  symlink or non-regular entry is corrupt, never followed) and judged by the shared
+  `classifyMarkerOwner`, must name this record's session and an owner proven DEAD, and the record
+  re-read after that verdict must carry the same non-null `attachIncarnation` the marker copied.
+  No marker, an unreadable or mismatched one, a live owner, an inconclusive one and an unbound one
+  each refuse by name (`target-receiver-absent` / `-corrupt` / `-mismatch` / `-unbound`,
+  `target-live`, `target-indeterminate`) with no window; the launch uses the re-read record, and no
+  marker or record is removed or rewritten. The observation succeeds only when a NEW live owner in
+  the pane this call opened re-arms the marker for the same session with a fresh binding the
+  current record also carries (same createdAt); a record defect stops it at once as
+  `record-unreadable` with its cause (window kept), and an unseen re-arm is `resume-unobserved`.
+  The verb submits no prompt; for Claude Code what the runtime does after it comes back (a doorbell
+  on unread mail may wake a turn) is unmeasured. Both backends' resume windows now carry the fixed
+  identity scrub fresh-call already had (`-e PI_SESSION_ID= -e PI_AGENT_ID=`, shared from
+  `mux-launch.ts`), because a resumed Claude Code never re-exports its own. Inside herdr the tmux
+  resume rail refuses as `herdr-resume-unsupported` instead of using an ambient `TMUX` (this also
+  applies to pi). The receipt names the caller from the same authoritative identity fresh_call reads,
+  as attribution only: an anonymous caller is `unattributed`, never refused, while a defect in the
+  caller's own store fails the call loud — for pi resume too — exactly as fresh_call does.
+- **The arm binding: one new V3 key, `attachIncarnation` (#147 L2 B1).** A dead receiver marker
+  used to be resume evidence even when a LATER attach of the same session had committed but could
+  not re-arm the marker (owner unproven, marker write failed), so a second window could open on a
+  live session. Now the Claude Code hook mints a clock-independent 128-bit value (`randomBytes(16)`)
+  on every arm-capable event (SessionStart, CwdChanged, FileChanged — an arm revision, so one live
+  process mints many), commits it in the same atomic record upsert and copies it into the receiver
+  marker; UserPromptSubmit and every other writer preserve it, and nothing fills it by inference.
+  Every write the hook makes to an existing record runs under a per-gid record-arm lock in its own
+  directory (`meta-record-arm-locks`, beside the receivers dir; never the v2 dispatch lock visible
+  resume holds across its observation): the garden id is learned by a read-only certified lookup,
+  an absent record is published create-only (`upsertMetaSession` `expectAction` refuses a raced
+  create instead of turning it into an unlocked attach), an arm waits at most 2 s for the lock and
+  otherwise writes NOTHING and logs ERROR, and a busy UserPromptSubmit skips its backfill. A marker
+  write failure after the record committed is an ERROR logged after `INFO armed watch`, and resume
+  then refuses that garden as unbound. **Schema:** the same V3, one key wider — absent reads as
+  `null` ("no binding observed"), every serialize emits it, a present value must be 32 lowercase
+  hex, every other stray key is still refused; gardenId, nativeSessionId and createdAt keep their
+  values and no record is rewritten. `meta-facts` citizens carry the key verbatim. **One-way per host:** a reader that predates the key refuses
+  every record that carries it, and an old writer certifies the whole store first, so once one new
+  write lands every old reader and writer on that host refuses — a mixed-reader incident on oracle
+  on 2026-10-21 (records written by a Pi loaded from the development checkout) took the CC hook
+  and the pi-durable contact down until the checkout dist and the CC hook bundle were re-deployed.
+  Codex birth, the Copilot extension/receiver, the OMP bridge/receiver and the external
+  `entwurf-peek` mirror still carried the old reader there at L2; the on-disk copies were rolled
+  forward on 2026-10-22 (see the retirement section).
+  Old dormant Claude Code citizens whose record has no binding stay `target-receiver-unbound` until
+  a human reopens them once under a new hook. **Accepted boundary (GLG, 2026-10-21, current live
+  Pi/CC cohort scope):** only committed hook attaches are guarded — a process that holds the session
+  without one (hooks disabled, a record-arm lock timeout or a store failure at its start) is
+  invisible to the proof. The installed CC hook bundle now carries `lib/entwurf-v2-lock`, and the
+  doctor's writer-version parity checks it beside the writer.
+- **Claude Code floor `>=2.1.306`** (`package.json` `entwurf.claudeCodeFloor`, GLG 2026-10-21):
+  same-id resume runs `claude --resume` from the record's last observed cwd, and the vendor CLI
+  reference says the session-id search covers other projects only from v2.1.223. 2.1.306 is the
+  version GLG relayed as running here; it is a declared floor with no LIVE receipt at 2.1.306 itself
+  (the 2026-10-22 n=1 round trip ran on 2.1.307). The
+  exec-form observations at 2.1.217 stand as observations.
+- Proof: QKs beside the composition (`entwurf-v2-visible-resume.test.ts`), in
+  `check-resume-launch-identity`, `check-mux-resume-call`, `check-meta-v3-record`,
+  `check-meta-session`, `check-meta-hook-session-switch` (binding pair, UPS preserve, unproven owner,
+  lock busy/wait/own-dir, two overlapping successful schedules, and an install-closure check that
+  compares the hook's static double-quoted `from` imports with what the installer copies and then
+  runs the staged compiled hook) and `check-meta-doctor-oracle` (installed binding; lock module
+  missing/drifted). Mutants: v2-visible-resume 18 → 40, mux-resume-call 10 → 13,
+  resume-launch-identity 7 → 10, meta-hook-session-switch 17 → 25, meta-identity 4 → 9, existing
+  ones re-anchored. At the L2 checkpoint the LIVE dormant→resume journey for Claude Code had not
+  been measured, and `smoke-mux-lifecycle-live`'s Claude Code cell, which expects the still-live
+  sibling's resume to be refused as `target-live`, had not been run. Retire (G3) and the caller's
+  four cells were not part of L2; the later 2026-10-22 n=1 round trip is recorded in the
+  retirement section. The Claude Code dormant leg is still not a release-gate MUST.
+
+### Team bookmarks
+
+- **`team.json.example` shows one way to keep long-lived siblings in view.** It is a fictional,
+  caller-maintained bookmark: each member's name, the descriptive form of address
+  `coordinating sibling` or `sibling`, backend, garden id and native session id. The real
+  `team.json` at a repository root stays ignored. No program loads either file; the record stays
+  the address authority, liveness is re-read from `entwurf peer-facts`, and membership is not
+  permission to send, resume or retire.
+
+### Herdr plugin
+
+- **Back to the checkout carrier for this unpublished candidate.** `plugins/herdr/runtime-lock.json`
+  moves from the published `@junghanacs/entwurf@0.40.0` npm pin to the closed `herdr-checkout`
+  source, as the 0.40.0 preparation did; no npm integrity is invented and the plugin manifest
+  version is not bumped. The npm re-pin follows publication in its own Herdr snapshot. Inside
+  Herdr, `entwurf_resume_call` still refuses as `herdr-resume-unsupported`; retirement from a
+  Herdr pane was not measured.
+
+### Upgrade notes
+
+- A running process keeps the bytes it loaded. Ordinary Pi's built-in MCP bridge and pi-durable
+  load the compiled `dist`, `start.sh` hosts load the source in a checkout, and installed
+  hook/extension copies change only through their owning installers; restart the session after
+  that ([setup](./docs/setup-clean-host.md#applying-new-source-to-a-running-host)). A reader that
+  predates `attachIncarnation` refuses records carrying it, so roll every installed reader forward.
+- Claude Code needs `>=2.1.306` for same-id resume. Its retirement uses a Linux pidfd helper and is
+  refused elsewhere. The native-Windows preview has no resume, and retirement was not
+  measured there. Copilot's Native
+  runtime validation is deferred by GLG's decision on the free `auto` account.
+
+### Evidence boundary
+
+- **One real round trip per backend, at `a9c9459`, not at this release's SHA.** A fresh pi-durable
+  caller retired and same-id resumed a fresh ordinary Pi and a native Claude Code 2.1.307 target
+  once each: dormant delivery refused, native identity and transcript preserved across the
+  promptless resume, blind recall correct. n=1; not a release-gate MUST, ACP, Herdr, Windows,
+  release-artifact or flush/descendant claim
+  ([BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1),
+  [#147](https://github.com/junghan0611/entwurf/issues/147#issuecomment-6329217980)).
+- Kill-power re-measured at this shipped SHA: none (all 1173 committed claims not re-proved,
+  #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-entwurf-v2-retire"]` 32/32 receipt fc08567fb8d3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-retirement-event"]` 16/16 receipt 948a9661fdc0
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-pi-durable-beside"]` 44/44 receipt 61e5b0552648
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","smoke-agy-install-state"]` 12/12 receipt deccfdbf3990
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","scripts/smoke-pi-provider-state.sh"]` 5/5 receipt 9de492738ef4
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a9c945921a7e surface
+  80a4f8a7b942 -- `["bash","run.sh","check-entwurf-v2-surface"]` 17/17 receipt b4c765bd35b7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a9c945921a7e surface
+  80a4f8a7b942 -- `["bash","run.sh","check-pi-durable-beside"]` 44/44 receipt b6751a543d7a
+- **Local static and LIVE floor, measured on this preparation's candidate:** head `c318f30` plus
+  the three release-prep files (this evidence line excepted); the HEAD/index/worktree fingerprint
+  and the 94-file compiled `dist` were unchanged before and after each run. `pnpm run check:full`
+  PASS (exit 0, 882 s) with the host herdr at the supply pin 0.9.5, where `check-herdr-sandbox`
+  passed its 12 assertions on a private server and left the operator's panes and Pi trust store
+  untouched. Two earlier local attempts stayed RED and are kept, each at its own head: at
+  `bf24e17`, a `dist` built 35 s before the last `.ts` commit (the managed rebuild then produced
+  byte-identical output); at `c318f30`, the host herdr 0.9.4 against the 0.9.5 pin. `LIVE=1 ./run.sh release-gate <scratch> --cut`:
+  **MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0, cut OK**, 11:59:15–12:19:05 KST, with the
+  caller identity carriers stripped. The Codex step ran against a test-owned app-server started
+  for this run in its own tmux session (pid named from its own launch, start ticks recorded,
+  stopped by one TERM afterwards) from a different gate session, with the requested tiers
+  `gpt-6-luna` and `openai-codex/gpt-6-luna` — the request, not a billing or model-identity
+  proof. Receipts on the operator host: `.tmp-verify/release-0.41.0/` (`full-r3/full.log`
+  `44332ee7fd78`, `live/release-gate.log` `6f56fffab3da`).
+- **Still owed before the tag.** This prepared SHA's exact push CI (four required jobs). This
+  release is carrier-bearing, so its candidate is the native-Windows preview workflow's pack at
+  the prepared SHA, never a local `npm pack`. The strict `doctor-meta-bridge` on an installed
+  0.41.0 Claude host in a new post-install session, the agy shipped-lane cell and the Codex
+  caller-seat cell (VERIFY release acceptance 4, 7, 8) follow that candidate. Tag, GitHub
+  release and npm publication each need their own approval.
+
+## v2026.10.20-herdr.0.40.0 — Herdr Entwurf plugin 0.40.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.40.0 and its
+`v0.40.0` tag remain unchanged. The operator has published the core to npm.
+
+**Reading guide (2026-10-20).** The `## 0.40.0` section below and the body of the
+[v0.40.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.40.0) are
+prepare-time text: their "still owed before the tag" lines and their npm wording predate the
+cut. The cut-time acceptance (exact-SHA CI, the Windows preview candidate, the Linux consumer,
+the installed remote-pair gate, VERIFY §3.4, and §3.7 (agy) excluded for that cut only by the
+operator's decision, not a PASS) is recorded in the
+[#107 cut receipt](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6281283301).
+The publish is the later registry fact recorded in this section (`latest` 0.40.0, published
+2026-10-20T01:49:33Z, registry bytes equal to the accepted candidate). Neither the published
+tarball's CHANGELOG nor the release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.40.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.40.0
+  rode to production npm source `@junghanacs/entwurf@0.40.0` with the registry's measured
+  sha512 (`sha512-y9HgQIcm…bQnZUW/g==`). The plugin manifest moves 0.39.0 → 0.40.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From the
+  `v2026.10.19-herdr.0.39.0` snapshot to `v0.40.0`, the only change under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` was that lock's return
+  to `herdr-checkout`.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`; core 0.40.0
+  keeps the Pi 1.3.0 SDK set.
+- **Not a remote-pair certification.** Core 0.40.0's remote pair (#107) is carried in the
+  acquired runtime's bytes, but this snapshot measures no remote delivery, no SSH and no second
+  host through Herdr. The one real exchange remains the core section's L4 trial.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.39.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.40.0 and `repair` 0.12.8-repair.1, 621 files, published
+  2026-10-20T01:49:33Z. The downloaded registry tarball is byte-equal to the preserved accepted
+  core candidate (SHA256 `4a6906ac38ff5024b9e07f7a092cc54a7686696082893293dfa653036f87fa55`,
+  11292707 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge`. No model turn.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.39.0 runtime was seeded from its own committed lock (`ba46dec`); the swap to
+  0.40.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.39.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.39.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-dep-versions`, `check-install-surface` and `check-gate-manifests` (1034 committed
+  mutants across 79 lanes validated, none executed). `check-herdr-plugin-build` and
+  `check-herdr-sandbox` were not run locally because they run the operator's own herdr; they
+  ride the pushed SHA's FULL floor in CI.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
 ## 0.40.0 - 2026-10-20
 
 The bridge is crossed and the questions are carried forward. A person laid a bridge

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi or Claude Code siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.
 

package/DELIVERY.md

@@ -59,6 +59,22 @@ ringing any doorbell, its filenames are ISO stamps so a drain is a global FIFO,
 is an honest `mailbox-undeliverable` refusal, and its receipt is that FILE. A mailbox enqueue is a
 durable file receipt; a control-socket queue is process memory.
 
+### Candidate lifecycle commands are not delivery boundaries (#147)
+
+The current checkout's Pi control server also accepts the internal `retire` RPC, so a Pi
+started from that checkout can expose it before a release is cut. It requires matching
+record/native identity, a TUI, idle state and no pending work. Its `shutdown-requested` ACK
+is not socket closure, process exit, flush or model silence. This command is not itself a public
+MCP/contact verb and is not part of the four send boundaries above; the candidate public
+`entwurf_retire_call` reaches a Pi target through it. A Pi whose process started before its
+checkout carried this command does not know it, and its generic error answer is classified as
+`unknown`/`malformed-response`, never as a safe refusal or a reason to replay. The candidate
+CC pidfd helper observes one fd-pinned process, not a conversation, descendants or flush;
+unknown never grants safe replay. Package/source presence, compiled consumer checks and a
+real native lifecycle remain separate evidence axes; the one dated native lifecycle measurement
+is [BASELINE's 2026-10-22 n=1 round trip](./BASELINE.md#147-native-round-trip-2026-10-22-n1). Historical delivery receipts below do
+not certify these candidate components.
+
 ## Levels (D0–D8)
 
 These are independent of VERIFY's `L0–L5` evidence levels and BASELINE's question
@@ -109,7 +125,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
 | **pi Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. A pi session calls the verbs through Pi's built-in MCP running the compiled `entwurf-bridge` (#125); the receive rail is unchanged. |
-| **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
+| **Claude Code interactive `>=2.1.306`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. `>=2.1.306` is the current declared floor; that historical B2 receipt does not certify #147 resume/retire lifecycle on this floor. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |
 | **Codex embedded TUI** | deferred | D0 partial | At the 2026-09-08 Codex 0.153.4 measurement, standalone mode had no `watchPaths`/`FileChanged`/`asyncRewake` analogue or supported idle receive route. This is dated vendor evidence, not a claim that the current candidate lacks records or fresh. |
@@ -128,7 +144,7 @@ Re-audit backend versions before turning probe evidence into a shipped adapter.
 
 ### Claude Code: durable body, edge-triggered wake
 
-Claude's hook contract is exec-only at `>=2.1.217`. `SessionStart` arms a per-session
+Claude's hook contract is exec-only at `>=2.1.306`. `SessionStart` arms a per-session
 watch path; the sender writes durable `*.msg` bodies before poking the signal;
 `FileChanged` emits a doorbell and `asyncRewake` wakes the idle session. The receiver
 then calls `entwurf_inbox_read`, which drains all unread bodies and archives them as

package/FAQ.md

@@ -8,7 +8,7 @@ No. Entwurf is closer to a workshop than a factory: it connects independently ow
 
 ## What does Entwurf do?
 
-It opens, reopens and messages visible sibling sessions across independent harnesses, each under a stable **garden id**. `entwurf_fresh_call` opens a new sibling in the caller's Herdr workspace or tmux session by default, `entwurf_resume_call` reopens a dormant pi sibling under the same id, and `entwurf_v2` delivers a message, reply or hand-off to an existing one through the rail it actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
+It opens, reopens and messages visible sibling sessions across independent harnesses, each under a stable **garden id**. `entwurf_fresh_call` opens a new sibling in the caller's Herdr workspace or tmux session by default, `entwurf_resume_call` reopens a dormant pi or Claude Code sibling under the same id, and `entwurf_v2` delivers a message, reply or hand-off to an existing one through the rail it actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
 
 ## What is a garden id?
 
@@ -24,15 +24,19 @@ The visible top-level session is the garden principal. Internal children remain
 
 ## Does sending a message start a process?
 
-No. [`entwurf_v2`](./README.md#entwurf_v2--canonical-dispatch-verb) only addresses an existing garden citizen and selects its supported delivery rail. `entwurf_fresh_call` opens a new visible sibling; `entwurf_resume_call` reopens a dormant pi citizen under the same id.
+No. [`entwurf_v2`](./README.md#entwurf_v2--canonical-dispatch-verb) only addresses an existing garden citizen and selects its supported delivery rail. `entwurf_fresh_call` opens a new visible sibling; `entwurf_resume_call` reopens a dormant pi or Claude Code citizen under the same id.
+
+## Can an agent retire a sibling on its own?
+
+No. `entwurf_retire_call` (new in 0.41.0) attempts retirement of one Pi or Claude Code sibling, and only one the human operator explicitly requested. Seeing the tool, a coordinator role or the caller's identity is not permission; where a host provides an approval step it applies too, and Pi and pi-durable 1.3.0 have none by default. The configured Claude ACP child is also [set to run without per-call permission prompts](./docs/acp-backend-rail.md#configured-claude-acp-permissions); that is source configuration, not measured ACP retirement. The record stays, so `entwurf_resume_call` can reopen the same id, and an unknown result is never a reason to retry.
 
 ## Where do visible siblings open?
 
-Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, pi-durable, Claude Code, Copilot, OMP, or Codex runtimes in a new window of the caller's tmux session, or of an existing session the caller names; without an explicit tmux placement, a Codex caller opens beside its own TUI pane. A dormant pi sibling reopens under the same id in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
+Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, pi-durable, Claude Code, Copilot, OMP, or Codex runtimes in a new window of the caller's tmux session, or of an existing session the caller names; without an explicit tmux placement, a Codex caller opens beside its own TUI pane. A dormant pi or Claude Code sibling reopens under the same id in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
 
 ## Does Entwurf replace Herdr or tmux?
 
-No. Herdr and tmux provide visible seats. Entwurf opens siblings into them, reopens dormant pi siblings, and carries identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
+No. Herdr and tmux provide visible seats. Entwurf opens siblings into them, reopens dormant pi or Claude Code siblings, and carries identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
 
 ## How do I install it?