@junghanacs/entwurf 0.40.0 → 0.41.1

package/pi-extensions/meta-bridge-hook.ts

@@ -53,20 +53,38 @@
  * closure (build-bridge → dist), because Node REFUSES strip-types on a `.ts` below
  * node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). The installer picks
  * the artifact by layout (0.12.5), mirroring start.sh / store-doctor.
- * Imports `./lib/meta-session.ts` (+ `./lib/session-id.js`); `rewriteRelativeImportExtensions`
- * rewrites that to `./lib/meta-session.js` in the emitted closure. The installer
- * copies the lib dir alongside this file so `${CLAUDE_PLUGIN_ROOT}` self-locates it.
+ * Imports `./lib/meta-session.ts` and `./lib/entwurf-v2-lock.ts` (+ `./lib/session-id.js`);
+ * `rewriteRelativeImportExtensions` rewrites those to `.js` in the emitted closure. The
+ * installer copies exactly those lib files alongside this file so `${CLAUDE_PLUGIN_ROOT}`
+ * self-locates them.
+ *
+ * RECORD-ARM LOCK (#147 L2 B1). Every write this hook makes to an EXISTING record happens
+ * under a per-gid lock (`defaultMetaRecordArmLocksDir`, the shared `acquireLock` primitive in
+ * its own directory — never the v2 dispatch lock dir, which visible resume holds across its
+ * observation). The garden id is learned by a READ-ONLY certified lookup; a record found
+ * absent is published create-only. On an arm-capable event the lock is held from the upsert
+ * that commits a fresh `attachIncarnation` through the receiver marker that copies it, so two
+ * normal arms (or an arm and a UserPromptSubmit) always finish as a matching record/marker
+ * pair. An arm that cannot take the lock within its bound writes NOTHING and logs ERROR: that
+ * attach is not committed, and a live native process may then exist that no record names — a
+ * boundary, not a refusal. A UserPromptSubmit that finds the lock busy skips its backfill.
  */
 
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { acquireLock, type LockClaim, releaseLock } from "./lib/entwurf-v2-lock.ts";
 import {
 	defaultMetaMailboxDir,
+	defaultMetaRecordArmLocksDir,
 	defaultMetaSessionsDir,
+	findCertifiedIdentityByNativeSessionId,
 	isPlausibleOwnerPid,
+	type MetaIdentityMintInput,
 	type MetaReceiverArmProvenance,
+	mintAttachIncarnation,
 	readMetaSenderMarker,
 	removeMetaReceiverMarker,
+	UpsertActionMismatchError,
 	upsertMetaSession,
 	writeMetaReceiverMarker,
 	writeMetaSenderMarker,
@@ -97,8 +115,62 @@ function logLine(level: LogLevel, message: string): void {
 	}
 }
 
+/** The record-arm lock this run holds, released on every exit path (see {@link emit}). */
+let heldArmLock: LockClaim | null = null;
+
+/** Arm-capable events wait this long for the record-arm lock; the critical section is a few file writes. */
+const ARM_LOCK_WAIT_MS = 2_000;
+const ARM_LOCK_POLL_MS = 25;
+
+function sleepSync(ms: number): void {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/**
+ * Take the record-arm lock for `gardenId`: ONE attempt, or (arm-capable events) polled up to
+ * {@link ARM_LOCK_WAIT_MS}. A throw from the primitive (its claim could not be written) is
+ * the same answer as busy — the caller writes nothing.
+ */
+function takeArmLock(gardenId: string, wait: boolean): { ok: true } | { ok: false; detail: string } {
+	const dir = defaultMetaRecordArmLocksDir();
+	const deadline = Date.now() + (wait ? ARM_LOCK_WAIT_MS : 0);
+	for (;;) {
+		let detail: string;
+		try {
+			const acquired = acquireLock(gardenId, { dir });
+			if (acquired.ok) {
+				heldArmLock = acquired.claim;
+				return { ok: true };
+			}
+			detail = acquired.conflict.detail;
+		} catch (err) {
+			detail = err instanceof Error ? err.message : String(err);
+		}
+		if (Date.now() >= deadline) return { ok: false, detail };
+		sleepSync(ARM_LOCK_POLL_MS);
+	}
+}
+
+function releaseArmLock(): void {
+	const claim = heldArmLock;
+	if (claim === null) return;
+	heldArmLock = null;
+	try {
+		const outcome = releaseLock(claim, { dir: defaultMetaRecordArmLocksDir() });
+		if (outcome !== "released") logLine("WARN", `record-arm lock release for ${claim.gardenId}: ${outcome}`);
+	} catch (err) {
+		// The holder pid is this short-lived hook, so a lock it failed to unlink is reclaimed
+		// by the next acquirer once this process is gone (same host + ESRCH).
+		logLine(
+			"WARN",
+			`record-arm lock release failed for ${claim.gardenId}: ${err instanceof Error ? err.message : String(err)}`,
+		);
+	}
+}
+
 /** Emit a hook response on stdout and exit 0. `{}` means "did nothing, do not block startup". */
 function emit(payload: Record<string, unknown>): never {
+	releaseArmLock();
 	process.stdout.write(`${JSON.stringify(payload)}\n`);
 	process.exit(0);
 }
@@ -174,6 +246,59 @@ function resolveMetaHookOwnerPid(): number | null {
 	return ownerPid;
 }
 
+/**
+ * Commit this event's record write and return the garden id (#147 L2 B1). The garden id to
+ * lock is learned READ ONLY; a record found absent is published create-only (a create needs no
+ * lock: its exclusive publish cannot replace anything, and a concurrent publisher turns the
+ * create into a refusal here, never into an unlocked attach). Every write to an EXISTING
+ * record then happens under the record-arm lock, which the caller keeps through the receiver
+ * marker write (released by {@link emit}). An arm-capable event mints its binding in that same
+ * atomic upsert. Lock busy: an arm writes nothing and logs ERROR (admission failure — not a
+ * committed attach, not an armed watch); any other event skips its backfill with a WARN.
+ * Throws on a store defect, exactly as the upsert does.
+ */
+function commitRecord(
+	input: MetaIdentityMintInput,
+	armsWatch: boolean,
+	logContext: string,
+): { gardenId: string; attachIncarnation: string | undefined } {
+	let existing = findCertifiedIdentityByNativeSessionId(input.nativeSessionId);
+	if (existing === null) {
+		try {
+			const created = upsertMetaSession({ input, expectAction: "create" });
+			logLine("INFO", `create record ${path.basename(created.path)} (${logContext})`);
+			// Nothing to bind and nothing older to preserve: the create is the whole write.
+			if (!armsWatch) return { gardenId: created.record.gardenId, attachIncarnation: undefined };
+			existing = created.record;
+		} catch (err) {
+			if (!(err instanceof UpsertActionMismatchError)) throw err;
+			existing = findCertifiedIdentityByNativeSessionId(input.nativeSessionId);
+			if (existing === null) throw err;
+		}
+	}
+	const locked = takeArmLock(existing.gardenId, armsWatch);
+	if (!locked.ok) {
+		if (armsWatch) {
+			// Admission failure: NOTHING is written, so the store keeps whatever pair it had. This
+			// attach is not committed, and a live process may now hold this session unseen.
+			logLine(
+				"ERROR",
+				`record-arm lock busy — attach NOT committed, watch not armed (garden=${existing.gardenId}, ${logContext}): ${locked.detail}`,
+			);
+		} else {
+			logLine(
+				"WARN",
+				`record-arm lock busy — backfill skipped (garden=${existing.gardenId}, ${logContext}): ${locked.detail}`,
+			);
+		}
+		emit({});
+	}
+	const attachIncarnation = armsWatch ? mintAttachIncarnation() : undefined;
+	const result = upsertMetaSession({ input: { ...input, attachIncarnation }, expectAction: "attach" });
+	logLine("INFO", `${result.action} record ${path.basename(result.path)} (${logContext})`);
+	return { gardenId: result.record.gardenId, attachIncarnation };
+}
+
 function main(): void {
 	let raw: string;
 	try {
@@ -230,16 +355,16 @@ function main(): void {
 		emit({});
 	}
 
+	// Arm-capable events commit a fresh binding; every other event preserves it.
+	const armsWatch = armProvenanceFor(eventName) !== null;
 	let gardenId: string;
+	let attachIncarnation: string | undefined;
 	try {
-		const result = upsertMetaSession({
-			input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
-		});
-		gardenId = result.record.gardenId;
-		logLine(
-			"INFO",
-			`${result.action} record ${path.basename(result.path)} (event=${eventName}, source=${source}, native=${sessionId})`,
-		);
+		({ gardenId, attachIncarnation } = commitRecord(
+			{ backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
+			armsWatch,
+			`event=${eventName}, source=${source}, native=${sessionId}`,
+		));
 	} catch (err) {
 		// Best-effort: a broken record store must surface via the doctor, not by
 		// breaking the user's session open. Log and continue with no arm. This is
@@ -362,12 +487,16 @@ function main(): void {
 					nativeSessionId: sessionId,
 					ownerPid,
 					armProvenance,
+					attachIncarnation,
 				});
 				logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName} source=${source}`);
 			} catch (err) {
+				// ERROR, after `INFO armed watch` so the hook-log doctor does not read a later arm as
+				// recovery: the record already carries this arm's binding, the marker does not, so the
+				// garden is undeliverable AND a later resume refuses it as unbound.
 				logLine(
-					"WARN",
-					`receiver marker write failed (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`,
+					"ERROR",
+					`receiver marker write failed — record binding committed, marker not (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`,
 				);
 			}
 		} else {

package/pi-extensions/meta-bridge-pi-durable.ts

@@ -98,6 +98,13 @@
  * operator host started outside tmux gets the bridge's named `no-tmux-context` refusal. Exposing the
  * tool is not a caller LIVE proof.
  *
+ * CALLER RESUME (the seventh tool, #147 L1). `entwurf_resume_call` lets this durable citizen reopen a
+ * DORMANT pi or Claude Code citizen under its own garden id (#147 L2), under the bridge's own
+ * single-`target` schema (pinned below). The bridge decides everything else from the target's record,
+ * exactly as for any other caller: other backends have no same-id resume, a live target is refused,
+ * and the window opens in the tmux session this host was launched in. Exposing the tool names no new authority and is not a caller LIVE
+ * proof; it never resumes this durable host itself.
+ *
  * NOT HERE: crash-safe receive. `entwurf_inbox_read` archives a body before the durable tool
  * result commits, so a crash between the two loses that body to the model; recovery settles the
  * call as interrupted and no doorbell rings again. A drain that fails part-way has archived the
@@ -156,6 +163,8 @@ export const PI_DURABLE_TOOL_NAMES = [
 	"entwurf_inbox_read",
 	"entwurf_callback",
 	"entwurf_fresh_call",
+	"entwurf_resume_call",
+	"entwurf_retire_call",
 ] as const;
 export type PiDurableToolName = (typeof PI_DURABLE_TOOL_NAMES)[number];
 
@@ -164,7 +173,7 @@ const DRAFT_07 = "http://json-schema.org/draft-07/schema#";
 /**
  * The bridge's `tools/list` inputSchemas for the exposed tools (`mcp/entwurf-bridge/src/index.ts`
  * `entwurf_v2` 456-507, `entwurf_self`, `entwurf_peers`, `entwurf_inbox_read`, `entwurf_callback`,
- * `entwurf_fresh_call`),
+ * `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_retire_call`),
  * as the bridge serialises them.
  * `attach` compares the live list against these and refuses on any difference.
  */
@@ -235,7 +244,7 @@ export const PI_DURABLE_TOOL_SCHEMAS: Readonly<Record<PiDurableToolName, Readonl
 				maxLength: 200,
 				pattern: "^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$",
 				description:
-					"Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.",
+					"Required runtime model: canonical provider/model for pi (a bare alias is refused), provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name. Neither pi nor pi-durable may name the openrouter provider.",
 			},
 			task: {
 				type: "string",
@@ -266,6 +275,33 @@ export const PI_DURABLE_TOOL_SCHEMAS: Readonly<Record<PiDurableToolName, Readonl
 		required: ["backend", "model", "task"],
 		$schema: DRAFT_07,
 	},
+	entwurf_resume_call: {
+		type: "object",
+		properties: {
+			target: {
+				type: "string",
+				minLength: 1,
+				pattern: "^\\d{8}T\\d{6}-[0-9a-f]{6}$",
+				description: "Garden id of the DORMANT pi or Claude Code citizen to reopen (discover with entwurf_peers).",
+			},
+		},
+		required: ["target"],
+		$schema: DRAFT_07,
+	},
+	entwurf_retire_call: {
+		type: "object",
+		properties: {
+			target: {
+				type: "string",
+				minLength: 1,
+				pattern: "^\\d{8}T\\d{6}-[0-9a-f]{6}$",
+				description:
+					"Exact garden id of the Pi or Claude Code target the human operator explicitly requested to retire.",
+			},
+		},
+		required: ["target"],
+		$schema: DRAFT_07,
+	},
 };
 
 /** Key-order-insensitive JSON, for comparing a schema copy against the bridge's own. */
@@ -318,7 +354,7 @@ export interface PiDurableRoots {
 // ---------------------------------------------------------------------------
 // Durable surface, typed NARROWLY and locally — read at pi-durable 1.0.2 @cd32f77 (#129,
 // `harness/types.ts`; historical coordinates, not re-anchored here). The current supply is the
-// carrier emitted from Entwurf's owned source (pi/pi-durable/src, #141) against the 1.3.0 SDK set
+// carrier emitted from Entwurf's owned source (pi/pi-durable/src, #141) against the 1.4.0 SDK set
 // `pi/pi-durable/overlay/upstream-pin.json` names (origin `abe508e`). `[read 2026-10-13]` at
 // v1.2.0 one shape typed below moved: `ToolExecutionResult.content` is now `output`, beside the new
 // `structuredOutput` (`harness/types.ts`, its CHANGELOG's breaking changes). An omitted `output`
@@ -748,6 +784,24 @@ const TOOL_DESCRIPTIONS: Record<PiDurableToolName, string> = {
 		"(backend, model and task required; optional cwd and placement). Returns the bridge's LAUNCH receipt or its " +
 		"named refusal — not a started runtime, a delivered task or a reply; the sibling's callback names it. Opening " +
 		"beside this host needs the tmux pane this host itself was launched in.",
+	entwurf_resume_call:
+		"Reopen ONE dormant pi or Claude Code citizen under its own garden id in a visible tmux window through the " +
+		"entwurf-bridge (target required; the record supplies the session and cwd — no task, no prompt, no turn). " +
+		"Returns the bridge's LAUNCH and OBSERVATION receipts or its named refusal: a live target, another backend, " +
+		"or a Claude Code citizen not proven dormant is refused by name, and opening the window needs the tmux " +
+		"session this host itself was launched in.",
+	entwurf_retire_call:
+		"Only when the human operator explicitly requested this particular target/work: make ONE retirement attempt for that request " +
+		"through the bridge (target only, Pi or Claude Code; self retirement refuses). Development work, a role or " +
+		"a record-backed actor is NOT a grant. Use host approval where provided/configured; " +
+		"Pi and pi-durable have no built-in per-call approval prompt by default. An explicit operator request and " +
+		"agent operating policy are required; attribution and MCP annotations are hints, not grants or proof of approval. " +
+		"No autonomous cleanup, timers or automatic " +
+		"retry of unknown, cancelled or lost results. Do not manually /resume or /clear the target during the request. " +
+		"Pi shutdown-requested is only an ACK, not process exit, flush or model silence. Claude Code exited is that " +
+		"fd-pinned process only, not conversation end, children or flush. The JSON receipt keeps outcome, record and " +
+		"release separate; receipt return does not mean exit, and cancellation does not undo an action. Invoke once " +
+		"per explicitly named target, never infer a roster. This contact does not turn hints into authorization.",
 };
 
 /** Announce, never push: the notice names the garden and the tool, never the body. */

package/run.sh

@@ -224,7 +224,7 @@ Usage:
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
   ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
-  ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume refused target-not-pi, no window opened and no lock residue. LIVE=1 ./run.sh smoke-mux-lifecycle-live
+  ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume of the still-live sibling refused target-live, no window opened and no lock residue (its dormant same-id resume is deterministic-only, #147 L2). LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one `herdr integration status` + one `entwurf peer-facts` + one `herdr agent list` per open, in that order (counted, not claimed), through ONE spawn call site; the four blocks each naming their own owner/observation time with no aggregate verdict; the D3=C fallback reading the activation ledger from the path its WRITER owns (XDG state, never the runtime's data root) and only when the phase is `active`, with ENTWURF_BIN and PATH still winning outright; the citizen axis alone skipping by name when no binary is reachable; every broken-evidence state a named red rather than a crash or an empty table, and a selected herdr atom that is `outdated`/`needs repair` as block [1]'s OWN red (`not installed` stays a reported skip); ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
   ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
@@ -1343,6 +1343,44 @@ check_control_send_receipt() {
   run_vitest pi-extensions/lib/control-send-receipt.test.ts
 }
 
+check_control_retire() {
+  # Mutant execution coordinate only; the existing beside glob owns test discovery.
+  section "Pi idle-only shutdown boundary (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/control-retire.test.ts
+}
+
+check_pi_retire_request() {
+  # Mutant execution coordinate only; the existing beside glob owns test discovery.
+  section "Pi retire request adapter (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/pi-retire-request.test.ts
+}
+
+check_cc_retire_pidfd() {
+  # MUTANT EXECUTION COORDINATE, not a discovery path — check-tests-beside-behavior finds the test
+  # like every other beside lane. This case exists because the #147 G3 CCRETIRE-* mutants name it as
+  # gate argv; it stays in check:contracts for the same reason as check-control-send-receipt.
+  section "Linux pidfd retire helper (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/cc-retire-pidfd.test.ts
+}
+
+check_cc_retire_request() {
+  # Mutant execution coordinate only; the existing beside glob owns test discovery.
+  section "Claude Code retire request adapter (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/cc-retire-request.test.ts
+}
+
+check_retirement_event() {
+  # Mutant execution coordinate only; the existing beside glob owns test discovery.
+  section "Retirement append leaf (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/retirement-event.test.ts
+}
+
+check_entwurf_v2_retire() {
+  # Mutant execution coordinate only; the existing beside glob owns test discovery.
+  section "Requested retirement dispatcher and production binding (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/entwurf-v2-retire.test.ts pi-extensions/lib/entwurf-v2-retire-production.test.ts
+}
+
 check_win32_preview() {
   # MUTANT EXECUTION COORDINATE, not a discovery path — the Windows preview's (#78) loader and
   # platform wiring tests are found by check-tests-beside-behavior like every other beside-behaviour
@@ -1455,6 +1493,15 @@ check_acp_foreground_only() {
   run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
 }
 
+check_fresh_call_provider() {
+  # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
+  # MUTANT EXECUTION COORDINATE for the #76 provider claims in scripts/mutants/fresh-call-dispatch.json
+  # (same reasoning as check_entwurf_resume_args above): pi and pi-durable refuse a model that names
+  # the openrouter provider, and pi refuses one that names no provider, at the dispatch root.
+  section "fresh-call provider contract (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/fresh-call-dispatch.test.ts
+}
+
 check_acp_set_model_readback() {
   # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
   # MUTANT EXECUTION COORDINATE for scripts/mutants/acp-set-model-readback.json (#128): the claude
@@ -1670,7 +1717,8 @@ smoke_mux_lifecycle_live() {
   # resumed pane_start_path == the RECORD's cwd (separate tmux query, never pane text), and the
   # transcript byte-identical across the resume itself -> entwurf_v2 recalling the fact from
   # BEFORE the close, which is what proves the same CONVERSATION returned. Claude Code runs the
-  # callback+mailbox half and its resume is refused as target-not-pi with no window opened and no lock residue.
+  # callback+mailbox half and its resume, while that sibling is still live, is refused as target-live with no
+  # window opened and no lock residue (#147 L2: Claude Code's dormant resume is certified deterministically).
   # Fixture-fenced writes (XDG, four meta roots, v2 lock dir, control socket via fixture HOME);
   # the runtime auth roots stay REAL and sibling transcripts remain in the real pi agent dir as
   # evidence. Private tmux server per cell, bounded teardown, operator real-root entry sets
@@ -2731,7 +2779,7 @@ EOF
 check_claude_floor_coherence() {
   # #51 policy A. The Claude Code floor is a THREE-PART version, unlike the Node
   # floor's major lane: the discriminator lives in the patch position (2.1.138 drops
-  # `args`, 2.1.139 introduces the exec form, 2.1.217 is the version actually proven
+  # `args`, 2.1.139 introduces the exec form, 2.1.217 is the version the exec form was proven on
   # in a live session). So it cannot borrow check-node-floor-coherence's major-only
   # comparison and needs its own binding.
   #
@@ -3973,6 +4021,10 @@ check_pack() {
   # JS for installed entrypoints. The files array lists pi/pi-durable per FILE, so nothing admits these
   # today; this tripwire is what fails loud the day an allowlist entry would.
   local durable_source_pattern='^pi/pi-durable/(src/|tsconfig\.json$|overlay/runtime-contacts\.patch$)'
+  # #148 S1b: the goldens and generator a beside test reads (pi-extensions/lib/fixtures/) are test input,
+  # not product. `pi-extensions/` ships whole, so the `!pi-extensions/**/fixtures/**` negation is the only
+  # thing keeping them out, and this is its tripwire (same 결합 규칙 as the `.test.ts` pattern above).
+  local test_fixture_pattern='^pi-extensions/(.*/)?fixtures/'
 
   local pass=1 f pat hit
 
@@ -3999,6 +4051,13 @@ check_pack() {
     pass=0
   fi
 
+  hit=$(grep -E "$test_fixture_pattern" <<<"$file_list" || true)
+  if [ -n "$hit" ]; then
+    fail "[check-pack] a beside test's fixtures (pi-extensions/**/fixtures/) ride the tarball — test input is not product; restore the files-array negation:"
+    echo "$hit" | sed 's/^/    /' >&2
+    pass=0
+  fi
+
   # #78 — a pack carries the Windows addon not at all, or as exactly a verified addon + manifest
   # pair (pack_win32_carrier_verdict, proven on owned fixtures by check-pack-win32-carrier).
   # "present" means the carrier verified, never that the build was approved for publication.
@@ -4109,7 +4168,7 @@ check_pack_win32_carrier() {
 #     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
 #     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@1\.3\.0(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@1\.4\.0(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
@@ -4126,18 +4185,18 @@ check_pack_pin_matcher() {
   # Cell 1 — the version boundary. Every measured peer-hash shape is a fixture: the
   # 0.84.4-era `_@modelcontextprotocol+sdk@…`, the `_ws@8.21.3` observed on a real
   # 0.85.1 tree, and `[측정 2026-09-20]` the combined suffix a 0.86.0 install carries.
-  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
+  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`1.4.0-beta.1`,
   # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@1.3.0' \
-    '@earendil-works+pi-ai@1.3.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@1.3.0_ws@8.21.3' \
-    '@earendil-works+pi-ai@1.3.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
-    '@earendil-works+pi-ai@1.3.0-beta.1' \
+    '@earendil-works+pi-ai@1.4.0' \
+    '@earendil-works+pi-ai@1.4.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.4.0_ws@8.21.3' \
+    '@earendil-works+pi-ai@1.4.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.4.0-beta.1' \
     '@earendil-works+pi-agent-core@0.87.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.3.0-beta.1
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.4.0-beta.1
 @earendil-works+pi-agent-core@0.87.1' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.3.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.3.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.4.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.4.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -4145,9 +4204,9 @@ check_pack_pin_matcher() {
   # (0.85.0 onward, still true at 0.99.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+chord@1.3.0' \
+    '@earendil-works+chord@1.4.0' \
     '@earendil-works+chord@0.87.1' \
-    '@earendil-works+pi-ai@1.3.0' | pack_install_leaked_pi)
+    '@earendil-works+pi-ai@1.4.0' | pack_install_leaked_pi)
   if [ "$matcher_probe" != '@earendil-works+chord@0.87.1' ]; then
     fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it was a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0, `[측정 2026-09-23]` at 0.87.1 and `[측정 2026-09-30]` at 0.99.1, where pi-coding-agent adds pi-codemode and pi-mcp beside them; `[측정 2026-10-13]` at 1.2.0 pi-durable alone declares it) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
@@ -4161,7 +4220,7 @@ check_pack_pin_matcher() {
 # Cells: L1s (Entwurf alone, $3), L1 (project-local beside an aligned host pi-coding-agent at the
 # pinned SDK version), L2 (an isolated `npm -g --prefix`), each through (a) the INSTALLED verifier
 # (exit 0, prints its own carrier-resolver) and (b) an independent consumer oracle; then the L3
-# NEGATIVE (an override binds pi-durable's pi-ai edge to an older published version: the installed verifier must
+# NEGATIVE (an override binds pi-durable's pi-codemode edge to an older published version: the installed verifier must
 # refuse it by name, while a bare import still succeeds); then (c) the public launch on L1s.
 # The oracle observes RESOLUTIONS (a resolve hook), not every filesystem read; it asserts each
 # resolved product file lies inside THIS consumer's node_modules — a sandbox ancestor is not the
@@ -4256,13 +4315,18 @@ ORACLE
     echo "[check-pack-install] pi-durable $cell: installed verifier PASS; consumer oracle $out"
   done
 
-  printf '%s\n' "{\"name\":\"pd-mismatch\",\"version\":\"1.0.0\",\"private\":true,\"overrides\":{\"@earendil-works/pi-durable\":{\"@earendil-works/pi-ai\":\"1.0.3\"}}}" > "$box/pd-mismatch/package.json"
+  # The wrong edge must still IMPORT, or the control proves a crash rather than a refusal. `[측정 2026-10-22]`
+  # SDK 1.4 pi-durable imports pi-ai's new `utils/identity`, absent from the older pi-ai control versions
+  # checked here (1.0.3 and 1.3.0 both fail to load); pi-telemetry 1.0.3/1.3.0 and chord 1.3.0 lack exports
+  # it imports. pi-codemode 1.3.0 loads, and depends on no SDK member, so this tree carries exactly one
+  # depth-2 mismatch (L4 keeps depth 3).
+  printf '%s\n' "{\"name\":\"pd-mismatch\",\"version\":\"1.0.0\",\"private\":true,\"overrides\":{\"@earendil-works/pi-durable\":{\"@earendil-works/pi-codemode\":\"1.3.0\"}}}" > "$box/pd-mismatch/package.json"
   out=$(cd "$box/pd-mismatch" && npm install "$tgz" --no-audit --no-fund 2>&1) || {
     fail "[check-pack-install] pi-durable L3 (mismatch control) install failed:"; echo "$out" | tail -10 | sed 's/^/    /' >&2; return 1; }
   pkg="$box/pd-mismatch/node_modules/@junghanacs/entwurf"
   rc=0; out=$(cd "$box" && node "$pkg/mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-runtime.js" resolve 2>&1) || rc=$?
-  if [ "$rc" -ne 3 ] || ! grep -q "pi-durable-sdk-mismatch: @earendil-works/pi-durable → @earendil-works/pi-ai wants $pin_ver, binds 1.0.3" <<<"$out"; then
-    fail "[QK:PACK-INSTALL-DURABLE-MISMATCH-REFUSED] [check-pack-install] pi-durable L3: an installed tree whose pi-durable binds pi-ai 1.0.3 must be refused by name as pi-durable-sdk-mismatch (rc=$rc): $out"
+  if [ "$rc" -ne 3 ] || ! grep -q "pi-durable-sdk-mismatch: @earendil-works/pi-durable → @earendil-works/pi-codemode wants $pin_ver, binds 1.3.0" <<<"$out"; then
+    fail "[QK:PACK-INSTALL-DURABLE-MISMATCH-REFUSED] [check-pack-install] pi-durable L3: an installed tree whose pi-durable binds pi-codemode 1.3.0 must be refused by name as pi-durable-sdk-mismatch (rc=$rc): $out"
     return 1
   fi
   rc=0; out=$(cd "$box" && node --input-type=module -e "import { pathToFileURL } from 'node:url'; await import('$pkg/pi/pi-durable/carrier-resolver.mjs'); const m = await import(pathToFileURL('$pkg/pi/pi-durable/carrier/runtime.js').href); console.log(typeof m.openDurable);" 2>&1) || rc=$?
@@ -4787,19 +4851,21 @@ _check_pack_install_impl() {
   # `[측정 2026-10-16]` at 1.3.0 the constellation is unchanged: the installed manifests give the
   # same member edges as at 1.2.0, now every one exact 1.3.0 (upstream #10865), and the consumer
   # oracle walked 10 member edges with 0 mismatches (.tmp-verify/145-stage1/08-pack-install.log).
-  echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.3.x SDK + chord + codemode + mcp + durable + typebox)"
+  # `[측정 2026-10-22]` at 1.4.0 the nine members are again exact 1.4.0 edges (registry manifests; #148 S0),
+  # and pi-tui 1.4.0 adds one third-party dependency (marked-cjk-friendly 0.1.2) outside the closure.
+  echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.4.x SDK + chord + codemode + mcp + durable + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@1.3.0" \
-    "@earendil-works/pi-coding-agent@1.3.0" \
-    "@earendil-works/pi-tui@1.3.0" \
-    "@earendil-works/pi-agent-core@1.3.0" \
-    "@earendil-works/pi-telemetry@1.3.0" \
-    "@earendil-works/chord@1.3.0" \
-    "@earendil-works/pi-codemode@1.3.0" \
-    "@earendil-works/pi-mcp@1.3.0" \
-    "@earendil-works/pi-durable@1.3.0" \
+    "@earendil-works/pi-ai@1.4.0" \
+    "@earendil-works/pi-coding-agent@1.4.0" \
+    "@earendil-works/pi-tui@1.4.0" \
+    "@earendil-works/pi-agent-core@1.4.0" \
+    "@earendil-works/pi-telemetry@1.4.0" \
+    "@earendil-works/chord@1.4.0" \
+    "@earendil-works/pi-codemode@1.4.0" \
+    "@earendil-works/pi-mcp@1.4.0" \
+    "@earendil-works/pi-durable@1.4.0" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -4815,11 +4881,11 @@ _check_pack_install_impl() {
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.3.0):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.4.0):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.3.0 (chord and pi-durable included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.4.0 (chord and pi-durable included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -5381,7 +5447,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
 #!/usr/bin/env bash
 printf '%s\n' "$*" >> "${FAKE_CLAUDE_LOG:?}"
 case "$1${2:+ $2}" in
-  "--version") echo "2.1.217 (Claude Code)" ;;
+  "--version") echo "2.1.306 (Claude Code)" ;;
   "plugin validate") : ;;
   "plugin uninstall") : ;;
   "plugin marketplace") : ;;
@@ -5457,6 +5523,8 @@ SH
   mkdir -p "$nm_probe/lib"
   cp "$installed_hook" "$nm_probe/meta-bridge-hook.js"
   cp "$stable_asm/entwurf-meta-receive/lib/meta-session.js" "$nm_probe/lib/meta-session.js"
+  # The real installer already supplies this hook import; the node_modules probe must too.
+  cp "$stable_asm/entwurf-meta-receive/lib/entwurf-v2-lock.js" "$nm_probe/lib/entwurf-v2-lock.js"
   cp "$stable_asm/entwurf-meta-receive/lib/session-id.js" "$nm_probe/lib/session-id.js"
   cp "$stable_asm/entwurf-meta-receive/entwurf-capabilities.json" "$nm_probe/entwurf-capabilities.json"
   local probe_env='{"session_id":"pack-probe","transcript_path":"/tmp/x.jsonl","cwd":"/tmp","hook_event_name":"SessionStart","model":{"id":"probe"}}'
@@ -5695,7 +5763,7 @@ function finish(trimmed) {
   // gate that exists to catch "green clone, dead consumer". Equality also catches the
   // other direction the narrow-surface rule cares about: an extra or duplicated verb
   // reaching hosts without a decision. Written sorted; `names` is sorted above.
-  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_retire_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
     console.error('installed MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
     process.exit(1);
@@ -6257,12 +6325,12 @@ function finishOk(trimmed) {
   }
   const names = tools.map((t) => t?.name).sort();
   // EXACT set, not a floor. This is the assertion behind the operator-facing claim that
-  // `entwurf check-bridge` proves the installed bytes list the eight garden tools — and
+  // `entwurf check-bridge` proves the installed bytes list the nine garden tools — and
   // under an installed package this launcher IS the dist branch of start.sh, so a subset
   // check here let an artifact missing entwurf_fresh_call / entwurf_resume_call read as a
   // green bridge. Equality also refuses an undecided extra verb. Written sorted; `names`
   // is sorted above.
-  const expected = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const expected = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_retire_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== expected.length || expected.some((n, i) => names[i] !== n)) {
     console.error(`MCP tool set MISMATCH — want exactly [${expected.join(',')}] got [${names.join(',')}]`);
     process.exit(1);
@@ -7502,6 +7570,24 @@ case "$cmd" in
   check-control-send-receipt)
     check_control_send_receipt
     ;;
+  check-control-retire)
+    check_control_retire
+    ;;
+  check-pi-retire-request)
+    check_pi_retire_request
+    ;;
+  check-cc-retire-pidfd)
+    check_cc_retire_pidfd
+    ;;
+  check-cc-retire-request)
+    check_cc_retire_request
+    ;;
+  check-retirement-event)
+    check_retirement_event
+    ;;
+  check-entwurf-v2-retire)
+    check_entwurf_v2_retire
+    ;;
   check-win32-preview)
     check_win32_preview
     ;;
@@ -7532,6 +7618,9 @@ case "$cmd" in
   check-acp-foreground-only)
     check_acp_foreground_only
     ;;
+  check-fresh-call-provider)
+    check_fresh_call_provider
+    ;;
   check-acp-set-model-readback)
     check_acp_set_model_readback
     ;;