@junghanacs/entwurf 0.40.0 → 0.41.1

package/CHANGELOG.md

@@ -4,6 +4,568 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.41.1 — 2026-10-23
+
+**Unpublished candidate; release acceptance is not complete.** The actual operator
+transition and Native aggregate below have been measured. Final prepared-SHA CI and
+the requested manual BODY, the exact carrier-bearing artifact, main promotion, tags
+and publication remain separate gates. Main still carries the published 0.41.0 Herdr
+lock: promoting the checkout lock can change what main-tracking installations acquire.
+A validation artifact or an earlier checkpoint's green run is not final acceptance.
+
+### Pi 1.4.0 reference shell
+
+- Move the coherent nine-member production SDK set from exact 1.3.0 to exact 1.4.0,
+  keeping Entwurf's owned app/TUI composition and deterministic carrier emission.
+  The SDK owns execution, storage, queues, compaction and recovery; this adds no second
+  engine, supervisor, automatic retry policy or credential surface. The ordinary Pi
+  adapter's supported range becomes `>=1.4.0 <1.5`.
+- Show sleeping tasks in the background-task tally, their local wake time in the task
+  panel, and the SDK's blocked reason verbatim. Keep cancellation distinct from retry;
+  no new retry command or UI is added.
+- Adapt the ACP vendor-rejection test to pi-ai 1.4's bounded HTTP-status matching:
+  digits inside opaque request/tool ids no longer classify as transient. The raw
+  `Internal error` control remains transient. The production non-replay verdict and
+  raw diagnostic preservation are unchanged.
+- Add SDK 1.3 public-API-generated SQL fixtures and independent SQLite conformance
+  tests for the SDK 1.4 schema transition, row/index preservation, constraints,
+  reopening and future-version refusal. These are SDK conformance, not a local
+  mutation claim over the upstream engine. Keep fixture data and its generator out
+  of installed packages, with npm packlist and tarball-floor checks.
+- Separate this unpublished candidate's checkout instructions from public npm
+  0.41.0 / SDK 1.3 instructions. The Herdr lock uses the closed `herdr-checkout`
+  verification carrier; it invents no unpublished npm integrity. No new Herdr
+  snapshot or registry publication is implied.
+- Keep the Codex LIVE fixture callback-only on its outbound Pi leg. Asking for an
+  extra ACK created a fourth real tool call while the audit required three. The
+  exact-three, nonce and terminal-turn assertions remain unchanged; only the two
+  matching task strings changed, not production routing or retry behavior.
+- Trim historical platform details, dated labels and duplicated lifecycle prose
+  from the README while retaining operator consent, unknown-outcome handling,
+  platform limits and the published-versus-candidate install distinction.
+
+### Upgrade boundary
+
+Opening each existing durable session with SDK 1.4 migrates its SQLite storage to
+schema 2. SDK 1.3 / Entwurf 0.41.0 refuses that session. Reinstalling the older package
+is not data rollback: restoring a pre-upgrade backup reopens the old data, but omits
+work done after that backup. Database restoration does not undo external messages,
+tool/file/network effects, meta records or mailbox read receipts. Preserve the newer
+set and inspect unknown outcomes before considering a restore or resend.
+Even a refused SDK 1.4 open can change the file header
+and sidecars while preserving logical rows (measured on a future-schema copy). Back up the complete target session
+file set before its first new-SDK open.
+
+Close the old owner normally and prove the process has exited before cutover. A
+stale lock is not proof: a bounded, SQLite-free fixture reproduced a stalled but live
+owner losing its lock. This lock behavior already existed in 0.41.0. Use the resume
+picker to select the intended session rather than guessing with `--continue`.
+
+SDK 1.4 counts a task SDK 1.3 left running as an interrupted run at its first open;
+SDK 1.4's own normal close does not add a restart. Repeated interruptions can park a
+task at the restart limit. Inspect outcomes before any resend; cancellation is not
+retry, and recovery of an actual parked model generation remains unmeasured.
+
+### Preparation and operating evidence — not final release acceptance
+
+Implementation checkpoint `3ed079b` follows independent source/proof reviews. Its
+earlier working candidate passed the deterministic FULL floor in 885 seconds with
+source/index unchanged, carrier 45 tests, storage conformance 11 tests, and ACP
+vendor rejection 14 tests. The final pre-commit vocabulary sweep then changed one
+harness-table SDK literal into a reference to the pin authority, independently read
+and checked. These are implementation-era observations, not this prepared version's
+FULL, native LIVE, installed artifact, operating-session migration or exact-SHA CI.
+
+Private sandbox observations separately cover old-package refusal, backup restoration
+and loss of later marker work, SDK task replay/parking, candidate shell open/close,
+SDK 1.3-born fixture identity carried into the SDK 1.4 shell, and in-process open
+failure releasing the session lock. Parked non-generation Hold tasks did not block
+root input; conversation abort cancelled only the non-background Hold. None proves
+real model-generation continuity or an operating citizen's actual upgrade.
+
+Kill-power re-measured at this shipped SHA: none (all 1178 committed claims not
+re-proved, #144).
+
+That required line records the source's preparation-time measurement state, not a
+prediction of later CI. GLG separately requested manual BODY evidence. The earlier
+validation SHA `ff86c88bd58ba776e15ef48e1e4be566971a3e9a` has a four-job green push run
+[39790950791](https://github.com/junghan0611/entwurf/actions/runs/39790950791) and a
+separate `workflow_dispatch qualify=true` run
+[39792701159](https://github.com/junghan0611/entwurf/actions/runs/39792701159): 85 lanes,
+1178 unique claims KILLED, survived/error/skipped 0. Those are that SHA's receipts,
+not this later prepared SHA's. Its requested exact-SHA CI/BODY results must be recorded
+separately in [#148's live evidence thread](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6348113761);
+no future result is invented here and the standing release policy is unchanged.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-dep-versions"]` 4/4 receipt 48d085e06816.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-pack-pin-matcher"]` 2/2 receipt 593dd0401502.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-pi-durable-carrier"]` 35/35 receipt 258f783406a7.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head ff86c88bd58b surface
+7c75301f53a9 -- `["bash","run.sh","check-release-gate-outcomes"]` 21/21 receipt 251b71584442.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head ff86c88bd58b surface
+7c75301f53a9 -- `["bash","run.sh","check-mux-fresh-call"]` 150/150 receipt 56c3558f9a15.
+
+Both ff86c88 PARTIAL receipts were taken with the Codex fixture correction still
+uncommitted on that head, on the recorded working surface.
+
+The versioned working candidate's earlier FULL completed in 890 seconds, exit 0,
+with source/index unchanged (log SHA256 `757115f291c05f397631f6e8de48a2b77fdfde973d5219edf70e63658c3b8e88`).
+It predates later checkpoint metadata and is not a final committed-SHA CI result.
+
+**Actual operator transition:** after the human closed the original owners and their
+exit was proven with the scheme-aware owner classifier, the complete session file
+set was consistently backed up without opening SQLite. The exact Linux validation
+tarball (`92e5b2722ab8063d2bc50936db358a36a02a5e92e36babc3e1fbf98b399c2f44`)
+was accepted unchanged in a container, separately exercised through an isolated pnpm
+global old-to-new takeover, then installed as the operator's 0.41.1/SDK 1.4 runtime.
+User-scope extension loading and doctors passed. The coordinator resumed the actual
+old conversation: garden/native/createdAt/cwd stayed unchanged, a new owner attached,
+a real model turn recalled the pre-close agreement and used tools, and four
+send/read/reply/read receipts closed a round trip with an existing Claude Code sibling.
+The human-reopened Pi reviewer also confirmed its identity, model, tools and recall.
+No separate live DB query or universal transcript/parked-generation recovery claim is
+made. This addon-less Linux validation tarball is not the carrier-bearing release file.
+
+**Native aggregate:** the first run at `ff86c88` was MUST 23/1/0 and BEHAVIOR 1/0/0:
+the extra requested ACK was a fourth distinct call, not parser duplication. Its raw
+failure is preserved. After the scoped fixture correction, an affected fresh Codex
+run passed 66 assertions with both terminal audits exactly 3/3. The new full run at
+`a9d05847295230ed58f53b0bfd689d9ebd6ac1da` then passed **MUST 24/0/0,
+BEHAVIOR 1/0/0**, including the deterministic FULL; source/index stayed unchanged.
+The operator still used the **ff86c88 validation install**, not an installed a9d0584
+artifact. Its runtime closure (bridge dist, pi-durable carrier, bootstrap and resolver)
+was byte-identical to the checkout before and after the run; README and LIVE fixture
+bytes differ. This is checkout-gate evidence with that installed runtime, not a claim
+that the complete a9d0584 package was installed or accepted.
+Scratch `/tmp/entwurf-release-gate-0.41.1-r2.cl0DDR`, log `release-gate.log`, SHA256
+`020f489bf6fe024447bfc26a12f3499e5b80e844b0dcadf1e474e6adc8b4ae05`.
+P9 was a read-only census: root 4.9 GiB and home 6.9 GiB free, with the existing
+Emacs infrastructure identified rather than killed; current receipts and scratch
+were preserved. Only the explicitly owned test app-server was normally stopped.
+
+The final prepared-SHA push CI/manual BODY and Win32-bearing artifact acceptance
+are still pending. The validation tarball has no Win32 addon; it cannot stand for
+M3w or final macOS/Windows acceptance. No tag, GitHub release, npm publication,
+Herdr re-pin or laptop rollout has occurred. Earlier 0.41.0 receipts below remain
+historical.
+
+## v2026.10.22-herdr.0.41.0 — Herdr Entwurf plugin 0.41.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.41.0 and its
+`v0.41.0` tag remain unchanged. Core 0.41.0 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-22).** The `## 0.41.0` section below and the body of the
+[v0.41.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.41.0) are
+prepare-time and make-time text: their npm wording (the Herdr lock's "unpublished candidate",
+"npm publication each need their own approval") predates the publication. The publish is the later registry fact recorded in this section (`latest` 0.41.0,
+published 2026-10-22T04:37:02.853Z, registry bytes equal to the accepted candidate). Neither the
+published tarball's CHANGELOG nor the core release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.41.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.41.0
+  rode to production npm source `@junghanacs/entwurf@0.41.0` with the registry's measured
+  sha512 (`sha512-hSf6St0u…fBlvA==`). The plugin manifest moves 0.40.0 → 0.41.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From the
+  `v2026.10.20-herdr.0.40.0` snapshot to `v0.41.0`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's resume/retire wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **What the acquired runtime now carries.** Core 0.41.0's lifecycle verbs ride in the runtime's
+  bytes: its installed bridge lists nine tools, `entwurf_retire_call` among them. Inside Herdr,
+  `entwurf_resume_call` still refuses as `herdr-resume-unsupported`. This snapshot measures no
+  retirement or resume through Herdr.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`; core 0.41.0
+  keeps the Pi 1.3.0 SDK set.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.40.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+- **README.** The first-user-path receipt description no longer says the installed
+  `check-bridge` lists an eight-verb set; it names the verb set the installed bridge declares,
+  nine since 0.41.0.
+- **Raw-install smoke scaffolding follows the Claude Code floor.** The first public-ref run of
+  `smoke-herdr-raw-install-live` at `cfdae0e` built its container with Claude Code 2.1.278, a
+  hand-kept pin from 2026-09-19, and the acquired 0.41.0 runtime refused to wire Claude below its
+  supported floor `>= 2.1.306` — the product's intended refusal, not a runtime defect. The smoke now
+  derives its exact Claude Code version from `package.json` `entwurf.claudeCodeFloor` instead of
+  retyping it. The product floor, the Pi, Herdr and Node pins and the smoke's end-state oracle are
+  unchanged.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.41.0 and `repair` 0.12.8-repair.1, 642 files, published
+  2026-10-22T04:37:02.853Z. The downloaded registry tarball is byte-equal to the preserved
+  accepted core candidate (SHA256 `2bd03ba900324a7c0882c2738c29593df0a1e4829fb3ae18d22be62186cf67ad`,
+  11399545 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge` with nine tools.
+  No model turn. The accepted run stripped every `PI_`, `ENTWURF_`, `CLAUDE`, `CODEX_HOME`,
+  `TMUX` and `HERDR_` carrier and ran on the branch worktree, whose only checkout input (the
+  bridge resolver script) is unchanged; an earlier run from the clean tag HEAD left `TMUX` and
+  non-identity `PI_*` variables set and is kept only as a preliminary record.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.40.0 runtime was seeded from its own committed lock (`036e268`); the swap to
+  0.41.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.40.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.40.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-herdr-plugin-build` (21, its real-binary cell on herdr 0.9.5), `check-herdr-sandbox`
+  (12, a private herdr 0.9.5 server), `check-dep-versions`, `check-install-surface` and
+  `check-gate-manifests` (1173 committed mutants across 85 lanes validated, none executed).
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
+## 0.41.0 - 2026-10-22
+
+A sibling's garden id is its birthday, and this cut lets it rest and come back under it. A
+sibling can now be opened, spoken to, retired when the human operator names it, and reopened
+under the same id with its conversation intact. That holds for ordinary Pi and native Claude
+Code. Retirement is a pause in a long session, not cleanup: it is never autonomous, a paired
+requested/outcome record beside the target's record is attempted for every request with any
+recording failure reported on its own axis, and the record and transcript stay.
+A durable pi-durable sibling can drive both verbs. Each was measured once on real sessions, which
+is recorded as dated evidence, not as a release gate.
+
+### Fresh call
+
+- **A Pi-dialect model names its provider, and never OpenRouter (#76).** The dispatch root both
+  rails share now refuses, before either rail is asked anything, a pi or pi-durable model whose
+  provider segment is `openrouter` in any letter case (`model-openrouter-forbidden`) and a pi
+  model that names no provider at all (`pi-model-not-provider-qualified`). The second replaces
+  the 2026-08-13 non-goal that allowed a bare id: GLG decided on 2026-10-21 that the provider is
+  stated explicitly, because a bare alias resolves to whichever catalog row Pi prefers (the
+  2026-09-17 bare `terra` opened on an OpenRouter row). It is a call-time input contract, not a
+  version pin: no model list, catalog copy, resolved-row or endpoint check was added, so a later
+  model name passes this provider check once it is written `<provider>/<id>` (not a promise
+  that it launches, nor a bypass of #128). Other backends' model names
+  (a claude-code `opus` alias) are not judged; resume and #128 curation are unchanged. The
+  refusal checks the name a caller wrote, not the endpoint a provider name reaches. The
+  `entwurf_fresh_call` model description says both rules. Proof:
+  `pi-extensions/lib/fresh-call-dispatch.test.ts` (three QKs) and three mutants in the
+  `fresh-call-dispatch` lane (12 → 15), executed through `./run.sh check-fresh-call-provider`.
+
+### pi-durable
+
+- **The durable contact offers `entwurf_resume_call` (#147 L1).** A pi-durable citizen (the
+  coordinator's host) could not call the existing same-id resume verb: its contact exposed six bridge
+  tools and resume was not among them. It now registers a seventh, under the bridge's own
+  single-`target` schema, and forwards the call to the bridge unchanged. The verb itself is
+  unchanged by L1: at that checkpoint pi-only targets (L2 below widens the domain), a live target
+  refused, no turn, the record supplies the launch facts. Nothing new authorises who may resume, a
+  retire verb is not here, and a running durable host offers the tool only after it is restarted onto a build that
+  carries it. Because the bootstrap reserves every contact tool name, an operator native module
+  that registers a tool named `entwurf_resume_call` is now refused as `native-module-name-reserved`.
+  Proof: two QKs in `pi-extensions/meta-bridge-pi-durable.test.ts` — the tool is offered and hands
+  the bridge exactly `{target}`, and a faux model's call on the published runtime reaches this
+  package's compiled bridge through the contact's production connector and reads the bridge's named
+  refusal for a test-owned record of a backend with no same-id resume (codex since L2; no citizen is
+  resumed). Two mutants
+  in the `pi-durable` lane (84 → 86), executed through `./run.sh check-pi-durable-beside`. The
+  independent tool lists of `check-pi-durable-contact`, `check-pi-durable-send` and
+  `smoke-pi-durable-fresh-live` now name seven tools. One default-cell `check-pi-durable-send` run
+  (scripted loopback endpoint and the carrier app's native tool path; no vendor model turn) offered
+  `entwurf_resume_call` in the app's first model request, and its parameters there equal the
+  bridge's own listed schema — read from that run's raw wire receipt, because the default cell's
+  QK judges only self, peers and v2; the seven-tool `native-module` cell was not run. A running
+  coordinator host offering seven tools, and any operator rollout, remain unmeasured.
+
+### Operator-requested retirement (#147)
+
+- `entwurf_retire_call {target}` makes one explicitly human-requested Pi or Claude Code attempt. Development, coordinator status and record-backed attribution are not standing permission. Where a host provides or is configured with an approval step, that step applies as well; Pi and pi-durable 1.3.0 have no built-in approval prompt by default. MCP annotations and caller identity are hints and attribution, not permission. No autonomous cleanup, roster expansion or automatic replay.
+- The per-request production binding captures its directories and cancellation signal. Requested/outcome events share an id in a target-gid append-only sidecar with explicit actor/target fields. Action, record-write failure and lock cleanup stay independent; an append failure cannot turn a possibly effective action into a safe retry. The source bridge lists nine tools, ordinary Pi seven active plus two hidden, and the durable contact eight.
+- Independent review repaired a metadata-test oracle, random-id privacy-test flakiness and snapshot/file-target consistency. A private `node_modules` compiled consumer passed29 assertions over anonymous/self refusal, existing resume refusal, inert Node RPC and two-line attribution. Operator dist hashes stayed unchanged. That consumer is not real Pi/Claude Code retirement, Native/LIVE, G4 rollout or release acceptance; final candidate floors and exact-SHA CI are still owed.
+- 2026-10-22, source `a9c9459`: one operator-requested, test-owned Native round trip per backend — a fresh pi-durable caller (actual offering of all eight contact tools) retired and same-id resumed a fresh ordinary Pi and a native Claude Code 2.1.307 target once each, with dormant delivery refused, identity and transcript preserved across the promptless resume, and blind recall. n=1; not a MUST gate, ACP, Herdr, Windows, release-artifact or flush/descendant claim ([BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1)). The five stale on-disk Codex/Copilot/OMP reader copies were rolled forward with their owning installers; Copilot birth's doctor runtime axis remains RED on a historical hook error. GLG explicitly deferred its Native runtime validation for this landing: the current free `auto` account, not a subscription, is impractical to test (GLG reports a greeting taking over a minute; not re-benchmarked here). On-disk reader compatibility is closed with that named runtime deferral; resident-process reloads and broader runtime/release acceptance remain unmeasured. Earlier component receipts below do not become this candidate's kill-power.
+
+### Internal retirement checkpoints (#147; before public composition)
+
+- **Pi's control server now serves an internal `retire` RPC.** A Pi started from this
+  checkout can already receive it; this is not a claim about the published 0.40.0 package.
+  Immutable garden/native identity, TUI, idle and no-pending guards precede one SDK shutdown
+  request. The shared production response envelope and strict one-shot client keep
+  `shutdown-requested` distinct from exit, flush or model silence. Busy work is refused, not
+  aborted or queued for a later shutdown.
+- **Claude Code has a fixed Linux pidfd helper and request adapter.** The helper is copied
+  beside the compiled adapter; it pins a process, checks its start key, accepts one complete
+  go/cancel frame and requests one fd SIGTERM with bounded exit observation. Fresh
+  record/receiver/sender birth, arm binding, owner domain and pid/key joins run before helper
+  spawn and after ready. Unknown is not safe-retry permission. A fd-process exit does not
+  prove conversation identity, descendant termination or transcript flush.
+- **A private dispatcher preserves action and cleanup independently.** Trusted caller
+  attribution/self refusal, fresh target and liveness checks, one adapter and one lock release
+  are composed through mandatory seams. It creates no grant/role database. At these component
+  checkpoints there was no accepted production host composition or public retirement MCP/contact
+  registration. The later candidate composition above owns its separate binding and runtime proof.
+- **Proof remains candidate-local:** owned receiver/helper fixtures; independent review;
+  primitive PARTIAL Pi9 + CC11, later request-adapter PARTIAL9+6+15+40, then pure-dispatcher
+  PARTIAL10 on different candidates; private compiled consumer28 and a missing-Pi-entry
+  negative on the adapter candidate. These are not release-SHA kill-power, installed retirement
+  runtime or four-cell native lifecycle evidence. Actual host composition, G4 reader rollout,
+  public caller integration and the preserved #106 B append-only attribution record remain
+  open. Existing live/release floors are not waived by these checkpoints.
+
+### Resume
+
+- **`entwurf_resume_call` reopens a dormant Claude Code citizen under its own garden id (#147 L2).**
+  The verb's domain is now pi and claude-code, a closed set; every other backend is the named
+  `target-backend-unsupported` (the retired `target-not-pi` has no alias). A Claude Code target is
+  launched as the fixed `claude --resume <record nativeSessionId>` at the record's cwd — no model or
+  permission flag it was once started with is restored, and no transcript is read; the record's
+  session id must be a lowercase UUID and its recorded transcript an existing file. Dormancy means
+  the LAST VALIDATED owner the Entwurf hook armed is proven gone AND that arm is still the record's
+  last one: the receiver marker, read through the no-follow fd reader (`readStoreRecordFile`: a
+  symlink or non-regular entry is corrupt, never followed) and judged by the shared
+  `classifyMarkerOwner`, must name this record's session and an owner proven DEAD, and the record
+  re-read after that verdict must carry the same non-null `attachIncarnation` the marker copied.
+  No marker, an unreadable or mismatched one, a live owner, an inconclusive one and an unbound one
+  each refuse by name (`target-receiver-absent` / `-corrupt` / `-mismatch` / `-unbound`,
+  `target-live`, `target-indeterminate`) with no window; the launch uses the re-read record, and no
+  marker or record is removed or rewritten. The observation succeeds only when a NEW live owner in
+  the pane this call opened re-arms the marker for the same session with a fresh binding the
+  current record also carries (same createdAt); a record defect stops it at once as
+  `record-unreadable` with its cause (window kept), and an unseen re-arm is `resume-unobserved`.
+  The verb submits no prompt; for Claude Code what the runtime does after it comes back (a doorbell
+  on unread mail may wake a turn) is unmeasured. Both backends' resume windows now carry the fixed
+  identity scrub fresh-call already had (`-e PI_SESSION_ID= -e PI_AGENT_ID=`, shared from
+  `mux-launch.ts`), because a resumed Claude Code never re-exports its own. Inside herdr the tmux
+  resume rail refuses as `herdr-resume-unsupported` instead of using an ambient `TMUX` (this also
+  applies to pi). The receipt names the caller from the same authoritative identity fresh_call reads,
+  as attribution only: an anonymous caller is `unattributed`, never refused, while a defect in the
+  caller's own store fails the call loud — for pi resume too — exactly as fresh_call does.
+- **The arm binding: one new V3 key, `attachIncarnation` (#147 L2 B1).** A dead receiver marker
+  used to be resume evidence even when a LATER attach of the same session had committed but could
+  not re-arm the marker (owner unproven, marker write failed), so a second window could open on a
+  live session. Now the Claude Code hook mints a clock-independent 128-bit value (`randomBytes(16)`)
+  on every arm-capable event (SessionStart, CwdChanged, FileChanged — an arm revision, so one live
+  process mints many), commits it in the same atomic record upsert and copies it into the receiver
+  marker; UserPromptSubmit and every other writer preserve it, and nothing fills it by inference.
+  Every write the hook makes to an existing record runs under a per-gid record-arm lock in its own
+  directory (`meta-record-arm-locks`, beside the receivers dir; never the v2 dispatch lock visible
+  resume holds across its observation): the garden id is learned by a read-only certified lookup,
+  an absent record is published create-only (`upsertMetaSession` `expectAction` refuses a raced
+  create instead of turning it into an unlocked attach), an arm waits at most 2 s for the lock and
+  otherwise writes NOTHING and logs ERROR, and a busy UserPromptSubmit skips its backfill. A marker
+  write failure after the record committed is an ERROR logged after `INFO armed watch`, and resume
+  then refuses that garden as unbound. **Schema:** the same V3, one key wider — absent reads as
+  `null` ("no binding observed"), every serialize emits it, a present value must be 32 lowercase
+  hex, every other stray key is still refused; gardenId, nativeSessionId and createdAt keep their
+  values and no record is rewritten. `meta-facts` citizens carry the key verbatim. **One-way per host:** a reader that predates the key refuses
+  every record that carries it, and an old writer certifies the whole store first, so once one new
+  write lands every old reader and writer on that host refuses — a mixed-reader incident on oracle
+  on 2026-10-21 (records written by a Pi loaded from the development checkout) took the CC hook
+  and the pi-durable contact down until the checkout dist and the CC hook bundle were re-deployed.
+  Codex birth, the Copilot extension/receiver, the OMP bridge/receiver and the external
+  `entwurf-peek` mirror still carried the old reader there at L2; the on-disk copies were rolled
+  forward on 2026-10-22 (see the retirement section).
+  Old dormant Claude Code citizens whose record has no binding stay `target-receiver-unbound` until
+  a human reopens them once under a new hook. **Accepted boundary (GLG, 2026-10-21, current live
+  Pi/CC cohort scope):** only committed hook attaches are guarded — a process that holds the session
+  without one (hooks disabled, a record-arm lock timeout or a store failure at its start) is
+  invisible to the proof. The installed CC hook bundle now carries `lib/entwurf-v2-lock`, and the
+  doctor's writer-version parity checks it beside the writer.
+- **Claude Code floor `>=2.1.306`** (`package.json` `entwurf.claudeCodeFloor`, GLG 2026-10-21):
+  same-id resume runs `claude --resume` from the record's last observed cwd, and the vendor CLI
+  reference says the session-id search covers other projects only from v2.1.223. 2.1.306 is the
+  version GLG relayed as running here; it is a declared floor with no LIVE receipt at 2.1.306 itself
+  (the 2026-10-22 n=1 round trip ran on 2.1.307). The
+  exec-form observations at 2.1.217 stand as observations.
+- Proof: QKs beside the composition (`entwurf-v2-visible-resume.test.ts`), in
+  `check-resume-launch-identity`, `check-mux-resume-call`, `check-meta-v3-record`,
+  `check-meta-session`, `check-meta-hook-session-switch` (binding pair, UPS preserve, unproven owner,
+  lock busy/wait/own-dir, two overlapping successful schedules, and an install-closure check that
+  compares the hook's static double-quoted `from` imports with what the installer copies and then
+  runs the staged compiled hook) and `check-meta-doctor-oracle` (installed binding; lock module
+  missing/drifted). Mutants: v2-visible-resume 18 → 40, mux-resume-call 10 → 13,
+  resume-launch-identity 7 → 10, meta-hook-session-switch 17 → 25, meta-identity 4 → 9, existing
+  ones re-anchored. At the L2 checkpoint the LIVE dormant→resume journey for Claude Code had not
+  been measured, and `smoke-mux-lifecycle-live`'s Claude Code cell, which expects the still-live
+  sibling's resume to be refused as `target-live`, had not been run. Retire (G3) and the caller's
+  four cells were not part of L2; the later 2026-10-22 n=1 round trip is recorded in the
+  retirement section. The Claude Code dormant leg is still not a release-gate MUST.
+
+### Team bookmarks
+
+- **`team.json.example` shows one way to keep long-lived siblings in view.** It is a fictional,
+  caller-maintained bookmark: each member's name, the descriptive form of address
+  `coordinating sibling` or `sibling`, backend, garden id and native session id. The real
+  `team.json` at a repository root stays ignored. No program loads either file; the record stays
+  the address authority, liveness is re-read from `entwurf peer-facts`, and membership is not
+  permission to send, resume or retire.
+
+### Herdr plugin
+
+- **Back to the checkout carrier for this unpublished candidate.** `plugins/herdr/runtime-lock.json`
+  moves from the published `@junghanacs/entwurf@0.40.0` npm pin to the closed `herdr-checkout`
+  source, as the 0.40.0 preparation did; no npm integrity is invented and the plugin manifest
+  version is not bumped. The npm re-pin follows publication in its own Herdr snapshot. Inside
+  Herdr, `entwurf_resume_call` still refuses as `herdr-resume-unsupported`; retirement from a
+  Herdr pane was not measured.
+
+### Upgrade notes
+
+- A running process keeps the bytes it loaded. Ordinary Pi's built-in MCP bridge and pi-durable
+  load the compiled `dist`, `start.sh` hosts load the source in a checkout, and installed
+  hook/extension copies change only through their owning installers; restart the session after
+  that ([setup](./docs/setup-clean-host.md#applying-new-source-to-a-running-host)). A reader that
+  predates `attachIncarnation` refuses records carrying it, so roll every installed reader forward.
+- Claude Code needs `>=2.1.306` for same-id resume. Its retirement uses a Linux pidfd helper and is
+  refused elsewhere. The native-Windows preview has no resume, and retirement was not
+  measured there. Copilot's Native
+  runtime validation is deferred by GLG's decision on the free `auto` account.
+
+### Evidence boundary
+
+- **One real round trip per backend, at `a9c9459`, not at this release's SHA.** A fresh pi-durable
+  caller retired and same-id resumed a fresh ordinary Pi and a native Claude Code 2.1.307 target
+  once each: dormant delivery refused, native identity and transcript preserved across the
+  promptless resume, blind recall correct. n=1; not a release-gate MUST, ACP, Herdr, Windows,
+  release-artifact or flush/descendant claim
+  ([BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1),
+  [#147](https://github.com/junghan0611/entwurf/issues/147#issuecomment-6329217980)).
+- Kill-power re-measured at this shipped SHA: none (all 1173 committed claims not re-proved,
+  #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-entwurf-v2-retire"]` 32/32 receipt fc08567fb8d3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-retirement-event"]` 16/16 receipt 948a9661fdc0
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","check-pi-durable-beside"]` 44/44 receipt 61e5b0552648
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","run.sh","smoke-agy-install-state"]` 12/12 receipt deccfdbf3990
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 639f783df2d5 surface
+  d53b8f8d6602 -- `["bash","scripts/smoke-pi-provider-state.sh"]` 5/5 receipt 9de492738ef4
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a9c945921a7e surface
+  80a4f8a7b942 -- `["bash","run.sh","check-entwurf-v2-surface"]` 17/17 receipt b4c765bd35b7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a9c945921a7e surface
+  80a4f8a7b942 -- `["bash","run.sh","check-pi-durable-beside"]` 44/44 receipt b6751a543d7a
+- **Local static and LIVE floor, measured on this preparation's candidate:** head `c318f30` plus
+  the three release-prep files (this evidence line excepted); the HEAD/index/worktree fingerprint
+  and the 94-file compiled `dist` were unchanged before and after each run. `pnpm run check:full`
+  PASS (exit 0, 882 s) with the host herdr at the supply pin 0.9.5, where `check-herdr-sandbox`
+  passed its 12 assertions on a private server and left the operator's panes and Pi trust store
+  untouched. Two earlier local attempts stayed RED and are kept, each at its own head: at
+  `bf24e17`, a `dist` built 35 s before the last `.ts` commit (the managed rebuild then produced
+  byte-identical output); at `c318f30`, the host herdr 0.9.4 against the 0.9.5 pin. `LIVE=1 ./run.sh release-gate <scratch> --cut`:
+  **MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0, cut OK**, 11:59:15–12:19:05 KST, with the
+  caller identity carriers stripped. The Codex step ran against a test-owned app-server started
+  for this run in its own tmux session (pid named from its own launch, start ticks recorded,
+  stopped by one TERM afterwards) from a different gate session, with the requested tiers
+  `gpt-6-luna` and `openai-codex/gpt-6-luna` — the request, not a billing or model-identity
+  proof. Receipts on the operator host: `.tmp-verify/release-0.41.0/` (`full-r3/full.log`
+  `44332ee7fd78`, `live/release-gate.log` `6f56fffab3da`).
+- **Still owed before the tag.** This prepared SHA's exact push CI (four required jobs). This
+  release is carrier-bearing, so its candidate is the native-Windows preview workflow's pack at
+  the prepared SHA, never a local `npm pack`. The strict `doctor-meta-bridge` on an installed
+  0.41.0 Claude host in a new post-install session, the agy shipped-lane cell and the Codex
+  caller-seat cell (VERIFY release acceptance 4, 7, 8) follow that candidate. Tag, GitHub
+  release and npm publication each need their own approval.
+
+## v2026.10.20-herdr.0.40.0 — Herdr Entwurf plugin 0.40.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.40.0 and its
+`v0.40.0` tag remain unchanged. The operator has published the core to npm.
+
+**Reading guide (2026-10-20).** The `## 0.40.0` section below and the body of the
+[v0.40.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.40.0) are
+prepare-time text: their "still owed before the tag" lines and their npm wording predate the
+cut. The cut-time acceptance (exact-SHA CI, the Windows preview candidate, the Linux consumer,
+the installed remote-pair gate, VERIFY §3.4, and §3.7 (agy) excluded for that cut only by the
+operator's decision, not a PASS) is recorded in the
+[#107 cut receipt](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6281283301).
+The publish is the later registry fact recorded in this section (`latest` 0.40.0, published
+2026-10-20T01:49:33Z, registry bytes equal to the accepted candidate). Neither the published
+tarball's CHANGELOG nor the release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.40.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.40.0
+  rode to production npm source `@junghanacs/entwurf@0.40.0` with the registry's measured
+  sha512 (`sha512-y9HgQIcm…bQnZUW/g==`). The plugin manifest moves 0.39.0 → 0.40.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From the
+  `v2026.10.19-herdr.0.39.0` snapshot to `v0.40.0`, the only change under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` was that lock's return
+  to `herdr-checkout`.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`; core 0.40.0
+  keeps the Pi 1.3.0 SDK set.
+- **Not a remote-pair certification.** Core 0.40.0's remote pair (#107) is carried in the
+  acquired runtime's bytes, but this snapshot measures no remote delivery, no SSH and no second
+  host through Herdr. The one real exchange remains the core section's L4 trial.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.39.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.40.0 and `repair` 0.12.8-repair.1, 621 files, published
+  2026-10-20T01:49:33Z. The downloaded registry tarball is byte-equal to the preserved accepted
+  core candidate (SHA256 `4a6906ac38ff5024b9e07f7a092cc54a7686696082893293dfa653036f87fa55`,
+  11292707 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge`. No model turn.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.39.0 runtime was seeded from its own committed lock (`ba46dec`); the swap to
+  0.40.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.39.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.39.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-dep-versions`, `check-install-surface` and `check-gate-manifests` (1034 committed
+  mutants across 79 lanes validated, none executed). `check-herdr-plugin-build` and
+  `check-herdr-sandbox` were not run locally because they run the operator's own herdr; they
+  ride the pushed SHA's FULL floor in CI.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
 ## 0.40.0 - 2026-10-20
 
 The bridge is crossed and the questions are carried forward. A person laid a bridge

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi or Claude Code siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.
 

package/DELIVERY.md

@@ -59,6 +59,22 @@ ringing any doorbell, its filenames are ISO stamps so a drain is a global FIFO,
 is an honest `mailbox-undeliverable` refusal, and its receipt is that FILE. A mailbox enqueue is a
 durable file receipt; a control-socket queue is process memory.
 
+### Candidate lifecycle commands are not delivery boundaries (#147)
+
+The current checkout's Pi control server also accepts the internal `retire` RPC, so a Pi
+started from that checkout can expose it before a release is cut. It requires matching
+record/native identity, a TUI, idle state and no pending work. Its `shutdown-requested` ACK
+is not socket closure, process exit, flush or model silence. This command is not itself a public
+MCP/contact verb and is not part of the four send boundaries above; the candidate public
+`entwurf_retire_call` reaches a Pi target through it. A Pi whose process started before its
+checkout carried this command does not know it, and its generic error answer is classified as
+`unknown`/`malformed-response`, never as a safe refusal or a reason to replay. The candidate
+CC pidfd helper observes one fd-pinned process, not a conversation, descendants or flush;
+unknown never grants safe replay. Package/source presence, compiled consumer checks and a
+real native lifecycle remain separate evidence axes; the one dated native lifecycle measurement
+is [BASELINE's 2026-10-22 n=1 round trip](./BASELINE.md#147-native-round-trip-2026-10-22-n1). Historical delivery receipts below do
+not certify these candidate components.
+
 ## Levels (D0–D8)
 
 These are independent of VERIFY's `L0–L5` evidence levels and BASELINE's question
@@ -109,7 +125,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
 | **pi Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. A pi session calls the verbs through Pi's built-in MCP running the compiled `entwurf-bridge` (#125); the receive rail is unchanged. |
-| **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
+| **Claude Code interactive `>=2.1.306`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. `>=2.1.306` is the current declared floor; that historical B2 receipt does not certify #147 resume/retire lifecycle on this floor. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |
 | **Codex embedded TUI** | deferred | D0 partial | At the 2026-09-08 Codex 0.153.4 measurement, standalone mode had no `watchPaths`/`FileChanged`/`asyncRewake` analogue or supported idle receive route. This is dated vendor evidence, not a claim that the current candidate lacks records or fresh. |
@@ -128,7 +144,7 @@ Re-audit backend versions before turning probe evidence into a shipped adapter.
 
 ### Claude Code: durable body, edge-triggered wake
 
-Claude's hook contract is exec-only at `>=2.1.217`. `SessionStart` arms a per-session
+Claude's hook contract is exec-only at `>=2.1.306`. `SessionStart` arms a per-session
 watch path; the sender writes durable `*.msg` bodies before poking the signal;
 `FileChanged` emits a doorbell and `asyncRewake` wakes the idle session. The receiver
 then calls `entwurf_inbox_read`, which drains all unread bodies and archives them as