@junghanacs/entwurf 0.41.0 → 0.41.1

package/CHANGELOG.md

@@ -4,6 +4,247 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.41.1 — 2026-10-23
+
+**Unpublished candidate; release acceptance is not complete.** The actual operator
+transition and Native aggregate below have been measured. Final prepared-SHA CI and
+the requested manual BODY, the exact carrier-bearing artifact, main promotion, tags
+and publication remain separate gates. Main still carries the published 0.41.0 Herdr
+lock: promoting the checkout lock can change what main-tracking installations acquire.
+A validation artifact or an earlier checkpoint's green run is not final acceptance.
+
+### Pi 1.4.0 reference shell
+
+- Move the coherent nine-member production SDK set from exact 1.3.0 to exact 1.4.0,
+  keeping Entwurf's owned app/TUI composition and deterministic carrier emission.
+  The SDK owns execution, storage, queues, compaction and recovery; this adds no second
+  engine, supervisor, automatic retry policy or credential surface. The ordinary Pi
+  adapter's supported range becomes `>=1.4.0 <1.5`.
+- Show sleeping tasks in the background-task tally, their local wake time in the task
+  panel, and the SDK's blocked reason verbatim. Keep cancellation distinct from retry;
+  no new retry command or UI is added.
+- Adapt the ACP vendor-rejection test to pi-ai 1.4's bounded HTTP-status matching:
+  digits inside opaque request/tool ids no longer classify as transient. The raw
+  `Internal error` control remains transient. The production non-replay verdict and
+  raw diagnostic preservation are unchanged.
+- Add SDK 1.3 public-API-generated SQL fixtures and independent SQLite conformance
+  tests for the SDK 1.4 schema transition, row/index preservation, constraints,
+  reopening and future-version refusal. These are SDK conformance, not a local
+  mutation claim over the upstream engine. Keep fixture data and its generator out
+  of installed packages, with npm packlist and tarball-floor checks.
+- Separate this unpublished candidate's checkout instructions from public npm
+  0.41.0 / SDK 1.3 instructions. The Herdr lock uses the closed `herdr-checkout`
+  verification carrier; it invents no unpublished npm integrity. No new Herdr
+  snapshot or registry publication is implied.
+- Keep the Codex LIVE fixture callback-only on its outbound Pi leg. Asking for an
+  extra ACK created a fourth real tool call while the audit required three. The
+  exact-three, nonce and terminal-turn assertions remain unchanged; only the two
+  matching task strings changed, not production routing or retry behavior.
+- Trim historical platform details, dated labels and duplicated lifecycle prose
+  from the README while retaining operator consent, unknown-outcome handling,
+  platform limits and the published-versus-candidate install distinction.
+
+### Upgrade boundary
+
+Opening each existing durable session with SDK 1.4 migrates its SQLite storage to
+schema 2. SDK 1.3 / Entwurf 0.41.0 refuses that session. Reinstalling the older package
+is not data rollback: restoring a pre-upgrade backup reopens the old data, but omits
+work done after that backup. Database restoration does not undo external messages,
+tool/file/network effects, meta records or mailbox read receipts. Preserve the newer
+set and inspect unknown outcomes before considering a restore or resend.
+Even a refused SDK 1.4 open can change the file header
+and sidecars while preserving logical rows (measured on a future-schema copy). Back up the complete target session
+file set before its first new-SDK open.
+
+Close the old owner normally and prove the process has exited before cutover. A
+stale lock is not proof: a bounded, SQLite-free fixture reproduced a stalled but live
+owner losing its lock. This lock behavior already existed in 0.41.0. Use the resume
+picker to select the intended session rather than guessing with `--continue`.
+
+SDK 1.4 counts a task SDK 1.3 left running as an interrupted run at its first open;
+SDK 1.4's own normal close does not add a restart. Repeated interruptions can park a
+task at the restart limit. Inspect outcomes before any resend; cancellation is not
+retry, and recovery of an actual parked model generation remains unmeasured.
+
+### Preparation and operating evidence — not final release acceptance
+
+Implementation checkpoint `3ed079b` follows independent source/proof reviews. Its
+earlier working candidate passed the deterministic FULL floor in 885 seconds with
+source/index unchanged, carrier 45 tests, storage conformance 11 tests, and ACP
+vendor rejection 14 tests. The final pre-commit vocabulary sweep then changed one
+harness-table SDK literal into a reference to the pin authority, independently read
+and checked. These are implementation-era observations, not this prepared version's
+FULL, native LIVE, installed artifact, operating-session migration or exact-SHA CI.
+
+Private sandbox observations separately cover old-package refusal, backup restoration
+and loss of later marker work, SDK task replay/parking, candidate shell open/close,
+SDK 1.3-born fixture identity carried into the SDK 1.4 shell, and in-process open
+failure releasing the session lock. Parked non-generation Hold tasks did not block
+root input; conversation abort cancelled only the non-background Hold. None proves
+real model-generation continuity or an operating citizen's actual upgrade.
+
+Kill-power re-measured at this shipped SHA: none (all 1178 committed claims not
+re-proved, #144).
+
+That required line records the source's preparation-time measurement state, not a
+prediction of later CI. GLG separately requested manual BODY evidence. The earlier
+validation SHA `ff86c88bd58ba776e15ef48e1e4be566971a3e9a` has a four-job green push run
+[39790950791](https://github.com/junghan0611/entwurf/actions/runs/39790950791) and a
+separate `workflow_dispatch qualify=true` run
+[39792701159](https://github.com/junghan0611/entwurf/actions/runs/39792701159): 85 lanes,
+1178 unique claims KILLED, survived/error/skipped 0. Those are that SHA's receipts,
+not this later prepared SHA's. Its requested exact-SHA CI/BODY results must be recorded
+separately in [#148's live evidence thread](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6348113761);
+no future result is invented here and the standing release policy is unchanged.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-dep-versions"]` 4/4 receipt 48d085e06816.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-pack-pin-matcher"]` 2/2 receipt 593dd0401502.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-pi-durable-carrier"]` 35/35 receipt 258f783406a7.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head ff86c88bd58b surface
+7c75301f53a9 -- `["bash","run.sh","check-release-gate-outcomes"]` 21/21 receipt 251b71584442.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head ff86c88bd58b surface
+7c75301f53a9 -- `["bash","run.sh","check-mux-fresh-call"]` 150/150 receipt 56c3558f9a15.
+
+Both ff86c88 PARTIAL receipts were taken with the Codex fixture correction still
+uncommitted on that head, on the recorded working surface.
+
+The versioned working candidate's earlier FULL completed in 890 seconds, exit 0,
+with source/index unchanged (log SHA256 `757115f291c05f397631f6e8de48a2b77fdfde973d5219edf70e63658c3b8e88`).
+It predates later checkpoint metadata and is not a final committed-SHA CI result.
+
+**Actual operator transition:** after the human closed the original owners and their
+exit was proven with the scheme-aware owner classifier, the complete session file
+set was consistently backed up without opening SQLite. The exact Linux validation
+tarball (`92e5b2722ab8063d2bc50936db358a36a02a5e92e36babc3e1fbf98b399c2f44`)
+was accepted unchanged in a container, separately exercised through an isolated pnpm
+global old-to-new takeover, then installed as the operator's 0.41.1/SDK 1.4 runtime.
+User-scope extension loading and doctors passed. The coordinator resumed the actual
+old conversation: garden/native/createdAt/cwd stayed unchanged, a new owner attached,
+a real model turn recalled the pre-close agreement and used tools, and four
+send/read/reply/read receipts closed a round trip with an existing Claude Code sibling.
+The human-reopened Pi reviewer also confirmed its identity, model, tools and recall.
+No separate live DB query or universal transcript/parked-generation recovery claim is
+made. This addon-less Linux validation tarball is not the carrier-bearing release file.
+
+**Native aggregate:** the first run at `ff86c88` was MUST 23/1/0 and BEHAVIOR 1/0/0:
+the extra requested ACK was a fourth distinct call, not parser duplication. Its raw
+failure is preserved. After the scoped fixture correction, an affected fresh Codex
+run passed 66 assertions with both terminal audits exactly 3/3. The new full run at
+`a9d05847295230ed58f53b0bfd689d9ebd6ac1da` then passed **MUST 24/0/0,
+BEHAVIOR 1/0/0**, including the deterministic FULL; source/index stayed unchanged.
+The operator still used the **ff86c88 validation install**, not an installed a9d0584
+artifact. Its runtime closure (bridge dist, pi-durable carrier, bootstrap and resolver)
+was byte-identical to the checkout before and after the run; README and LIVE fixture
+bytes differ. This is checkout-gate evidence with that installed runtime, not a claim
+that the complete a9d0584 package was installed or accepted.
+Scratch `/tmp/entwurf-release-gate-0.41.1-r2.cl0DDR`, log `release-gate.log`, SHA256
+`020f489bf6fe024447bfc26a12f3499e5b80e844b0dcadf1e474e6adc8b4ae05`.
+P9 was a read-only census: root 4.9 GiB and home 6.9 GiB free, with the existing
+Emacs infrastructure identified rather than killed; current receipts and scratch
+were preserved. Only the explicitly owned test app-server was normally stopped.
+
+The final prepared-SHA push CI/manual BODY and Win32-bearing artifact acceptance
+are still pending. The validation tarball has no Win32 addon; it cannot stand for
+M3w or final macOS/Windows acceptance. No tag, GitHub release, npm publication,
+Herdr re-pin or laptop rollout has occurred. Earlier 0.41.0 receipts below remain
+historical.
+
+## v2026.10.22-herdr.0.41.0 — Herdr Entwurf plugin 0.41.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.41.0 and its
+`v0.41.0` tag remain unchanged. Core 0.41.0 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-22).** The `## 0.41.0` section below and the body of the
+[v0.41.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.41.0) are
+prepare-time and make-time text: their npm wording (the Herdr lock's "unpublished candidate",
+"npm publication each need their own approval") predates the publication. The publish is the later registry fact recorded in this section (`latest` 0.41.0,
+published 2026-10-22T04:37:02.853Z, registry bytes equal to the accepted candidate). Neither the
+published tarball's CHANGELOG nor the core release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.41.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.41.0
+  rode to production npm source `@junghanacs/entwurf@0.41.0` with the registry's measured
+  sha512 (`sha512-hSf6St0u…fBlvA==`). The plugin manifest moves 0.40.0 → 0.41.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From the
+  `v2026.10.20-herdr.0.40.0` snapshot to `v0.41.0`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's resume/retire wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **What the acquired runtime now carries.** Core 0.41.0's lifecycle verbs ride in the runtime's
+  bytes: its installed bridge lists nine tools, `entwurf_retire_call` among them. Inside Herdr,
+  `entwurf_resume_call` still refuses as `herdr-resume-unsupported`. This snapshot measures no
+  retirement or resume through Herdr.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`; core 0.41.0
+  keeps the Pi 1.3.0 SDK set.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.40.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+- **README.** The first-user-path receipt description no longer says the installed
+  `check-bridge` lists an eight-verb set; it names the verb set the installed bridge declares,
+  nine since 0.41.0.
+- **Raw-install smoke scaffolding follows the Claude Code floor.** The first public-ref run of
+  `smoke-herdr-raw-install-live` at `cfdae0e` built its container with Claude Code 2.1.278, a
+  hand-kept pin from 2026-09-19, and the acquired 0.41.0 runtime refused to wire Claude below its
+  supported floor `>= 2.1.306` — the product's intended refusal, not a runtime defect. The smoke now
+  derives its exact Claude Code version from `package.json` `entwurf.claudeCodeFloor` instead of
+  retyping it. The product floor, the Pi, Herdr and Node pins and the smoke's end-state oracle are
+  unchanged.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.41.0 and `repair` 0.12.8-repair.1, 642 files, published
+  2026-10-22T04:37:02.853Z. The downloaded registry tarball is byte-equal to the preserved
+  accepted core candidate (SHA256 `2bd03ba900324a7c0882c2738c29593df0a1e4829fb3ae18d22be62186cf67ad`,
+  11399545 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge` with nine tools.
+  No model turn. The accepted run stripped every `PI_`, `ENTWURF_`, `CLAUDE`, `CODEX_HOME`,
+  `TMUX` and `HERDR_` carrier and ran on the branch worktree, whose only checkout input (the
+  bridge resolver script) is unchanged; an earlier run from the clean tag HEAD left `TMUX` and
+  non-identity `PI_*` variables set and is kept only as a preliminary record.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.40.0 runtime was seeded from its own committed lock (`036e268`); the swap to
+  0.41.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.40.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.40.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-herdr-plugin-build` (21, its real-binary cell on herdr 0.9.5), `check-herdr-sandbox`
+  (12, a private herdr 0.9.5 server), `check-dep-versions`, `check-install-surface` and
+  `check-gate-manifests` (1173 committed mutants across 85 lanes validated, none executed).
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
 ## 0.41.0 - 2026-10-22
 
 A sibling's garden id is its birthday, and this cut lets it rest and come back under it. A

package/README.md

@@ -27,7 +27,7 @@ Git branches, worktrees, file isolation and internal delegation remain their con
 |---|---|---|---|
 | **Open** a new sibling | `entwurf_fresh_call` | Herdr: a new unfocused tab in the caller's workspace. tmux: a new window in the caller's session, or an existing session named by `placement.tmuxSession`; without an explicit tmux placement, a Codex caller opens beside its own TUI pane | Herdr: pi, Claude Code. tmux: pi, pi-durable, Claude Code, Copilot, OMP, Codex |
 | **Reopen** a dormant sibling | `entwurf_resume_call` | A visible tmux window under the same garden id, with its record selecting the native session (Pi: identity-checked recorded transcript supplies launch metadata; Claude Code: `claude --resume <session id>` at the record cwd); the verb submits no prompt | pi, Claude Code |
-| **Retire** one sibling the human operator explicitly requested (new in 0.41.0) | `entwurf_retire_call` | One guarded attempt on that target: a Pi shutdown request or Claude Code fd-pinned process termination. Refused/unknown outcomes remain possible; the record stays for guarded same-id return. Not a grant, a roster cleanup or an automatic retry | pi, Claude Code |
+| **Retire** one sibling the human operator explicitly requested | `entwurf_retire_call` | One guarded attempt on that target: a Pi shutdown request or Claude Code fd-pinned process termination. Refused/unknown outcomes remain possible; the record stays for guarded same-id return. Not a grant, a roster cleanup or an automatic retry | pi, Claude Code |
 | **Message** an existing sibling | `entwurf_v2` | Its own rail: control socket, self-fetch mailbox or native push; delivery starts no process | pi, pi-durable, Claude Code, Copilot, OMP, Antigravity, Codex |
 
 Antigravity is message-only: an existing conversation registers itself, and Entwurf never
@@ -54,15 +54,26 @@ ownership of the harness.
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.3.0 <1.4`; Claude Code supported floor `>=2.1.306` is required for its
+range `>=1.4.0 <1.5`; Claude Code supported floor `>=2.1.306` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
+**Release state.** The Pi range above belongs to this source candidate, which moves the Pi SDK
+set to 1.4.0 and is **not published to npm yet**. The newest published package, `0.41.0`,
+ships the Pi 1.3.0 SDK set and requires Pi 1.3.x; the README inside that tarball and the Herdr
+snapshot `v2026.10.22-herdr.0.41.0` are its contract. Pick the path that matches the Pi you run.
+
+The published package (Pi 1.3.x):
+
 ```bash
-npm install -g @junghanacs/entwurf
+npm install -g @junghanacs/entwurf@0.41.0
 entwurf setup /path/to/your-project
 entwurf check-bridge
 ```
 
+This candidate (Pi 1.4): a source checkout of this commit, set up with `./run.sh setup` as
+[Clean-host setup](./docs/setup-clean-host.md) describes. It has no npm install command until it
+is released.
+
 `setup` composes each harness it finds and reports PASS / SKIP / FAIL. An absent
 harness is an explicit SKIP; a detected incomplete/below-floor integration is a
 named FAIL with nonzero exit, not a false green. `check-bridge` proves the installed
@@ -76,27 +87,18 @@ consent: [the operator steps](./docs/setup-clean-host.md#three-operator-decision
 Plain MCP registration alone does not make a garden citizen.
 
 **Platform bounds:** Linux is the certified harness-rail axis. macOS Entwurf-only
-installation is **CERTIFIED (CI)**, weaker than a physical-host doctor; its native
-harness rails, ACP and mux remain **NOT CERTIFIED — pending physical host**.
-Detected harness wiring on Darwin can therefore be written while setup stays
-non-green. WSL2: a CI runner (experimental) measured the Entwurf-only install and a
-zero-token Pi citizen; general, physical-machine or harness-parity WSL2 support is **not
-declared**, and delivery, other harnesses and physical machines are unmeasured. Native
-Windows has an **experimental first preview**, a CI-built x64 addon that ships in core
-0.39.0 (published to npm); 0.38.1 and earlier carry no Windows addon. On a GitHub Actions
-`windows-2025` x64 runner with Node 24.18.1 and Pi 1.3.0, a CI-built artifact was installed,
-wired with `pi install`, birthed two Pi citizens and
-delivered one garden-id `entwurf_v2` message between them, with an offline scripted model
-and no vendor turn. Every other native-Windows surface (other harnesses, `setup` and the
-`.sh` bins, fresh/resume, mux/Herdr/ACP, physical machines) is **not declared**; the
-measured scope and its named gaps are in [BASELINE](./BASELINE.md#release-host-baseline).
-The package has no npm `os` restriction; that is not certification of every platform's
-harness rails.
+installation is **CERTIFIED (CI)**; native harness rails, ACP and mux remain
+**NOT CERTIFIED — pending physical host**, so detected wiring can still leave setup non-green.
+WSL2 and native Windows have **experimental CI previews**, not general or physical-host support.
+The native-Windows preview covers Pi citizens and offline scripted delivery, not vendor turns,
+other harnesses, shell entrypoints, fresh/resume, mux, Herdr or ACP.
+[BASELINE](./BASELINE.md#release-host-baseline) owns the version-specific receipts and gaps;
+an npm package without an `os` restriction is not an all-platform certification.
 
 ### Native durable (pi-durable)
 
-**The package supplies Entwurf's owned app/TUI carrier and nine exact Pi 1.3.0 SDK
-members.** No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
+**This candidate's package supplies Entwurf's owned app/TUI carrier and nine exact Pi 1.4.0 SDK
+members** (unpublished; the published 0.41.0 supplies the 1.3.0 set). No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
 The launch verifies carrier integrity and every reachable SDK edge's name/version;
 incomplete, drifted or mixed supply refuses by name.
 
@@ -106,7 +108,7 @@ entwurf pi-durable --continue
 entwurf pi-durable --resume
 ```
 
-`--continue` opens this directory's newest durable session. `--resume` lists its
+`--continue` opens this directory's latest-created durable session. `--resume` lists its
 sessions, most recently written first, by creation time, garden id and last write, and
 reopens the one you choose as it was saved; a cancelled choice opens nothing.
 
@@ -117,20 +119,23 @@ SQLite, transcripts and recovery remain the upstream SDK's:
 
 Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
 imports, then installs its default native Extension after the contact.
-`--native-module-dir <absolute directory>` (#134) loads the top-level `*.extension.mjs` files of that
-one named directory in byte-wise order instead, and the durable TUI keeps a live
-background-task badge on screen at any terminal size. No automatic module discovery or
+`--native-module-dir <absolute directory>` loads that named directory's top-level
+`*.extension.mjs` files in byte-wise order instead. No automatic module discovery or
 classic Pi API shim; guards are not a sandbox or rollback.
-Ordinary Pi's known `peerDependencies` warning reflects the separate native SDK supply.
 [Native setup](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
 owns flags, refusals and the extension contract.
 
 ### Herdr workbench
 
 ```bash
-herdr plugin install junghan0611/entwurf/plugins/herdr --yes
+herdr plugin install junghan0611/entwurf/plugins/herdr --ref "$CANDIDATE_REF" --yes
 ```
 
+Set `CANDIDATE_REF` explicitly to a published branch or tag that carries the runtime you mean;
+these examples do not select a candidate from Herdr's default ref. A validation branch is not a
+release acceptance. The [Herdr guide](./plugins/herdr/README.md#from-a-raw-linux-box-in-nine-steps)
+says which runtime each ref installs.
+
 This separate path activates Herdr-integrated **pi and Claude Code** with an
 independently locked runtime and an observation pane; it puts no Entwurf bins on PATH.
 An Entwurf release does not automatically re-pin that runtime.
@@ -169,7 +174,7 @@ In that **harness session**, ask the agent to:
 ```
 
 These are tools, not shell subcommands. Pi calls
-`mcp__entwurf_bridge__<verb>` through Pi's built-in MCP. The 0.41.0 bridge exposes **nine**
+`mcp__entwurf_bridge__<verb>` through Pi's built-in MCP. The bridge exposes **nine**
 verbs; a pi citizen has **seven active + two hidden** (`entwurf_inbox_read` and
 `entwurf_register_native`), since it has no mailbox and its own extension births it.
 Those counts describe the source; a running host offers what its already-loaded bridge
@@ -199,9 +204,15 @@ pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
 | Message, reply or hand off to an existing garden id | `entwurf_v2 {target, intent:"fire-and-forget", message}` | Receiver acceptance boundary, mailbox enqueue or native injection; not completion |
 | Open a new visible sibling | `entwurf_fresh_call {backend, model, task, cwd?}` | Launch receipt only; the sibling's nonce callback envelope supplies its new garden id |
 | Reopen a dormant pi or Claude Code citizen under its own id | `entwurf_resume_call {target}` | Separate LAUNCH and OBSERVATION receipts (pi: same-id socket; Claude Code: a new live receiver marker in the opened pane, bound to the record); the verb submits no prompt |
-| Attempt retirement of one explicitly requested Pi or Claude Code target (new in 0.41.0) | `entwurf_retire_call {target}` | Separate action, append-only record and lock-release results. Pi ACK is request-only; CC exit is that fd-pinned process only |
+| Attempt retirement of one explicitly requested Pi or Claude Code target | `entwurf_retire_call {target}` | Separate action, append-only record and lock-release results. Pi ACK is request-only; CC exit is that fd-pinned process only |
 
-**Retirement is never autonomous.** Invoke it only for a target/action the human operator explicitly requested; development, coordinator status and caller identity are not standing permission. Where a host provides or is configured with an approval step, that step applies as well; Pi and pi-durable 1.3.0 have no built-in approval prompt by default. The configured Claude ACP child is likewise [set to run without per-call permission prompts](./docs/acp-backend-rail.md#configured-claude-acp-permissions); ACP retirement remains unmeasured. Tool annotations and the caller's identity are hints and attribution, not permission. No roster expansion, timer or automatic retry of an unknown/cancelled/lost result. The retirement path records requested/outcome events under a target-gid sidecar; absence is unknown, not proof of no retirement. Source, compiled fixture, Native/LIVE, rollout and release acceptance remain separate: one dated test-owned [Native round trip per backend](./BASELINE.md#147-native-round-trip-2026-10-22-n1) is recorded, which is neither a release gate nor a rollout claim.
+**Retirement is never autonomous.** It requires the human operator's explicit target/action;
+a role, caller identity or tool annotation grants no permission. Host approval applies where
+provided or configured. No roster expansion, timer or retry of an unknown/cancelled/lost result;
+an absent event is unknown, not proof that no action occurred.
+[DELIVERY](./DELIVERY.md#candidate-lifecycle-commands-are-not-delivery-boundaries-147)
+owns the lifecycle boundaries; [BASELINE](./BASELINE.md#147-native-round-trip-2026-10-22-n1)
+keeps dated native evidence separate from release and rollout acceptance.
 
 **Delivery starts no process.** A live pi receives over its record-addressed control
 address (a Unix socket; on the experimental native-Windows Pi preview, a named pipe);
@@ -220,32 +231,18 @@ is a live rail fact, not merely a consequence of trusted identity.
 
 **One declared remote pair (opt-in, #107).** The operator places an `entwurf-remote-pair.json` on each of two hosts. Then `entwurf_v2` to the declared remote garden id runs the other host's `entwurf remote-pair-receive` once over the operator's own SSH, and that host checks the pair and dispatches locally. The trust is the same operator's SSH account. It makes one attempt with no retry, and it uses no relay or listener. [DELIVERY](./DELIVERY.md#remote-pair-107-one-declared-pair-across-two-hosts) owns the contract; [setup](./docs/setup-clean-host.md#2c-optional-remote-pair-between-two-hosts-107) covers the operator steps.
 
-**Mux launches; it never delivers.** Inside Herdr, fresh opens a new unfocused tab
-in the caller's workspace, pi/Claude Code only, with no tmux fallback. Outside,
-it opens pi/pi-durable/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux
-server. pi-durable runs the installed carrier on its exact SDK set described above and
-refuses by name before any window when that verdict is not green; Herdr does not fresh-open it. The model is required; optional `cwd` is a literal
-absolute directory, omitted or empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
-tmux session (not permitted inside Herdr), never a new session or a cwd lookup.
-Omitted tmux placement follows the caller: Codex beside its own TUI pane matched
-by thread-id, everyone else in their own session. Missing/ambiguous context refuses.
-A launch receipt is neither the callback address nor proof of task processing.
-Resume is pi or Claude Code, tmux-only, same id, with the record as the sole address authority.
-For Pi, the record selects the absolute transcript and its native id must match; the transcript's
-session-header cwd and first `model_change` provider/model feed the launch resolver, without a
-record/host cwd fallback. Claude Code uses `claude --resume <record session id>` at the record cwd,
-without restoring model or permission flags;
-a live, unprovably dormant, unbound or other-backend target refuses, and an unobserved window
-stays visible without retry. Claude Code's [V3 arm binding](./docs/adding-a-harness.md#arm-binding-within-v3)
-is a record–receiver witness, not a new identity or an occupancy/permission token.
-Claude Code dormancy is read only from attaches the Entwurf hook committed: a process that
-holds the session without one (hooks disabled, a lock timeout or store failure at its start)
-is invisible to that check.
-Claude Code same-id resume is new in 0.41.0. One dated test-owned
-[Native round trip](./BASELINE.md#147-native-round-trip-2026-10-22-n1) was measured; its
-release acceptance remains separate from the shipped Pi resume history.
-Exact boundaries: [tmux launch](https://github.com/junghan0611/entwurf/blob/main/docs/mux-launch-rail.md)
-and [Herdr launch](https://github.com/junghan0611/entwurf/blob/main/docs/herdr-launch-rail.md).
+**Mux launches; it never delivers.** Fresh uses the caller's Herdr workspace or tmux server,
+within the harness limits in the table above. The model is required; optional `cwd` is a literal
+absolute directory (omitted or empty means caller cwd). `placement.tmuxSession` names an
+existing tmux session, never a new session or a cwd lookup, and is refused inside Herdr.
+Without that override, a Codex caller opens beside its thread-id-matched TUI pane;
+other callers use their own session. Missing or ambiguous context refuses without fallback.
+Resume is tmux-only for pi and Claude Code, selected by the record, with no submitted prompt.
+Claude Code dormancy covers only attaches its hook committed, not every possible session holder;
+[V3 arm binding](./docs/adding-a-harness.md#arm-binding-within-v3) is not occupancy or permission.
+An unobserved window stays visible without retry. Address liveness alone is not conversation recall.
+Exact argv, identity checks and limits belong to [tmux launch](./docs/mux-launch-rail.md)
+and [Herdr launch](./docs/herdr-launch-rail.md).
 
 ## Concepts
 

package/VERIFY.md

@@ -374,7 +374,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.3.0 <1.4`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.4.0 <1.5`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -24,7 +24,7 @@ takes/helpers/tests are maintainer tooling and are deliberately excluded from th
 
 - Node at the `package.json#engines.node` floor; the checkout's pinned dependencies and
   current compiled bridge. After a source/bootstrap change, build with `pnpm run build-bridge`.
-- Pi at the checkout's supported floor (**current floor 1.3.0**); `entwurf` on PATH must be
+- Pi at the checkout's supported floor (**current floor 1.4.0**); `entwurf` on PATH must be
   the intended source stable-bin. Source evidence is not registry-package acceptance.
 - `herdr` on PATH at exactly `scripts/fixtures/herdr-supply.json#version`; `asciinema` v3.
 - Herdr's existing Pi integration at

package/docs/acp-backend-rail.md

@@ -135,7 +135,7 @@ Dep bump ledger. 0.38.0 (#145) changes only the pi SDK set; the ACP rows are unc
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | SDK exact `1.3.0`, host `>=1.3.0 <1.4` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. The published 0.36.0 through 0.37.1 shipped the 1.2.0 set (#141); 0.38.0 (#145) is the first to carry 1.3.0. Historical: the published 0.33.0 through 0.35.1 ship SDK exact 1.1.0, 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
+| pi runtime | SDK exact `1.4.0`, host `>=1.4.0 <1.5` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. The published 0.36.0 through 0.37.1 shipped the 1.2.0 set (#141); 0.38.0 (#145) is the first to carry 1.3.0. Historical: the published 0.33.0 through 0.35.1 ship SDK exact 1.1.0, 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.8.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.90.0` | **exact**, bundled | shipped since 0.36.1; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.296` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |

package/docs/setup-clean-host.md

@@ -23,14 +23,18 @@ evidence split, and its three states must not collapse into "macOS is supported"
 
 ## Requirements
 
+This table is this source candidate's, which moves the Pi SDK set to 1.4.0 and is **not published
+to npm yet**. The newest published package, `@junghanacs/entwurf@0.41.0`, ships the Pi 1.3.0 SDK
+set and requires Pi 1.3.x; the setup guide inside that tarball is its contract.
+
 | Component | Requirement | Needed for |
 |---|---|---|
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.3.0 <1.4` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
-| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.3.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
+| pi | optional-by-presence, `>=1.4.0 <1.5` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.4.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.306`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -79,11 +83,15 @@ node --version
 npm --version
 ```
 
+The two npm forms below install the **published** package, `0.41.0` (Pi 1.3.x, the Pi 1.3.0 SDK
+set), not this candidate. This candidate (Pi 1.4) installs only from a source checkout of its
+commit, further down this section; it has no npm install command until it is released.
+
 Global install is simplest when native harnesses should find stable bins from every
 working directory:
 
 ```bash
-npm install -g @junghanacs/entwurf
+npm install -g @junghanacs/entwurf@0.41.0
 entwurf --help
 entwurf setup /path/to/your-project
 entwurf check-bridge
@@ -94,7 +102,7 @@ A project-local installation is also supported:
 ```bash
 mkdir -p ~/entwurf-smoke && cd ~/entwurf-smoke
 npm init -y
-npm install --save-dev @junghanacs/entwurf
+npm install --save-dev @junghanacs/entwurf@0.41.0
 npx entwurf setup .
 npx entwurf check-bridge
 ```
@@ -119,9 +127,15 @@ with a nonzero setup result):
 ```bash
 git clone https://github.com/junghan0611/entwurf ~/repos/gh/entwurf
 cd ~/repos/gh/entwurf
+git checkout "$CANDIDATE_REF"   # set it first to the commit you mean to run; a bare clone gives the default branch
 ./run.sh setup /path/to/consumer-project
 ```
 
+Set `CANDIDATE_REF` explicitly to a published branch or tag that carries the commit you mean;
+a bare clone selects the default branch, not a promised candidate. A validation branch is not a
+release acceptance. A checkout that already holds the intended commit skips the clone and the
+`git checkout`.
+
 This owns `~/.local/bin/entwurf` as a symlink to that checkout's `run.sh` and fails if the
 link is foreign, outside PATH, or shadowed by another command. It detects and wires
 pi/Claude/agy/Copilot/OMP/Codex by presence and prints a computed per-component
@@ -207,18 +221,21 @@ physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
 on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 `setup` names the pi row FAIL with the §1 Darwin wording.
 
-Install the exact release floor, then wire the project:
+Install this candidate's exact Pi floor, then wire the project from the candidate's source
+checkout (§1; `entwurf` is the link `./run.sh setup` made to it). The published 0.41.0 instead
+takes the Pi 1.3.x its own setup guide names and the global package root,
+`$(npm root -g)/@junghanacs/entwurf`, in place of the checkout:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.3.0
+npm install -g @earendil-works/pi-coding-agent@1.4.0
 pi --version
 
 cd ~/entwurf-smoke
 entwurf install .
-pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
+pi -e ~/repos/gh/entwurf --list-models entwurf
 ```
 
-The supported range is `>=1.3.0 <1.4`. It is a hard minimum: installing this
+The supported range is `>=1.4.0 <1.5`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -322,7 +339,7 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
 What the Entwurf package supplies:
 
 1. **The pi SDK set** — `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
-   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.3.0`, plus
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.4.0`, plus
    `proper-lockfile`, as Entwurf's own production dependencies (declared once in
    `pi/pi-durable/overlay/upstream-pin.json` `sdk`). Model data rides the published
    `pi-ai`; there is no catalog copy.
@@ -335,7 +352,7 @@ What the Entwurf package supplies:
    (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
    own `dist/` as installed — never through a source checkout.
 
-The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.3.0/packages/durable/README.md)
+The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.4.0/packages/durable/README.md)
 and the [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
 (last published at v1.1.0) describe what the carrier is. Running the bare upstream app does not attach Entwurf's
 garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
@@ -420,7 +437,7 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
   not a claim that every load path is harmless.
 
-The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.3.0 <1.4`): a host Pi is
+The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.4.0 <1.5`): a host Pi is
 not needed to run pi-durable, and a host inside the range need not be the same copy as the
 carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
 in place rather than copying credentials or migrating ordinary Pi transcripts. Native
@@ -431,6 +448,29 @@ to the app's own model resolution; the checkout contact/send/receive gates run t
 with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate release
 proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
+### Moving durable sessions from the Pi 1.3 SDK to 1.4
+
+This candidate is unpublished, and moving a live host onto it is a separate operator decision. When
+you do:
+
+1. **Confirm the old owner is gone.** Close the 0.41 (SDK 1.3) durable session normally and check
+   that its process has exited. A stale session lock alone is not proof.
+2. **Back up first.** Before the first 1.4 open, copy the target session directory whole
+   (`session.sqlite` with any `-wal`/`-shm`) as one consistent set.
+3. **Choose the session by name.** Reopen with the `--resume` picker and pick the entry you mean;
+   do not use `--continue` on a host with more than one session.
+4. **Package downgrade is not data rollback.** The first 1.4 open migrates SQLite storage to
+   schema 2, which SDK 1.3 (Entwurf 0.41) refuses to open. Reinstalling the old package does not
+   undo that. Restoring the backup does, and work done after the 1.4 open is not in the backup.
+5. **Inspect parked work before retrying.** On its first open, 1.4 counts a task that SDK 1.3 left
+   running as one restart, and after repeated cut-offs it parks the task (`restart_limit`). Read
+   what the task already did before you resend anything: recovery of a parked model turn is not
+   measured, and its side effects or outcome may be unknown. The existing conversation abort is
+   cancellation, not retry; it need not affect background tasks.
+
+The measurements behind these points, and what they do not cover, are in the
+[#148 checkpoint](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6339048361).
+
 ### Maintainer: re-emitting the carrier
 
 Only a maintainer changing the pi-durable app runs `scripts/emit-pi-durable-carrier.ts`. Its
@@ -647,7 +687,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.3.0 <1.4`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.4.0 <1.5`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.41.0",
+	"version": "0.41.1",
 	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, retire on request and reopen pi or Claude Code in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
@@ -89,7 +89,8 @@
 		"CHANGELOG.md",
 		"!**/__pycache__",
 		"!**/*.pyc",
-		"!pi-extensions/**/*.test.ts"
+		"!pi-extensions/**/*.test.ts",
+		"!pi-extensions/**/fixtures/**"
 	],
 	"engines": {
 		"node": ">=24.0.0"
@@ -101,15 +102,15 @@
 		"@agentclientprotocol/claude-agent-acp": "0.90.0",
 		"@agentclientprotocol/sdk": "1.8.0",
 		"@anthropic-ai/sdk": "0.100.1",
-		"@earendil-works/chord": "1.3.0",
-		"@earendil-works/pi-agent-core": "1.3.0",
-		"@earendil-works/pi-ai": "1.3.0",
-		"@earendil-works/pi-codemode": "1.3.0",
-		"@earendil-works/pi-coding-agent": "1.3.0",
-		"@earendil-works/pi-durable": "1.3.0",
-		"@earendil-works/pi-mcp": "1.3.0",
-		"@earendil-works/pi-telemetry": "1.3.0",
-		"@earendil-works/pi-tui": "1.3.0",
+		"@earendil-works/chord": "1.4.0",
+		"@earendil-works/pi-agent-core": "1.4.0",
+		"@earendil-works/pi-ai": "1.4.0",
+		"@earendil-works/pi-codemode": "1.4.0",
+		"@earendil-works/pi-coding-agent": "1.4.0",
+		"@earendil-works/pi-durable": "1.4.0",
+		"@earendil-works/pi-mcp": "1.4.0",
+		"@earendil-works/pi-telemetry": "1.4.0",
+		"@earendil-works/pi-tui": "1.4.0",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"proper-lockfile": "4.1.2",
 		"smol-toml": "^1.8.0",

package/pi/pi-durable/carrier/tui.js

@@ -219,6 +219,7 @@ export class TaskBadge                      {
 			...tally("aborting", (node) => node.abortRequested),
 			...tally("completing", (node) => !node.abortRequested && node.state.status === "completing"),
 			...tally("waiting", (node) => !node.abortRequested && node.state.status === "waiting"),
+			...tally("sleeping", (node) => !node.abortRequested && node.state.status === "sleeping"),
 			...tally("pending", (node) => !node.abortRequested && node.state.status === "pending"),
 		].join(", ");
 	}
@@ -621,19 +622,33 @@ class DurableTui {
 	}
 }
 
-function describeTask(node               )         {
+/** A task's line in the tasks panel: a sleeping task says when it wakes, a blocked one why it cannot run. */
+export function describeTask(node               )         {
 	const state = node.state;
 	const status =
 		state.status === "waiting"
 			? `waiting on ${state.on.join(", ")}`
 			: state.status === "completing"
 				? `completing (${state.outcome})`
-				: `${state.status} ${state.phase}`;
-	const flags = [node.background ? "background" : "", node.abortRequested ? "aborting" : ""].filter(Boolean);
+				: state.status === "sleeping"
+					? `sleeping ${state.phase} until ${localTime(state.until)}`
+					: `${state.status} ${state.phase}`;
+	const flags = [
+		node.background ? "background" : "",
+		node.abortRequested ? "aborting" : "",
+		node.blocked !== undefined ? `blocked:${node.blocked}` : "",
+	].filter(Boolean);
 	const owned = node.conversations.length > 0 ? ` owns conversation ${node.conversations.join(", ")}` : "";
 	return `${node.kind} #${node.id}: ${status}${flags.length > 0 ? ` [${flags.join(", ")}]` : ""}${owned}`;
 }
 
+/** Epoch milliseconds as local wall-clock time, `YYYY-MM-DD HH:MM:SS`. */
+function localTime(epoch        )         {
+	const at = new Date(epoch);
+	const pad = (n        ) => String(n).padStart(2, "0");
+	return `${at.getFullYear()}-${pad(at.getMonth() + 1)}-${pad(at.getDate())} ${pad(at.getHours())}:${pad(at.getMinutes())}:${pad(at.getSeconds())}`;
+}
+
 function userText(content                        )         {
 	if (typeof content === "string") return content;
 	return content

package/pi/pi-durable/overlay/upstream-pin.json

@@ -76,8 +76,8 @@
 			{
 				"name": "tui.js",
 				"source": "pi/pi-durable/src/experimental/durable/tui.ts",
-				"blob": "eb5e2ec4e98919cd3ff4f81f166eb52afe6555af",
-				"sha256": "a1b0d9d9358c5b54ac0974de84068b7792669171917ebd7b7351374ed625c9c5"
+				"blob": "405600f6ba1558bf6bf22d144afdcf3f1295c282",
+				"sha256": "d4bf4e2861bde917e1dcdea6f063bdc3e101ab500107a9c5fab0e3ce97fb2c4a"
 			},
 			{
 				"name": "harness-setup.js",
@@ -132,17 +132,17 @@
 		]
 	},
 	"sdk": {
-		"comment": "The published library set the carrier runs against, derived from the 1.3.0 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.3.0 pins). Each is an exact production dependency in package.json. Since 1.3.0 the members' own edges are exact too (upstream #10865), and the installed physical edges are still what must equal these versions.",
+		"comment": "The published library set the carrier runs against, derived from the 1.4.0 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.4.0 pins). Each is an exact production dependency in package.json. Since 1.3.0 the members' own edges are exact too (upstream #10865), and the installed physical edges are still what must equal these versions.",
 		"members": {
-			"@earendil-works/chord": "1.3.0",
-			"@earendil-works/pi-agent-core": "1.3.0",
-			"@earendil-works/pi-ai": "1.3.0",
-			"@earendil-works/pi-codemode": "1.3.0",
-			"@earendil-works/pi-coding-agent": "1.3.0",
-			"@earendil-works/pi-durable": "1.3.0",
-			"@earendil-works/pi-mcp": "1.3.0",
-			"@earendil-works/pi-telemetry": "1.3.0",
-			"@earendil-works/pi-tui": "1.3.0"
+			"@earendil-works/chord": "1.4.0",
+			"@earendil-works/pi-agent-core": "1.4.0",
+			"@earendil-works/pi-ai": "1.4.0",
+			"@earendil-works/pi-codemode": "1.4.0",
+			"@earendil-works/pi-coding-agent": "1.4.0",
+			"@earendil-works/pi-durable": "1.4.0",
+			"@earendil-works/pi-mcp": "1.4.0",
+			"@earendil-works/pi-telemetry": "1.4.0",
+			"@earendil-works/pi-tui": "1.4.0"
 		},
 		"direct": {
 			"proper-lockfile": "4.1.2"

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -239,9 +239,11 @@ export interface AcpBackendAdapter {
 
 	/** OPTIONAL capability (#127): recognise a typed vendor rejection of `session/prompt`
 	 *  whose raw text must not become pi's `errorMessage`. pi decides a whole-prompt replay
-	 *  from `errorMessage` alone, and a vendor's "Internal error" — or any digit run in the
-	 *  ids it carries — reads as transient, so a turn whose tools already ran would be resent
-	 *  from a cold session. A recognised rejection returns a fixed, authored verdict for
+	 *  from `errorMessage` alone, and a vendor's "Internal error" reads as transient
+	 *  (pi-ai's `internal.?error` term), so a turn whose tools already ran would be resent
+	 *  from a cold session. Through pi-ai 1.3 a digit run inside the ids it carries (`…8503…`)
+	 *  read as an HTTP status too; pi-ai 1.4 bounds the status terms (upstream #11057), so
+	 *  the ids no longer trigger it — the "Internal error" text alone still does. A recognised rejection returns a fixed, authored verdict for
 	 *  `errorMessage`; backend.ts keeps the raw rejection as a pi diagnostic instead.
 	 *
 	 *  ABSENT means every failure of this backend keeps the verbatim-first `errorMessage`.

package/pi-extensions/lib/acp/backend.ts

@@ -668,13 +668,15 @@ async function settleChildEnd(latch: ChildEndLatch, ms: number): Promise<void> {
  * may appear here, or a dead child would put a full cold prompt replay back on
  * the table — with the tool side effects this turn already produced.
  *
- * That pattern is a bare substring alternation (`new RegExp(terms.join("|"), "i")`
- * — NO word boundaries) and its terms enumerate the HTTP statuses "429", "500",
- * "502", "503", "504" and "524". So the settle bound is deliberately NOT interpolated: rendering
- * CHILD_END_SETTLE_MS made this line say "within 500ms", which pi read as an
- * HTTP 500 and classified as transient. Naming the window in prose keeps a later
- * change of that constant from silently re-arming the replay — do not "improve"
- * this by putting the number back; the bound belongs in the code and the gate.
+ * That pattern is a substring alternation (`new RegExp(terms.join("|"), "i")` — NO word
+ * boundaries on its word terms). Through pi-ai 1.3 its HTTP status terms ("429", "500",
+ * "502", "503", "504", "520", "524") were bare substrings too, and rendering
+ * CHILD_END_SETTLE_MS made this line say "within 500ms", which pi read as an HTTP 500 and
+ * classified as transient. pi-ai 1.4 bounds only those status terms (upstream #11057), so
+ * "500ms" no longer matches; the word terms above are still unbounded. The settle bound
+ * stays deliberately NOT interpolated: naming the window in prose keeps a later change of
+ * that constant, or of the classifier, from silently re-arming the replay — do not
+ * "improve" this by putting the number back; the bound belongs in the code and the gate.
  *
  * The three endings are kept DISTINCT on purpose (issue #72 Done-when): an
  * exit code, a signal, and "we waited and it never said" are three different
@@ -1468,8 +1470,9 @@ export function streamAcpTurn(
 		// the turn-scoped full-transcript-replay cause.
 		const hint = aborted ? undefined : actionableAcpBackendHint(full);
 		// #127: pi's retry and overflow classifiers read `errorMessage` ALONE, and a
-		// vendor's "Internal error" or any digit run in its ids/stderr reads as transient
-		// — a replay of a turn whose tools already ran. A rejection the adapter names gets
+		// vendor's "Internal error" reads as transient — a replay of a turn whose tools
+		// already ran. (Through pi-ai 1.3 a digit run in its ids/stderr did too; 1.4 bounds
+		// the status terms, upstream #11057.) A rejection the adapter names gets
 		// its fixed verdict there; every raw part rides one diagnostic, appended after any
 		// existing ones. An abort keeps the abort path.
 		const rejection = aborted ? undefined : adapter?.readPromptRejection?.(err);

package/pi-extensions/meta-bridge-pi-durable.ts

@@ -354,7 +354,7 @@ export interface PiDurableRoots {
 // ---------------------------------------------------------------------------
 // Durable surface, typed NARROWLY and locally — read at pi-durable 1.0.2 @cd32f77 (#129,
 // `harness/types.ts`; historical coordinates, not re-anchored here). The current supply is the
-// carrier emitted from Entwurf's owned source (pi/pi-durable/src, #141) against the 1.3.0 SDK set
+// carrier emitted from Entwurf's owned source (pi/pi-durable/src, #141) against the 1.4.0 SDK set
 // `pi/pi-durable/overlay/upstream-pin.json` names (origin `abe508e`). `[read 2026-10-13]` at
 // v1.2.0 one shape typed below moved: `ToolExecutionResult.content` is now `output`, beside the new
 // `structuredOutput` (`harness/types.ts`, its CHANGELOG's breaking changes). An omitted `output`

package/run.sh

@@ -4021,6 +4021,10 @@ check_pack() {
   # JS for installed entrypoints. The files array lists pi/pi-durable per FILE, so nothing admits these
   # today; this tripwire is what fails loud the day an allowlist entry would.
   local durable_source_pattern='^pi/pi-durable/(src/|tsconfig\.json$|overlay/runtime-contacts\.patch$)'
+  # #148 S1b: the goldens and generator a beside test reads (pi-extensions/lib/fixtures/) are test input,
+  # not product. `pi-extensions/` ships whole, so the `!pi-extensions/**/fixtures/**` negation is the only
+  # thing keeping them out, and this is its tripwire (same 결합 규칙 as the `.test.ts` pattern above).
+  local test_fixture_pattern='^pi-extensions/(.*/)?fixtures/'
 
   local pass=1 f pat hit
 
@@ -4047,6 +4051,13 @@ check_pack() {
     pass=0
   fi
 
+  hit=$(grep -E "$test_fixture_pattern" <<<"$file_list" || true)
+  if [ -n "$hit" ]; then
+    fail "[check-pack] a beside test's fixtures (pi-extensions/**/fixtures/) ride the tarball — test input is not product; restore the files-array negation:"
+    echo "$hit" | sed 's/^/    /' >&2
+    pass=0
+  fi
+
   # #78 — a pack carries the Windows addon not at all, or as exactly a verified addon + manifest
   # pair (pack_win32_carrier_verdict, proven on owned fixtures by check-pack-win32-carrier).
   # "present" means the carrier verified, never that the build was approved for publication.
@@ -4157,7 +4168,7 @@ check_pack_win32_carrier() {
 #     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
 #     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@1\.3\.0(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@1\.4\.0(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
@@ -4174,18 +4185,18 @@ check_pack_pin_matcher() {
   # Cell 1 — the version boundary. Every measured peer-hash shape is a fixture: the
   # 0.84.4-era `_@modelcontextprotocol+sdk@…`, the `_ws@8.21.3` observed on a real
   # 0.85.1 tree, and `[측정 2026-09-20]` the combined suffix a 0.86.0 install carries.
-  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
+  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`1.4.0-beta.1`,
   # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@1.3.0' \
-    '@earendil-works+pi-ai@1.3.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@1.3.0_ws@8.21.3' \
-    '@earendil-works+pi-ai@1.3.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
-    '@earendil-works+pi-ai@1.3.0-beta.1' \
+    '@earendil-works+pi-ai@1.4.0' \
+    '@earendil-works+pi-ai@1.4.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.4.0_ws@8.21.3' \
+    '@earendil-works+pi-ai@1.4.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.4.0-beta.1' \
     '@earendil-works+pi-agent-core@0.87.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.3.0-beta.1
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.4.0-beta.1
 @earendil-works+pi-agent-core@0.87.1' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.3.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.3.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.4.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.4.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -4193,9 +4204,9 @@ check_pack_pin_matcher() {
   # (0.85.0 onward, still true at 0.99.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+chord@1.3.0' \
+    '@earendil-works+chord@1.4.0' \
     '@earendil-works+chord@0.87.1' \
-    '@earendil-works+pi-ai@1.3.0' | pack_install_leaked_pi)
+    '@earendil-works+pi-ai@1.4.0' | pack_install_leaked_pi)
   if [ "$matcher_probe" != '@earendil-works+chord@0.87.1' ]; then
     fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it was a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0, `[측정 2026-09-23]` at 0.87.1 and `[측정 2026-09-30]` at 0.99.1, where pi-coding-agent adds pi-codemode and pi-mcp beside them; `[측정 2026-10-13]` at 1.2.0 pi-durable alone declares it) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
@@ -4209,7 +4220,7 @@ check_pack_pin_matcher() {
 # Cells: L1s (Entwurf alone, $3), L1 (project-local beside an aligned host pi-coding-agent at the
 # pinned SDK version), L2 (an isolated `npm -g --prefix`), each through (a) the INSTALLED verifier
 # (exit 0, prints its own carrier-resolver) and (b) an independent consumer oracle; then the L3
-# NEGATIVE (an override binds pi-durable's pi-ai edge to an older published version: the installed verifier must
+# NEGATIVE (an override binds pi-durable's pi-codemode edge to an older published version: the installed verifier must
 # refuse it by name, while a bare import still succeeds); then (c) the public launch on L1s.
 # The oracle observes RESOLUTIONS (a resolve hook), not every filesystem read; it asserts each
 # resolved product file lies inside THIS consumer's node_modules — a sandbox ancestor is not the
@@ -4304,13 +4315,18 @@ ORACLE
     echo "[check-pack-install] pi-durable $cell: installed verifier PASS; consumer oracle $out"
   done
 
-  printf '%s\n' "{\"name\":\"pd-mismatch\",\"version\":\"1.0.0\",\"private\":true,\"overrides\":{\"@earendil-works/pi-durable\":{\"@earendil-works/pi-ai\":\"1.0.3\"}}}" > "$box/pd-mismatch/package.json"
+  # The wrong edge must still IMPORT, or the control proves a crash rather than a refusal. `[측정 2026-10-22]`
+  # SDK 1.4 pi-durable imports pi-ai's new `utils/identity`, absent from the older pi-ai control versions
+  # checked here (1.0.3 and 1.3.0 both fail to load); pi-telemetry 1.0.3/1.3.0 and chord 1.3.0 lack exports
+  # it imports. pi-codemode 1.3.0 loads, and depends on no SDK member, so this tree carries exactly one
+  # depth-2 mismatch (L4 keeps depth 3).
+  printf '%s\n' "{\"name\":\"pd-mismatch\",\"version\":\"1.0.0\",\"private\":true,\"overrides\":{\"@earendil-works/pi-durable\":{\"@earendil-works/pi-codemode\":\"1.3.0\"}}}" > "$box/pd-mismatch/package.json"
   out=$(cd "$box/pd-mismatch" && npm install "$tgz" --no-audit --no-fund 2>&1) || {
     fail "[check-pack-install] pi-durable L3 (mismatch control) install failed:"; echo "$out" | tail -10 | sed 's/^/    /' >&2; return 1; }
   pkg="$box/pd-mismatch/node_modules/@junghanacs/entwurf"
   rc=0; out=$(cd "$box" && node "$pkg/mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-runtime.js" resolve 2>&1) || rc=$?
-  if [ "$rc" -ne 3 ] || ! grep -q "pi-durable-sdk-mismatch: @earendil-works/pi-durable → @earendil-works/pi-ai wants $pin_ver, binds 1.0.3" <<<"$out"; then
-    fail "[QK:PACK-INSTALL-DURABLE-MISMATCH-REFUSED] [check-pack-install] pi-durable L3: an installed tree whose pi-durable binds pi-ai 1.0.3 must be refused by name as pi-durable-sdk-mismatch (rc=$rc): $out"
+  if [ "$rc" -ne 3 ] || ! grep -q "pi-durable-sdk-mismatch: @earendil-works/pi-durable → @earendil-works/pi-codemode wants $pin_ver, binds 1.3.0" <<<"$out"; then
+    fail "[QK:PACK-INSTALL-DURABLE-MISMATCH-REFUSED] [check-pack-install] pi-durable L3: an installed tree whose pi-durable binds pi-codemode 1.3.0 must be refused by name as pi-durable-sdk-mismatch (rc=$rc): $out"
     return 1
   fi
   rc=0; out=$(cd "$box" && node --input-type=module -e "import { pathToFileURL } from 'node:url'; await import('$pkg/pi/pi-durable/carrier-resolver.mjs'); const m = await import(pathToFileURL('$pkg/pi/pi-durable/carrier/runtime.js').href); console.log(typeof m.openDurable);" 2>&1) || rc=$?
@@ -4835,19 +4851,21 @@ _check_pack_install_impl() {
   # `[측정 2026-10-16]` at 1.3.0 the constellation is unchanged: the installed manifests give the
   # same member edges as at 1.2.0, now every one exact 1.3.0 (upstream #10865), and the consumer
   # oracle walked 10 member edges with 0 mismatches (.tmp-verify/145-stage1/08-pack-install.log).
-  echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.3.x SDK + chord + codemode + mcp + durable + typebox)"
+  # `[측정 2026-10-22]` at 1.4.0 the nine members are again exact 1.4.0 edges (registry manifests; #148 S0),
+  # and pi-tui 1.4.0 adds one third-party dependency (marked-cjk-friendly 0.1.2) outside the closure.
+  echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.4.x SDK + chord + codemode + mcp + durable + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@1.3.0" \
-    "@earendil-works/pi-coding-agent@1.3.0" \
-    "@earendil-works/pi-tui@1.3.0" \
-    "@earendil-works/pi-agent-core@1.3.0" \
-    "@earendil-works/pi-telemetry@1.3.0" \
-    "@earendil-works/chord@1.3.0" \
-    "@earendil-works/pi-codemode@1.3.0" \
-    "@earendil-works/pi-mcp@1.3.0" \
-    "@earendil-works/pi-durable@1.3.0" \
+    "@earendil-works/pi-ai@1.4.0" \
+    "@earendil-works/pi-coding-agent@1.4.0" \
+    "@earendil-works/pi-tui@1.4.0" \
+    "@earendil-works/pi-agent-core@1.4.0" \
+    "@earendil-works/pi-telemetry@1.4.0" \
+    "@earendil-works/chord@1.4.0" \
+    "@earendil-works/pi-codemode@1.4.0" \
+    "@earendil-works/pi-mcp@1.4.0" \
+    "@earendil-works/pi-durable@1.4.0" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -4863,11 +4881,11 @@ _check_pack_install_impl() {
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.3.0):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.4.0):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.3.0 (chord and pi-durable included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.4.0 (chord and pi-durable included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the

package/scripts/check-gate-qualification.ts

@@ -3470,7 +3470,7 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 89,
+		"pi-durable": 94,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 15,

package/scripts/lib/codex-fresh-live-protocol.ts

@@ -52,8 +52,9 @@ export function buildCodexInstruction(input: CodexInstructionInput): string {
 		// DIRECTORY must come from this Codex's own record (#95 lane C), which is a fact only
 		// because its thread now opens where its pane is rather than where the app-server sits.
 		// Omitting the parameter is the whole point — passing one would prove neither.
-		'NO cwd parameter and NO placement parameter, and task "After your automatic callback succeeds, answer ACK and ' +
-		'stop. Do not open another sibling."\n' +
+		'NO cwd parameter and NO placement parameter, and task "Your automatic callback is the whole task and there is ' +
+		"no result to send. After it succeeds, end the turn: no message, no report, no further tool call. Do not open " +
+		'another sibling."\n' +
 		"2. Stop and wait for the Pi callback delivered into this Codex thread. Accept only a callback whose body " +
 		"repeats the exact nonce from your LAUNCH receipt and whose sender envelope carries a garden id on its `session:` line.\n" +
 		`3. Only after that match, call public mcp__entwurf_bridge__entwurf_v2 once with target ${input.callerGid}, ` +

package/scripts/mutants/control-send-receipt.json

@@ -181,7 +181,7 @@
 			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
 			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-agent-core\": \"1.3.0\","],
+			"find": ["\"@earendil-works/pi-agent-core\": \"1.4.0\","],
 			"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/mutants/pack-install.json

@@ -6,8 +6,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes \u2014 @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.4\\.0(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+' | grep -v '@1\\.4\\.0' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED]",
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure \u2014 @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.4\\.0(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.4\\.0(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",

package/scripts/mutants/pi-durable.json

@@ -1207,6 +1207,66 @@
 			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
 			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
 		},
+		{
+			"claim": "PI-DURABLE-TASK-SLEEPING-COUNTED",
+			"title": "the badge stops naming sleeping tasks: a background task in its durable backoff is counted but said to be nothing",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\t\t...tally(\"sleeping\", (node) => !node.abortRequested && node.state.status === \"sleeping\"),"],
+			"replace": ["\t\t\t// sleeping is not named"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-SLEEPING-COUNTED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TASK-SLEEPING-SHOWN",
+			"title": "a sleeping task's panel line drops its wake time, so nothing on screen says when the sleeping work comes back",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\t\t\t\t? `sleeping ${state.phase} until ${localTime(state.until)}`"],
+			"replace": ["\t\t\t\t\t? `sleeping ${state.phase}`"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-SLEEPING-SHOWN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TASK-BLOCKED-SHOWN",
+			"title": "the panel stops marking blocked tasks: a task the SDK will not run reads as ordinary pending work",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\tnode.blocked !== undefined ? `blocked:${node.blocked}` : \"\","],
+			"replace": ["\t\t\"\","],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-BLOCKED-SHOWN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TASK-BLOCKED-REASON",
+			"title": "every blocked task is said to be parked by the restart limit, whatever reason the SDK gave",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\tnode.blocked !== undefined ? `blocked:${node.blocked}` : \"\","],
+			"replace": ["\t\tnode.blocked !== undefined ? `blocked:restart_limit` : \"\","],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-BLOCKED-REASON]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TEST-FIXTURES-NOT-SHIPPED",
+			"title": "package.json drops its fixture negation, so every published tarball carries the test goldens under pi-extensions/**/fixtures/",
+			"subject": "package.json",
+			"find": ["\t\t\"!pi-extensions/**/*.test.ts\",", "\t\t\"!pi-extensions/**/fixtures/**\""],
+			"replace": ["\t\t\"!pi-extensions/**/*.test.ts\""],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TEST-FIXTURES-NOT-SHIPPED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
 		{
 			"claim": "PI-DURABLE-STREAM-TRANSPORT-WIRE",
 			"title": "the Harness settings stop carrying the transport: the provider never continues a response, so every request of a long session resends the whole conversation",

package/scripts/mutants/pi-floor.json

@@ -7,10 +7,10 @@
 			"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
 			"subject": "pnpm-workspace.yaml",
 			"find": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0 || 1.2.0 || 1.3.0'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0 || 1.2.0 || 1.3.0 || 1.4.0'"
 			],
 			"replace": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0 || 1.2.0'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0 || 1.2.0 || 1.3.0'"
 			],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
@@ -21,8 +21,8 @@
 			"claim": "PI-SDK-PRODUCTION-SET",
 			"title": "the durable library's production pin falls one release behind the SDK set the pin declares, so the carrier would bind a pi-durable nobody verified it against",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-durable\": \"1.3.0\","],
-			"replace": ["\"@earendil-works/pi-durable\": \"1.2.0\","],
+			"find": ["\"@earendil-works/pi-durable\": \"1.4.0\","],
+			"replace": ["\"@earendil-works/pi-durable\": \"1.3.0\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-SDK-PRODUCTION-SET]",
@@ -33,7 +33,7 @@
 			"title": "an @earendil-works package returns as a dev dependency beside its production pin, one name in two dependency classes",
 			"subject": "package.json",
 			"find": ["\"@biomejs/biome\": \"^2.4.13\","],
-			"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.3.0\","],
+			"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.4.0\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-SDK-NO-DUAL-DECLARATION]",

package/scripts/smoke-codex-fresh-live.ts

@@ -1082,7 +1082,8 @@ async function run(): Promise<void> {
 	const codexWaitToken = `CODEX-WAIT-${Math.random().toString(36).slice(2, 10).toUpperCase()}`;
 	const finalToken = `CODEX-PI-FINAL-${Math.random().toString(36).slice(2, 10).toUpperCase()}`;
 	expectedReportTokens.push(finalToken);
-	const outboundPiTask = "After your automatic callback succeeds, answer ACK and stop. Do not open another sibling.";
+	const outboundPiTask =
+		"Your automatic callback is the whole task and there is no result to send. After it succeeds, end the turn: no message, no report, no further tool call. Do not open another sibling.";
 	const codexTask =
 		`After your required callback receipt, end the turn and wait passively for the addressed instruction containing ${codexWaitToken}. ` +
 		"Do not call shell, sleep, terminal, or any tool to wait.";

package/scripts/smoke-herdr-raw-install-live.sh

@@ -110,9 +110,16 @@ fi
 
 PI_SPEC="$(node -p "require('$REPO/package.json').dependencies['@earendil-works/pi-coding-agent']")"
 # Pinned, not floating: a receipt that cannot say WHICH Claude Code it ran is not
-# reproducible. This is the version measured in the container on 2026-09-19. Claude Code
-# is scaffolding here (Rule 17) — the product face starts at `herdr integration install`.
-CLAUDE_SPEC="2.1.278"
+# reproducible. The exact version is the support floor itself, derived from
+# `package.json` `entwurf.claudeCodeFloor` rather than retyped: a hand-kept pin stayed at
+# 2.1.278 after the floor moved to 2.1.306 and the activation then refused it, as it should.
+# Claude Code is scaffolding here (Rule 17) — the product face starts at `herdr integration install`.
+CLAUDE_FLOOR="$(node -p "require('$REPO/package.json').entwurf.claudeCodeFloor")"
+CLAUDE_SPEC="${CLAUDE_FLOOR#>=}"
+if [[ "$CLAUDE_FLOOR" != ">=$CLAUDE_SPEC" || ! "$CLAUDE_SPEC" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "[smoke-herdr-raw-install-live] FAIL — package.json entwurf.claudeCodeFloor is '$CLAUDE_FLOOR', not '>=X.Y.Z'." >&2
+  exit 1
+fi
 FLOOR_SPEC="$(node -p "require('$REPO/package.json').engines.node")"
 FLOOR_MAJOR="${FLOOR_SPEC#>=}"; FLOOR_MAJOR="${FLOOR_MAJOR%%.*}"
 HERDR_VERSION="$(node -p "require('$REPO/scripts/fixtures/herdr-supply.json').version")"