@junghanacs/entwurf 0.41.0 → 0.41.2

package/AGENTS.md

@@ -35,7 +35,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; roll forward a stale reader that rejects a newly known backend or V3 key. Reader-version skew is not a generation change: preserve identities and records, and verify every participating reader before claiming rollout complete. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
-10. **Native-push is distinct.** It is neither mailbox nor pi socket. Native-push citizens are record-backed plus probe-alive, with no receiver/watch state or resume authority. Antigravity retries only after bounded re-probe; Codex never replays queue acceptance. Codex sender identity is request-scoped metadata; app-server environment carries root/placement, never citizen identity.
+10. **Native-push is distinct.** It is neither mailbox nor pi socket. Native-push citizens are record-backed plus probe-alive, with no receiver/watch state or resume authority. Antigravity retries only after bounded re-probe, and its native push is paused (#152: one contract constant refuses dispatch and registration, and makes the sender non-replyable, before any probe); Codex never replays queue acceptance. Codex sender identity is request-scoped metadata; app-server environment carries root/placement, never citizen identity.
 11. **Package proof models a consumer.** Installed operator entrypoints reach compiled JS; `run_ts` is the sole TS crossing. Keep checkout, tarball, and consumer proofs distinct.
 12. **Offline verification never rewires the operator.** Sandbox HOME, `PI_CODING_AGENT_DIR`, and writable XDG roots. Only named LIVE gates may touch the host, and must say so.
 13. **Doctors report runtime and ownership independently.** Working runtime does not prove ownership; broken ownership does not erase runtime observation. Required failure on either axis is red.

package/BASELINE.md

@@ -312,7 +312,9 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 
 ## Native-citizen baseline — Antigravity / agy (shipped)
 
-This is not an ACP overlay interview. Run it in a **fresh agy conversation** after
+This is not an ACP overlay interview, and while agy native push is paused (#152) it is an
+optional diagnostic run on request, not a release-cut requirement (VERIFY criterion 7).
+Run it in a **fresh agy conversation** after
 `install-agy-bridge`, `install-agy-statusline`, and `install-agy-hooks`, with all
 three doctors green. `PreInvocation` is the earliest lifecycle event, so a brief
 `🪛 ? agy` before the first model invocation is honest; after that first invocation
@@ -321,13 +323,13 @@ the same conversation must have a garden id.
 | ID | Check | PASS | FAIL |
 |---|---|---|---|
 | Q-AGY-BIRTH | Automatic birth | First invocation creates/attaches one record by native `conversationId`; statusline becomes `🪛 <garden-id> agy`. | Manual cwd matching or `entwurf_register_native` is required for normal birth; a new id appears on every turn. |
-| Q-AGY-SELF | Sender identity | `entwurf_self` reports the same garden id, `origin=meta-session`, `agentId=meta-session/antigravity`, and `replyable:true` while the native probe is alive. | Anonymous `external-mcp`, unbacked marker accepted, model name substituted into `agentId`, or mailbox evidence used to infer replyability. |
-| Q-AGY-SEND | Outbound attribution | `entwurf_v2` from agy reaches a sibling carrying that same sender garden id and `replyable:true`. | Receiver sees unknown host/wrong garden id, or sender ambiguity is silently guessed. |
-| Q-AGY-REPLY | Same-conversation reply | Sibling replies with `entwurf_v2(target=<agy-gid>, intent=fire-and-forget)` and the message direct-injects into the same live agy conversation. | New conversation/spawn, mailbox file/doorbell, or a cosmetic delivered result with no live native route. |
+| Q-AGY-SELF | Sender identity | `entwurf_self` reports the same garden id, `origin=meta-session`, `agentId=meta-session/antigravity`, and, while native push is paused (#152), `replyable:false` with a reason naming the pause and no probe run. | Anonymous `external-mcp`, unbacked marker accepted, model name substituted into `agentId`, or mailbox evidence used to infer replyability. |
+| Q-AGY-SEND | Outbound attribution | `entwurf_v2` from agy reaches a sibling carrying that same sender garden id; while native push is paused (#152) the sender is `replyable:false`. | Receiver sees unknown host/wrong garden id, or sender ambiguity is silently guessed. |
+| Q-AGY-REPLY | Same-conversation reply (paused, #152) | While the pause holds, a sibling's `entwurf_v2(target=<agy-gid>, intent=fire-and-forget)` returns `native-push-paused` with nothing probed or sent, and the agy record is unchanged. When the pause lifts: the message direct-injects into the same live agy conversation. | New conversation/spawn, mailbox file/doorbell, a probe or send while paused, or a cosmetic delivered result with no live native route. |
 | Q-AGY-OWNERSHIP | Install scope | MCP owns one server plus one narrow `mcp(entwurf-bridge/<tool>)` rule per normal-path tool (`entwurf_v2`, `entwurf_peers`, `entwurf_self`) and nothing else; statusline owns its subtree; hooks own one named hook. | Installer broadens YOLO policy (`command(*)`, `unsandboxed(*)`), grants tools it does not need (`entwurf_inbox_read`, `entwurf_register_native`), or overwrites unrelated settings/hooks. |
 | Q-AGY-CONCURRENCY | Evidence boundary | Separate agy processes have separate pid/start-key markers; same-pid concurrent model invocation is explicitly reported unsupported. | Claims that one pid can safely identify two simultaneously invoking conversations. |
 
-The replyability formula is **record-backed identity AND live native-push probe**.
+The replyability formula is **record-backed identity AND live native-push probe**; while agy native push is paused (#152) the probe does not run and agy replyability is false by name.
 There is intentionally no receiver marker, `watchArmed`, mailbox, or resume
 authority (no rail has one since the visible-first cut). The model field may exist in the meta-record/status display,
 but `agentId=meta-session/antigravity` is the stable sender contract.

package/CHANGELOG.md

@@ -4,6 +4,432 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.41.2 — 2026-10-24
+
+A bug-fix release for the setup, pack and mux verification surfaces. It also carries #149's remote-pair declaration change, a hard cut: every host that has an `entwurf-remote-pair.json` must convert it by hand (Remote pairs below, setup §2c). It also pauses agy native push (#152, Antigravity below), a scope added while this release was being made. The release evidence below separates what was measured while this release was prepared from what the MAKE phase measures on the exact artifact and installed hosts. Herdr is not re-pinned to npm here. An npm lock must name this checkout's exact version, and 0.41.2 had no published bytes when this release was prepared, so `plugins/herdr/runtime-lock.json` returned to the closed `herdr-checkout` verification carrier, as earlier release candidates did. Since the prepare commit `1e66466` reached main, a main-tracking Herdr install builds its runtime from the checked-out commit instead of npm, and a host already on the npm 0.41.1 runtime must run `herdr-plugin-deactivate` before it reinstalls. The published 0.41.1 pairing stays pinned by the Herdr tag `v2026.10.23-herdr.0.41.1` (its section below). The Herdr manifest version is unchanged; a separate snapshot re-pins npm after 0.41.2 is published.
+
+### Release evidence
+
+- Kill-power re-measured at this shipped SHA: none (all 1215 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 439b399c64ef surface de3c1bcf6db9 -- ["bash","run.sh","check-remote-pair-beside"] 47/47 receipt 55bd9563fe43
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 439b399c64ef surface de3c1bcf6db9 -- ["bash","run.sh","check-tests-beside-behavior"] 6/6 receipt aef18acbe804
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 156bb6231cee surface c883d0df88b5 -- ["bash","run.sh","check-pack-argv-matcher"] 4/4 receipt 11470c62389c
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head e7ed0576ea65 surface 9bff5948bcb3 -- ["bash","run.sh","smoke-agy-install-state"] 18/18 receipt 13b86f54457e
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head e7ed0576ea65 surface 9bff5948bcb3 -- ["bash","run.sh","smoke-setup-verdict"] 4/4 receipt ba3113f9661e
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e2673ba9a1b surface 2b1c5c7c1d52 -- ["bash","run.sh","check-mux-launcher-fence"] 8/8 receipt d27f3ded70ab
+- Not measured for this release: the real two-host exchange (T3) over the v2 remote-pair file. It is opt-in operator evidence, not a release-gate MUST (VERIFY, "Real two-host exchange"), and it was not re-run for this candidate.
+- `LIVE=1 ./run.sh smoke-herdr-plugin-build-live` on Herdr 0.9.5, measured on an earlier working tree (diff `40f12860ffbf`, smoke `15744e13f9bf`), not on this SHA: 635 s, 5 passed, 0 skipped. The Claude cell ran the real vendor CLI. The gap install exited 1 with the registry unchanged and the ledger on the gap commit, and the reconcile then re-bound to HEAD with 0. Log `0a9f293a155c`. A fixture pack is not a release artifact.
+- Prepare-time floor and release gate, measured on the working tree `80c40705809c` (fixture source `15744e13f9bf`, before this record's final wording), not on an exact SHA: managed build 6 s with dist byte-identical, `check:full` 905 s exit 0. `release-gate --cut`: MUST 24/0/0, BEHAVIOR 1/0/0, cut OK, log `8c18f08880d3`. The census afterwards was read-only.
+- Prior candidate, kept and not inherited: the prepare commit `1e66466`, its push CI, its M3w artifact `df407c70c0b2` and that artifact's container and Claude installed acceptance were measured before the #152 pause. They are evidence for that candidate only; the paused product bytes do not inherit them.
+- #152 PARTIAL (operator-attested, not this SHA): head 1e664667a663 surface 81cbb2888465 -- ["bash","run.sh","check-native-push-paused"] 1/1 receipt 2f262170bf98
+- #152 PARTIAL (operator-attested, not this SHA): head 1e664667a663 surface 81cbb2888465 -- ["bash","run.sh","check-entwurf-v2-contract"] 1/1 receipt 0c624bad9b67
+- #152 PARTIAL (operator-attested, not this SHA): head 1e664667a663 surface 81cbb2888465 -- ["bash","run.sh","check-entwurf-v2-production"] 5/5 receipt f7dd4d94c275
+- #152 PARTIAL (operator-attested, not this SHA): head 1e664667a663 surface 81cbb2888465 -- ["bash","run.sh","check-entwurf-self-address"] 8/8 receipt 3c223a9034d8
+- Those four groups were measured on an uncommitted working tree with green controls; the other 1189 of 1204 committed mutants were not run for them. They are not shipped-SHA kill-power and do not sum to release coverage.
+- #152 candidate floor, before this record's final doc amendment: `check:full` 900 s exit 0 on the uncommitted working tree with tracked patch `f883ba29c22d` (log `ce9ca5df53eb`), not this SHA.
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 100f618e2b42 surface 61f6ab3d25c1 -- ["bash","run.sh","check-chain-terminus-publication"] 1/1 receipt 6a8af23eb259
+- That group was measured on an uncommitted working tree over `100f618` with green controls; the other 1204 of 1205 committed mutants were not run for it, and it is not shipped-SHA kill-power.
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head ed6490fdc949 surface e966ed7447e8 -- ["bash","run.sh","check-tests-beside-behavior"] 6/6 receipt cecf3a83a675
+- `LIVE=1 ./run.sh smoke-entwurf-chain-live` on the chain-terminus candidate (uncommitted, tracked patch `4df5f793fb04`), not this SHA: 24 assertions, 24 s, exit 0, log `e5115bbeb06d`; every identity and read-receipt check after the doorbell was reached.
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head bad44f4beb6c surface cd1627ae7b7c -- ["bash","run.sh","check-mux-fresh-call"] 160/160 receipt 33b6f81cff24
+- That group was measured on an uncommitted working tree over `bad44f4` (the bootstrap repair) with green controls; the other 1055 of 1215 committed mutants were not run for it, and it is not shipped-SHA kill-power.
+- Guided caller check, `LIVE=1 ./run.sh smoke-codex-fresh-live` on an earlier uncommitted candidate (tracked patch `a5b3833b9ebd`), not this SHA: 66 assertions, exit 0, the initial Pi's peers prefix 1, log `753dd4b24b6c`. It is one run of the path the task asked for, not evidence of a sibling's own judgement, and the earlier outbound-callback timeout (P5 r4) is still unexplained.
+- Exact prepared-SHA CI and the M3w artifact with its container acceptance belong to the final prepared SHA and produce their own receipts. §3.7 is VERIFY criterion 7's deterministic paused proof inside `check:full`; it needs no install.
+- Release gate and native Claude acceptance after install (§3.4), measured on `4f14a4d` (the bootstrap checkpoint, before the docs-only agy-scope change), not this SHA: `release-gate --cut` log `fcb5c64dd70a`, its `check:full` 923 s exit 0, MUST 24/0/0, BEHAVIOR 1/0/0, cut OK. Installed `doctor-meta-bridge` exited 0 (log `0065d7a78d8e`). A new Claude Code session ran the acceptance prefix's MCP entry `8ca6d4cb4b90`, the same bytes as the tarball member, and sent its own self-report. The checkout re-registration and its doctor passed afterwards.
+- Also on `4f14a4d`, not this SHA: `smoke-omp-fresh-live` 21 assertions after the managed OMP install (log `e2c91d7683cc`), and `smoke-herdr-fresh-call-live` 32 assertions (log `bbfe0386b2c6`).
+- Those `4f14a4d` receipts stand for this SHA only if the final artifact differs from the `4f14a4d` artifact `37b4670837d2` in exactly BASELINE.md, CHANGELOG.md, VERIFY.md and docs/setup-clean-host.md. That comparison is an operator-handoff receipt, not part of this record.
+
+### Docs
+
+- **remote-sibling-principles now carries #149.** Several relationships coexist, each one exact sender–target edge, never a union of memberships or a local fallback. Record, process, screen and conversational continuity stay separate. Disjoint routes do not narrow SSH account trust. Implementation, switch-over and a real exchange are kept as separate evidence; no version-2 nonce round trip is claimed. The page keeps the why and links the mechanism to DELIVERY and setup.
+- **README's orchestration section is an entrance, not a second manual.** It drops the lifecycle table it repeated from the overview and the acceptance-boundary detail DELIVERY owns, and adds two short entries: a minimal v2 remote-pair file with its mirror rule, linked to the principles page, DELIVERY and setup §2c; and `team.json`, a person's bookmark copied from `team.json.example`, which Entwurf does not load as runtime configuration.
+
+### Remote pairs (#149)
+
+- **One host's declaration now carries several exact pairs.** `entwurf-remote-pair.json` keeps its name and location. Its content is now exactly `{"version": 2, "routes": [...]}`, and each route has the four keys of the #107 file. One local citizen may pair with several remotes, one remote with several locals, and one alias may carry several routes. The file is refused if a pair repeats, a garden id is both local and remote, one remote garden id has two aliases or files, or one alias has two files. A route is selected by the exact (sender, target) pair. A target declared remote with no route for the calling sender is refused with zero SSH and no local fallback. The receiving entry matches both ends of one route at once, so a sender declared in one route cannot reach another route's local. It still refuses with the two existing reasons (`remote-pair-from-mismatch`, `remote-pair-target-mismatch`). The claim, SSH argv, exit codes and receipt are unchanged.
+- **Hard cut, converted by hand.** The versionless single-pair file is refused by name with its manual rewrite; there is no legacy reader. Setup §2c gives the per-host order. While a host's bytes and its file disagree, every `entwurf_v2` call of its bridges is refused, local targets included; a running bridge keeps the code it loaded. Trust stays same-account SSH: every key that account accepts can claim any garden id its file declares.
+- **Evidence.**
+  - T1 cells cover the v2 shape, the legacy refusal, the set rules, exact-pair selection with no local fallback, the cross-pair refusal and the matched-route label.
+  - The T2 surface-in scene adds a third host and a second citizen on one root, giving three routes in one file: fan-out, a shared remote, the reverse, an undeclared sender with zero SSH, and a cross claim refused on the receiving host.
+  - The remote-pair mutants run through the new narrow coordinate `check-remote-pair-beside`, which is in `check:contracts`.
+  - Not measured: a real exchange over the v2 file (T3 must be re-run for the schema change) and a sender and a receiver on different releases.
+
+### Antigravity native push paused (#152)
+
+- **agy native push is paused.** On the external send path entwurf measured, the agy language server refused the `agentapi` call with `Unauthenticated: missing CSRF token` (#128 on agy 1.2.16, again on agy 1.4.6). Whether a first-party own-tool shell holds a token entwurf could legitimately present is unmeasured; this pause does not claim it is impossible. One fixed constant in the v2 contract drives three refusals before any probe: `entwurf_v2` rejects an agy target as the new pre-probe reason `native-push-paused` with `observedLiveness: null`, an agy sender's `replyable` is false with a reason naming the pause, and `entwurf_register_native` refuses without probing or minting a garden id. Existing agy records, the backend enum, the record reader and the schema are unchanged, so agy citizens stay readable and listed with their birth hook and statusline. Codex native push is unaffected. The fresh-cut quiescence probe stays outside the pause and keeps failing closed.
+- **Acceptance changes with it.** VERIFY criterion 7 proves the pause with the deterministic `[QK:AGY-NATIVE-PUSH-PAUSED]` cell, which needs no agy conversation; the doctors and the fresh-conversation identity check of the retained legacy identity surfaces are an optional diagnostic run on request, not a cut requirement, and are not send evidence. A release does not claim the installed agy host is certified or can receive. A same-gid reply is not claimed while the pause holds. `smoke-agy-native-push-live` exits 2 with `[entwurf:paused]` before it reads a conversation id, and that is not a PASS. The mutant for that cell runs through the narrow coordinate `./run.sh check-native-push-paused`, which is also part of `check:contracts`.
+
+### Fixed
+
+- **A fresh sibling may check its caller before calling back, and may hold back.** The framing no longer calls the callback the literal first action. A read-only `entwurf_peers` check may come first, and a capped listing that does not show the caller proves no absence. A sibling whose check does not hold up may hold the callback and the task; the caller then has no address for it. The callback correlates an address; it grants no trust and no authority, and Entwurf decides nothing on the sibling's behalf. omp's stage one reads the caller id from the launch env for display only, and a requested bootstrap without a well-formed one is refused with its task unsent. The LIVE audits admit only successful exact checks before one exact callback; that is those fixtures' condition, not a list of what a sibling may do. Pi and pi-durable prove the result order by row ordinals, Codex only the call order.
+- **`smoke-entwurf-chain-live` could report a false RED while the terminus message was still being published.** `enqueueMetaMessage` writes the `.msg` body first and `inbox.signal` last. The smoke stopped waiting at the first body and checked the signal at once, and in the 0.41.2 release gate on 2026-10-24 the signal landed about 5 ms later. The wait now ends only when the body and the signal are both there, inside the same deadline. A missing body, a missing signal and a duplicate still fail, and the identity and read-receipt checks after it are unchanged. Product mailbox behavior is unchanged. The wait lives in `scripts/lib/chain-terminus-publication.ts` and is proven offline by `test/chain-terminus-publication.test.ts` through the narrow coordinate `check-chain-terminus-publication` (in `check:vitest`), with one mutant that restores the early stop.
+- **The release MUST now drives `entwurf_fresh_call`'s explicit seat over the real MCP wire (#108).** Before this, `placement.tmuxSession` was checked on the bridge only through its schema and a source regex, and the seat was proven only by calling the composition directly. In `smoke-mux-lifecycle-live`, the native pi cell's existing `tools/call` now names a seat session made on the same private tmux server, with no extra model turn. The harness asks tmux itself (not the receipt, whose session id is the target the product chose) that the pane sits in that seat, that the caller's windows are unchanged, and that the stable-handle close removes only that window while the seat's original anchor session, window and pane stand. The ACP and Claude Code cells keep the omitted-placement path. Product code is unchanged.
+- **`check-pack-install`'s two dispatcher-verb leak refusals could pass a leak on a SIGPIPE.** The copilot and codex-app-server cells searched the vendor stand-in's argv with `printf '%s' "$op_out" | grep -qF …` under `pipefail` and refused only when that pipeline exited 0. bash's `printf` writes a multi-line value one line at a time, so a `-q` that closes the pipe at the first match can kill the producer with 141 and pass the cell. The defect was latent: no false green was observed in CI, and the product carries no leak. Both cells now return through one verdict, `pack_install_refuse_argv_leak`. It searches a here-string, which has no producer to kill. It passes on a clean search, and refuses with the cell's existing diagnostic on a leak, or by name when the search itself fails.
+  - `check-pack-argv-matcher` is a snapshot-safe gate in `check:package`. Like `check-pack-pin-matcher`, it also runs first inside `check-pack-install`. It drives that same verdict: it must refuse a leak at the front or end of about 260 KB, pass clean output silently, and refuse a failing `grep`. A text check holds both cells to the verdict.
+  - A teeth control first requires the retired pipe shape to miss the front-loaded leak on the host. The mutant that restores that shape dies deterministically only because of this large fixture; on the real small output it would survive.
+  - The other pipe-to-`-q` lines reviewed alongside are unchanged: the pi-provider doctor and dev-only gate fence checks, which the next confirm-type check backstops; the meta-sessions `ls | grep -q .` cell; the `takeover-user-scope` and uninstall notes; and the confirm-type greps.
+- **A source checkout's setup could report a developer install while an old global entwurf was still selectable.** The bins step certified only the PATH winner: `~/.local/bin/entwurf` into this checkout. An old pnpm global shim later in the same PATH stayed in place, and a non-interactive SSH shell, whose PATH puts that directory first, ran it with the old reader. Source setup now also refuses, by name, any other root under the six package bin names in every PATH entry and in the global bin directory that `pnpm bin -g` and `npm prefix -g` report.
+  - The same resolved target is the same install, so duplicate PATH entries and second links pass. An unreadable package manifest, or a package manager that fails or hangs, is refused rather than read as clean. pnpm 11 refuses `bin -g` while its global bin dir is off PATH, so that case is refused too.
+  - Nothing is removed and no profile is edited. The refusal prints the path, the conditional package-manager removal command and the next `./run.sh setup`. Installed mode is unchanged.
+  - A PASS covers only the directories checked: another shell's PATH, another package manager, a running bridge and the other host are outside it.
+  - The two setup smokes now drop host PATH entries that carry a package bin name and answer the global-bin queries with fixtures, so the host's own installation cannot reach their verdict.
+- **`smoke-herdr-plugin-build-live` could not go green on the current Herdr and manifest.** Three fixture defects are fixed in the smoke alone; product code is unchanged.
+  - The snapshot and gap-probe clones now install their own frozen, offline, ignore-scripts dependencies before their ordinary commit, which the strict hook needs.
+  - Cell 1 locates the managed checkout from Herdr's own registration: exactly one `plugins.json` entry, whose `plugin_root` must resolve inside the sandbox. It no longer scans a `plugins/github/` layout that Herdr no longer writes.
+  - Cell 4's probe had replaced a `version = "0.1.0"` literal that the manifest stopped carrying at dd84ac0, so it changed nothing. It now derives the change from the version line it reads, and records the runner's code and the written change in a JSON receipt. The smoke accepts the post-build gap only when that receipt shows code 0 and a real change.
+
+## v2026.10.23-herdr.0.41.1 — Herdr Entwurf plugin 0.41.1
+
+A separate Herdr plugin snapshot, not another core release: core package 0.41.1 and its
+`v0.41.1` tag remain unchanged. Core 0.41.1 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-23).** The `## 0.41.1` section below is prepare-time text. Its opening
+"Unpublished candidate; release acceptance is not complete", its "Main still carries the
+published 0.41.0 Herdr lock" and its closing "No tag, GitHub release, npm publication, Herdr
+re-pin or laptop rollout has occurred" predate later facts: `v0.41.1` and its GitHub release
+point at `6a88436` and that SHA's main push CI ran its four required jobs green ([#148 make
+record](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6353660427)), and npm
+`latest` is 0.41.1 (published 2026-10-22T23:49:43.983Z), byte-equal to the accepted
+Windows-bearing candidate ([#148 publication
+record](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6354276182)). When main
+moved to `6a88436`, its Herdr lock was the `herdr-checkout` carrier, so until this snapshot
+lands a main-tracking `herdr plugin install` acquires the checkout commit rather than an npm
+artifact. Neither the published tarball's CHANGELOG nor the core release page is amended by
+this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.41.1 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that the Pi 1.4.0
+  SDK candidate rode to production npm source `@junghanacs/entwurf@0.41.1` with the registry's
+  measured sha512 (`sha512-GEKfcpFC…xWqw==`). The plugin manifest moves 0.41.0 → 0.41.1;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From
+  the `v2026.10.22-herdr.0.41.0` snapshot to `v0.41.1`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's candidate wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **Pi 1.4 is now required.** The acquired runtime carries the Pi 1.4.0 SDK set and accepts Pi
+  `>=1.4.0 <1.5`; the previous snapshot's runtime accepted Pi `>=1.3.0 <1.4`. Upgrade Pi to 1.4
+  first, then install or reinstall the plugin: a host still on Pi 1.3 is refused at activation
+  by name (`outside the supported range`), the check `entwurf setup` applies, and no Pi
+  settings are written.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.41.0
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed a `herdr-checkout` candidate — from main at `6a88436` or from a validation branch —
+  must explicitly deactivate by its own absolute runtime path before reinstalling the
+  npm-source snapshot. No operator installation or active session is rewired by this release
+  work.
+- **What the acquired runtime carries, and what this path does not.** The runtime ships core
+  0.41.1's bytes, including its nine-tool bridge and the pi-durable carrier. Herdr wires and
+  opens only `{pi, claude-code}`, so this plugin path launches no pi-durable session and makes
+  no claim about migrating durable-session storage. Inside Herdr, `entwurf_resume_call` still
+  refuses as `herdr-resume-unsupported`.
+- **README.** The quick start and nine steps drop the candidate's `--ref "$CANDIDATE_REF"`
+  instructions and install against the ref Herdr resolves; the Pi step keeps `>=1.4.0 <1.5`,
+  and the runtime paragraph names npm 0.41.1 and points at the previous snapshot for Pi 1.3.x.
+- **Current install docs.** The root README and the clean-host setup guide replace their "not
+  published to npm yet / newest published 0.41.0" install text with the published 0.41.1 and its
+  Pi 1.4.x requirement, and point at the previous 0.41.0 for Pi 1.3.x. Moving a live host onto
+  0.41.1 remains a separate operator decision for each host, with the durable-session backup,
+  owner-exit and no-rollback boundaries unchanged.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.41.1 and `repair` 0.12.8-repair.1, 642 files, published
+  2026-10-22T23:49:43.983Z. The downloaded registry tarball is byte-equal (SHA256 and `cmp`) to
+  the preserved accepted core candidate (SHA256
+  `0172b049edde352d404b1119e330852b92ce235e3f2809e06d1ef0e71c95b95f`, 11406938 bytes); its
+  independently computed sha512 and sha1 equal `dist.integrity` and `dist.shasum`. Core make
+  already ran its container consumer against those same 0.41.1 bytes (repoDigest
+  `node@sha256:6dac556d…`, image ID `sha256:55ab623b…`, both recorded in make's artifact
+  receipt), so that result is reused here, not repeated. The new registry acquisition and
+  dependency resolution are closed separately: a sandboxed global npm install of the registry
+  package passed its installed `check-bridge` with nine tools, and a sandboxed `pi install`
+  resolved its bridge inside the sandbox, recorded the registry URL with that integrity, and
+  printed seven `entwurf` model rows (plus the header) including the curated Claude anchors.
+  The only checkout input of that `pi install` check, the bridge resolver script, is unchanged
+  on this branch. No model turn. The accepted run stripped every `PI_`, `ENTWURF_`, `CLAUDE`,
+  `CODEX_HOME`, `TMUX` and `HERDR_` carrier. These rows do not cover the runtime Herdr acquires
+  in use — its bins, its `check-bridge`, or the installed CLI's deactivate path — which belong
+  to the public-ref journey below. npm 11.16 listed the package's `postinstall` chmod as not
+  yet covered by `allowScripts`; whether that script ran was not checked. The installed
+  `entwurf` of the global install ran and its `check-bridge` exited 0.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.41.0 runtime was seeded from its own committed lock (`addcb8c`); the swap to
+  0.41.1 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.41.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.41.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates, by surface.** On the pin surface (lock, manifest, plugin README and this
+  section before its later amendments), with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-herdr-plugin-build` (21, its real-binary cell on herdr 0.9.5), `check-herdr-sandbox`
+  (12, a private herdr 0.9.5 server), `check-dep-versions` (Pi 1.4.0 coherent),
+  `check-install-surface`, `check-claude-floor-coherence` and `check-gate-manifests` (1178
+  committed mutants across 85 lanes validated, none executed). After the root README, setup
+  guide and NEXT changes, the seven gates those documents affect ran again on that later
+  surface, unchanged across them: `check-dep-versions`, `check-node-floor-coherence`,
+  `check-claude-floor-coherence`, `check-pi-runtime-version`, `check-herdr-plugin` (49),
+  `check-install-surface` and `check-entwurf-v2-surface` (99). Neither set certifies the final
+  amended surface; that is closed by the frozen FULL.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.4.0. Earlier npm or checkout-carrier
+  receipts cannot certify these source-specific axes. Those outcomes are recorded in the
+  snapshot's post-push acceptance ledger, not in this frozen text.
+
+## 0.41.1 — 2026-10-23
+
+**Unpublished candidate; release acceptance is not complete.** The actual operator
+transition and Native aggregate below have been measured. Final prepared-SHA CI and
+the requested manual BODY, the exact carrier-bearing artifact, main promotion, tags
+and publication remain separate gates. Main still carries the published 0.41.0 Herdr
+lock: promoting the checkout lock can change what main-tracking installations acquire.
+A validation artifact or an earlier checkpoint's green run is not final acceptance.
+
+### Pi 1.4.0 reference shell
+
+- Move the coherent nine-member production SDK set from exact 1.3.0 to exact 1.4.0,
+  keeping Entwurf's owned app/TUI composition and deterministic carrier emission.
+  The SDK owns execution, storage, queues, compaction and recovery; this adds no second
+  engine, supervisor, automatic retry policy or credential surface. The ordinary Pi
+  adapter's supported range becomes `>=1.4.0 <1.5`.
+- Show sleeping tasks in the background-task tally, their local wake time in the task
+  panel, and the SDK's blocked reason verbatim. Keep cancellation distinct from retry;
+  no new retry command or UI is added.
+- Adapt the ACP vendor-rejection test to pi-ai 1.4's bounded HTTP-status matching:
+  digits inside opaque request/tool ids no longer classify as transient. The raw
+  `Internal error` control remains transient. The production non-replay verdict and
+  raw diagnostic preservation are unchanged.
+- Add SDK 1.3 public-API-generated SQL fixtures and independent SQLite conformance
+  tests for the SDK 1.4 schema transition, row/index preservation, constraints,
+  reopening and future-version refusal. These are SDK conformance, not a local
+  mutation claim over the upstream engine. Keep fixture data and its generator out
+  of installed packages, with npm packlist and tarball-floor checks.
+- Separate this unpublished candidate's checkout instructions from public npm
+  0.41.0 / SDK 1.3 instructions. The Herdr lock uses the closed `herdr-checkout`
+  verification carrier; it invents no unpublished npm integrity. No new Herdr
+  snapshot or registry publication is implied.
+- Keep the Codex LIVE fixture callback-only on its outbound Pi leg. Asking for an
+  extra ACK created a fourth real tool call while the audit required three. The
+  exact-three, nonce and terminal-turn assertions remain unchanged; only the two
+  matching task strings changed, not production routing or retry behavior.
+- Trim historical platform details, dated labels and duplicated lifecycle prose
+  from the README while retaining operator consent, unknown-outcome handling,
+  platform limits and the published-versus-candidate install distinction.
+
+### Upgrade boundary
+
+Opening each existing durable session with SDK 1.4 migrates its SQLite storage to
+schema 2. SDK 1.3 / Entwurf 0.41.0 refuses that session. Reinstalling the older package
+is not data rollback: restoring a pre-upgrade backup reopens the old data, but omits
+work done after that backup. Database restoration does not undo external messages,
+tool/file/network effects, meta records or mailbox read receipts. Preserve the newer
+set and inspect unknown outcomes before considering a restore or resend.
+Even a refused SDK 1.4 open can change the file header
+and sidecars while preserving logical rows (measured on a future-schema copy). Back up the complete target session
+file set before its first new-SDK open.
+
+Close the old owner normally and prove the process has exited before cutover. A
+stale lock is not proof: a bounded, SQLite-free fixture reproduced a stalled but live
+owner losing its lock. This lock behavior already existed in 0.41.0. Use the resume
+picker to select the intended session rather than guessing with `--continue`.
+
+SDK 1.4 counts a task SDK 1.3 left running as an interrupted run at its first open;
+SDK 1.4's own normal close does not add a restart. Repeated interruptions can park a
+task at the restart limit. Inspect outcomes before any resend; cancellation is not
+retry, and recovery of an actual parked model generation remains unmeasured.
+
+### Preparation and operating evidence — not final release acceptance
+
+Implementation checkpoint `3ed079b` follows independent source/proof reviews. Its
+earlier working candidate passed the deterministic FULL floor in 885 seconds with
+source/index unchanged, carrier 45 tests, storage conformance 11 tests, and ACP
+vendor rejection 14 tests. The final pre-commit vocabulary sweep then changed one
+harness-table SDK literal into a reference to the pin authority, independently read
+and checked. These are implementation-era observations, not this prepared version's
+FULL, native LIVE, installed artifact, operating-session migration or exact-SHA CI.
+
+Private sandbox observations separately cover old-package refusal, backup restoration
+and loss of later marker work, SDK task replay/parking, candidate shell open/close,
+SDK 1.3-born fixture identity carried into the SDK 1.4 shell, and in-process open
+failure releasing the session lock. Parked non-generation Hold tasks did not block
+root input; conversation abort cancelled only the non-background Hold. None proves
+real model-generation continuity or an operating citizen's actual upgrade.
+
+Kill-power re-measured at this shipped SHA: none (all 1178 committed claims not
+re-proved, #144).
+
+That required line records the source's preparation-time measurement state, not a
+prediction of later CI. GLG separately requested manual BODY evidence. The earlier
+validation SHA `ff86c88bd58ba776e15ef48e1e4be566971a3e9a` has a four-job green push run
+[39790950791](https://github.com/junghan0611/entwurf/actions/runs/39790950791) and a
+separate `workflow_dispatch qualify=true` run
+[39792701159](https://github.com/junghan0611/entwurf/actions/runs/39792701159): 85 lanes,
+1178 unique claims KILLED, survived/error/skipped 0. Those are that SHA's receipts,
+not this later prepared SHA's. Its requested exact-SHA CI/BODY results must be recorded
+separately in [#148's live evidence thread](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6348113761);
+no future result is invented here and the standing release policy is unchanged.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-dep-versions"]` 4/4 receipt 48d085e06816.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-pack-pin-matcher"]` 2/2 receipt 593dd0401502.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head addcb8cd0bac surface
+6a9481bc357c -- `["bash","run.sh","check-pi-durable-carrier"]` 35/35 receipt 258f783406a7.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head ff86c88bd58b surface
+7c75301f53a9 -- `["bash","run.sh","check-release-gate-outcomes"]` 21/21 receipt 251b71584442.
+
+Earlier-candidate PARTIAL (operator-attested, not this SHA): head ff86c88bd58b surface
+7c75301f53a9 -- `["bash","run.sh","check-mux-fresh-call"]` 150/150 receipt 56c3558f9a15.
+
+Both ff86c88 PARTIAL receipts were taken with the Codex fixture correction still
+uncommitted on that head, on the recorded working surface.
+
+The versioned working candidate's earlier FULL completed in 890 seconds, exit 0,
+with source/index unchanged (log SHA256 `757115f291c05f397631f6e8de48a2b77fdfde973d5219edf70e63658c3b8e88`).
+It predates later checkpoint metadata and is not a final committed-SHA CI result.
+
+**Actual operator transition:** after the human closed the original owners and their
+exit was proven with the scheme-aware owner classifier, the complete session file
+set was consistently backed up without opening SQLite. The exact Linux validation
+tarball (`92e5b2722ab8063d2bc50936db358a36a02a5e92e36babc3e1fbf98b399c2f44`)
+was accepted unchanged in a container, separately exercised through an isolated pnpm
+global old-to-new takeover, then installed as the operator's 0.41.1/SDK 1.4 runtime.
+User-scope extension loading and doctors passed. The coordinator resumed the actual
+old conversation: garden/native/createdAt/cwd stayed unchanged, a new owner attached,
+a real model turn recalled the pre-close agreement and used tools, and four
+send/read/reply/read receipts closed a round trip with an existing Claude Code sibling.
+The human-reopened Pi reviewer also confirmed its identity, model, tools and recall.
+No separate live DB query or universal transcript/parked-generation recovery claim is
+made. This addon-less Linux validation tarball is not the carrier-bearing release file.
+
+**Native aggregate:** the first run at `ff86c88` was MUST 23/1/0 and BEHAVIOR 1/0/0:
+the extra requested ACK was a fourth distinct call, not parser duplication. Its raw
+failure is preserved. After the scoped fixture correction, an affected fresh Codex
+run passed 66 assertions with both terminal audits exactly 3/3. The new full run at
+`a9d05847295230ed58f53b0bfd689d9ebd6ac1da` then passed **MUST 24/0/0,
+BEHAVIOR 1/0/0**, including the deterministic FULL; source/index stayed unchanged.
+The operator still used the **ff86c88 validation install**, not an installed a9d0584
+artifact. Its runtime closure (bridge dist, pi-durable carrier, bootstrap and resolver)
+was byte-identical to the checkout before and after the run; README and LIVE fixture
+bytes differ. This is checkout-gate evidence with that installed runtime, not a claim
+that the complete a9d0584 package was installed or accepted.
+Scratch `/tmp/entwurf-release-gate-0.41.1-r2.cl0DDR`, log `release-gate.log`, SHA256
+`020f489bf6fe024447bfc26a12f3499e5b80e844b0dcadf1e474e6adc8b4ae05`.
+P9 was a read-only census: root 4.9 GiB and home 6.9 GiB free, with the existing
+Emacs infrastructure identified rather than killed; current receipts and scratch
+were preserved. Only the explicitly owned test app-server was normally stopped.
+
+The final prepared-SHA push CI/manual BODY and Win32-bearing artifact acceptance
+are still pending. The validation tarball has no Win32 addon; it cannot stand for
+M3w or final macOS/Windows acceptance. No tag, GitHub release, npm publication,
+Herdr re-pin or laptop rollout has occurred. Earlier 0.41.0 receipts below remain
+historical.
+
+## v2026.10.22-herdr.0.41.0 — Herdr Entwurf plugin 0.41.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.41.0 and its
+`v0.41.0` tag remain unchanged. Core 0.41.0 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-22).** The `## 0.41.0` section below and the body of the
+[v0.41.0 GitHub release](https://github.com/junghan0611/entwurf/releases/tag/v0.41.0) are
+prepare-time and make-time text: their npm wording (the Herdr lock's "unpublished candidate",
+"npm publication each need their own approval") predates the publication. The publish is the later registry fact recorded in this section (`latest` 0.41.0,
+published 2026-10-22T04:37:02.853Z, registry bytes equal to the accepted candidate). Neither the
+published tarball's CHANGELOG nor the core release page is amended by this snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.41.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.41.0
+  rode to production npm source `@junghanacs/entwurf@0.41.0` with the registry's measured
+  sha512 (`sha512-hSf6St0u…fBlvA==`). The plugin manifest moves 0.40.0 → 0.41.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From the
+  `v2026.10.20-herdr.0.40.0` snapshot to `v0.41.0`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's resume/retire wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **What the acquired runtime now carries.** Core 0.41.0's lifecycle verbs ride in the runtime's
+  bytes: its installed bridge lists nine tools, `entwurf_retire_call` among them. Inside Herdr,
+  `entwurf_resume_call` still refuses as `herdr-resume-unsupported`. This snapshot measures no
+  retirement or resume through Herdr.
+- **Pi range unchanged.** The acquired runtime still accepts Pi `>=1.3.0 <1.4`; core 0.41.0
+  keeps the Pi 1.3.0 SDK set.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.40.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+- **README.** The first-user-path receipt description no longer says the installed
+  `check-bridge` lists an eight-verb set; it names the verb set the installed bridge declares,
+  nine since 0.41.0.
+- **Raw-install smoke scaffolding follows the Claude Code floor.** The first public-ref run of
+  `smoke-herdr-raw-install-live` at `cfdae0e` built its container with Claude Code 2.1.278, a
+  hand-kept pin from 2026-09-19, and the acquired 0.41.0 runtime refused to wire Claude below its
+  supported floor `>= 2.1.306` — the product's intended refusal, not a runtime defect. The smoke now
+  derives its exact Claude Code version from `package.json` `entwurf.claudeCodeFloor` instead of
+  retyping it. The product floor, the Pi, Herdr and Node pins and the smoke's end-state oracle are
+  unchanged.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.41.0 and `repair` 0.12.8-repair.1, 642 files, published
+  2026-10-22T04:37:02.853Z. The downloaded registry tarball is byte-equal to the preserved
+  accepted core candidate (SHA256 `2bd03ba900324a7c0882c2738c29593df0a1e4829fb3ae18d22be62186cf67ad`,
+  11399545 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`, so core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`; a sandboxed
+  global npm install of the same package passed its installed `check-bridge` with nine tools.
+  No model turn. The accepted run stripped every `PI_`, `ENTWURF_`, `CLAUDE`, `CODEX_HOME`,
+  `TMUX` and `HERDR_` carrier and ran on the branch worktree, whose only checkout input (the
+  bridge resolver script) is unchanged; an earlier run from the clean tag HEAD left `TMUX` and
+  non-identity `PI_*` variables set and is kept only as a preliminary record.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.40.0 runtime was seeded from its own committed lock (`036e268`); the swap to
+  0.41.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  both the ready journal's observed digest and the accepted candidate. The `installing` journal
+  carried the 0.40.0 identity as `previousRuntime` and the `runtime-ready` journal carries
+  `null`; when acquisition began the 0.40.0 tree was still at the active address. A manually
+  seeded torn swap (the active tree moved to the backup address with a half candidate in
+  staging; not a killed process) was restored before acquisition and reported `recovered:
+  torn-swap-with-candidate`. An exact re-request acquired nothing and left journal and tree
+  byte-identical, and the owned removal reclaimed cache, runtime and journal. The helper is a
+  leaf that probes no Pi, so these cells certify neither a Pi upgrade nor Herdr's
+  install/update relocation, harness wiring, the installed CLI's deactivate path, a model turn,
+  or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45),
+  `check-herdr-plugin-build` (21, its real-binary cell on herdr 0.9.5), `check-herdr-sandbox`
+  (12, a private herdr 0.9.5 server), `check-dep-versions`, `check-install-surface` and
+  `check-gate-manifests` (1173 committed mutants across 85 lanes validated, none executed).
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey of this npm pin, on Herdr 0.9.5 (the binary
+  `scripts/fixtures/herdr-supply.json` names) with Pi 1.3.0, from the public `main` ref rather
+  than the tag. Earlier npm or checkout-carrier receipts cannot certify these source-specific
+  axes. Those outcomes are recorded in the snapshot's post-push acceptance ledger, not in this
+  frozen text.
+
 ## 0.41.0 - 2026-10-22
 
 A sibling's garden id is its birthday, and this cut lets it rest and come back under it. A