@junghanacs/entwurf 0.41.2 → 0.50.0

package/AGENTS.md

@@ -16,6 +16,8 @@ Ask: does this follow capability rather than a surface name; record backend asym
 
 ## Architecture
 
+- **Product guidance:** root [ENTWURF.json](./ENTWURF.json) is the sole editable source for its extracted English payload families, currently MCP metadata, durable short variants (#154 C1-A), the static entwurf_v2 reject hints (C1-B), the static visible-resume (record/liveness) reject hints of entwurf_resume_call (C1-C), the static tmux launch-stage reject hints of entwurf_fresh_call and entwurf_resume_call (C1-D), five static delivery-result clauses of the entwurf_v2 dirty-lock and remote-pair receipts (E1a) and the text on either side of the record-less-socket reject hint's one code-owned slot (E1b). Compiled copies are deterministic transport, never another authority. Keep independent pre-extraction oracles intact; current metadata is checked against those originals plus explicitly reviewed literal amendment layers, not regenerated expectations. Payload revision is independent of releases/history-only edits. Metadata is not delivered to models; existing engraving/user-config contracts remain unchanged. Bootstrap, notices, the protocol-bearing mailbox envelope, receipt syntax and its annotations, other hints (including the slot-bearing model-invalid and task-too-long hints, the peers record-less-socket diagnostics, the shared ACP model hint, the preflight repair text kept beside its predicates and every herdr rail hint) and ACP text are not yet centralized.
+- **CLI description:** root [ENTWURF-CLI.json](./ENTWURF-CLI.json) is the sole editable source of the compact overview `entwurf --help` prints, the full documented catalog `entwurf help all` prints, the command page of `entwurf help <command>` / `<command> -h|--help`, as before, and the guide topics `entwurf help team` / `entwurf help remote-pair` print (#157: static text that reads none of the settings it describes; the package references it points the reader to (team.json.example and docs/setup-clean-host.md) ship in the package); `scripts/cli-help.mjs` renders it with plain `node` (builtins only, module-relative bytes, fail-loud with no fallback), so help needs Node. A command name there owns a description, never a dispatch: a small preflight before run.sh's unchanged case answers those exact help forms without entering an arm, refuses (exit 2) an undescribed name (`all` and the topic names are read-only views, not commands it dispatches: only `help <name>` reaches a topic, and `<topic> --help` is refused like any undescribed name), extra argv or `--help <command>`, and leaves the five vendor launchers' argv alone; the case and its source-defined gate functions own execution, and `check-install-surface` S9 compares the two independently, including the frozen set of commands still undescribed. The peer-facts, meta-facts, meta-bridge-fresh-cut and meta-bridge-prune leaves keep their own streams and exit codes, but their usage line is only a pointer to `entwurf help <command>`; other leaf usage strings (remote-pair-receive, meta-bridge-store-doctor), the undescribed commands, and the factual accuracy of inherited text beyond the reviewed amendments are not yet carried by it. It is separate from the MCP payload families of ENTWURF.json.
 - **entwurf-core (v2):** garden-id addressing, record facts, rail liveness, dispatch decisions, and delivery evidence.
 - **Record authority:** every citizen uses V3 `MetaIdentity`; `backend` selects rail capability, never identity rank.
 - **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and registers the compiled `entwurf-bridge` with Pi’s built-in MCP under that record’s identity.
@@ -69,7 +71,7 @@ A pi control session and native bridge session are citizens for the same reason:
 **Retirement is operator-requested, never autonomous.** A real citizen may be retired only when the operator explicitly requests that target/action, like the separate approval needed for a push. Development, tool exposure, a coordinator role, record-backed attribution or delegated release judgement is not a standing retirement grant. No timer, idle heuristic, roster cleanup or agent initiative substitutes for that request. Preserve request attribution without inventing a self-signed permission boolean or role database. Test-owned lifecycle gates require their own named execution scope; working siblings are never incidental test targets.
 
 - Pi owns its native session lifecycle; `birthPiCitizen` attaches `(backend: "pi", nativeSessionId)` to the stable garden id. Socket and env values are record-derived carriers.
-- `entwurf_resume_call {target}` is a separate lifecycle verb for pi and Claude Code targets, not delivery intent. It reopens the same dormant id visibly, submits no prompt, and uses the record as the sole address authority (Pi: the record selects an absolute transcript whose native id must match; its session-header cwd and first `model_change` provider/model feed the launch resolver, with no record/host cwd fallback; Claude Code: record session id and cwd, with no model or permission flag restored). Dormancy is rail-specific: a dead pi control socket, or — for Claude Code — the last validated owner the Entwurf hook armed is proven gone (`classifyMarkerOwner` dead) AND the record, re-read after that verdict, still carries the same non-null `attachIncarnation` (arm revision) the marker copied; an absent, unreadable, mismatched, inconclusive or unbound marker refuses. That guarantees only committed hook attaches: a process holding the session without one (hooks disabled, a record-arm lock timeout or store failure at its start) is invisible to it — a boundary GLG accepted on 2026-10-21. A launch receipt and the observation (same-id socket, or a NEW live owner in the opened pane re-arming the marker with a fresh binding the record carries) are distinct; an unobserved window stays visible. The caller is attributed, never authorised by that. Inside herdr it refuses; there is no herdr resume rail. No watcher, retry, or supervisor.
+- `entwurf_resume_call {target}` is a separate lifecycle verb for pi, pi-durable and Claude Code targets, not delivery intent. It reopens the same dormant id visibly, submits no prompt, and uses the record as the sole address authority (Pi: the record selects an absolute transcript whose native id must match; its session-header cwd and first `model_change` provider/model feed the launch resolver, with no record/host cwd fallback; Claude Code: record session id and cwd, with no model or permission flag restored; pi-durable: the record's native session and cwd, opened by `entwurf pi-durable --entwurf-adopt` with a closed `{v, gardenId, metaRoot, sourceGeneration}` context and the fixed five-name profile/meta-root projection, a bridge-only launch rather than an operator selector). Dormancy is rail-specific: a dead pi control socket; for pi-durable, a session claim the owner fence can reserve for one child — closed and released, or its holder proven gone — while a claim a live process holds, a reservation awaiting adoption included, refuses without delivery advice; or — for Claude Code — the last validated owner the Entwurf hook armed is proven gone (`classifyMarkerOwner` dead) AND the record, re-read after that verdict, still carries the same non-null `attachIncarnation` (arm revision) the marker copied; an absent, unreadable, mismatched, inconclusive or unbound marker refuses. That guarantees only committed hook attaches: a process holding the session without one (hooks disabled, a record-arm lock timeout or store failure at its start) is invisible to it — a boundary GLG accepted on 2026-10-21. A launch receipt and the observation (same-id socket; for pi-durable a child's adoption of this call's reservation, which is not readiness, liveness or recall; or a NEW live owner — the opened pane's direct child — re-arming the marker with a fresh binding the record carries) are distinct; while a reservation stays unadopted under its live holder a resume refuses on it, nothing clears it automatically, and a child that adopts it becomes its holder; an unobserved window stays visible. The caller is attributed, never authorised by that. Inside herdr pi, pi-durable and Claude Code targets reopen, in a new herdr tab (pi through agent start; pi-durable and Claude Code through one `layout.apply`, the Claude Code observation joining the receiver marker to the pane's direct child herdr reports, or `pane-process-unread` when it reports none — #157 stage 4, two n=1 runs on 2026-11-02: recall unmeasured in the first, a blind recall in the second) launched through the same injected seam by the same exact `HERDR_ENV=1` predicate fresh call reads (#157 G1a; the dated native-Pi n=1 in BASELINE records actual resume/protocol/no-turn/recall on a PATH-supplemented private fixture, not release acceptance; #157 B3's dated pi-durable n=1 there is a pre-final candidate with synthetic callers, and the tmux path is unmeasured); a failure after the tab exists is reported with its recovery rather than as nothing opened, and no rail falls back to the other. No watcher, retry, or supervisor.
 - **control-socket:** live send under per-target lock; dormant rejects.
 - **self-fetch:** active receiver plus deliverable mailbox; no resume authority. Sender/receiver joins are owner-kind specific and must not be generalized across vendors.
 - **native-push:** probe-alive direct injection; no mailbox and no resume authority.
@@ -121,7 +123,7 @@ implement → affected focused gates → independent review → one amendment bu
 - [ROADMAP.md](./ROADMAP.md) — direction and deferred work.
 - [docs/adding-a-harness.md](./docs/adding-a-harness.md) — entry route for a new harness.
 - [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) — mux ownership and launch contracts.
-- [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md) — herdr launch rail (#116): two-step placement, the one-line birth argv, and within-generation reclaim. `entwurf_fresh_call` selects it from process context (`HERDR_ENV=1`, pilot `pi | claude-code`), never from a caller parameter and never as a fallback either direction.
+- [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md) — herdr launch rail (#116): two-step placement, the one-line birth argv, and within-generation reclaim. `entwurf_fresh_call` selects it from process context (`HERDR_ENV=1`; agent-start `pi | claude-code`, one `layout.apply` for `pi-durable` — §16, #157 A-L1), never from a caller parameter and never as a fallback either direction; `entwurf_resume_call` selects its herdr launch by the same predicate (pi through agent start, §15, #157 G1a; pi-durable through one `layout.apply`, §17, #157 B3; Claude Code through one `layout.apply` plus a `pane.process_info` join, §15, #157 stage 4).
 - [docs/acp-backend-rail.md](./docs/acp-backend-rail.md) — ACP adapter contract.
 - [DELIVERY.md](./DELIVERY.md), [VERIFY.md](./VERIFY.md), [BASELINE.md](./BASELINE.md) — delivery coordinates, verification protocol, and evidence.
 - [README.md](./README.md) — operator-facing package contract.

package/BASELINE.md

@@ -105,7 +105,116 @@ and its owner's one installed schema certification accepted 1,847 records with z
 acceptance, not whole-parser equivalence. Resident processes remain unmeasured; broader runtime
 and release acceptance are not silently waived.
 
-Notes the table cannot carry without becoming prose again:
+### #157 Herdr Pi native round trip, 2026-11-01 (n=1)
+
+Not a certification row, release gate or other-backend acceptance. One private Linux aarch64 Herdr 0.9.5 server, source `c2032093f71b2dfc92bc49e9e85d96178a34b89a`, installed Pi 1.4.0 provenance and Node 24.18.1. Native Claude Code citizen915040 measured it; Astra567753 reviewed saved raw/records/transcripts and independently checked saved hashes/prefix/fact occurrence without another runtime probe. Main read the receipts and protocol/hash artifacts. Portable decisive evidence: [#157 runtime receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6553792285).
+
+| Axis | Measured |
+|---|---|
+| fixture | Private HOME/XDG/meta/control/lock/socket, empty target/caller cwds, existing real Pi agent-dir config/auth reference. Nix shell initialization overwrote PATH; a NEW fixture `.bashrc` prepended the existing pnpm bin. This is a PATH-supplemented fixture, not a pristine-HOME result; no operator profile/SDK was changed. |
+| seed/dormancy | Terminal seed ACK and a completed absolute transcript are bound by the V3 record to gardenId `20261101T135933-80116c`; the transcript header matches nativeSessionId `01a1957a-23ee-7314-a6d6-fca90682712e` and cwd, and its first model_change matches the canonical model. One test-owned pane close removed the original runtime/socket, preserving the record/transcript. No glob or manual record repair. |
+| actual public caller | Native Pi in private Herdr w1:p3 made exactly one resume toolCall with the target gid; its matching toolResult was non-error and carried separate LAUNCH/OBSERVATION for new tab w1:t2/pane w1:p4. Target gid/native/path kept; the returned pane joins the private server and target listener process. |
+| protocol/no-turn | One owner `get_info` RPC returned the same gid/cwd/model and idle=true. Stop-complete baseline and resume-complete/pre-recall transcript are both 65,049 B with SHA256 `aa7903edf56d6577466e42b59fa4ce86f5d3e3d85cfa04b70aff28e2f3188e29`; final 66,541 B keeps that exact prefix. |
+| recall/record set | One separately counted synthetic fixture sender used public `entwurf_v2`: control-socket sent, then the target recalled the unique seed value. The answer was absent from caller/recall/helper inputs. Records are exactly target/caller/sender, target identity preserved, locks empty. |
+| cleanup | One official private stop; saved raw supports the 12 tracked PID absences and four listener-path absences. 13 R4 visibility-helper rows remain, earlier helpers untouched. This is not total-descendant-zero. |
+
+A post-stop bookkeeping line failed to parse (unescaped find parentheses, exit2); it is retained. Separately authorized read-only recovery found no T/C/S gid entries in six real roots and matching before/after entry sets. This later snapshot proves neither a live-interval no-leak invariant nor unchanged file contents. Recovery also violated sequential-only scheduling with a seven-call batch: its racing first count was discarded and completed-producer sequential reads were used. These exceptions remain; review accepted the saved functional evidence, not a procedural-floor pass.
+
+Three logical user turns are not a measured provider-request count. Provider/billing, OAuth/vendor other writes, the null-to-filled transcriptPath transition and the MCP-timeout/cancellation boundary were not measured; the complete resume-ready seed transcript was observed, and the resume tool result returned in about 3 s. Confirmed real-agent-dir writes are two new transcripts and the target recall append. No pi-durable/Claude Code Herdr resume, registry artifact, aggregate MUST or release acceptance follows. Host artifacts: `/tmp/e157h/g1a-resume-r4/{RECEIPT.md,A10-READ-ADDENDUM.md}` and `raw/`.
+
+### #157 pi-durable exact native CLI selection, 2026-11-01 (n=1)
+
+Native checkout CLI evidence, not public garden-id resume or release acceptance. Subject: base `2aaf8562497abd78ff32a490929c80d233ad75bc` plus uncommitted B1 s2, work-surface SHA256 `e07908ea5d6aaab042ff1cd01a13fbd7c11c7932adf90019d875fdd35ad4799b`. Citizen915040 measured; Astra567753 independently read saved requests, kernel/process/marker/storage/cleanup artifacts and compared saved candidate seals; main read the receipts and decisive kernel/record artifacts. Notebook coordinator b22677 reviewed supplied source/receipt excerpts, not host-local bytes or runtime. [Portable source, PARTIAL and native CLI receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6555677872).
+
+| Axis | Measured |
+|---|---|
+| fixture/selection | One PATH-supplemented private Herdr0.9.5 server, Node24.18.1 and real Pi agent-dir reference. An input-free seed created gid `20261101T173050-ca665f` / native id `1793521850194-7520265c-2633-4740-8c21-0df272ede11d`. The second fixed command was `run.sh pi-durable --session <that native id>` in the same explicit cwd, with no provider/model/width/bootstrap/task/picker flags. This is the managed checkout CLI, not an installed-package invocation or an API-seam-only test. |
+| close/reopen binding | One intentional bound test-pane close; old host1045274/bridge1045313 then absent by ps and individual proc-stat ENOENT, with the known lock absent. Second layout result w1:t3/p3 and new terminal join actual host1046710/start65005448, compiled bridge1046764, private parent1044712 and new sender/receiver owner `linux:65005448`. Marker-candidate success alone was not accepted. |
+| identity/storage | One record retains gid/nativeId/cwd/createdAt; only recordUpdatedAt changes. Model/transcript/incarnation remain null; Herdr detection remains unknown. Only the same record-derived native directory/known lock were stat/listed; no external SQLite open/read/copy. Sizes/mtimes do not establish content preservation. |
+| cleanup/seal | One official private stop, eight specifically tracked PIDs absent, two scoped listener queries/socket paths absent, native lock absent and directory/metadata preserved. Eight visibility-helper rows remain, not all-descendants-zero. Source/index/NEXT/new files/launch7-carrier+pin/dist97 manifests compare equal across the observation. Six-root/gid snapshots are not interval/content non-leak proof. |
+
+The same s2 candidate has four separate affected PARTIAL receipts: carrier39/39, beside46/46, install-surface44/44 and manifest-head52/52 killed, green controls/restoration/stable seals; the other1179 mutants and FULL were not run. Separate bounded raw witnesses reached NOT-HERE's own missing-id refusal assertion and ENV's first-file-mode config name/version mismatch, not just integrity/shared-beforeAll failure. The initial declared95/actual100 inventory HEAD failure remains a failure before any mutant; its one-line declaration correction is part of s2. Earlier pre-inventory package/installed-consumer proof is not transferred to this exact candidate or to installed `--session` execution.
+
+Functional observation was accepted, not a clean-procedure floor. Retain five parallel read-only helper reads, semicolon status captures, bundled multi-rc observations and kernel/storage brace groups whose components lack individual statuses; actual printed PID/PPID/starttime/cwd/stat values were cross-joined, not inferred from outer0. Interactive G3 shell preflight was not repeated; non-interactive fixture checks were used. No unexpected error was recorded in retained observations, not universal error absence. No `entwurf_retire_call` or working-citizen retirement occurred; the authorized test runtime was intentionally closed once. No deliberate input does not prove provider/vendor/billing zero. Public pi-durable addressed resume/B3 fencing, stalled-owner safety, working watch/delivery, recall, headless use, content invariance, exact installed artifact, final native/CI/release acceptance remain separate. Host artifacts: `/tmp/e157h/b-l1/{RECEIPT-PARTIAL.md,RECEIPT-CLOSURE.md}` and `/tmp/e157h/g3-b1-native-session-r1/RECEIPT.md` with scoped raw.
+
+### #157 Herdr public pi-durable fresh, 2026-11-01 (n=1)
+
+Not a certification row, release gate, installed-artifact or other-backend acceptance. Subject: HEAD `d6129139ad9738a3bc0ade9b5ef3abbac4b7580f` plus the uncommitted A-L1 work surface (tracked diff SHA256 `bccf722d11796003294486f298fec088fe008e4b91cbf3f0cbcfc1ee7f8596b5`, 731-file source surface `79ff55b9b1fbad7d3c7864d9c7f8929a7996673da7146f3a879f09d2125c327c`), run on the checkout compiled bridge from the A-L1 package proof (97-file dist seal `e32433cb699c2141a60c9141516559d38079e81f5a14123925a5a72f377c2734`). One private Linux Herdr server (Herdr version and architecture not re-read in this run), Node 24.18.1 per `/proc/<pid>/exe`. Citizen915040 measured; Astra567753 independently accepted the saved raw, records, kernel/view/cleanup artifacts and seals (d74d42); main read the receipts. [Portable LIVE receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6557466848).
+
+| Axis | Measured |
+|---|---|
+| fixture | New private HOME/XDG/meta/control/lock/socket root. The env allowlist is the G1a one plus the two `verify_deps_before_run=error` flags; existing real Pi agent-dir reference; PATH-supplemented like G1a (interactive preflight output identical after path normalization). No operator profile/SDK/PATH edits or credential copies; SDK/vendor OAuth refresh writes were not measured. |
+| topology | One workspace. Before launch: focused root pane w1:p1 in directory A, unfocused caller pane w1:p2 in directory B, A ≠ B. After launch: w1:p1 still focused in A. These are two end-point views; focus continuity and cross-workspace selection are not measured. |
+| actual public caller | Native Pi caller `20261101T203132-e82002` (openai-codex/gpt-6.1-sol; thinking level a separate entry) made exactly one `entwurf_fresh_call` toolCall with args exactly {backend `pi-durable`, model `openai-codex/gpt-6.1-sol`, the approved task} — no cwd, no placement, no other tool call. Its paired toolResult was non-error: the Herdr layout receipt with cwd B from "this agent's own process directory", the checkout `run.sh` runtime, tab w1:t2 / pane w1:p3, nonce `mux-fresh-call-c8406ed0bdefea1fdc2940a9`. A one-shot read-only matcher, statically preflighted on synthetic 0/6/7 cases first, passed 27/27 on the record-selected transcript. |
+| callback/join | The caller received exactly one `entwurf-message`: body the nonce alone, sender `20261101T203137-97561c` (pi-durable, cwd B, no wants_reply). That gid joins its private V3 record (pi-durable, native id `1793532696952-5eb222ef-08fd-46ee-a4c0-587cf1d0d330`, cwd B, model/transcript null), receiver and sender markers (owner 1244328, `linux:66079156`), process-info of the returned pane (bootstrap with the requested provider/model and the callback-first framed task as argv), `/proc` (cwd B, parent = the private server, starttime = the marker key, one child = the checkout compiled bridge) and the returned view (w1, new tab w1:t2, cwd B, observed unfocused). |
+| cleanup/seal | Revalidated test-owned close of w1:p3 only; one immediate observation found host and bridge absent and the native lock released. One official private stop; nine tracked PIDs and three named listener paths absent. Six real-root before/after listings equal (snapshots, not interval/content non-leak proof). New real-agent paths preserved: the caller transcript (70,038 B; C's `SEEN` turn was appended after the callback message arrived, and the file was identical at the recorded pre-/post-stop snapshots d07, d13 and d14) and the record-derived pi-durable native directory; no SQLite open/read/copy. L0 equals the package p2 seal and L1 equals L0, including all 97 dist bytes/modes/mtimes. |
+
+Observed order: the caller's turn ended `LAUNCHED`, the callback arrived about 2.5 s later and opened a separate caller turn ending `SEEN` — an observation of an idle receiver, not a rule (a busy one receives it as a steer). The same candidate has five affected PARTIAL receipts (165/165 killed; the other 1218 mutants and FULL not run) and a current-artifact package proof (`check-pack` 660 files, `check-pack-install` smoke and self-fence pass, tarball SHA not retained); none is exact retained-artifact or release acceptance.
+
+Which tool produced the callback (`entwurf_callback` versus `entwurf_v2` carrying the same nonce) and whether it was the target's first action stay requested, not measured: the target transcript lives in the pi-durable SQLite, which was not accessed. The framing also asks the sibling to send its final result with `entwurf_v2`; no second message reached the caller before the stop, which proves neither that one would or would not. Target ACK, the target's actual runtime model, inbound watch/delivery (a receiver arm is not a watch), recall, request/turn/billing counts, OAuth/vendor writes and the Herdr env pair (environ not read) are unmeasured. At this R13 subject, omitted agent-start cwd and aggregate status narration remained open; the later A-L1x/A-L2 source and R2 observation below supersede those gaps, not this older LIVE subject. Procedure exceptions retained: two read-only print lines used `;` after every value was in its own rc file; one report line misstated the tmux session count and was corrected; the package P1 seal comparison stopped on an authoring SyntaxError and resumed only under a named recovery. Host artifacts: `/tmp/e157h/a-l1-live-r1/RECEIPT.md`, `/tmp/e157h/a-l1-matcher-preflight-r1/RECEIPT.md`, `/tmp/e157h/a-l1-package-r1/RECEIPT.md` and `/tmp/e157h/a-l1-qualification-r1/RECEIPT.md` with scoped raw.
+
+### #157 Herdr Pi caller-cwd and declared RAILS status, 2026-11-01 (n=1)
+
+Owner915040 measured; Astra567753 independently read and accepted the saved evidence (ffee1a); main read the full receipt. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6559408491). Subject: HEAD d6129139 plus tracked diff451163b0… / source733, SHA5a503455…; package p2 and LIVE L0/L1 full JSON equal, including the 97-file compiled seal `ed698d3af56e52cd6d591a471acfdef73d789c73cb3b25a131a205823a519110` (mtimes included). Subsequent documentation promotion is a different work surface. This is not FULL, exact retained-artifact, CI, B3, stage3 or release acceptance.
+
+Genuine native Pi C `20261101T232917-5b8331` made one public fresh call with backend pi and no cwd/placement. Matcher0/28 joined nonce `mux-fresh-call-b491697267d4743dd41087a8` to sender T `20261101T232923-e6837d`, V3 pi record/header native id `01a19783-d8cd-74ef-b3aa-78c86f3b9cb9`, socket/unique foreground1451707, kernel shell1451684→private server1451076 and checkout bridge1451763. Receipt/record/header/kernel/view cwd=B≠focused A; pane w1:t2/w1:p3/term_65f37daffbd813 had agent pi and an actual agent_session object bound to T's transcript. Focus is endpoint observation only. Revalidation preceded the bound pane close; T/bridge and socket absence were observed. Official stop1 returned0/0; eight tracked PIDs/four named listeners were absent, six real-root listing snapshots equal. Tee/p1-shell exits remain unmeasured. Native JSONLs were preserved; only T's header was read.
+
+The source-owned status entry returned leaf0/tee0/stderr0B under its one-step node-only PATH/absolute HERDR_BIN/private-root override. It printed 3 fresh backends=AS2+LY1, correct domain labels/order and PD no-kind/no-detection note, no `--kind pi-durable`, and citizens `entwurf-not-found`. This is a source declaration, not host capability, installed overlay or installation proof. AS detection is measured here; LY contrast cites the separate R13 LIVE. Current affected qualification153/153 and pack/install660 were separately accepted; other1233 mutants/FULL were not run, and tarball SHA was not retained.
+
+R1 stopped on a contract-required argv tail while process-info displayed `["pi"]`; old evidence already had that shape. Its raw/STOP and procedure exceptions remain. Independently reviewed R2 removed only that unnecessary requirement, keeping unique foreground/socket PID, shell/kernel/view/cwd/status checks mandatory. Startup flags/actual T model rail/ACK/completion/exact callback verb or first action/billing/env pair/timing remain unmeasured. `agent_status=done` is not task completion. C snapshot byte equality supports only no additional persisted entry visible in the compared snapshots, not volatile receipt/arrival or future absence. Grouped captures/reads, launch chain, bounded socket wait, formatting tools and s05 sed construction remain procedure exceptions, not clean-procedure acceptance. Local evidence: `/tmp/e157h/a-l1x-live-r2/RECEIPT.md` SHA88fa5173b5d5e848a5d5333c19325e838a7812959829a7b668c8fe1fdcaa310f; R1 plus its addendum are preserved alongside it.
+
+### #157 B3 locator, lifetime fence and mandatory-unit supply checkpoint, 2026-11-02
+
+Source and isolated focused evidence only, not a certification row, frozen FULL, current-candidate kill-power, package acceptance, Native LIVE, public pi-durable resume or stage3 completion. HEAD d6129139 plus the uncommitted C4/fence/supply surface is the measured subject; a later checkpoint commit does not retroactively certify its exact SHA. [Portable closure and original exceptions](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6561973609). Owner915040 measured; Astra567753 independently accepted saved source/focused evidence, and main read the receipts.
+
+C4 preserves the actual native directory as a canonical, record-bound location carrier under the actual receivers root, using the existing record-arm lock and attachIncarnation. Its three non-atomic pair failure states remain explicit; a matching pair is not birth success, receiver activity, dormancy or guarded enrollment. Source closure e5ddd5 and compiled-consumer recovery c67cb1 are separate subjects (`b3-c4-proof-r2/RECEIPT.md` SHA380dd2c8…; `c4-compiled-recovery-r2/RECEIPT.md` SHA3c081f57…, under `/tmp/e157h/`). No MetaIdentity key or store-reader rollout was added.
+
+The pre-lease fence excludes cooperating owned openers at one physical in-D resource using owner PID/start-key/host, fresh generations and one transaction hold per decision/write; it precedes the SDK lease on every owned route. Live/uncertain owners and a transaction residue fail closed without age takeover; an unrelated atomic temp stays inert and preserved, and a collision on this writer's own temp name fails without removing the existing entry. Attempted init failure is not never-opened; failed/unknown first storage close and lease outcomes remain distinct from environment cleanup. It does not establish SQLite health, unmanaged-opener exclusion or recovery success. D1–D4 source/focused amendment accepted as574475 (`b3-fence-amendment-r1/RECEIPT.md` SHAc76a0a81…): root48files873, helper16, durable109, carrier58, native14, install/capability37/bridge19, four type fences and lint returned0. The canonical emitted runtime SHA is37fe7bc4d66232032bb59afe18931ce25f6286bcd9747f2fbcf09d45044a1790; SDK/origin version set remains1.4.0.
+
+Supply follow-up ff250b (`b3-fence-supply-l1/RECEIPT.md` SHA867ddf90…): the fixed compiled owner-fence unit is the fifth precreation presence check, after the four existing units, with its own named refusal. It proves presence only, not integrity/importability. All14 saved groups returned0, including root48files874/durable110/carrier58/native14/Herdr47+21/MUX343, four type fences, lint, install/capability37/bridge19. No emitter ran in this leaf; only two compiled verifier/preflight bytes changed, with a new99-file/108-entry build/mtime subject and equal postbuild/postgate seals. Static139 durable mutants/1425 unique claims are inventory, not executed qualification. The older fresh-call LIVE/PARTIAL/package subjects above remain separate.
+
+Original formatter-stop/unauthorized-write, first compiled-oracle STOP, missing old-dist byte backup/early tmux removal and read-error/recovery histories are retained; later green does not make those procedures clean. GLG separately approved the bounded in-D app metadata write/residue cost ([6560478307](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6560478307)), not SDK DB access, ownership correctness or public resume. Parent reservation/adoption, exact SDK profile provenance, metadata-root closure and public admission remain the next contract; public pi-durable addressed resume stays refused. GLG requested a local-only intermediate checkpoint on2026-11-02; final affected qualification/FULL/native floors and final commit/feature push remain separate, with no main/release inference.
+
+### #157 B3 Herdr public pi-durable same-id resume, 2026-11-02 (n=1)
+
+Not a certification row, release gate, final-candidate LIVE, tmux-path or installed-artifact acceptance. Subject: candidate `82b5ec36` = HEAD `46c7c776` plus the then-uncommitted stage-3 diff (NEXT excluded), on the checkout compiled bridge (managed dist manifest `c9a3befa…`, 99 files); it precedes the later provider-close fix, R17/R18 wording and the final checkpoint `43594eba`, none of which inherits this observation. Owner915040 measured; main read the complete receipt `/tmp/e157h/s3-pd-live-r1/RECEIPT.md` (`71c21b37…`), not every raw leaf. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6566126053).
+
+| Axis | Measured |
+|---|---|
+| fixture | Private HOME/XDG/meta/control/locks/sockets and a private Herdr server. The operator-selected model `openai-codex/gpt-6.1-terra` ran under the existing SDK profile (approved normal use; no credential copy, symlink or proxy); new native data is confined to one new test-cwd hash. Callers C1/C2/C3 are synthetic fixture records, not real Claude Code or other model sessions. Provider/billing/OAuth writes were not measured. |
+| seed/close | C1's public `entwurf_fresh_call` opened target T `20261102T091526-fdad9c` (native id `1793578526845-ff5d0b8a-…`) in a private Herdr tab; T returned its nonce callback. The first close committed storage closed and lease released; the record stayed byte-equal. That host needed a second exit signal, the linger later repaired with API0 loopback evidence only. |
+| public resume | C2 called `entwurf_resume_call` with target T only. The bridge reserved generation `85ee35c3…`; ONE `layout.apply` opened a new tab w1:t3 / pane w1:p3; the observation was `adopted` after 1503 ms. Garden id, native id and cwd were unchanged; `attachIncarnation` changed and the C4 owner and claim owner became the child, whose argv carried `--entwurf-adopt` with the closed four-field context and no task/provider/model/session flag. The receipt said no prompt was submitted (SQLite stat unchanged there — metadata, not content). |
+| recall | C3 sent T a question without the seed fact through `entwurf_v2`; T answered with it. The fact was counted zero times in the question, helper source, identities, argv and resume artifacts, once in the seed and once in the answer. No SQLite content read or transcript hydration; one seed and one recall target-model turn, no caller-model turn. |
+| cleanup | Official private Herdr stop returned 0; ten tracked PIDs and both sockets absent; operational metadata-root listings equal before/after. The new native directory and four fixture records are preserved. |
+
+Unmeasured and not inherited: the tmux path, the final candidate, a real Claude Code or other real caller, billing, native byte equality, G-abandon, exact-SHA CI, registry/release acceptance and operating-reader rollout.
+
+### #157 stage 4 Herdr Claude Code same-id resume, 2026-11-02 (n=1 ×2), and operator vendor-data changes observed during the runs
+
+Not a certification row, release gate, LIVE MUST, tmux-path, installed-plugin-runtime or registry acceptance. Subject: HEAD `2734f524` plus the uncommitted stage-4 worktree. The first run (H2) used compiled `herdr-resume-call.js` `f507a42a` / `entwurf-v2-visible-resume.js` `3718fccc`, before the D1 hint fix and the review text fixes. The second (N2) used source `herdr-resume-call.ts` `ebfbdd6a` / `entwurf-v2-visible-resume.ts` `195535a4`, compiled (q10) to `6636324c` / `0eddf418` — the same source and compiled bytes as the stage-4 PARTIAL/FULL floor. Neither observation is inherited by the later docs bundle or by a final candidate. Owner915040 measured; main read the receipt `/tmp/e157h/s4-cc-a/RECEIPT.md` and the launcher/version-store state directly, not every raw leaf. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6573387199).
+
+**Operator impact first.** The operator's real Claude Code installation changed twice inside these runs' windows, separately from the product behaviour below. H2's change points into that run's own fixture; N2's is tied to its run by timing only. No writer pid was recorded for either:
+
+| Event | Measured | Not established |
+|---|---|---|
+| H2 launcher relink (16:38:20 KST) | `~/.local/bin/claude` was repointed from `~/.local/share/claude/versions/2.1.316` to a copy under the fixture's `XDG_DATA_HOME` in `/tmp` (same sha256 `55cdb8e1…`). H2 paired the real HOME with a fixture `XDG_DATA_HOME` without the existing #67 launcher fence (`scripts/lib/claude-launcher-fence.ts`), rebuilding the precondition recorded at `scripts/smoke-herdr-fresh-call-live.ts:402-416`. Main restored the original link at 17:24:53 with GLG's approval; readlink, realpath and sha were re-read equal. | The writer pid; the resumed claude is a timing-only hypothesis. |
+| N2 version-store loss (17:27:08 KST) | Under the #67 Herdr form (only fixture `xdg-data/claude` linked to the operator's data directory; launcher fence `problems=[]`), `~/.local/share/claude/versions` went from 2.1.312/314/316 to 2.1.314/316, at the same instant (17:27:08.68) as that run's fixture gained `xdg-cache/claude/staging` and `xdg-state/claude/locks` (names and mtimes only). The active 2.1.316 link and bytes are unchanged. No copy of 2.1.312 is known and its sha was never recorded; nothing was restored, re-downloaded or reinstalled. | The writer pid; whether an ordinary operator `claude` run prunes the same way; harmlessness. "Not the launcher target" does not mean unused. |
+
+The #67 fence certifies launcher integrity, not the whole shared vendor store. Each run's real-HOME check covered the entry names under `~/.pi/agent/meta-{sessions,mailbox,senders,receivers}` and `~/.pi/entwurf-v2-locks` (unchanged, no fixture gid) and `~/.claude/projects` (one new directory per run, for the fixture cwd). It is not a whole-HOME invariance proof; the two events above are its counterexamples. Further native runs stopped here.
+
+| Axis | Measured |
+|---|---|
+| fixture | One private Linux aarch64 Herdr 0.9.5 server (installed binary sha256 `17d7536f…` equals the pinned asset in `scripts/fixtures/herdr-supply.json`) and Claude Code 2.1.316. Real HOME (approved: vendor auth and native records); XDG ×5, the four meta roots and `PI_CODING_AGENT_DIR` are fixture, except that in N2 only, fixture `xdg-data/claude` was linked to the operator's `~/.local/share/claude` (the #67 Herdr form). Callers are synthetic fixture records with zero model turns. |
+| layout join (H1, no model) | A harmless program opened by ONE `layout.apply`: its self-reported pid equals `pane.process_info` `shell_pid` and the foreground pid; its self-read starttime equals the kernel's, so it is the same incarnation; its kernel parent is the private server. In H2 the agent-start pane's direct child was bash, with claude beneath it — the reason the Claude Code resume uses the layout launch. |
+| H2 resume | Public `entwurf_resume_call` through the compiled bridge: `[entwurf resume call ↻ herdr]`, `receiver-armed` after 2035 ms. Pane child = marker ownerPid = kernel pid; kernel starttime = marker startKey; parent = private server; cmdline `claude --resume <session>` with no prompt or model; same gid, session and createdAt; `attachIncarnation` refreshed and equal to the marker's. |
+| H2 recall | **Not measured.** The doorbell woke one turn; the model declined to read the mail, citing its seed task's "and stop" (a screen reading, not a product diagnosis); no reply in 480 s (helper rc 3); the mail stayed unread. 2 submitted turns, 5 provider requests. |
+| N2 resume | The same public path: `receiver-armed` after 1523 ms; the same pid/starttime/parent join; `attachIncarnation` `0644e2aa`→`f0cb63fc`, equal in record and marker. |
+| N2 recall | Blind: nothing on the resume or recall path re-injected the seed fact — it was absent from the resume argv and context and from the recall question (the seed turn itself carried it). The target read the mail through its inbox tool with no refusal (`.delivered.read`, lastReadAt 08:27:15Z) and replied `scene-32744819`, the seed fact. 2 submitted turns, 7 provider requests; all 8 assistant entries are `claude-sonnet-5-5`; the resume passed no `--model`. |
+| cleanup | Private server stopped (rc 0 in both runs); tracked pids absent (H2 6, N2 11), no listeners. The h2/h3 trees and native records are preserved. |
+
+Unmeasured and not inherited: the tmux Claude Code path at this candidate, n>1, billing and OAuth writes, `~/.claude.json`, the final candidate, exact-SHA CI, any installed plugin runtime pin, and registry/release acceptance. Host artifacts: `/tmp/e157h/s4-cc-a/{RECEIPT.md,h1/,h2/raw/,h3/raw/}` (incidents: `h3/raw/x00-claude-link-mutation.txt`, `h3/raw/x01-vendor-version-loss.md`) and `/tmp/e157h/stage4/{LAUNCHER-RESTORE.md,CURRENT-N2-AND-FLOOR.md,QUALIFICATION-AND-FULL.md}`.
+
+Notes on the release-host certification table above:
 
 - **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
   candidate `.tgz`, checkout-invisible non-root global install, PATH shims, a frozen

package/CHANGELOG.md

@@ -4,6 +4,334 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.50.0 — 2026-11-02
+
+Same-id resume now reaches every resumable backend on both launch rails. A dormant pi, pi-durable or Claude Code citizen reopens under its own garden id in a visible tmux window or, inside Herdr, a new Herdr tab, with no fallback from one rail to the other (#157). The CLI gains one description source, safe help and a thin `entwurf claude` entry (#153, continued in #157).
+
+What this release is not: it adds no MCP tool (the nine tools of 0.45.0 are unchanged) and no new authority. No resume submits a prompt. A Claude Code resume restores no model or permission flag. A pi resume still launches with the provider/model the transcript's first `model_change` records. Delivery still never starts a process. Herdr is not re-pinned to npm here. An npm lock must name a published version, and 0.50.0 has no published bytes while it is prepared, so `plugins/herdr/runtime-lock.json` returns to the closed `herdr-checkout` verification carrier, as earlier release candidates did. From the moment the prepare commit reaches main, a main-tracking Herdr install builds its runtime from the checked-out commit instead of npm, and a host already on the npm 0.45.0 runtime must run `herdr-plugin-deactivate` before it reinstalls. The published 0.45.0 pairing stays pinned by the Herdr tag `v2026.10.27-herdr.0.45.0`. The Herdr manifest version is unchanged; a separate snapshot re-pins npm after 0.50.0 is published.
+
+### Same-id resume across rails (#157)
+
+- **Pi inside Herdr.** `entwurf_resume_call` reopens a dormant pi citizen in a new Herdr tab through agent start. The rail is selected by the same `HERDR_ENV=1` predicate fresh call reads. Workspace drift and agent occupancy refuse before start, and a failure after the tab exists reports its recovery rather than "nothing opened".
+- **pi-durable, on tmux and Herdr.** A dormant pi-durable citizen reopens through an owner-fence reservation and `entwurf pi-durable --entwurf-adopt` with a closed bootstrap context; Herdr uses one `layout.apply`. The observation is adoption (`adopted`, `not-yet-adopted`, `reservation-lost`, `unobserved`), not readiness or recall. A reservation awaiting adoption under a live holder refuses a second resume and is never cleared automatically.
+- **pi-durable session handling.** It adds exact native session selection for the current cwd (no picker, no model override) and Herdr fresh through one layout request with lifetime fencing. Known reserve/withdraw writes survive release failures, and reservation holders are kept distinct from addressable citizens.
+- **Claude Code inside Herdr.** The target opens through ONE `layout.apply` running `claude --resume <session>`. ONE `pane.process_info` then reads the pane's direct child, and that child is joined by equality to the receiver marker's owner, under the same dormancy, startKey, fresh-binding and record checks as tmux. If the child cannot be read, the observation is `pane-process-unread`: it does not wait, close or retry. On the resume path only pi uses agent start, because agent start types into the pane's shell; a fresh Claude Code sibling inside Herdr still opens through agent start.
+
+### CLI (#153, #157)
+
+- **One description source.** `ENTWURF-CLI.json` is the description source. Exact help forms (`entwurf --help`, `help all`, `help <command>`, `<command> --help`) are answered before dispatch, and an undescribed name is refused. The root page is task-oriented and the documented catalog lives under `help all`. The guide topics `help team` and `help remote-pair` ship with `team.json.example`.
+- **`entwurf claude [args…]`** (#157 stage 4) execs the `claude` on PATH with argv, cwd, exit status and signals unchanged. It removes an inherited `PI_SESSION_ID`/`PI_AGENT_ID` and exports only `ENTWURF_CLAUDE_LAUNCH_ACTIVE=1`. Two recursion fences refuse a re-entry. Citizenship still comes from the hooks `install-meta-bridge` installed.
+- **Maintainer-facing.** Development gate dispatch is deduplicated with operator commands, help and exit behavior preserved.
+
+### Herdr plugin
+
+- **One receipt-owned operator link.** An explicit, PATH-qualified expose/withdraw pair carries a schema-3 activation floor, staged candidate admission and a link teardown that preflights everything first. Installed dev-bin mutations stay source-only.
+
+### Agent guidance
+
+- `ENTWURF.json` payload revision 11 → 19 (schemaVersion 6). It adds the Herdr pi resume rail (12), pi-durable inside Herdr (13), the 2048-character host-cap rewrite of the `entwurf_fresh_call` description and its restored contract phrases (14–15), the fresh-call cwd parameter's echo sources (16), pi-durable same-id resume (17–18) and Claude Code resume inside Herdr (19). Each is a reviewed amendment layer over preserved originals.
+
+### Upgrade
+
+- **Checkout-run hosts** refresh the bytes each surface actually loads. Ordinary Pi and pi-durable require `pnpm run build-bridge`, accepted output/SDK verification, then a new host process; copied hook/extension units require their owning installer. Follow [Applying new source to a running host](docs/setup-clean-host.md#applying-new-source-to-a-running-host) before restarting sessions. An already-running bridge keeps the modules it loaded.
+- **Claude Code hosts** re-run `entwurf install-meta-bridge`, which re-assembles the plugin copy, then restart open Claude Code sessions in the operator's own order, one by one. No working session is stopped automatically. A rollout is complete only once each participating reader is verified on the new bytes.
+- **npm consumers** re-run `entwurf setup` in the same scope, then `check-bridge`.
+- **Herdr plugin hosts** that already installed the npm 0.45.0 runtime keep running it until they reinstall; that pairing stays pinned by the Herdr tag `v2026.10.27-herdr.0.45.0`. An install that tracks main after this prepare builds its runtime from the checked-out commit through `herdr-checkout`, and a host switching from npm runs `herdr-plugin-deactivate` first. A separate snapshot re-pins npm 0.50.0 once it is published.
+
+### Dated native observations (BASELINE; not floors)
+
+- Herdr native Pi same-id resume n=1 (2026-11-01).
+- pi-durable Herdr public resume n=1 on a pre-final candidate.
+- Claude Code Herdr resume, n=1 ×2 (2026-11-02). Recall was unmeasured in the first run and measured blind in the second.
+- **Operator impact recorded with those runs.** The launcher relink was restored with approval. Claude Code 2.1.312 was lost from the shared vendor store; the writer pid was not measured and harmlessness is not established.
+- No named LIVE or release gate covers same-id resume inside Herdr or pi-durable same-id resume. Herdr fresh call has its own on-demand LIVE (`smoke-herdr-fresh-call-live`).
+
+### Release evidence
+
+- Pre-version landing: `6f4dc72`, exact-SHA push CI run 41427433295, all four required jobs successful. This is the landing SHA's evidence, not the prepared SHA's CI.
+- Prepare-time floor and LIVE gate: working tree over `6f4dc72`, patch `020a024c978cd5700f5e76fb60d59af55eb8c00bd1cd59357b9ed4f75042293a`, before the final evidence/upgrade wording. `release-gate --cut` ran once from 22:37:28 to 22:59:33 KST (1325 s), with `check:full` 1008 s exit 0, MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut OK. Scratch/log: `/tmp/entwurf-release-gate-0.50.0-r3.CMLPOf/release-gate.log`, SHA-256 `c66729b4bf26a36091e43697d1a9056b56dc2b659c472fb222d6e449accba086`; 99-file compiled manifest `69c4cafa8c80c1927853f71e2cfa473cdb292c79e1f86ade008c2070fd41a8c4`. [Shared receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6579130897). Codex CLI 0.166.0 used a test-owned app-server with models `gpt-6-luna` / `openai-codex/gpt-6.1-terra`.
+- Earlier prepare candidates remain RED: the first FULL failed on the npm lock/package mismatch; the first LIVE gate returned MUST 20/4/0 (stale OMP writer, two 1 MiB capture overflows, Codex 0.162.1 callback timeout); the second returned MUST 23/1/0 (the moved README floor declaration). The Codex timeout's cause remains unknown: queue acceptance is not a model-read receipt. No older LIVE/static results were combined into the final aggregate.
+- Operator-side changes outside the package: OMP birth/receive units were reinstalled through ownership-matched installers and their doctors passed; GLG updated Codex to 0.166.0. Claude Code launcher and 2.1.314/2.1.316 file fields/hashes matched before/after the final gate. This does not prove whole-HOME invariance, erase the earlier 2.1.312 loss, or prove every already-loaded reader was refreshed. The x02 unintended vendor invocations were stopped; other HOME writes/request usage remain unmeasured.
+- The gate validated the manifest's 1497 claims across 94 lanes without executing the qualification body (#144). Exact prepared-SHA CI, the mandatory M3w Windows carrier tarball and unchanged-file Linux acceptance, installed-host acceptance and operating rollout/restart need their own receipts. The local floor is not those proofs. npm publication is GLG's own action.
+- Kill-power re-measured at this shipped SHA: none (all 1497 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 674887de2ffb surface 3410eb4abb62 -- ["bash","run.sh","check-install-surface"] 39/39 receipt 96e54476fdea
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 29179171d2a5 surface 416486bb2dd7 -- ["bash","run.sh","check-install-surface"] 44/44 receipt 4c3aa18d303a
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 85f3fd0d966f
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 61/61 receipt 720cd58c7ade
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-fresh-call-dispatch"] 13/13 receipt 5b95fbbb0909
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-fresh-call-provider"] 3/3 receipt 2106ba968015
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt 862a41c278d7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface e67f76c5feb6 -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 61/61 receipt 6342ca495393
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-pi-durable-carrier"] 39/39 receipt 685a8c6dfa7d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-pi-durable-beside"] 46/46 receipt c3817aba8552
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-install-surface"] 44/44 receipt baa8ddb8c3d2
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-gate-manifests"] 52/52 receipt fbd7c0a7f297
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-herdr-fresh-call"] 59/59 receipt 593e9193286d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-fresh-call-dispatch"] 15/15 receipt 07b0b36dadca
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 8a186fd0790c
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-herdr-plugin"] 25/25 receipt a3f9c21cca50
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-gate-manifests"] 52/52 receipt f9c17068de14
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-herdr-fresh-call"] 61/61 receipt 1be9d472a202
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-herdr-plugin"] 26/26 receipt 3124d7184d34
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 0e84ba092a95
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-gate-manifests"] 52/52 receipt 22b2be63719d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 96604c251769
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-tests-beside-behavior"] 74/74 receipt de7bd99c0627
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt bda6d08af94f
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 80/80 receipt 930c572bd121
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-pi-durable-beside"] 51/51 receipt 29b846b0ead9
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 783f01aa8b0c -- ["bash","run.sh","check-pi-durable-carrier"] 51/51 receipt 709e9f7bb632
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 88/88 receipt 3634eaeb7043
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 997eb11e3be3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt d63c171fe084
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt 65daf45dfff2
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 94/94 receipt 19b759779c6a
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt e07f2130adb5
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-claude-launch"] 12/12 receipt 3c218eb802e6
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-install-surface"] 44/44 receipt 47c25cef1581
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt c12e1151be55
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt ec08a9060e91
+
+## v2026.10.27-herdr.0.45.0 — Herdr Entwurf plugin 0.45.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.45.0 and its
+`v0.45.0` tag remain unchanged. Core 0.45.0 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-27).** The `## 0.45.0` section below is the text that shipped inside
+the 0.45.0 tarball. Its statement that the Herdr lock rides the `herdr-checkout` carrier while
+0.45.0 is unpublished predates later facts: `v0.45.0` and its GitHub release point at
+`191e425`, that SHA's push CI ran its four required jobs green, and npm `latest` is 0.45.0,
+byte-equal to the accepted Windows-bearing candidate. Until this snapshot lands, a
+main-tracking `herdr plugin install` acquires the checkout commit rather than an npm artifact.
+Neither the published tarball's CHANGELOG nor the core release page is amended by this
+snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.45.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that the 0.45.0
+  candidate rode to production npm source `@junghanacs/entwurf@0.45.0` with the registry's
+  measured sha512 (`sha512-/Uu7rLyS…59tbQ==`). The plugin manifest moves 0.41.2 → 0.45.0;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From
+  the `v2026.10.24-herdr.0.41.2` snapshot to `v0.45.0`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's candidate wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **Pi stays at 1.4.** The acquired runtime carries the Pi 1.4.0 SDK set and accepts Pi
+  `>=1.4.0 <1.5`, the same range as the previous snapshot's 0.41.2.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.41.2
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed the 0.45.0 `herdr-checkout` candidate from main must explicitly deactivate by its
+  own absolute runtime path before reinstalling the npm-source snapshot. No operator
+  installation or active session is rewired by this release work, and a harness already
+  running keeps the runtime it started with.
+- **What the acquired runtime carries, and what this path does not.** The runtime ships core
+  0.45.0's bytes, including its nine-tool bridge, root `ENTWURF.json`, the pi-durable carrier
+  and the paused agy native push. Herdr wires and opens only `{pi, claude-code}`, so this
+  plugin path launches no pi-durable or agy session. Inside Herdr, `entwurf_resume_call` still
+  refuses as `herdr-resume-unsupported`.
+- **README.** The runtime paragraph and the Pi requirement name npm 0.45.0 and point at the
+  previous snapshots' 0.41.2 and 0.41.1 on the same Pi 1.4.0 SDK set.
+- **Current install docs.** The root README and the clean-host setup guide name the published
+  0.45.0 in their install commands and tool counts, and the root README names this snapshot as
+  the Herdr pin. Moving a live host onto 0.45.0 remains a separate operator decision for each
+  host.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.45.0 and `repair` 0.12.8-repair.1, 651 files. The
+  downloaded registry tarball is byte-equal (SHA256 and `cmp`) to the preserved accepted core
+  candidate (SHA256 `584fca5d623cce8e91c2ef0901ed54824e7b1d03042035e5e7547e854291c408`,
+  11473584 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`. No dist-tag snapshot was taken immediately before the operator's manual
+  publish, so `repair` is observed unchanged only against an earlier dated reading.
+- **Package consumer, reused.** Core make already ran its container consumer against those
+  same 0.45.0 bytes (acceptance log `4ccd048bcf79`, repoDigest `node@sha256:6dac556d…`, image
+  ID `sha256:55ab623b…`), so that result is reused here, not repeated.
+- **Registry-installed package (Pi).** A sandboxed `pi install npm:@junghanacs/entwurf@0.45.0`
+  (Pi 1.4.0) resolved its bridge to the installed root inside the sandbox; the installed
+  compiled bridge entry and `ENTWURF.json` equal the accepted tarball's members;
+  `--list-models entwurf` printed seven `entwurf` rows including the curated Claude anchors,
+  with no unknown-provider error. No model turn. The run started from an empty environment
+  (`env -i`, PATH only) with sandboxed HOME, XDG and agent roots. npm 11.16 listed the
+  package's install scripts as not yet covered by `allowScripts` and did not run them; the
+  tarball's executables already carry mode 0755.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.41.2 runtime was seeded from its own committed lock (`94d0594`); the swap to
+  0.45.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  the accepted candidate. A manually seeded torn swap (not a killed process) was restored before
+  acquisition and reported `recovered: torn-swap-with-candidate`; an exact re-request acquired
+  nothing, and the owned removal reclaimed cache, runtime and journal. The helper probes no Pi,
+  so these cells certify neither a Pi upgrade nor Herdr's install/update relocation, harness
+  wiring, the installed CLI's deactivate path, a model turn, or recovery from a real kill.
+- **Affected deterministic gates** on this tree: lint and the sixteen Herdr, version-floor,
+  install-surface, v2-surface and gate-manifest checks the previous snapshot ran, each exit 0.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey. That journey is a main-ref receipt for the SHA it resolved,
+  not a tag-ref install claim. Earlier npm or checkout-carrier receipts cannot certify these
+  axes.
+
+## 0.45.0 — 2026-10-26
+
+The text Entwurf hands to models is product code. A model chooses whether to resume, retry, wait or ask a person from the words in a tool description or a reject hint, so that wording is part of the contract, not decoration. Before this release those words lived as string literals scattered through the delivery, resume and launch modules, with no single place that said which text was current or which change had been reviewed. 0.45.0 gives the extracted text one versioned source, root `ENTWURF.json`, read by one strict reader and carried unchanged into the source, compiled and installed package, with the original pre-extraction text kept as an oracle and every semantic change recorded as a separate, reviewed amendment layer. The version moves from 0.41.2 straight to 0.45.0 to mark that milestone; there are no 0.42–0.44 releases.
+
+What this release is not: it adds no wire value, algorithm, tool or permission, and changes no routing or authority decision. It does not centralize every authored string — bootstrap, notices, the protocol-bearing mailbox envelope, receipt syntax, the slot-bearing model-invalid and task-too-long hints and ACP text stay in code (listed below). It makes no claim that any model now behaves differently in practice; it fixes what the text says and where it is owned.
+
+Herdr is not re-pinned to npm here. An npm lock must name a published version, and 0.45.0 has no published bytes while it is prepared, so `plugins/herdr/runtime-lock.json` returns to the closed `herdr-checkout` verification carrier, as earlier release candidates did. From the moment the prepare commit reaches main, a main-tracking Herdr install builds its runtime from the checked-out commit instead of npm, and a host already on the npm 0.41.2 runtime must run `herdr-plugin-deactivate` before it reinstalls. The published 0.41.2 pairing stays pinned by the Herdr tag `v2026.10.24-herdr.0.41.2`. The Herdr manifest version is unchanged; a separate snapshot re-pins npm after 0.45.0 is published.
+
+### Agent guidance has one source (#154)
+
+- **Root `ENTWURF.json`** (schemaVersion 6, payload revision 11) is the sole editable source for these families: the MCP tool descriptions and their durable short variants; the five static `entwurf_v2` reject hints; the eleven static visible-resume (record/liveness) reject hints of `entwurf_resume_call`; the static tmux launch-stage reject hints of `entwurf_fresh_call` (19) and `entwurf_resume_call` (15), kept as two records because shared text between the verbs is a coincidence, not a contract; five delivery-result clauses of the `entwurf_v2` dirty-lock and remote-pair receipts; and the text on either side of the record-less-socket hint's one code-owned slot (the fresh-cut command stays owned by `meta-session.ts`).
+- **One strict reader.** `pi-extensions/lib/agent-guidance.ts` imports only `node:fs`, checks every key in order and the schema version, and exports deep-frozen values. A missing, extra or empty key, or a wrong schema version, throws at load: invalid guidance crashes rather than falling back to an inline string.
+- **The same bytes in every projection.** The package `files` array ships `ENTWURF.json`; `build-bridge` copies it byte for byte to the compiled bridge root, as transport, never as a second source. `check-capability-bundle-reach` proves the compiled reader exports the Root families and that the compiled delivery surface renders the slotted hint from the Root text around the compiled owner's command.
+- **Payload revision is its own counter.** Each accepted payload change appends a history entry and advances `revision`; releases and history-only edits do not. `schemaVersion` tracks reader compatibility.
+- **Originals stay as oracles.** Each extraction was compared byte for byte with an independently recorded inventory of `94d0594` before the product JSON was edited; those originals live in `pi-extensions/lib/fixtures/agent-guidance/` and are never regenerated. Current text is checked as original plus the explicitly reviewed amendment layers, each checking its exact old value. `check-agent-guidance-beside` joins `check:contracts`.
+
+### Agent-facing wording corrected
+
+Each change below is a reviewed semantic amendment layer over the preserved original; wire reason ids, branch conditions and slots are unchanged.
+
+- **Delivery, lifecycle and receipt are separate (revision 2).** The tool descriptions separate delivery, lifecycle and receipt authority, qualify what a resume or callback outcome does and does not show, and add short guidance for colleague-to-colleague messages.
+- **Dormant socket wording is scoped (revision 3).** The intent parameter's `dormant-fire-forget-unsupported` rejection is stated for socket citizens only.
+- **A paused dispatch probed nothing and sent nothing (revision 6).** `native-push-paused` now says so, because the decider refuses before any probe.
+- **Uncertain outcomes are not stated as facts (revision 10).** A dirty lock no longer implies prior acceptance or a certain duplicate; `target-invalid` names address syntax, not a missing record; an indeterminate native probe no longer asserts that the host is running.
+- **Recovery hints name the human operator (revision 11).** `target-receiver-absent`, `target-receiver-unbound` and `native-push-target-dead` say that reopening a window or conversation is the operator's act, not something the calling verb does; `entwurf_register_native` points to `entwurf_fresh_call` instead of calling a supported capability deferred; the `entwurf_v2` description names `mailbox-enqueued` on a re-resolved mailbox leg instead of claiming the four receiver boundaries are the whole union.
+
+### Still code-owned
+
+Bootstrap and notices, the protocol-bearing mailbox envelope, receipt syntax and its annotations, the slot-bearing model-invalid and task-too-long hints, the peers record-less-socket diagnostics, the shared ACP model hint, the preflight repair text kept beside its predicates, every herdr rail hint, and ACP text. Moving any of them is later work, not implied by this release.
+
+### Upgrade
+
+Nothing to convert. An installed package carries `ENTWURF.json`; a checkout-run operator reads it from the tree. Herdr hosts follow the source-switch note above.
+
+### Release evidence
+
+- Kill-power re-measured at this shipped SHA: none (all 1245 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-agent-guidance-beside"] 7/7 receipt d5a3342fd8f0
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-entwurf-bridge-boot"] 5/5 receipt 2b18b407508b
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-entwurf-self-address"] 8/8 receipt dc031f386bf5
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-entwurf-v2-surface"] 17/17 receipt 7249f97714b1
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-mux-fresh-call"] 160/160 receipt a44b36b8b7f3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-mux-resume-call"] 13/13 receipt d5e923601730
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 514b6f14eaa0 -- ["bash","run.sh","check-pi-durable-beside"] 45/45 receipt f83b1385d9cf
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 43b183b15789 -- ["bash","run.sh","check-agent-guidance-beside"] 8/8 receipt ab8eb9dc4248
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 43b183b15789 -- ["bash","run.sh","check-capability-bundle-reach"] 1/1 receipt 279757fa6ef6
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 149fe24da006 surface 43b183b15789 -- ["bash","run.sh","check-entwurf-v2-surface"] 17/17 receipt e695187eae31
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a3f2abc26ed9 surface adea41b8f979 -- ["bash","run.sh","check-agent-guidance-beside"] 9/9 receipt 833b2055df1c
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a3f2abc26ed9 surface adea41b8f979 -- ["bash","run.sh","check-capability-bundle-reach"] 2/2 receipt faddb8eb7995
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head a3f2abc26ed9 surface adea41b8f979 -- ["bash","run.sh","check-entwurf-v2-surface"] 18/18 receipt d1da0cff8802
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 4a50aba502dd surface 563ff466619b -- ["bash","run.sh","check-agent-guidance-beside"] 10/10 receipt 9a9ffe7c4252
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 4a50aba502dd surface 563ff466619b -- ["bash","run.sh","check-capability-bundle-reach"] 3/3 receipt 9fc14648c19e
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 4a50aba502dd surface 563ff466619b -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 41/41 receipt c194610cae09
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 297ff9ea63fe surface 6e05a69e4c6d -- ["bash","run.sh","check-agent-guidance-beside"] 10/10 receipt 6f4149456809
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d174fef0b943 surface a39c5f90d434 -- ["bash","run.sh","check-agent-guidance-beside"] 12/12 receipt 2ecc8270ebc5
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d174fef0b943 surface a39c5f90d434 -- ["bash","run.sh","check-capability-bundle-reach"] 4/4 receipt 8bac9d11fa92
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d174fef0b943 surface a39c5f90d434 -- ["bash","run.sh","check-mux-fresh-call"] 161/161 receipt 14d498185caf
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d174fef0b943 surface a39c5f90d434 -- ["bash","run.sh","check-mux-resume-call"] 15/15 receipt a1c4efe73741
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 08242648863b surface 6571de821ed1 -- ["bash","run.sh","check-agent-guidance-beside"] 13/13 receipt daaf09c7c9ae
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 08242648863b surface 6571de821ed1 -- ["bash","run.sh","check-capability-bundle-reach"] 5/5 receipt 1bf305912814
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 08242648863b surface 6571de821ed1 -- ["bash","run.sh","check-entwurf-v2-surface"] 19/19 receipt 696ec4d6e85c
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 08242648863b surface 6571de821ed1 -- ["bash","run.sh","check-remote-pair-beside"] 48/48 receipt 90824d56e3a6
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e8ade22b1c2 surface cdd2bf224af8 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 92182844e8df
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e8ade22b1c2 surface cdd2bf224af8 -- ["bash","run.sh","check-capability-bundle-reach"] 7/7 receipt 9476e8787d6d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e8ade22b1c2 surface cdd2bf224af8 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt 6d1b40c6713f
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e8ade22b1c2 surface 2d64d05cd9b9 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt be9f054e160e
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e8ade22b1c2 surface 2d64d05cd9b9 -- ["bash","run.sh","check-capability-bundle-reach"] 7/7 receipt a7d0564d8398
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e8ade22b1c2 surface 2d64d05cd9b9 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt e619be0f0e3b
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d3963c2d16a9 surface 8a3ad98f6cf1 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 8c108523fc45
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d3963c2d16a9 surface 8a3ad98f6cf1 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt b2e06e3122d1
+- Those groups were measured on uncommitted working trees with green controls, each on its own candidate; groups repeat across candidates and do not sum to release coverage.
+- A stopped run at `7b24e5b` (first group non-zero) is not a passing receipt; its groups were re-measured at `149fe24` above. No group receipt is recorded for the first extraction commit `1657eca`.
+- Pre-version landing: main `a4bea2d`, exact-SHA push CI run 40296075141, `check`, `install-surface`, `artifact-consumer` and `macos-install-surface` all success. That run belongs to the pre-version SHA, not this prepared SHA.
+- Prepare-time floor, measured on the working tree over `a4bea2d` (tracked patch `7a8d5581fd82`, source manifest `f2dd32bb4fee`, before this record's final wording), not on an exact SHA: in an isolated copy, managed build 6 s and `check:full` 918 s exit 0; in the checkout, one managed build of 6 s produced a compiled tree byte-identical to that copy's.
+- `release-gate --cut` on that same tree in the checkout: `check:full` 918 s exit 0, MUST 24/0/0, BEHAVIOR 1/0/0, cut OK, log `9b0bf7bbee8a`. Earlier attempts on this tree stopped for harness reasons — one RED run in a copy that had no compiled tree, one launcher stop before the gate began — and are not counted. The census afterwards was read-only.
+- Exact prepared-SHA CI, the M3w artifact with its container acceptance, the installed remote-pair check on that same artifact, and native installed-host acceptance belong to the make phase and produce their own receipts.
+
+## v2026.10.24-herdr.0.41.2 — Herdr Entwurf plugin 0.41.2
+
+A separate Herdr plugin snapshot, not another core release: core package 0.41.2 and its
+`v0.41.2` tag remain unchanged. Core 0.41.2 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-24).** The `## 0.41.2` section below is the text that shipped inside
+the 0.41.2 tarball. Its statements that the Herdr lock rides the `herdr-checkout` carrier
+while 0.41.2 is unpublished predate later facts: `v0.41.2` and its GitHub release point at
+`a2980d6`, that SHA's push CI ran its four required jobs green, and npm `latest` is 0.41.2,
+byte-equal to the accepted Windows-bearing candidate. Until this snapshot lands, a
+main-tracking `herdr plugin install` acquires the checkout commit rather than an npm artifact.
+Neither the published tarball's CHANGELOG nor the core release page is amended by this
+snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.41.2 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that the 0.41.2
+  candidate rode to production npm source `@junghanacs/entwurf@0.41.2` with the registry's
+  measured sha512 (`sha512-vONpYfVw…D5Et+A==`). The plugin manifest moves 0.41.1 → 0.41.2;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From
+  the `v2026.10.23-herdr.0.41.1` snapshot to `v0.41.2`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's candidate wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **Pi stays at 1.4.** The acquired runtime carries the Pi 1.4.0 SDK set and accepts Pi
+  `>=1.4.0 <1.5`, the same range as the previous snapshot's 0.41.1.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.41.1
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed the 0.41.2 `herdr-checkout` candidate from main must explicitly deactivate by its
+  own absolute runtime path before reinstalling the npm-source snapshot. No operator
+  installation or active session is rewired by this release work.
+- **What the acquired runtime carries, and what this path does not.** The runtime ships core
+  0.41.2's bytes, including its nine-tool bridge, the pi-durable carrier and the paused agy
+  native push. Herdr wires and opens only `{pi, claude-code}`, so this plugin path launches no
+  pi-durable or agy session. Inside Herdr, `entwurf_resume_call` still refuses as
+  `herdr-resume-unsupported`.
+- **README.** The runtime paragraph and the Pi requirement name npm 0.41.2 and point at the
+  previous snapshot's 0.41.1 on the same Pi 1.4.0 SDK set.
+- **Current install docs.** The root README and the clean-host setup guide name the published
+  0.41.2 in their install commands and tool counts, and the root README names this snapshot as
+  the Herdr pin. Moving a live host onto 0.41.2 remains a separate operator decision for each
+  host.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.41.2 and `repair` 0.12.8-repair.1, 645 files. The
+  downloaded registry tarball is byte-equal (SHA256 and `cmp`) to the preserved accepted core
+  candidate (SHA256 `fad4cfe7e903e1d1f4cacb0e926814b32f3d73358d446b433f63ba6e13a2cafc`,
+  11452583 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`.
+- **Package consumer, reused.** Core make already ran its container consumer against those
+  same 0.41.2 bytes (acceptance log `5fd18a4d294e`, repoDigest `node@sha256:6dac556d…`, image
+  ID `sha256:55ab623b…`, recorded in make's artifact receipt), so that result is reused here,
+  not repeated.
+- **Not re-measured for this pin:** the separate sandboxed global `npm install -g` form of the
+  registry package. The axes that form touched for Herdr (npm acquisition and integrity, the
+  installed runtime with its compiled entry, three bins and `check-bridge`, and the installed
+  CLI's deactivate path) belong to the public-ref journey below, which acquires through Herdr
+  itself.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.41.1 runtime was seeded from its own committed lock (`439b399`); the swap to
+  0.41.2 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  the accepted candidate. A manually seeded torn swap (not a killed process) was restored before
+  acquisition and reported `recovered: torn-swap-with-candidate`; an exact re-request acquired
+  nothing, and the owned removal reclaimed cache, runtime and journal. The helper probes no Pi,
+  so these cells certify neither a Pi upgrade nor Herdr's install/update relocation, harness
+  wiring, the installed CLI's deactivate path, a model turn, or recovery from a real kill.
+- **Registry-installed package (Pi).** A sandboxed `pi install npm:@junghanacs/entwurf@0.41.2`
+  (Pi 1.4.0) resolved its bridge to the installed root inside the sandbox; the lock records the
+  registry tarball URL, version 0.41.2 and the integrity above; the installed compiled bridge
+  entry equals the accepted tarball's member; `--list-models entwurf` printed seven `entwurf`
+  rows including the curated Claude anchors, with no unknown-provider error. No model turn. The
+  run stripped every `PI_`, `ENTWURF_`, `CLAUDE`, `CODEX_HOME`, `TMUX`, `HERDR_` and npm
+  carrier. npm 11.16 listed the package's install scripts as not yet covered by `allowScripts`.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey. That journey is a main-ref receipt for the SHA it resolved,
+  not a tag-ref install claim. Earlier npm or checkout-carrier receipts cannot certify these
+  axes.
+
 ## 0.41.2 — 2026-10-24
 
 A bug-fix release for the setup, pack and mux verification surfaces. It also carries #149's remote-pair declaration change, a hard cut: every host that has an `entwurf-remote-pair.json` must convert it by hand (Remote pairs below, setup §2c). It also pauses agy native push (#152, Antigravity below), a scope added while this release was being made. The release evidence below separates what was measured while this release was prepared from what the MAKE phase measures on the exact artifact and installed hosts. Herdr is not re-pinned to npm here. An npm lock must name this checkout's exact version, and 0.41.2 had no published bytes when this release was prepared, so `plugins/herdr/runtime-lock.json` returned to the closed `herdr-checkout` verification carrier, as earlier release candidates did. Since the prepare commit `1e66466` reached main, a main-tracking Herdr install builds its runtime from the checked-out commit instead of npm, and a host already on the npm 0.41.1 runtime must run `herdr-plugin-deactivate` before it reinstalls. The published 0.41.1 pairing stays pinned by the Herdr tag `v2026.10.23-herdr.0.41.1` (its section below). The Herdr manifest version is unchanged; a separate snapshot re-pins npm after 0.41.2 is published.

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi or Claude Code siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi, pi-durable or Claude Code siblings ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.