@junghanacs/entwurf 0.41.2 → 0.50.0

package/README.md

@@ -1,10 +1,9 @@
 # entwurf
 
-`entwurf` connects independent agent harnesses as visible siblings: open a new session,
-reopen a supported dormant sibling in tmux, or reach an existing sibling by **garden id**. Fresh
-sessions open in the caller's Herdr workspace or tmux session by default; explicit tmux
-placement can name another existing session. Each harness keeps its own runtime,
-authentication, tools and transcript.
+`entwurf` connects independent agent harnesses as visible siblings. Open a fresh sibling, or reopen
+or message an existing one by its **garden id**. Every harness keeps its own runtime,
+authentication, tools and transcript; Entwurf adds identity, delivery, receipts and named
+lifecycle verbs.
 
 ![entwurf — a forged screwdriver for visible sibling sessions](docs/assets/entwurf-hero.jpg)
 
@@ -17,107 +16,83 @@ A recorded source-checkout demo: callback → task → native Bash → reply.
 
 [![npm](https://img.shields.io/npm/v/@junghanacs/entwurf?logo=npm)](https://www.npmjs.com/package/@junghanacs/entwurf) · maintained by [junghanacs.com](https://junghanacs.com/)
 
-A sibling is a visible session with its own runtime boundary, not a disposable
-worker or a subagent of a new central harness. Entwurf supplies identity, delivery,
-receipts and named lifecycle verbs; the operator and native harnesses keep steering.
-Git branches, worktrees, file isolation and internal delegation remain their concern.
+## Why
+
+- **Siblings, not workers.** A sibling is a visible session with its own runtime boundary, not a
+  disposable worker or a subagent of a new central harness. You and the native harnesses keep
+  steering; branches, worktrees, file isolation and internal delegation stay their concern.
+- **Native harnesses stay native.** Claude Code keeps its hooks and tools, Codex its own threads and
+  delegation, pi its extensions. Entwurf reconstructs no prompt, hydrates no transcript and mediates
+  no credential.
+- **One address.** A garden id names a record-backed citizen. A pane, socket, native session id or
+  model is a carrier or an observation, never a second address.
+- **The same verbs on both screens.** In an ordinary tmux session or inside a Herdr workspace, a
+  sibling opens and reopens beside you through the same tools. The rail follows where the caller
+  runs, with no fallback from one to the other.
+
 [Short answers: FAQ](./FAQ.md).
 
-| Verb | Tool | Where it lands | Harnesses |
+## The four verbs
+
+| Verb | Tool | What it does | Harnesses |
 |---|---|---|---|
-| **Open** a new sibling | `entwurf_fresh_call` | Herdr: a new unfocused tab in the caller's workspace. tmux: a new window in the caller's session, or an existing session named by `placement.tmuxSession`; without an explicit tmux placement, a Codex caller opens beside its own TUI pane | Herdr: pi, Claude Code. tmux: pi, pi-durable, Claude Code, Copilot, OMP, Codex |
-| **Reopen** a dormant sibling | `entwurf_resume_call` | A visible tmux window under the same garden id, with its record selecting the native session (Pi: identity-checked recorded transcript supplies launch metadata; Claude Code: `claude --resume <session id>` at the record cwd); the verb submits no prompt | pi, Claude Code |
-| **Retire** one sibling the human operator explicitly requested | `entwurf_retire_call` | One guarded attempt on that target: a Pi shutdown request or Claude Code fd-pinned process termination. Refused/unknown outcomes remain possible; the record stays for guarded same-id return. Not a grant, a roster cleanup or an automatic retry | pi, Claude Code |
-| **Message** an existing sibling | `entwurf_v2` | Its own rail: control socket, self-fetch mailbox or native push; delivery starts no process | pi, pi-durable, Claude Code, Copilot, OMP, Codex (Antigravity native push is paused, #152) |
-
-Antigravity is a legacy citizen: an existing conversation registers itself, and Entwurf never
-launches one. Its native push is paused (#152): on the measured external path the agy language server
-refused Entwurf's calls for a missing CSRF token, so a message to it is refused as `native-push-paused`. A launch receipt is neither the new sibling's address nor proof that it
-processed its task; the sibling's own callback envelope supplies its garden id.
-
-The package holds the v2 core, native-harness bridges, a pi adapter and an ACP
-plugin. ACP is one ingress, not the boundary; pi is one adapter, not the center.
-Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so they
-retain their own tools and work context. Capabilities differ by rail: a shipped
-citizen is not a promise of every lifecycle operation.
-
-[Releases](https://github.com/junghan0611/entwurf/releases) contain each cut's notes and acceptance
-receipts; [CHANGELOG](./CHANGELOG.md) records source history.
+| **Open** | `entwurf_fresh_call` | Opens a new visible sibling beside the caller — a new Herdr tab, or a tmux window — and hands it a first task. The sibling's own callback supplies its garden id | tmux: pi, pi-durable, Claude Code, Copilot, OMP, Codex. Herdr: pi, pi-durable, Claude Code |
+| **Reopen** | `entwurf_resume_call` | Reopens a dormant sibling under the same garden id, its record selecting the native session. Submits no prompt | pi, pi-durable, Claude Code |
+| **Message** | `entwurf_v2` | Delivers to an existing sibling over its own rail. Starts no process | pi, pi-durable, Claude Code, Copilot, OMP, Codex |
+| **Retire** | `entwurf_retire_call` | One guarded attempt on one sibling the human operator explicitly named. The record stays for a later same-id return | pi, Claude Code |
 
-## Install
+Every verb returns a receipt, not the sibling's turn result. Capabilities differ by rail, so a
+shipped citizen is not a promise of every lifecycle operation; [DELIVERY](./DELIVERY.md) owns each
+rail's admission. Antigravity is a legacy citizen: it registers an existing conversation, Entwurf
+never launches one, and its native push is paused (#152).
 
-**Choose by where you work. Bring your own harnesses, subscriptions and login.**
-The native durable route below additionally supplies an app/TUI, Entwurf's own thin composition of
-the durable app upstream omits from its npm release; it does not supply credentials or take
-ownership of the harness.
+Capabilities here describe this source and ref; an installed release can differ — see its
+[release notes](https://github.com/junghan0611/entwurf/releases) and
+[package-specific setup](./docs/setup-clean-host.md#requirements).
 
-### Direct — ordinary shell or tmux
+## Install
 
-Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
-to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.4.0 <1.5`; Claude Code supported floor `>=2.1.306` is required for its
-managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
+Bring your own harnesses, subscriptions and logins. Entwurf installs its own bytes and composes the
+harnesses it finds; it needs Node 24 or newer, Python 3 for `setup`, and whichever harnesses you
+use, already installed and signed in.
 
-**Release state.** The Pi range above belongs to the published 0.41.1, which ships the Pi
-1.4.0 SDK set. The previous `0.41.0` ships the Pi 1.3.0 set and requires Pi 1.3.x; the README
-inside that tarball and the Herdr snapshot `v2026.10.22-herdr.0.41.0` are its contract.
+### Direct — ordinary shell or tmux
 
 ```bash
-npm install -g @junghanacs/entwurf@0.41.1
+npm install -g @junghanacs/entwurf
 entwurf setup /path/to/your-project
 entwurf check-bridge
 ```
 
-`setup` composes each harness it finds and reports PASS / SKIP / FAIL. An absent
-harness is an explicit SKIP; a detected incomplete/below-floor integration is a
-named FAIL with nonzero exit, not a false green. `check-bridge` proves the installed
-MCP bytes boot and list tools without backend auth; it does **not** certify a real
-model turn or native receive rail.
-
-[Clean-host setup](./docs/setup-clean-host.md) owns project-local/source installs,
-config paths, optional backends, doctors, upgrade/repair and uninstall.
-Codex also needs your own hook-trust decision, app-server and exact-directory
-consent: [the operator steps](./docs/setup-clean-host.md#three-operator-decisions-before-fresh).
-Plain MCP registration alone does not make a garden citizen.
-
-**Platform bounds:** Linux is the certified harness-rail axis. macOS Entwurf-only
-installation is **CERTIFIED (CI)**; native harness rails, ACP and mux remain
-**NOT CERTIFIED — pending physical host**, so detected wiring can still leave setup non-green.
-WSL2 and native Windows have **experimental CI previews**, not general or physical-host support.
-The native-Windows preview covers Pi citizens and offline scripted delivery, not vendor turns,
-other harnesses, shell entrypoints, fresh/resume, mux, Herdr or ACP.
-[BASELINE](./BASELINE.md#release-host-baseline) owns the version-specific receipts and gaps;
-an npm package without an `os` restriction is not an all-platform certification.
+`setup` composes each harness it finds and reports PASS / SKIP / FAIL. An absent harness is an
+explicit SKIP; a detected incomplete or below-floor integration is a named FAIL with a nonzero exit,
+not a false green. `check-bridge` proves the installed MCP bytes boot and list their tools without
+backend auth; it does **not** certify a model turn or a receive rail.
 
-### Native durable (pi-durable)
+[Clean-host setup](./docs/setup-clean-host.md) owns the supported harness versions, installing a
+chosen package version, project-local and source installs, the per-harness steps (Codex needs
+[your own trust decision and app-server](./docs/setup-clean-host.md#three-operator-decisions-before-fresh)),
+doctors, upgrade, repair and uninstall. Plain MCP registration alone does not make a garden citizen.
+Linux is the certified harness-rail axis; [BASELINE](./BASELINE.md#release-host-baseline) owns the
+macOS, WSL2 and native-Windows evidence split, and an npm package without an `os` restriction is not
+an all-platform certification.
 
-**The package supplies Entwurf's owned app/TUI carrier and nine exact Pi 1.4.0 SDK
-members** (the previous 0.41.0 supplies the 1.3.0 set). No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
-The launch verifies carrier integrity and every reachable SDK edge's name/version;
-incomplete, drifted or mixed supply refuses by name.
+### Native durable (pi-durable)
 
 ```bash
 entwurf pi-durable --provider <provider> --model <model-id> --width task-wide
 entwurf pi-durable --continue
 entwurf pi-durable --resume
+entwurf pi-durable --session <native id>
 ```
 
-`--continue` opens this directory's latest-created durable session. `--resume` lists its
-sessions, most recently written first, by creation time, garden id and last write, and
-reopens the one you choose as it was saved; a cancelled choice opens nothing.
-
-The contact adds garden identity and two-way mailbox communication. Entwurf owns the
-thin app/TUI composition (shipped as an emitted JS carrier); execution, models/auth, queues,
-SQLite, transcripts and recovery remain the upstream SDK's:
-[Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
-
-Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
-imports, then installs its default native Extension after the contact.
-`--native-module-dir <absolute directory>` loads that named directory's top-level
-`*.extension.mjs` files in byte-wise order instead. No automatic module discovery or
-classic Pi API shim; guards are not a sandbox or rollback.
-[Native setup](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
-owns flags, refusals and the extension contract.
+The package supplies Entwurf's thin app/TUI carrier and the exact pi SDK set it declares; the launch
+verifies both and refuses incomplete, drifted or mixed supply by name. No separate runtime checkout,
+patch, build or ordinary Pi CLI is needed. The contact adds garden identity and two-way mailbox
+communication; execution, models, auth, queues, storage and recovery stay the upstream SDK's
+([Hard Rule 17](./AGENTS.md#hard-rules): **supply the missing surface; do not become the harness**).
+Selectors, native modules and refusals:
+[setup §2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable).
 
 ### Herdr workbench
 
@@ -125,37 +100,36 @@ owns flags, refusals and the extension contract.
 herdr plugin install junghan0611/entwurf/plugins/herdr --yes
 ```
 
-The [Herdr guide](./plugins/herdr/README.md#from-a-raw-linux-box-in-nine-steps) says which
-runtime each ref installs.
+This separate path activates Herdr-integrated **pi and Claude Code** with its own locked runtime
+and an observation pane. By default it puts no Entwurf bins on PATH; a runtime that carries
+`herdr-plugin-expose-operator` makes exactly one `entwurf` link, and only when you ask for it.
+An Entwurf release does not re-pin that runtime by itself; the
+[Herdr guide](./plugins/herdr/README.md#from-a-raw-linux-box-in-nine-steps) says which runtime each
+ref installs and owns install, use, evidence and removal. The plugin owns neither delivery nor the
+Herdr launch rail.
 
-This separate path activates Herdr-integrated **pi and Claude Code** with an
-independently locked runtime and an observation pane; it puts no Entwurf bins on PATH.
-An Entwurf release does not automatically re-pin that runtime: while 0.41.2 is an unpublished
-candidate, main's lock rides the `herdr-checkout` verification carrier, and the published 0.41.1
-runtime stays pinned by the Herdr tag `v2026.10.23-herdr.0.41.1`.
-[Herdr guide](./plugins/herdr/README.md) owns install, use, evidence and removal;
-the plugin does not own delivery or the Herdr launch rail.
+## First steps
 
-### Garden launcher
-
-After direct setup, start a pi citizen in your project:
+Start a citizen in your project:
 
 ```bash
 cd /path/to/your-project
 entwurf pi
-# equivalent when the package is registered (also the Herdr plugin's spelling):
-pi --entwurf-control
 ```
 
-`entwurf pi` execs your own pi with the control flag. A plain pi may load the
-package without becoming a citizen. The record mints the garden id; do not inject
-a session id. Native harness launch and manual Herdr argv instructions live in
-[setup §2–§5](./docs/setup-clean-host.md#2-optional-pi-adapter--acp-plugin).
+`entwurf pi` execs your own pi with the control flag (`pi --entwurf-control` is equivalent once the
+package is registered); the record mints the garden id, so do not inject a session id.
+`entwurf claude [args…]` execs the `claude` on your PATH with its arguments unchanged; a Claude Code
+session is a citizen through the hooks `entwurf install-meta-bridge` installed
+([setup §3](./docs/setup-clean-host.md#3-optional-claude-code-native-citizen)), however it started.
+`entwurf pi-durable` is the durable contact above. `entwurf --help` is the quick overview of the
+other entries and `entwurf help all` the full catalog; `entwurf help team` and
+`entwurf help remote-pair` are the two guides.
 
-In that **harness session**, ask the agent to:
+In that harness session, ask the agent to:
 
-1. Call `entwurf_self` to confirm its authoritative identity.
-2. Call `entwurf_peers` to discover existing citizens and their liveness facts.
+1. Call `entwurf_self` to confirm its identity.
+2. Call `entwurf_peers` to see existing siblings and their liveness facts.
 3. Pick a live garden id and call `entwurf_v2` with a message, for example:
 
 ```json
@@ -167,22 +141,12 @@ In that **harness session**, ask the agent to:
 }
 ```
 
-These are tools, not shell subcommands. Pi calls
-`mcp__entwurf_bridge__<verb>` through Pi's built-in MCP. The bridge exposes **nine**
-verbs; a pi citizen has **seven active + two hidden** (`entwurf_inbox_read` and
-`entwurf_register_native`), since it has no mailbox and its own extension births it.
-Those counts describe the source; a running host offers what its already-loaded bridge
-listed, so see [applying new source to a running host](./docs/setup-clean-host.md#applying-new-source-to-a-running-host).
-The server key stays `entwurf-bridge`. An operator/trusted-project MCP entry with
-that normalized namespace can replace the registration by Pi's own precedence;
-`/mcp` shows it, and Entwurf does not scan or fight that choice.
-
-## Entwurf orchestration
+These are MCP tools inside a session, not shell commands; pi reaches them as
+`mcp__entwurf_bridge__<verb>` through its built-in MCP. A running host offers what its
+already-loaded bridge listed:
+[applying new source to a running host](./docs/setup-clean-host.md#applying-new-source-to-a-running-host).
 
-One narrow dispatch capability connects independent siblings, not an agent factory.
-The record is the **sole address authority**. A pane, socket, native transcript id,
-model or process marker is a carrier or observation, never a second address axis.
-Liveness is read at dispatch time; an id's shape does not tell you its transport.
+## How delivery works
 
 ### `entwurf_v2` — canonical dispatch verb
 
@@ -193,75 +157,50 @@ pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
       → control-socket | self-fetch mailbox | native-push
 ```
 
-**Delivery starts no process.** A live pi receives over its record-addressed control
-address, an armed self-fetch citizen (Claude Code, Copilot, OMP, pi-durable) through its
-mailbox, a probe-alive native-push citizen (Codex; Antigravity is paused, #152) through its own
-conversation or thread. Anything else is refused honestly, never launched into. The receipt
-is a receiver acceptance boundary, a durable mailbox file or an injection, never completion;
-`wants_reply` is etiquette, not waiting. [DELIVERY](./DELIVERY.md#control-socket-acceptance-boundaries-120)
-owns what each boundary means and each rail's admission.
-
-The lifecycle verbs in the [table above](#entwurf) return their own receipts, never a delivery
-result: fresh a launch receipt (the sibling's callback envelope supplies its garden id), resume
-separate LAUNCH and OBSERVATION receipts, retire separate action, record and lock results.
-**Retirement is never autonomous:** it needs the human operator's explicit target and action, and
-no role, caller identity or tool annotation grants it ([DELIVERY](./DELIVERY.md#candidate-lifecycle-commands-are-not-delivery-boundaries-147)).
-
-**Mux launches; it never delivers.** Fresh opens in the caller's Herdr workspace or tmux session;
-`placement.tmuxSession` names another existing tmux session and is refused inside Herdr. The model
-is required and `cwd` is a literal absolute directory. Missing or ambiguous context refuses with no
-fallback. Exact argv, identity checks and limits: [tmux launch](./docs/mux-launch-rail.md),
-[Herdr launch](./docs/herdr-launch-rail.md).
-
-### Remote siblings — declared pairs across hosts
-
-Opt-in. The v2 file below is in main and the 0.41.2 candidate; the published 0.41.1 reads the
-earlier single-pair file. On each host, write `~/.pi/agent/entwurf-remote-pair.json` (mode `0600`; a
-moved agent dir or meta store moves it, see [setup §2c](./docs/setup-clean-host.md#2c-optional-remote-pair-between-two-hosts-107)). The ids
-below are fictional; use your own records' garden ids:
-
-```json
-{
-  "version": 2,
-  "routes": [
-    {
-      "localGardenId": "20260101T090000-a1b2c3",
-      "remoteGardenId": "20260101T091500-d4e5f6",
-      "ssh": "host-b",
-      "remotePairFile": "/home/me/.pi/agent/entwurf-remote-pair.json"
-    }
-  ]
-}
-```
-
-The other host carries the mirror route: the two garden ids swapped, its own SSH alias for this
-host, and this file's canonical absolute path. Then send with the ordinary `entwurf_v2` to the
-remote garden id: one SSH attempt over your own account, checked and dispatched by the host that
-holds the record. There is no peer discovery, wake or retry. Why: [remote sibling principles](./docs/remote-sibling-principles.md);
-contract: [DELIVERY](./DELIVERY.md#remote-pairs-107-149-declared-pairs-across-hosts); steps and the
-hand conversion from the earlier file: [setup §2c](./docs/setup-clean-host.md#2c-optional-remote-pair-between-two-hosts-107).
-
-### Team bookmarks — `team.json`
-
-A person's bookmark of the siblings one project works with. Copy [`team.json.example`](./team.json.example)
-to an ignored `team.json` at the project root and fill names, backend, garden id, native session id
-and cwd from Entwurf's record facts; read liveness from `entwurf_peers` when you dispatch. Entwurf
-does not load it as runtime configuration, and it is not configuration for identity, routes, roles, permissions or lifecycle. The
-example's own notes say the rest.
+**Delivery starts no process.** The record is the sole address authority, and liveness is read at
+dispatch time: a live pi receives over its control address, an armed self-fetch citizen through its
+mailbox, a probe-alive native-push citizen in its own conversation. Anything else is refused, never
+launched into. The receipt is the receiver's acceptance boundary, a durable mailbox file or an
+injection — never the sibling's turn result; `wants_reply` is etiquette, not waiting.
+[DELIVERY](./DELIVERY.md#control-socket-acceptance-boundaries-120) owns what each boundary means.
+
+**Lifecycle verbs keep their own receipts.** Open returns a launch receipt, not an address; reopen
+separates its launch from its observation; retire reports action, record and lock separately.
+**Retirement is never autonomous:** it needs the human operator's explicit target and action, and no
+role, caller identity or tool annotation grants it
+([DELIVERY](./DELIVERY.md#candidate-lifecycle-commands-are-not-delivery-boundaries-147)).
+
+**Lifecycle launch is separate from `entwurf_v2` delivery.** Open and reopen place a sibling in the
+caller's Herdr workspace or tmux session; `placement.tmuxSession` names another existing tmux session and is refused inside Herdr.
+Missing or ambiguous context refuses with no fallback:
+[tmux launch](./docs/mux-launch-rail.md) · [Herdr launch](./docs/herdr-launch-rail.md).
+
+### Remote siblings and team bookmarks
+
+**Remote pairs** are opt-in. Each host declares the pair in its own file, and `entwurf_v2` to the
+remote garden id makes one SSH attempt over your own account, checked and dispatched by the host that
+holds the record — no discovery, wake or retry. `entwurf help remote-pair`, the steps in
+[setup §2c](./docs/setup-clean-host.md#2c-optional-remote-pair-between-two-hosts-107), the
+[principles](./docs/remote-sibling-principles.md) and the
+[contract](./DELIVERY.md#remote-pairs-107-149-declared-pairs-across-hosts).
+
+**Team bookmarks:** [`team.json.example`](./team.json.example) is a person's note of the siblings one
+project works with, copied to an ignored `team.json`. Entwurf never loads it as configuration for
+identity, routes, roles, permissions or lifecycle. `entwurf help team`.
 
 ## Concepts
 
-**Entwurf** (기투, projection-of-self) connects independent visible siblings;
-**garden id** names a record-backed citizen, not its pane or native transcript.
-[FAQ](./FAQ.md) explains ACP, MCP and context carriers.
-
-## Pi integration
+**Entwurf** (기투, projection-of-self) connects independent visible siblings; a **garden id** names
+a record-backed citizen, not its pane or native transcript. The package holds the v2 core, the
+native-harness bridges, a pi adapter and an ACP plugin. ACP is one ingress, not the boundary; pi is
+one adapter, not the center. Claude and Cortex Code are ACP backends; Codex and Antigravity stay
+native so they keep their own tools and work context. The pi adapter registers the compiled bridge
+with Pi's built-in MCP after record birth, while pi's own receive stays its record-addressed control
+address. [FAQ](./FAQ.md) explains ACP, MCP and context carriers.
 
-The pi adapter registers the compiled bridge with Pi's built-in MCP after record
-birth; Pi supervises the MCP child. **MCP is ingress; pi receive remains the
-record-addressed control address (a Unix socket, or the native-Windows preview's named
-pipe).** Garden identity and dispatch stay Entwurf's.
-Codemode is harness-internal, not another garden citizen.
+Product guidance and CLI help each have one editable source: [ENTWURF.json](./ENTWURF.json) for
+the MCP tool descriptions and the hints extracted there, [ENTWURF-CLI.json](./ENTWURF-CLI.json) for
+`entwurf --help`. [AGENTS](./AGENTS.md#architecture) lists exactly what each carries.
 
 ## Operation guides
 
@@ -287,6 +226,8 @@ credential mediation, subscription bypass, pane-typing delivery or hidden orches
 
 Installation, a doctor, a fixture and an exact release candidate prove different things;
 none is interchangeable with the others or an all-host/long-haul guarantee.
+[Releases](https://github.com/junghan0611/entwurf/releases) carry each cut's notes and acceptance
+receipts; [CHANGELOG](./CHANGELOG.md) records source history.
 
 ## References
 

package/VERIFY.md

@@ -121,7 +121,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 >
 > Be honest about its cost, because it is a MUST: it spends real model turns on the operator's configured runtimes (two pi siblings, each resumed once, plus one Claude Code sibling), it READS the operator's real runtime config, and the siblings' native session transcripts stay in the real pi agent dir — they are not cleaned up, and they are part of the evidence a resume was real. The fence is per-axis rather than absolute: the four meta roots (records, mailbox, receivers, senders) are fixture for every cell, so no garden record is ever minted outside it; the native pi cell's control socket and v2 lock are fixture too; the ACP pi cell's are REAL and transient (see the paragraph above); and the Claude cell runs its runtime under the real HOME while its mailbox and meta stay fixture. The run ends by proving the operator's SIX real roots — the four meta roots plus `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks` — hold the entry sets they started with, with no fixture garden id anywhere, and that proof now runs on the failure path as well as the green one. Missing prerequisites decline with the protocol SKIP (97), which `release-gate --cut` refuses rather than rounding up.
 >
-> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends four model turns (two in the caller's own session, two in a second SEAT session on the same private server — the #105 seat x cwd matrix), and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
+> **Fresh-call LIVE is on-demand, not part of `release-gate`.** `LIVE=1 ./run.sh smoke-mux-fresh-call-live` opens configured Pi and Claude Code siblings, spends four model turns (two in the caller's own session, two in a second SEAT session on the same private server — the #105 seat x cwd matrix), and preserves their native transcripts; run it directly whenever a cut changes mux fresh-call/launch behavior. Its private tmux servers and fixture-bound entwurf write axes make it deterministic about garden-record/socket residue, but those real native turns should not appear unexpectedly in every aggregate cut. **Both this smoke and `smoke-mux-lifecycle-live` enumerate `pi` and `claude-code` only — that exclusion is intentional.** Neither covers pi-durable same-id resume (#157 B3), and no LIVE or release gate does: its proof is the deterministic beside tests plus the local FULL/package floor, and its one public n=1 (Herdr, a pre-final candidate, synthetic callers) is a dated [BASELINE](./BASELINE.md) row, not a floor. The tmux path at the final candidate is unmeasured. Claude Code's same-id resume inside Herdr (#157 stage 4) is covered by no LIVE or release gate either: its proof is the deterministic beside tests plus the local FULL/package floor (a dated receipt, not a floor this text inherits: on 2026-11-02 the affected PARTIAL, six groups, and one frozen FULL of 1016 s passed at the stage-4 candidate, work surface `1075a5c8…` = HEAD `2734f524` plus the then-uncommitted changes; later edits leave that receipt valid for its snapshot but do not certify a later candidate, which owes its own), and its two test-owned n=1 runs on 2026-11-02 are a dated [BASELINE](./BASELINE.md) row, together with the operator vendor-data changes observed inside their windows — not a floor. A Copilot visible-fresh (step 9 clause 7) was accepted on 2026-08-25 as an operator-metered LIVE (receipts in `DELIVERY.md`'s Copilot matrix row and the issue #82 thread). It still spends Copilot premium quota, still needs its own grant to re-run, and is never folded into those loops or into the release-gate MUST tier.
 
 > **A visible-fresh receipt outside the MUST tier is no longer the general rule — it is Copilot's preserved exception.** #87 measured what that wording permitted: because clause 7 sat outside every aggregate, a harness could be admitted as a full D6 citizen that `entwurf_fresh_call` cannot open, carry an honest "not a supported harness" sentence in the delivery matrix, and still pass the whole floor toward a cut. From OMP onward, the FIRST release of a harness admitted under the #82 contract owes its clause 7 receipt as a release-gate MUST step (`smoke-omp-fresh-live`), and the deterministic half of the same rule (`check-harness-admission-parity`, inside `check:full`) makes a citizen backend missing from `FRESH_CALL_BACKENDS` a red floor rather than a documented one. Forward-only by decision: Copilot's row is not reopened. The contract lives in `docs/adding-a-harness.md` step 9, "The release stop"; this note exists so the cost discipline above is not read as permission.
 >
@@ -282,7 +282,7 @@ caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a re
 | Axis | Required proof | Limit |
 |---|---|---|
 | Source | `pnpm run check:full` in the prepared SHA's CI `check` job | Does not prove an installed consumer. Kill-power of the committed claims is not re-measured per release (#144); the release record says so and lists any earlier-candidate PARTIAL separately. |
-| Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
+| Packed install | `check-pack-install` | Real tarball, but checkout-visible. Every npm install it runs (the npm-managed root and second root, the four #130 pi-durable cells) and its pnpm consumer run with lifecycle scripts off (`--ignore-scripts`), so its executable, bridge and closure checks measure the tree as installed without the package's postinstall; that hook stays shipped as a registry-mode defense this gate does not exercise, and packed file modes remain the pack gate's evidence. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | the exact SHA's push run: all four required CI jobs green (the qualification body is not read, #144) | A different green SHA is not transferable evidence. |
 | macOS Entwurf-only install | required `macos-install-surface` CI job at the exact release SHA | Shape-only, CERTIFIED (CI): certifies the Entwurf-only install path on macOS only — never Claude/Copilot/OMP/agy wiring, the pi rail, ACP or mux. Promoted from non-voting (`continue-on-error`) to required in 0.20.0 after its first CERTIFIED (CI) green on a GitHub Actions `macos-latest` runner (not a physical host): run 34303884286 @ `70eda03` (2026-09-09), 65s, all 10 steps success — the packed candidate installed clean, `entwurf --help` and `entwurf check-bridge` ran (the latter listing the seven `entwurf-bridge` MCP tools of that date; 0.41.0 declares nine, unmeasured on that runner), an all-harness-absent `entwurf setup` reached `result: green` across the five documented SKIP probes (`pi`/`claude`/`agy`/`copilot`/`omp`), and five checked paths (`.pi`, `settings.json`, `.gemini`, `.copilot`, `auth.json.bak`) plus a byte-identical `auth.json` proved zero harness/credential writes. A macOS runner failure now blocks every release cut, the same as any other required job. |

package/docs/external-mcp-host.md

@@ -11,7 +11,7 @@ the one-line registration; everything an operator needs to actually wire a host
 
   **Being garden-native is not the same as being replyable, and Copilot is the case that separates them.** Its hook writes a sender marker, so an `entwurf_v2` send carries its own garden id and the receiver learns who wrote — measured 2026-08-21 on Copilot CLI 1.0.80, where a live send arrived under its own garden id with `origin: "meta-session"` and `replyable: false`. Replyability arrived later and through a different process: a first-party extension (`run.sh install-copilot-receive`) that the CLI forks, which binds to the same V3 record and writes a receiver marker owned by its own pid (#82 RAIL 5). So a Copilot citizen is `replyable: true` exactly while that extension is armed for it, and `replyable: false` — honestly, with a real garden identity — when it is not installed, not launched with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` (which is what `entwurf copilot` sets for one invocation), not yet born, or gone. Read the two facts off different rails: the sender marker answers *who sent this*; the receiver marker answers *can a reply land*. The onboarding obligations are in [`adding-a-harness.md`](./adding-a-harness.md) step 7, and the evidence boundary — the managed LIVE acceptance that moved receive to D6, and what D7-partial / D3-pending still exclude — is in [`DELIVERY.md`](../DELIVERY.md).
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity/Codex and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation. Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?, placement?}`**, and reopen a DORMANT pi or Claude Code citizen under the same id with **`entwurf_resume_call {target}`**. **`entwurf_retire_call {target}`** (new in 0.41.0) attempts retirement of exactly one target, and only one the human operator explicitly requested; mounting or seeing the tool, a coordinator role or caller identity is not permission, and an unknown result is not a reason to replay.
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity/Codex and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation. Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?, placement?}`**, and reopen a DORMANT pi, pi-durable or Claude Code citizen under the same id with **`entwurf_resume_call {target}`**. **`entwurf_retire_call {target}`** (new in 0.41.0) attempts retirement of exactly one target, and only one the human operator explicitly requested; mounting or seeing the tool, a coordinator role or caller identity is not permission, and an unknown result is not a reason to replay.
 
 Observed: Claude Code, Codex CLI, Antigravity CLI, GitHub Copilot CLI and OMP all reach this MCP bridge. Claude, Copilot and OMP become symmetric/replyable through mailbox-backed meta-sessions; agy and Codex use native-push. Codex's identity is request-scoped `_meta.threadId`, and its replyability requires that exact record plus a loaded app-server thread. Plain external hosts still need an identity lane to send.
 
@@ -325,5 +325,5 @@ MCP registration gives the external harness the tools; the host still needs work
 
 For the maintained multi-harness setup and skill/command packaging details, see
 [agent-config](https://github.com/junghan0611/agent-config). See also the
-[concept primer](../README.md#concept-primer), the sender-envelope contract in
-[AGENTS.md](../AGENTS.md), and [custom skills](../README.md#custom-skills).
+[concepts](../README.md#concepts), the sender-envelope contract in
+[AGENTS.md](../AGENTS.md), and [custom skills](./setup-clean-host.md#custom-skills).

package/docs/setup-clean-host.md

@@ -23,7 +23,7 @@ evidence split, and its three states must not collapse into "macOS is supported"
 
 ## Requirements
 
-This table is the published `@junghanacs/entwurf@0.41.1`'s, which ships the Pi 1.4.0 SDK set.
+This table is the published `@junghanacs/entwurf@0.45.0`'s, which ships the Pi 1.4.0 SDK set.
 The previous package, `0.41.0`, ships the Pi 1.3.0 SDK set and requires Pi 1.3.x; the setup guide
 inside that tarball is its contract.
 
@@ -83,14 +83,16 @@ node --version
 npm --version
 ```
 
-The two npm forms below install the **published** package, `0.41.1` (Pi 1.4.x, the Pi 1.4.0 SDK
-set).
+The two npm forms below install the **published** package, `0.45.0` (Pi 1.4.x, the Pi 1.4.0 SDK
+set). The [product entry](../README.md#install)'s unpinned `npm install -g @junghanacs/entwurf`
+takes whichever version npm's `latest` dist-tag names; pin `@<version>` as below when you mean the
+exact artifact the [Requirements](#requirements) table describes.
 
 Global install is simplest when native harnesses should find stable bins from every
 working directory:
 
 ```bash
-npm install -g @junghanacs/entwurf@0.41.1
+npm install -g @junghanacs/entwurf@0.45.0
 entwurf --help
 entwurf setup /path/to/your-project
 entwurf check-bridge
@@ -101,7 +103,7 @@ A project-local installation is also supported:
 ```bash
 mkdir -p ~/entwurf-smoke && cd ~/entwurf-smoke
 npm init -y
-npm install --save-dev @junghanacs/entwurf@0.41.1
+npm install --save-dev @junghanacs/entwurf@0.45.0
 npx entwurf setup .
 npx entwurf check-bridge
 ```
@@ -111,7 +113,7 @@ project-local install, or `./run.sh <command>` from a source checkout. Keep that
 same scope when upgrading and checking; native process restarts are separate (§7).
 
 `check-bridge` is auth-free. It proves the installed prebuilt MCP server boots and
-lists the nine garden tools (0.41.1); it does not prove a backend model turn, native hook or retirement permission.
+lists the nine garden tools (0.45.0); it does not prove a backend model turn, native hook or retirement permission.
 
 Neither npm form installs a harness runtime. `pi`, Claude Code, Copilot CLI, Codex CLI, agy,
 Cortex, and their authentication remain operator-owned optional prerequisites for the
@@ -257,7 +259,7 @@ A plain `pi` can load the package without becoming a citizen.
 In that session ask for `entwurf_self`, then `entwurf_peers`. Pick an existing
 live garden id and ask for `entwurf_v2` with `intent: "fire-and-forget"` and your
 message. These are harness tools, not shell subcommands; pi exposes them through
-Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The 0.41.1 bridge has nine tools;
+Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The 0.45.0 bridge has nine tools;
 pi hides `entwurf_inbox_read` and `entwurf_register_native`, leaving seven active.
 The added `entwurf_retire_call` is only for one target/action explicitly requested by the
 human operator, never autonomous cleanup. Where a host provides or is configured with an approval
@@ -270,6 +272,10 @@ Tool-call ingress is MCP; delivery to a pi citizen is still its record-addressed
 control address (a Unix socket; a named pipe on the experimental native-Windows Pi
 preview). A boot/listing from `check-bridge` is not a model-turn or
 native-rail acceptance.
+The server key stays `entwurf-bridge`. An operator/trusted-project MCP entry with
+that normalized namespace can replace the registration by Pi's own precedence;
+`/mcp` shows it, and Entwurf does not scan or fight that choice.
+Codemode is harness-internal, not another garden citizen.
 
 To inspect the ACP provider from a project-local package instead of a global one:
 
@@ -385,15 +391,23 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   entwurf pi-durable --provider <provider> --model <exact catalog id> --width task-wide
   entwurf pi-durable --continue    # this directory's newest durable session
   entwurf pi-durable --resume      # choose one of this directory's durable sessions
+  entwurf pi-durable --session <native id>   # reopen exactly that session of this directory
   ```
 
+  `--continue`, `--resume` and `--session` reopen a session as it was saved: they take no
+  `--provider`, `--model`, `--width` or `--entwurf-bootstrap` and are mutually exclusive.
+  `--session` takes the native session id (`<13-digit ms>-<uuid>`, as `--resume` lists it), not a
+  garden id, with no interactive session picker or picker-specific TTY check (the normal TUI still
+  runs); a value of any other shape is refused as `session-id-malformed` before your module is
+  evaluated, the TUI loads or the app opens.
+
   The bootstrap imports only the compiled closure shipped beside it
   (`mcp/entwurf-bridge/dist/…`); a source checkout needs a built bridge
   (`pnpm run build-bridge`) and its development dependencies installed first.
   `plugins/pi-durable/bootstrap.mjs` is only the checkout path that re-exports it.
 
-- **One explicit native module (optional).** Add `--native-module <absolute file>` to either
-  launch to load ONE module of your own. It is an ordinary ES module: its top-level code (top-level
+- **One explicit native module (optional).** Add `--native-module <absolute file>` to any of these
+  launches to load ONE module of your own. It is an ordinary ES module: its top-level code (top-level
   await included) runs first, before the TUI and the durable runtime load, so it can prepare the
   environment the provider runtime and tool children will read; its default export is a native
   durable `Extension` (`{ name, tools?, sections?, hooks?, … }`, the upstream durable API, not
@@ -450,8 +464,8 @@ proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
 ### Moving durable sessions from the Pi 1.3 SDK to 1.4
 
-0.41.1 is published; moving a live host onto it remains a separate operator decision for each
-host. When you do:
+0.41.1, 0.41.2 and 0.45.0 are published on the 1.4.0 SDK set; moving a live host onto any of them
+remains a separate operator decision for each host. When you do:
 
 1. **Confirm the old owner is gone.** Close the 0.41 (SDK 1.3) durable session normally and check
    that its process has exited. A stale session lock alone is not proof.
@@ -558,7 +572,7 @@ entwurf install-meta-bridge
 entwurf doctor-meta-bridge
 ```
 
-The supported floor `>=2.1.306` is enforced by package metadata through installer
+The Claude Code supported floor `>=2.1.306` is enforced by package metadata through installer
 and doctor gates. Older Claude versions validate an exec-form hook but silently drop
 its `args` at runtime, so there is no shell-form fallback.
 
@@ -568,6 +582,17 @@ validation, or hand-inspected marker cannot replace a new real session. If the l
 form is unsupported, reinstall; if ownership is correct but the live join is absent,
 restart the affected session.
 
+Start a session as plain `claude` or as `entwurf claude [args…]`. The second execs the
+`claude` on PATH in this terminal — same cwd, pid and exit status, signals reaching it directly,
+arguments and `--help` unchanged — after removing an inherited `PI_SESSION_ID`/`PI_AGENT_ID` and
+exporting only `ENTWURF_CLAUDE_LAUNCH_ACTIVE=1`. Unlike `entwurf copilot` it checks no Entwurf setup
+or citizen precondition before launch — only that `claude` resolves to an executable file that
+is not this launcher — and sets no feature flag: either spelling is a citizen through the hooks above,
+and plain Claude Code without them. A launch whose environment already carries that sentinel
+(inherited from an earlier `entwurf claude` up its process tree), or whose `claude` resolves to
+Entwurf's own `run.sh`, refuses as a recursive managed launch instead of looping; its message
+currently names only the PATH cause. Run plain `claude` there.
+
 The Darwin install fence is open (`Linux | Darwin`); python3 is the
 refusal, not the platform name. A completed Darwin install is still not
 a rail receipt: this rail is NOT CERTIFIED — pending physical host. The