@junghanacs/entwurf 0.45.0 → 0.51.0

package/AGENTS.md

@@ -17,6 +17,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 ## Architecture
 
 - **Product guidance:** root [ENTWURF.json](./ENTWURF.json) is the sole editable source for its extracted English payload families, currently MCP metadata, durable short variants (#154 C1-A), the static entwurf_v2 reject hints (C1-B), the static visible-resume (record/liveness) reject hints of entwurf_resume_call (C1-C), the static tmux launch-stage reject hints of entwurf_fresh_call and entwurf_resume_call (C1-D), five static delivery-result clauses of the entwurf_v2 dirty-lock and remote-pair receipts (E1a) and the text on either side of the record-less-socket reject hint's one code-owned slot (E1b). Compiled copies are deterministic transport, never another authority. Keep independent pre-extraction oracles intact; current metadata is checked against those originals plus explicitly reviewed literal amendment layers, not regenerated expectations. Payload revision is independent of releases/history-only edits. Metadata is not delivered to models; existing engraving/user-config contracts remain unchanged. Bootstrap, notices, the protocol-bearing mailbox envelope, receipt syntax and its annotations, other hints (including the slot-bearing model-invalid and task-too-long hints, the peers record-less-socket diagnostics, the shared ACP model hint, the preflight repair text kept beside its predicates and every herdr rail hint) and ACP text are not yet centralized.
+- **CLI description:** root [ENTWURF-CLI.json](./ENTWURF-CLI.json) is the sole editable source of the compact overview `entwurf --help` prints, the full documented catalog `entwurf help all` prints, the command page of `entwurf help <command>` / `<command> -h|--help`, as before, and the guide topics `entwurf help team` / `entwurf help remote-pair` print (#157: static text that reads none of the settings it describes; the package references it points the reader to (team.json.example and docs/setup-clean-host.md) ship in the package); `scripts/cli-help.mjs` renders it with plain `node` (builtins only, module-relative bytes, fail-loud with no fallback), so help needs Node. A command name there owns a description, never a dispatch: a small preflight before run.sh's unchanged case answers those exact help forms without entering an arm, refuses (exit 2) an undescribed name (`all` and the topic names are read-only views, not commands it dispatches: only `help <name>` reaches a topic, and `<topic> --help` is refused like any undescribed name), extra argv or `--help <command>`, and leaves the five vendor launchers' argv alone; the case and its source-defined gate functions own execution, and `check-install-surface` S9 compares the two independently, including the frozen set of commands still undescribed. The peer-facts, meta-facts, meta-bridge-fresh-cut and meta-bridge-prune leaves keep their own streams and exit codes, but their usage line is only a pointer to `entwurf help <command>`; other leaf usage strings (remote-pair-receive, meta-bridge-store-doctor), the undescribed commands, and the factual accuracy of inherited text beyond the reviewed amendments are not yet carried by it. It is separate from the MCP payload families of ENTWURF.json.
 - **entwurf-core (v2):** garden-id addressing, record facts, rail liveness, dispatch decisions, and delivery evidence.
 - **Record authority:** every citizen uses V3 `MetaIdentity`; `backend` selects rail capability, never identity rank.
 - **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and registers the compiled `entwurf-bridge` with Pi’s built-in MCP under that record’s identity.
@@ -70,7 +71,7 @@ A pi control session and native bridge session are citizens for the same reason:
 **Retirement is operator-requested, never autonomous.** A real citizen may be retired only when the operator explicitly requests that target/action, like the separate approval needed for a push. Development, tool exposure, a coordinator role, record-backed attribution or delegated release judgement is not a standing retirement grant. No timer, idle heuristic, roster cleanup or agent initiative substitutes for that request. Preserve request attribution without inventing a self-signed permission boolean or role database. Test-owned lifecycle gates require their own named execution scope; working siblings are never incidental test targets.
 
 - Pi owns its native session lifecycle; `birthPiCitizen` attaches `(backend: "pi", nativeSessionId)` to the stable garden id. Socket and env values are record-derived carriers.
-- `entwurf_resume_call {target}` is a separate lifecycle verb for pi and Claude Code targets, not delivery intent. It reopens the same dormant id visibly, submits no prompt, and uses the record as the sole address authority (Pi: the record selects an absolute transcript whose native id must match; its session-header cwd and first `model_change` provider/model feed the launch resolver, with no record/host cwd fallback; Claude Code: record session id and cwd, with no model or permission flag restored). Dormancy is rail-specific: a dead pi control socket, or — for Claude Code — the last validated owner the Entwurf hook armed is proven gone (`classifyMarkerOwner` dead) AND the record, re-read after that verdict, still carries the same non-null `attachIncarnation` (arm revision) the marker copied; an absent, unreadable, mismatched, inconclusive or unbound marker refuses. That guarantees only committed hook attaches: a process holding the session without one (hooks disabled, a record-arm lock timeout or store failure at its start) is invisible to it — a boundary GLG accepted on 2026-10-21. A launch receipt and the observation (same-id socket, or a NEW live owner in the opened pane re-arming the marker with a fresh binding the record carries) are distinct; an unobserved window stays visible. The caller is attributed, never authorised by that. Inside herdr it refuses; there is no herdr resume rail. No watcher, retry, or supervisor.
+- `entwurf_resume_call {target}` is a separate lifecycle verb for pi, pi-durable and Claude Code targets, not delivery intent. It reopens the same dormant id visibly, submits no prompt, and uses the record as the sole address authority (Pi: the record selects an absolute transcript whose native id must match; its session-header cwd and first `model_change` provider/model feed the launch resolver, with no record/host cwd fallback; Claude Code: record session id and cwd, with no model or permission flag restored; pi-durable: the record's native session and cwd, opened by `entwurf pi-durable --entwurf-adopt` with a closed `{v, gardenId, metaRoot, sourceGeneration}` context and the fixed five-name profile/meta-root projection, a bridge-only launch rather than an operator selector). Dormancy is rail-specific: a dead pi control socket; for pi-durable, a session claim the owner fence can reserve for one child — closed and released, or its holder proven gone — while a claim a live process holds, a reservation awaiting adoption included, refuses without delivery advice; or — for Claude Code — the last validated owner the Entwurf hook armed is proven gone (`classifyMarkerOwner` dead) AND the record, re-read after that verdict, still carries the same non-null `attachIncarnation` (arm revision) the marker copied; an absent, unreadable, mismatched, inconclusive or unbound marker refuses. That guarantees only committed hook attaches: a process holding the session without one (hooks disabled, a record-arm lock timeout or store failure at its start) is invisible to it — a boundary GLG accepted on 2026-10-21. A launch receipt and the observation (same-id socket; for pi-durable a child's adoption of this call's reservation, which is not readiness, liveness or recall; or a NEW live owner — the opened pane's direct child — re-arming the marker with a fresh binding the record carries) are distinct; while a reservation stays unadopted under its live holder a resume refuses on it, nothing clears it automatically, and a child that adopts it becomes its holder; an unobserved window stays visible. The caller is attributed, never authorised by that. Inside herdr pi, pi-durable and Claude Code targets reopen, in a new herdr tab (pi through agent start; pi-durable and Claude Code through one `layout.apply`, the Claude Code observation joining the receiver marker to the pane's direct child herdr reports, or `pane-process-unread` when it reports none — #157 stage 4, two n=1 runs on 2026-11-02: recall unmeasured in the first, a blind recall in the second) launched through the same injected seam by the same exact `HERDR_ENV=1` predicate fresh call reads (#157 G1a; the dated native-Pi n=1 in BASELINE records actual resume/protocol/no-turn/recall on a PATH-supplemented private fixture, not release acceptance; #157 B3's dated pi-durable n=1 there is a pre-final candidate with synthetic callers, and the tmux path is unmeasured); a failure after the tab exists is reported with its recovery rather than as nothing opened, and no rail falls back to the other. No watcher, retry, or supervisor.
 - **control-socket:** live send under per-target lock; dormant rejects.
 - **self-fetch:** active receiver plus deliverable mailbox; no resume authority. Sender/receiver joins are owner-kind specific and must not be generalized across vendors.
 - **native-push:** probe-alive direct injection; no mailbox and no resume authority.
@@ -103,9 +104,10 @@ implement → affected focused gates → independent review → one amendment bu
 
 ## Type and Working Boundaries
 
-- Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. Root pi extensions use TypeBox through `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
+- Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. The pi-facing contract schema uses builders and schema types from `@earendil-works/pi-schema` and `StringEnum` from `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
 - Develop only on branches in this repository checkout; never use worktrees or tmp development clones. Isolated test fixtures and temporary evidence are not development checkouts.
 - Make surgical, one-contract changes. Removal repairs source and its proof together; a green gate never proves retired behavior.
+- A requested Pi SDK upgrade defaults to existing native authentication after coherent candidate installation, not a new login or credential copy. Do not re-ask that strategy each bump. Operating owner exit, consistent full session backup and the human-owned shutdown/reopen window remain gates; auth reuse grants no autonomous cutover, retirement or publication. The decision and #148 receipts are in [the SDK upgrade radius](./docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade).
 - Before commit, sweep repository-wide for retired authority vocabulary and landed-plan future tense. Historical tombstones may remain; live docs, source, gates, and usage must agree.
 - Prefer capability-domain language over identity rank. Use tabs unless the project formatter requires otherwise. GLG decides commit, push, and release gates.
 
@@ -122,7 +124,7 @@ implement → affected focused gates → independent review → one amendment bu
 - [ROADMAP.md](./ROADMAP.md) — direction and deferred work.
 - [docs/adding-a-harness.md](./docs/adding-a-harness.md) — entry route for a new harness.
 - [docs/mux-launch-rail.md](./docs/mux-launch-rail.md) — mux ownership and launch contracts.
-- [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md) — herdr launch rail (#116): two-step placement, the one-line birth argv, and within-generation reclaim. `entwurf_fresh_call` selects it from process context (`HERDR_ENV=1`, pilot `pi | claude-code`), never from a caller parameter and never as a fallback either direction.
+- [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md) — herdr launch rail (#116): two-step placement, the one-line birth argv, and within-generation reclaim. `entwurf_fresh_call` selects it from process context (`HERDR_ENV=1`; agent-start `pi | claude-code`, one `layout.apply` for `pi-durable` — §16, #157 A-L1), never from a caller parameter and never as a fallback either direction; `entwurf_resume_call` selects its herdr launch by the same predicate (pi through agent start, §15, #157 G1a; pi-durable through one `layout.apply`, §17, #157 B3; Claude Code through one `layout.apply` plus a `pane.process_info` join, §15, #157 stage 4).
 - [docs/acp-backend-rail.md](./docs/acp-backend-rail.md) — ACP adapter contract.
 - [DELIVERY.md](./DELIVERY.md), [VERIFY.md](./VERIFY.md), [BASELINE.md](./BASELINE.md) — delivery coordinates, verification protocol, and evidence.
 - [README.md](./README.md) — operator-facing package contract.

package/BASELINE.md

@@ -105,7 +105,116 @@ and its owner's one installed schema certification accepted 1,847 records with z
 acceptance, not whole-parser equivalence. Resident processes remain unmeasured; broader runtime
 and release acceptance are not silently waived.
 
-Notes the table cannot carry without becoming prose again:
+### #157 Herdr Pi native round trip, 2026-11-01 (n=1)
+
+Not a certification row, release gate or other-backend acceptance. One private Linux aarch64 Herdr 0.9.5 server, source `c2032093f71b2dfc92bc49e9e85d96178a34b89a`, installed Pi 1.4.0 provenance and Node 24.18.1. Native Claude Code citizen915040 measured it; Astra567753 reviewed saved raw/records/transcripts and independently checked saved hashes/prefix/fact occurrence without another runtime probe. Main read the receipts and protocol/hash artifacts. Portable decisive evidence: [#157 runtime receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6553792285).
+
+| Axis | Measured |
+|---|---|
+| fixture | Private HOME/XDG/meta/control/lock/socket, empty target/caller cwds, existing real Pi agent-dir config/auth reference. Nix shell initialization overwrote PATH; a NEW fixture `.bashrc` prepended the existing pnpm bin. This is a PATH-supplemented fixture, not a pristine-HOME result; no operator profile/SDK was changed. |
+| seed/dormancy | Terminal seed ACK and a completed absolute transcript are bound by the V3 record to gardenId `20261101T135933-80116c`; the transcript header matches nativeSessionId `01a1957a-23ee-7314-a6d6-fca90682712e` and cwd, and its first model_change matches the canonical model. One test-owned pane close removed the original runtime/socket, preserving the record/transcript. No glob or manual record repair. |
+| actual public caller | Native Pi in private Herdr w1:p3 made exactly one resume toolCall with the target gid; its matching toolResult was non-error and carried separate LAUNCH/OBSERVATION for new tab w1:t2/pane w1:p4. Target gid/native/path kept; the returned pane joins the private server and target listener process. |
+| protocol/no-turn | One owner `get_info` RPC returned the same gid/cwd/model and idle=true. Stop-complete baseline and resume-complete/pre-recall transcript are both 65,049 B with SHA256 `aa7903edf56d6577466e42b59fa4ce86f5d3e3d85cfa04b70aff28e2f3188e29`; final 66,541 B keeps that exact prefix. |
+| recall/record set | One separately counted synthetic fixture sender used public `entwurf_v2`: control-socket sent, then the target recalled the unique seed value. The answer was absent from caller/recall/helper inputs. Records are exactly target/caller/sender, target identity preserved, locks empty. |
+| cleanup | One official private stop; saved raw supports the 12 tracked PID absences and four listener-path absences. 13 R4 visibility-helper rows remain, earlier helpers untouched. This is not total-descendant-zero. |
+
+A post-stop bookkeeping line failed to parse (unescaped find parentheses, exit2); it is retained. Separately authorized read-only recovery found no T/C/S gid entries in six real roots and matching before/after entry sets. This later snapshot proves neither a live-interval no-leak invariant nor unchanged file contents. Recovery also violated sequential-only scheduling with a seven-call batch: its racing first count was discarded and completed-producer sequential reads were used. These exceptions remain; review accepted the saved functional evidence, not a procedural-floor pass.
+
+Three logical user turns are not a measured provider-request count. Provider/billing, OAuth/vendor other writes, the null-to-filled transcriptPath transition and the MCP-timeout/cancellation boundary were not measured; the complete resume-ready seed transcript was observed, and the resume tool result returned in about 3 s. Confirmed real-agent-dir writes are two new transcripts and the target recall append. No pi-durable/Claude Code Herdr resume, registry artifact, aggregate MUST or release acceptance follows. Host artifacts: `/tmp/e157h/g1a-resume-r4/{RECEIPT.md,A10-READ-ADDENDUM.md}` and `raw/`.
+
+### #157 pi-durable exact native CLI selection, 2026-11-01 (n=1)
+
+Native checkout CLI evidence, not public garden-id resume or release acceptance. Subject: base `2aaf8562497abd78ff32a490929c80d233ad75bc` plus uncommitted B1 s2, work-surface SHA256 `e07908ea5d6aaab042ff1cd01a13fbd7c11c7932adf90019d875fdd35ad4799b`. Citizen915040 measured; Astra567753 independently read saved requests, kernel/process/marker/storage/cleanup artifacts and compared saved candidate seals; main read the receipts and decisive kernel/record artifacts. Notebook coordinator b22677 reviewed supplied source/receipt excerpts, not host-local bytes or runtime. [Portable source, PARTIAL and native CLI receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6555677872).
+
+| Axis | Measured |
+|---|---|
+| fixture/selection | One PATH-supplemented private Herdr0.9.5 server, Node24.18.1 and real Pi agent-dir reference. An input-free seed created gid `20261101T173050-ca665f` / native id `1793521850194-7520265c-2633-4740-8c21-0df272ede11d`. The second fixed command was `run.sh pi-durable --session <that native id>` in the same explicit cwd, with no provider/model/width/bootstrap/task/picker flags. This is the managed checkout CLI, not an installed-package invocation or an API-seam-only test. |
+| close/reopen binding | One intentional bound test-pane close; old host1045274/bridge1045313 then absent by ps and individual proc-stat ENOENT, with the known lock absent. Second layout result w1:t3/p3 and new terminal join actual host1046710/start65005448, compiled bridge1046764, private parent1044712 and new sender/receiver owner `linux:65005448`. Marker-candidate success alone was not accepted. |
+| identity/storage | One record retains gid/nativeId/cwd/createdAt; only recordUpdatedAt changes. Model/transcript/incarnation remain null; Herdr detection remains unknown. Only the same record-derived native directory/known lock were stat/listed; no external SQLite open/read/copy. Sizes/mtimes do not establish content preservation. |
+| cleanup/seal | One official private stop, eight specifically tracked PIDs absent, two scoped listener queries/socket paths absent, native lock absent and directory/metadata preserved. Eight visibility-helper rows remain, not all-descendants-zero. Source/index/NEXT/new files/launch7-carrier+pin/dist97 manifests compare equal across the observation. Six-root/gid snapshots are not interval/content non-leak proof. |
+
+The same s2 candidate has four separate affected PARTIAL receipts: carrier39/39, beside46/46, install-surface44/44 and manifest-head52/52 killed, green controls/restoration/stable seals; the other1179 mutants and FULL were not run. Separate bounded raw witnesses reached NOT-HERE's own missing-id refusal assertion and ENV's first-file-mode config name/version mismatch, not just integrity/shared-beforeAll failure. The initial declared95/actual100 inventory HEAD failure remains a failure before any mutant; its one-line declaration correction is part of s2. Earlier pre-inventory package/installed-consumer proof is not transferred to this exact candidate or to installed `--session` execution.
+
+Functional observation was accepted, not a clean-procedure floor. Retain five parallel read-only helper reads, semicolon status captures, bundled multi-rc observations and kernel/storage brace groups whose components lack individual statuses; actual printed PID/PPID/starttime/cwd/stat values were cross-joined, not inferred from outer0. Interactive G3 shell preflight was not repeated; non-interactive fixture checks were used. No unexpected error was recorded in retained observations, not universal error absence. No `entwurf_retire_call` or working-citizen retirement occurred; the authorized test runtime was intentionally closed once. No deliberate input does not prove provider/vendor/billing zero. Public pi-durable addressed resume/B3 fencing, stalled-owner safety, working watch/delivery, recall, headless use, content invariance, exact installed artifact, final native/CI/release acceptance remain separate. Host artifacts: `/tmp/e157h/b-l1/{RECEIPT-PARTIAL.md,RECEIPT-CLOSURE.md}` and `/tmp/e157h/g3-b1-native-session-r1/RECEIPT.md` with scoped raw.
+
+### #157 Herdr public pi-durable fresh, 2026-11-01 (n=1)
+
+Not a certification row, release gate, installed-artifact or other-backend acceptance. Subject: HEAD `d6129139ad9738a3bc0ade9b5ef3abbac4b7580f` plus the uncommitted A-L1 work surface (tracked diff SHA256 `bccf722d11796003294486f298fec088fe008e4b91cbf3f0cbcfc1ee7f8596b5`, 731-file source surface `79ff55b9b1fbad7d3c7864d9c7f8929a7996673da7146f3a879f09d2125c327c`), run on the checkout compiled bridge from the A-L1 package proof (97-file dist seal `e32433cb699c2141a60c9141516559d38079e81f5a14123925a5a72f377c2734`). One private Linux Herdr server (Herdr version and architecture not re-read in this run), Node 24.18.1 per `/proc/<pid>/exe`. Citizen915040 measured; Astra567753 independently accepted the saved raw, records, kernel/view/cleanup artifacts and seals (d74d42); main read the receipts. [Portable LIVE receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6557466848).
+
+| Axis | Measured |
+|---|---|
+| fixture | New private HOME/XDG/meta/control/lock/socket root. The env allowlist is the G1a one plus the two `verify_deps_before_run=error` flags; existing real Pi agent-dir reference; PATH-supplemented like G1a (interactive preflight output identical after path normalization). No operator profile/SDK/PATH edits or credential copies; SDK/vendor OAuth refresh writes were not measured. |
+| topology | One workspace. Before launch: focused root pane w1:p1 in directory A, unfocused caller pane w1:p2 in directory B, A ≠ B. After launch: w1:p1 still focused in A. These are two end-point views; focus continuity and cross-workspace selection are not measured. |
+| actual public caller | Native Pi caller `20261101T203132-e82002` (openai-codex/gpt-6.1-sol; thinking level a separate entry) made exactly one `entwurf_fresh_call` toolCall with args exactly {backend `pi-durable`, model `openai-codex/gpt-6.1-sol`, the approved task} — no cwd, no placement, no other tool call. Its paired toolResult was non-error: the Herdr layout receipt with cwd B from "this agent's own process directory", the checkout `run.sh` runtime, tab w1:t2 / pane w1:p3, nonce `mux-fresh-call-c8406ed0bdefea1fdc2940a9`. A one-shot read-only matcher, statically preflighted on synthetic 0/6/7 cases first, passed 27/27 on the record-selected transcript. |
+| callback/join | The caller received exactly one `entwurf-message`: body the nonce alone, sender `20261101T203137-97561c` (pi-durable, cwd B, no wants_reply). That gid joins its private V3 record (pi-durable, native id `1793532696952-5eb222ef-08fd-46ee-a4c0-587cf1d0d330`, cwd B, model/transcript null), receiver and sender markers (owner 1244328, `linux:66079156`), process-info of the returned pane (bootstrap with the requested provider/model and the callback-first framed task as argv), `/proc` (cwd B, parent = the private server, starttime = the marker key, one child = the checkout compiled bridge) and the returned view (w1, new tab w1:t2, cwd B, observed unfocused). |
+| cleanup/seal | Revalidated test-owned close of w1:p3 only; one immediate observation found host and bridge absent and the native lock released. One official private stop; nine tracked PIDs and three named listener paths absent. Six real-root before/after listings equal (snapshots, not interval/content non-leak proof). New real-agent paths preserved: the caller transcript (70,038 B; C's `SEEN` turn was appended after the callback message arrived, and the file was identical at the recorded pre-/post-stop snapshots d07, d13 and d14) and the record-derived pi-durable native directory; no SQLite open/read/copy. L0 equals the package p2 seal and L1 equals L0, including all 97 dist bytes/modes/mtimes. |
+
+Observed order: the caller's turn ended `LAUNCHED`, the callback arrived about 2.5 s later and opened a separate caller turn ending `SEEN` — an observation of an idle receiver, not a rule (a busy one receives it as a steer). The same candidate has five affected PARTIAL receipts (165/165 killed; the other 1218 mutants and FULL not run) and a current-artifact package proof (`check-pack` 660 files, `check-pack-install` smoke and self-fence pass, tarball SHA not retained); none is exact retained-artifact or release acceptance.
+
+Which tool produced the callback (`entwurf_callback` versus `entwurf_v2` carrying the same nonce) and whether it was the target's first action stay requested, not measured: the target transcript lives in the pi-durable SQLite, which was not accessed. The framing also asks the sibling to send its final result with `entwurf_v2`; no second message reached the caller before the stop, which proves neither that one would or would not. Target ACK, the target's actual runtime model, inbound watch/delivery (a receiver arm is not a watch), recall, request/turn/billing counts, OAuth/vendor writes and the Herdr env pair (environ not read) are unmeasured. At this R13 subject, omitted agent-start cwd and aggregate status narration remained open; the later A-L1x/A-L2 source and R2 observation below supersede those gaps, not this older LIVE subject. Procedure exceptions retained: two read-only print lines used `;` after every value was in its own rc file; one report line misstated the tmux session count and was corrected; the package P1 seal comparison stopped on an authoring SyntaxError and resumed only under a named recovery. Host artifacts: `/tmp/e157h/a-l1-live-r1/RECEIPT.md`, `/tmp/e157h/a-l1-matcher-preflight-r1/RECEIPT.md`, `/tmp/e157h/a-l1-package-r1/RECEIPT.md` and `/tmp/e157h/a-l1-qualification-r1/RECEIPT.md` with scoped raw.
+
+### #157 Herdr Pi caller-cwd and declared RAILS status, 2026-11-01 (n=1)
+
+Owner915040 measured; Astra567753 independently read and accepted the saved evidence (ffee1a); main read the full receipt. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6559408491). Subject: HEAD d6129139 plus tracked diff451163b0… / source733, SHA5a503455…; package p2 and LIVE L0/L1 full JSON equal, including the 97-file compiled seal `ed698d3af56e52cd6d591a471acfdef73d789c73cb3b25a131a205823a519110` (mtimes included). Subsequent documentation promotion is a different work surface. This is not FULL, exact retained-artifact, CI, B3, stage3 or release acceptance.
+
+Genuine native Pi C `20261101T232917-5b8331` made one public fresh call with backend pi and no cwd/placement. Matcher0/28 joined nonce `mux-fresh-call-b491697267d4743dd41087a8` to sender T `20261101T232923-e6837d`, V3 pi record/header native id `01a19783-d8cd-74ef-b3aa-78c86f3b9cb9`, socket/unique foreground1451707, kernel shell1451684→private server1451076 and checkout bridge1451763. Receipt/record/header/kernel/view cwd=B≠focused A; pane w1:t2/w1:p3/term_65f37daffbd813 had agent pi and an actual agent_session object bound to T's transcript. Focus is endpoint observation only. Revalidation preceded the bound pane close; T/bridge and socket absence were observed. Official stop1 returned0/0; eight tracked PIDs/four named listeners were absent, six real-root listing snapshots equal. Tee/p1-shell exits remain unmeasured. Native JSONLs were preserved; only T's header was read.
+
+The source-owned status entry returned leaf0/tee0/stderr0B under its one-step node-only PATH/absolute HERDR_BIN/private-root override. It printed 3 fresh backends=AS2+LY1, correct domain labels/order and PD no-kind/no-detection note, no `--kind pi-durable`, and citizens `entwurf-not-found`. This is a source declaration, not host capability, installed overlay or installation proof. AS detection is measured here; LY contrast cites the separate R13 LIVE. Current affected qualification153/153 and pack/install660 were separately accepted; other1233 mutants/FULL were not run, and tarball SHA was not retained.
+
+R1 stopped on a contract-required argv tail while process-info displayed `["pi"]`; old evidence already had that shape. Its raw/STOP and procedure exceptions remain. Independently reviewed R2 removed only that unnecessary requirement, keeping unique foreground/socket PID, shell/kernel/view/cwd/status checks mandatory. Startup flags/actual T model rail/ACK/completion/exact callback verb or first action/billing/env pair/timing remain unmeasured. `agent_status=done` is not task completion. C snapshot byte equality supports only no additional persisted entry visible in the compared snapshots, not volatile receipt/arrival or future absence. Grouped captures/reads, launch chain, bounded socket wait, formatting tools and s05 sed construction remain procedure exceptions, not clean-procedure acceptance. Local evidence: `/tmp/e157h/a-l1x-live-r2/RECEIPT.md` SHA88fa5173b5d5e848a5d5333c19325e838a7812959829a7b668c8fe1fdcaa310f; R1 plus its addendum are preserved alongside it.
+
+### #157 B3 locator, lifetime fence and mandatory-unit supply checkpoint, 2026-11-02
+
+Source and isolated focused evidence only, not a certification row, frozen FULL, current-candidate kill-power, package acceptance, Native LIVE, public pi-durable resume or stage3 completion. HEAD d6129139 plus the uncommitted C4/fence/supply surface is the measured subject; a later checkpoint commit does not retroactively certify its exact SHA. [Portable closure and original exceptions](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6561973609). Owner915040 measured; Astra567753 independently accepted saved source/focused evidence, and main read the receipts.
+
+C4 preserves the actual native directory as a canonical, record-bound location carrier under the actual receivers root, using the existing record-arm lock and attachIncarnation. Its three non-atomic pair failure states remain explicit; a matching pair is not birth success, receiver activity, dormancy or guarded enrollment. Source closure e5ddd5 and compiled-consumer recovery c67cb1 are separate subjects (`b3-c4-proof-r2/RECEIPT.md` SHA380dd2c8…; `c4-compiled-recovery-r2/RECEIPT.md` SHA3c081f57…, under `/tmp/e157h/`). No MetaIdentity key or store-reader rollout was added.
+
+The pre-lease fence excludes cooperating owned openers at one physical in-D resource using owner PID/start-key/host, fresh generations and one transaction hold per decision/write; it precedes the SDK lease on every owned route. Live/uncertain owners and a transaction residue fail closed without age takeover; an unrelated atomic temp stays inert and preserved, and a collision on this writer's own temp name fails without removing the existing entry. Attempted init failure is not never-opened; failed/unknown first storage close and lease outcomes remain distinct from environment cleanup. It does not establish SQLite health, unmanaged-opener exclusion or recovery success. D1–D4 source/focused amendment accepted as574475 (`b3-fence-amendment-r1/RECEIPT.md` SHAc76a0a81…): root48files873, helper16, durable109, carrier58, native14, install/capability37/bridge19, four type fences and lint returned0. The canonical emitted runtime SHA is37fe7bc4d66232032bb59afe18931ce25f6286bcd9747f2fbcf09d45044a1790; SDK/origin version set remains1.4.0.
+
+Supply follow-up ff250b (`b3-fence-supply-l1/RECEIPT.md` SHA867ddf90…): the fixed compiled owner-fence unit is the fifth precreation presence check, after the four existing units, with its own named refusal. It proves presence only, not integrity/importability. All14 saved groups returned0, including root48files874/durable110/carrier58/native14/Herdr47+21/MUX343, four type fences, lint, install/capability37/bridge19. No emitter ran in this leaf; only two compiled verifier/preflight bytes changed, with a new99-file/108-entry build/mtime subject and equal postbuild/postgate seals. Static139 durable mutants/1425 unique claims are inventory, not executed qualification. The older fresh-call LIVE/PARTIAL/package subjects above remain separate.
+
+Original formatter-stop/unauthorized-write, first compiled-oracle STOP, missing old-dist byte backup/early tmux removal and read-error/recovery histories are retained; later green does not make those procedures clean. GLG separately approved the bounded in-D app metadata write/residue cost ([6560478307](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6560478307)), not SDK DB access, ownership correctness or public resume. Parent reservation/adoption, exact SDK profile provenance, metadata-root closure and public admission remain the next contract; public pi-durable addressed resume stays refused. GLG requested a local-only intermediate checkpoint on2026-11-02; final affected qualification/FULL/native floors and final commit/feature push remain separate, with no main/release inference.
+
+### #157 B3 Herdr public pi-durable same-id resume, 2026-11-02 (n=1)
+
+Not a certification row, release gate, final-candidate LIVE, tmux-path or installed-artifact acceptance. Subject: candidate `82b5ec36` = HEAD `46c7c776` plus the then-uncommitted stage-3 diff (NEXT excluded), on the checkout compiled bridge (managed dist manifest `c9a3befa…`, 99 files); it precedes the later provider-close fix, R17/R18 wording and the final checkpoint `43594eba`, none of which inherits this observation. Owner915040 measured; main read the complete receipt `/tmp/e157h/s3-pd-live-r1/RECEIPT.md` (`71c21b37…`), not every raw leaf. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6566126053).
+
+| Axis | Measured |
+|---|---|
+| fixture | Private HOME/XDG/meta/control/locks/sockets and a private Herdr server. The operator-selected model `openai-codex/gpt-6.1-terra` ran under the existing SDK profile (approved normal use; no credential copy, symlink or proxy); new native data is confined to one new test-cwd hash. Callers C1/C2/C3 are synthetic fixture records, not real Claude Code or other model sessions. Provider/billing/OAuth writes were not measured. |
+| seed/close | C1's public `entwurf_fresh_call` opened target T `20261102T091526-fdad9c` (native id `1793578526845-ff5d0b8a-…`) in a private Herdr tab; T returned its nonce callback. The first close committed storage closed and lease released; the record stayed byte-equal. That host needed a second exit signal, the linger later repaired with API0 loopback evidence only. |
+| public resume | C2 called `entwurf_resume_call` with target T only. The bridge reserved generation `85ee35c3…`; ONE `layout.apply` opened a new tab w1:t3 / pane w1:p3; the observation was `adopted` after 1503 ms. Garden id, native id and cwd were unchanged; `attachIncarnation` changed and the C4 owner and claim owner became the child, whose argv carried `--entwurf-adopt` with the closed four-field context and no task/provider/model/session flag. The receipt said no prompt was submitted (SQLite stat unchanged there — metadata, not content). |
+| recall | C3 sent T a question without the seed fact through `entwurf_v2`; T answered with it. The fact was counted zero times in the question, helper source, identities, argv and resume artifacts, once in the seed and once in the answer. No SQLite content read or transcript hydration; one seed and one recall target-model turn, no caller-model turn. |
+| cleanup | Official private Herdr stop returned 0; ten tracked PIDs and both sockets absent; operational metadata-root listings equal before/after. The new native directory and four fixture records are preserved. |
+
+Unmeasured and not inherited: the tmux path, the final candidate, a real Claude Code or other real caller, billing, native byte equality, G-abandon, exact-SHA CI, registry/release acceptance and operating-reader rollout.
+
+### #157 stage 4 Herdr Claude Code same-id resume, 2026-11-02 (n=1 ×2), and operator vendor-data changes observed during the runs
+
+Not a certification row, release gate, LIVE MUST, tmux-path, installed-plugin-runtime or registry acceptance. Subject: HEAD `2734f524` plus the uncommitted stage-4 worktree. The first run (H2) used compiled `herdr-resume-call.js` `f507a42a` / `entwurf-v2-visible-resume.js` `3718fccc`, before the D1 hint fix and the review text fixes. The second (N2) used source `herdr-resume-call.ts` `ebfbdd6a` / `entwurf-v2-visible-resume.ts` `195535a4`, compiled (q10) to `6636324c` / `0eddf418` — the same source and compiled bytes as the stage-4 PARTIAL/FULL floor. Neither observation is inherited by the later docs bundle or by a final candidate. Owner915040 measured; main read the receipt `/tmp/e157h/s4-cc-a/RECEIPT.md` and the launcher/version-store state directly, not every raw leaf. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6573387199).
+
+**Operator impact first.** The operator's real Claude Code installation changed twice inside these runs' windows, separately from the product behaviour below. H2's change points into that run's own fixture; N2's is tied to its run by timing only. No writer pid was recorded for either:
+
+| Event | Measured | Not established |
+|---|---|---|
+| H2 launcher relink (16:38:20 KST) | `~/.local/bin/claude` was repointed from `~/.local/share/claude/versions/2.1.316` to a copy under the fixture's `XDG_DATA_HOME` in `/tmp` (same sha256 `55cdb8e1…`). H2 paired the real HOME with a fixture `XDG_DATA_HOME` without the existing #67 launcher fence (`scripts/lib/claude-launcher-fence.ts`), rebuilding the precondition recorded at `scripts/smoke-herdr-fresh-call-live.ts:402-416`. Main restored the original link at 17:24:53 with GLG's approval; readlink, realpath and sha were re-read equal. | The writer pid; the resumed claude is a timing-only hypothesis. |
+| N2 version-store loss (17:27:08 KST) | Under the #67 Herdr form (only fixture `xdg-data/claude` linked to the operator's data directory; launcher fence `problems=[]`), `~/.local/share/claude/versions` went from 2.1.312/314/316 to 2.1.314/316, at the same instant (17:27:08.68) as that run's fixture gained `xdg-cache/claude/staging` and `xdg-state/claude/locks` (names and mtimes only). The active 2.1.316 link and bytes are unchanged. No copy of 2.1.312 is known and its sha was never recorded; nothing was restored, re-downloaded or reinstalled. | The writer pid; whether an ordinary operator `claude` run prunes the same way; harmlessness. "Not the launcher target" does not mean unused. |
+
+The #67 fence certifies launcher integrity, not the whole shared vendor store. Each run's real-HOME check covered the entry names under `~/.pi/agent/meta-{sessions,mailbox,senders,receivers}` and `~/.pi/entwurf-v2-locks` (unchanged, no fixture gid) and `~/.claude/projects` (one new directory per run, for the fixture cwd). It is not a whole-HOME invariance proof; the two events above are its counterexamples. Further native runs stopped here.
+
+| Axis | Measured |
+|---|---|
+| fixture | One private Linux aarch64 Herdr 0.9.5 server (installed binary sha256 `17d7536f…` equals the pinned asset in `scripts/fixtures/herdr-supply.json`) and Claude Code 2.1.316. Real HOME (approved: vendor auth and native records); XDG ×5, the four meta roots and `PI_CODING_AGENT_DIR` are fixture, except that in N2 only, fixture `xdg-data/claude` was linked to the operator's `~/.local/share/claude` (the #67 Herdr form). Callers are synthetic fixture records with zero model turns. |
+| layout join (H1, no model) | A harmless program opened by ONE `layout.apply`: its self-reported pid equals `pane.process_info` `shell_pid` and the foreground pid; its self-read starttime equals the kernel's, so it is the same incarnation; its kernel parent is the private server. In H2 the agent-start pane's direct child was bash, with claude beneath it — the reason the Claude Code resume uses the layout launch. |
+| H2 resume | Public `entwurf_resume_call` through the compiled bridge: `[entwurf resume call ↻ herdr]`, `receiver-armed` after 2035 ms. Pane child = marker ownerPid = kernel pid; kernel starttime = marker startKey; parent = private server; cmdline `claude --resume <session>` with no prompt or model; same gid, session and createdAt; `attachIncarnation` refreshed and equal to the marker's. |
+| H2 recall | **Not measured.** The doorbell woke one turn; the model declined to read the mail, citing its seed task's "and stop" (a screen reading, not a product diagnosis); no reply in 480 s (helper rc 3); the mail stayed unread. 2 submitted turns, 5 provider requests. |
+| N2 resume | The same public path: `receiver-armed` after 1523 ms; the same pid/starttime/parent join; `attachIncarnation` `0644e2aa`→`f0cb63fc`, equal in record and marker. |
+| N2 recall | Blind: nothing on the resume or recall path re-injected the seed fact — it was absent from the resume argv and context and from the recall question (the seed turn itself carried it). The target read the mail through its inbox tool with no refusal (`.delivered.read`, lastReadAt 08:27:15Z) and replied `scene-32744819`, the seed fact. 2 submitted turns, 7 provider requests; all 8 assistant entries are `claude-sonnet-5-5`; the resume passed no `--model`. |
+| cleanup | Private server stopped (rc 0 in both runs); tracked pids absent (H2 6, N2 11), no listeners. The h2/h3 trees and native records are preserved. |
+
+Unmeasured and not inherited: the tmux Claude Code path at this candidate, n>1, billing and OAuth writes, `~/.claude.json`, the final candidate, exact-SHA CI, any installed plugin runtime pin, and registry/release acceptance. Host artifacts: `/tmp/e157h/s4-cc-a/{RECEIPT.md,h1/,h2/raw/,h3/raw/}` (incidents: `h3/raw/x00-claude-link-mutation.txt`, `h3/raw/x01-vendor-version-loss.md`) and `/tmp/e157h/stage4/{LAUNCHER-RESTORE.md,CURRENT-N2-AND-FLOOR.md,QUALIFICATION-AND-FULL.md}`.
+
+Notes on the release-host certification table above:
 
 - **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
   candidate `.tgz`, checkout-invisible non-root global install, PATH shims, a frozen

package/CHANGELOG.md

@@ -4,6 +4,255 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.51.0 — 2026-11-04
+
+Entwurf now runs on the Pi 1.5.0 SDK set (#155). The exact SDK closure grows from nine to ten members, the supported host Pi range moves to `>=1.5.0 <1.6`, and the pi-durable carrier follows the 1.5 durable API. An operating host moves to this version only through a planned cutover, because SDK 1.5's first write to a durable session is not readable by SDK 1.4.
+
+What this release is not: it adds no MCP tool (the nine tools are unchanged) and no new authority. It adopts no 1.5 feature beyond what the migration requires. Hosts that stay on the published 0.50.0 / Pi 1.4.0 SDK set keep following the published 0.50.0 instructions, which remain checked separately.
+
+### Pi SDK 1.5.0 (#155)
+
+- **Exact SDK set.** All ten `@earendil-works/*` members are pinned at exactly 1.5.0: chord, pi-agent-core, pi-ai, pi-codemode, pi-coding-agent, pi-durable, pi-mcp, pi-schema (new), pi-telemetry and pi-tui. The pi-durable overlay pin moves with them.
+- **Host range.** The supported host Pi range is derived from the pinned SDK and is now `>=1.5.0 <1.6`; setup and `install-user-scope` refuse a detected pi outside it. A 1.4 host is outside the range of this version; install host Pi 1.5 by exact version.
+- **Tool schemas on pi-schema.** pi-ai 1.5.0 no longer exports TypeBox's `Type`, and upstream pi-durable 1.5.0 drops its `typebox` dependency. The `entwurf_v2` contract schema and the pi-durable subagent tool are built with `@earendil-works/pi-schema` builders; the subagent tool's input stays open (`{ open: true }`) so it accepts what it accepted before. The optional `typebox` peer dependency and its `peerDependenciesMeta` entry are removed from the package.
+- **pi-durable carrier on the 1.5 durable API.** The carrier no longer calls the removed `viewState()`, `taskGraph()` and `subscribeCommits()`. The transcript shows the SDK's whole active transcript (`Conversation.context().entries`, head marker first), not the latest entries of the 1.5 conversation window: it is read once, a watch attached right after that read appends later entries in ID order, and a compaction, a reset or a window that skipped entries reads it again from the SDK (#155 D1). A read that lands after a switch, the close or the session's own failure is dropped, and a read that fails is reported on screen as stopped updating, without a retry. The task panel follows `watchTaskGraph()`, and commits are observed through `observeCommits()`, whose end decides nothing because SDK 1.5 ends it `failed` at a normal close as well. Whether a session ended closed or failed is read from the session end's `kind`; the 1.4 `reason` field is absent in 1.5 and would otherwise read every end as closed. Reports show `report.error`, compaction status shows its `trigger`, and a run that ended without an answer stays visible as `pi.live.runFailure`.
+- **Durable data and rollback boundary.** SDK 1.5 keeps SQLite schema version 2 but stores `pi.live` at version 3, `pi.generation` at 2 and `pi.tool` at 3; SDK 1.4 refuses a session after 1.5 has written it. Two synthetic sessions written by SDK 1.4, one closed and one killed, with a hashed golden manifest, are opened by 1.5 without a resume or new input. A storage open keeps schema version 2 and every row. A Harness open that only reads the root conversation, the live document and the task inspection stores no new document version and changes exactly the tables SDK 1.4's own reopen of the same file changed: none for the closed session, the `durable_metadata` and `tasks` rows for the killed one, where the open runs crash recovery. The first 1.5 write stores `pi.live` at the version SDK 1.4 refuses. This is fixture evidence for those two files. It does not show that the database is opened read-only, and it does not certify compatibility or recovery for operating data. Upstream states that restart-limited tasks no longer park in 1.5 and end visibly instead; this release does not measure that behaviour.
+- **Published recipes stay separate.** Documentation regions marked `entwurf:published @junghanacs/entwurf@0.50.0 pi 1.4.0` keep describing the published 0.50.0 package and are checked by `check-dep-versions` against a frozen record of that artifact, independent of the development floor.
+
+### Release and upgrade workflow
+
+- **Default radius for a Pi SDK upgrade.** A requested SDK upgrade reuses the existing native authentication after a coherent installation; it does not make a fresh login or credential copy a prerequisite. Isolated, authentication-free checks come first; the operating window keeps normal owner exit, a consistent backup of the whole durable-session directory and same-identity reattachment. The decision does not authorize a cutover, retirement or publication ([setup](docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade)). Setup also records the recurring SDK rail.
+- **Persistent release candidates.** `make` creates each candidate in a private, uniquely named directory under `${XDG_STATE_HOME:-~/.local/state}/entwurf-releases/<version>-<sha12>/` instead of `/tmp`, keeps failed candidates, and never relocates a candidate or adds a `current` alias.
+- **One human publish line.** After U0 passes and a named pre-publication receipt records both dist-tags, the handoff prints exactly one shell-quoted line, `cd ~/repos/gh/entwurf && npm publish <canonical tgz> --tag <latest|repair>`. U2 restores its baseline from that receipt rather than from the post-publish registry. The supported dist-tags are `latest` and `repair`.
+- The `entwurf-dev` skill is narrowed to the citizen lifecycle; release and upgrade ordering live in the release skill and setup.
+
+### Herdr plugin
+
+The first five bullets record the plugin's re-pin to the published npm 0.50.0 runtime, made after the 0.50.0 release (`f45a95a`); they describe that runtime's Pi 1.4.0 SDK set, not this release's. The last bullet is this release's change.
+
+- Pinned the published npm `@junghanacs/entwurf@0.50.0` with its measured registry sha512 and align the plugin manifest to 0.50.0. The downloaded registry tarball is byte-identical to the accepted Windows-carrier core artifact (SHA-256 `64ca198067d8ad5265f89a903efdaa3e7946bfe7ba3a83dd27009a878631afba`). This closes the prepare-time `herdr-checkout` window described below; the core tag, npm bytes and historical 0.50.0 release section are unchanged.
+- Kept the Pi 1.4.0 SDK set and host range `>=1.4.0 <1.5`. The owning install guides name 0.50.0; the root README's unpinned entrance is unchanged. A checkout-source installation must explicitly deactivate before reinstalling this npm-source pin; a settled npm-source host follows the existing rebind/ownership rules. No operator installation or working session is automatically changed.
+- Source-specific verification: registry metadata reports `latest=0.50.0`, `repair=0.12.8-repair.1` and 668 files. The downloaded registry tarball's SHA-512 and SHA-1 equal `dist.integrity` and `dist.shasum`; SHA-256 and `cmp` match the accepted core artifact. No immediate pre-publish dist-tag snapshot was collected by the agent, so `repair` preservation is observed against the earlier dated reading, not claimed as a measured publication delta. The unchanged tarball's Windows and Linux package-consumer acceptance is explicitly reused, not re-run.
+- A private registry-installed Pi 1.4.0 consumer resolved the bridge inside its own installed root and listed seven `entwurf` model rows without a model turn. Its registry-shipped `herdr-runtime.mjs` is byte-equal to this checkout's. That helper acquired real npm 0.45.0, swapped to 0.50.0, restored the previous runtime before acquiring again in a manually seeded `torn-swap-with-candidate` state, skipped acquisition on an exact re-request, and removed its owned sandbox runtime/cache/journal. This is not recovery from an actual kill or a harness activation proof.
+- The public-ref install/use/activation/deactivation journey and pushed-SHA CI receive their own post-push receipts; prior checkout-carrier or older npm receipts are not those measurements. No plugin snapshot tag is claimed by this commit.
+- **This prepare returns the lock to the verification carrier.** Core 0.51.0 has no published bytes while it is prepared, and an npm lock must name the checkout's own version, so `plugins/herdr/runtime-lock.json` goes back to the closed `herdr-checkout` source, as the 0.50.0 and earlier candidates did. No npm version or integrity is invented for 0.51.0 and the plugin manifest version is not bumped. An install that tracks this source builds its runtime from the checked-out commit; a host switching from npm runs `herdr-plugin-deactivate` first. Hosts that installed the npm 0.50.0 runtime keep running it (Pi 1.4.0 SDK set) until they reinstall. A separate step re-pins npm 0.51.0 once it is published.
+
+### Upgrade
+
+- **Operating hosts** move in one planned window, following the [SDK upgrade radius](docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade) and the cutover conditions in [#155](https://github.com/junghan0611/entwurf/issues/155): close the old owners normally and prove they exited, back up the whole durable-session directory (including `-wal`/`-shm`) as one consistent set before the first 1.5 open, install host Pi at the pinned exact version 1.5.0 rather than through a bare `pi update`, install this package and move the user-scope ownership with `entwurf takeover-user-scope`, check the doctors, then reopen the same identities. Installing an older package afterwards is not a data rollback: returning a session to SDK 1.4 requires restoring the consistent backup taken before the first 1.5 open, and work done after that open is not in it.
+- **Checkout-run hosts** refresh the bytes each surface actually loads. Ordinary Pi and pi-durable require `pnpm run build-bridge`, accepted output/SDK verification, then a new host process; copied hook/extension units require their owning installer. Follow [Applying new source to a running host](docs/setup-clean-host.md#applying-new-source-to-a-running-host) before restarting sessions. An already-running bridge keeps the modules it loaded.
+- **Claude Code hosts** re-run `entwurf install-meta-bridge`, then restart open Claude Code sessions in the operator's own order. An already-running bridge keeps the modules it loaded.
+- **npm consumers** re-run `entwurf setup` in the same scope, then `check-bridge`.
+
+### Release evidence
+
+- Source checkpoint: `c95bd66`, branch push CI run 41587081824, all four required jobs successful. This is that checkpoint's evidence, not the prepared SHA's CI.
+- Prepare-time floor: working tree over `c95bd66` (index tree `6824440955ce`), patch `7081abf50b08447c89739976b825a30c0ded390188c7a058c7f48d04e8be5417`, before the branch handoff edits and this evidence wording. The managed build left the 99-file compiled manifest byte-identical (`3c3c679a466c5489d921960f082f1024bf6774b2f4fa1115173bed68c6386d85`). `check:full` ran 959 s, exit 0. The checkout-only pi-durable cells passed against that compiled bridge: `check-pi-durable-contact` 91, `check-pi-durable-send` 19, its `native-module` cell 14 and `check-pi-durable-receive` 21, 0 failed (V not run). The candidate seal was identical before and after.
+- LIVE release gate: working tree over `c95bd66`, same index tree and compiled manifest, patch `c8295e54606dbe3f9aaa0abcadf3e4a818d3b1466525969b8e2bb2591c4b5289` (the floor's patch plus branch handoff edits, before this evidence wording). `release-gate --cut` ran once on 2026-11-03 from 21:03:41 to 21:24:44 KST (1262 s), with `check:full` 953 s exit 0, MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut OK. Scratch/log: `/tmp/entwurf-release-gate-0.51.0.WGGdxZ/release-gate.log`, 598,872 bytes, SHA-256 `059bf77d197a5c10fd0dc0d0697839edae59380d3d9c9c385c08164365ed3ede`; the operator evidence copy is byte-identical (`cmp`). The candidate seal (HEAD, index tree, porcelain, changed-path bytes, compiled manifest) was identical before and after the gate.
+- That gate ran on the operating host after the cutover below, so its LIVE steps used host Pi 1.5.0 and the installed 0.51.0 validation package with the existing native authentication. Codex CLI 0.166.0 used an operator-owned app-server started for this run in its own tmux session, not the gate's, with models `gpt-6-luna` / `openai-codex/gpt-6.1-terra`; it was stopped afterwards. The wrapper ran in the real HOME with `PI_SESSION_ID`, `PI_AGENT_ID`, `CI` and the Claude Code session variables removed, and both verify-deps settings at `error`. `CLAUDE_CONFIG_DIR` was not in that removal list: it was absent from a sample of the gate session's running process tree taken during the run, from the tmux global environment and from the launching shell, so its absence was sampled, not enforced by the wrapper. A corrected wrapper that also removes it was written during the run and has not been run.
+- Host residue after the gate, read-only: no reparented process from the gate and no process using its paths. Its scratch, the pi-durable fresh-live receipts and the chain smoke's records were kept as evidence. `check:full`'s `herdr-resume-call` and `mux-resume-call` tests leave two directories per prefix per run (eight here, at most 34 bytes each); they are recorded as a finding and were not deleted.
+- Installation-validation tarball: unpublished and addon-less, packed from the floor's candidate, SHA-256 `199e5f41d20e5b2665125868b7e3e27740e5985f7a25ac61902126b7ed638bf5` (11,611,560 bytes), accepted by the unchanged Linux container (`validation-acceptance.log` SHA-256 `e505f5e9ec3982ad3091ac6582a1d3832573b5933a42e0aaf02325b8f1f70efe`). It carries no Windows build and is not the release candidate, which `make` produces from the prepared SHA. An isolated rehearsal of the global ownership transition passed (old 0.50.0 owner, then a normal install refused with exit 6 and settings unchanged, then an explicit `takeover-user-scope` to 0.51.0; run log SHA-256 `4d84a7b3433f7097d606b83d097facec25f5ea9a9a6a1559a665f21e081a6c00`).
+- Operating cutover on the maintainer host, 2026-11-03 20:46–20:49 KST, under the [#155](https://github.com/junghan0611/entwurf/issues/155) conditions. Four operating owners were closed normally and classified dead by the product's owner check, with no durable file holder and no lock left. The whole durable-session directory (171 files, 487,281,652 bytes; source-before, backup and source-after manifests identical, SHA-256 `5c08bed1968fd1e26baa58112f0ce5c36874e147ccc5e9b4c69ec1a0d9070a46`) and the two Pi transcripts were backed up before the first 1.5 open. Host Pi 1.5.0 was installed by exact version once all ten SDK members had passed pnpm's one-day release age, with the global pnpm policy file unchanged. The validation tarball above was installed and `takeover-user-scope` moved ownership to its root. The doctors reported ownership (`owned — this root`) and runtime (nine tools boot) separately, and the ten SDK members resolve to 1.5.0 from that root. The same identities were then reopened and the main pi-durable citizen made real turns on 1.5. A pi-durable same-id resume through `entwurf_resume_call` came back without the operator's `--native-module`, as its bridge-only launch contract states; the operator restarted that citizen by hand with its module.
+- Native Claude Code host after the cutover (VERIFY pass criterion 4), 2026-11-03 21:37–21:39 KST: a fresh Claude Code fixture opened through `entwurf_fresh_call` called back with its exact launch nonce. Its receiver and sender markers join its record (native session id and attach incarnation, with the owner's start key re-measured live). Its direct MCP child is the 0.51.0 bridge from the installed root, reached through the bare `entwurf-bridge` user-scope command, and no 0.50.0 bridge runs under it. The installed `doctor-meta-bridge` passed while the fixture was alive, with the deployed writer and hook lock module matching source. This was measured on the validation installation, not the release artifact, and Claude Code sessions opened before the cutover were not restarted.
+- Not covered by the above: the operating root is the validation tarball, not the published artifact, and rebinding operation to the registry's 0.51.0 is a separate step after publication. Claude Code sessions that were already open keep the 0.50.0 bridge they loaded until they restart. One Claude Code citizen's dedicated MCP file still names the 0.50.0 root, pending its operator's own decision; that root stays installed. Exact prepared-SHA CI, the Windows-carrier candidate and its Linux acceptance, installed-host acceptance of the release artifact and the registry proof need their own receipts. npm publication is GLG's own action.
+- **D1 transcript repair after that gate.** The transcript change above (#155 D1) landed after the gate and the cutover above, as the checkpoint `20426b2` over `434874e`. It changes the pi-durable carrier and its pin, not the compiled bridge or the SDK set: the 99-file compiled manifest stays `3c3c679a466c…`. The carrier qualification group ran on working-tree candidates over `434874e`, before that checkpoint commit. Its first run was red: it killed 65 of 66 claims, and the `ACTIVE-SEED` claim failed for the wrong reason because the test's setup failed before its assertion ran. After a one-line observer fix in the test, a second run on the corrected working tree killed 66 of 66 with both controls green; that receipt (head `434874e`, surface `b6cee8925072`) is listed below as an earlier-candidate PARTIAL.
+- LIVE release gate on the D1 checkpoint:
+  - **Candidate.** HEAD `20426b2` (tree `ba596c153283`) with working patch `b8172a65fd356db69a5f00d52c54ab84aeb75496acefab815dc855978124ba5c`, which touches only this file and the branch handoff and predates this evidence wording. The compiled manifest `3c3c679a466c…` was byte-identical after a managed build.
+  - **Result.** `release-gate --cut` ran once on 2026-11-04, from 03:02:41 to 03:23:10 KST (1229 s); the wrapper around it, including the managed build and the seals, ran from 03:02:34 to 03:23:11. Its own `check:full` was the first MUST step and ran 963 s, exit 0; no separate offline full floor was run for this candidate. MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut OK.
+  - **Integrity.** Log SHA-256 `d16537ca4455498c6a371bc80a869d0de70832d30d86d770ccbc8212427380c2`; the scratch original and the evidence copy are identical. The candidate seal was identical before and after the gate (`37446ea0a4f5…`).
+- How that gate reached the new source:
+  - **PATH.** `entwurf` on the gate's PATH resolved to this checkout's `run.sh` through a private directory holding only that link. `entwurf-bridge`, `entwurf-statusline` and `pi` stayed the installed 0.51.0 validation root.
+  - **Witness.** A read-only process sampler ran for the whole gate. It observed that the pi-durable fresh-live fixture's host ran this checkout's carrier bootstrap and resolver, that the host owned the new location whose garden is the smoke's pi-durable record, and that the host's `entwurf-bridge` child ran from this checkout's compiled bridge. The fixture's initial visible Pi ran the installed validation root's bridge.
+  - **Limit.** The sampler judged only that fixture; which root each other LIVE step loaded was not observed.
+- That gate's environment:
+  - **Host and auth.** It ran in the real HOME with the existing native authentication.
+  - **Removed variables.** Exactly these names were removed: `PI_SESSION_ID`, `PI_AGENT_ID`, `CI`, `CLAUDE_CONFIG_DIR`, `CLAUDECODE`, `CLAUDE_CODE_SESSION_ID`, `CLAUDE_CODE_ENTRYPOINT`, `CLAUDE_CODE_CHILD_SESSION`, `CLAUDE_CODE_MESSAGING_SOCKET`, `CLAUDE_CODE_MESSAGING_TOKEN`, `CLAUDE_PID`, `ENTWURF_CALLBACK_TARGET`, `ENTWURF_CALLBACK_NONCE` and `ENTWURF_META_SENDER_MARKER`. Both verify-deps settings were `error`.
+  - **Models.** Codex CLI 0.166.0 used `gpt-6-luna`, with `openai-codex/gpt-6.1-terra` for its callback Pi; the pi-durable fresh-live fixture's pi-durable host and its initial Pi used `openai-codex/gpt-6.1-sol`.
+  - **Codex app-server.** A dedicated app-server was started for this run in its own tmux session, not the gate's, and stopped after the gate. Before the gate, the launch helper's own listener check stopped with exit 3: it looked for the control path's text, but the socket is reached through Codex's rendezvous alias. A follow-up check found the same app-server process, with the same pid and start time, listening on the alias's target, and the gate ran against it.
+- Host residue after that gate (read-only, nothing deleted):
+  - No smoke private tmux server and no new reparented process naming `/tmp` were observed, and this run's own app-server, sampler and pi-durable host were gone; the one reparented process naming `/tmp` predates the run.
+  - `check:full`'s `herdr-resume-*` and `mux-resume-call-pd` tests again left two directories per prefix (eight, 0–34 bytes each), and the chain smoke left one.
+  - Its scratch, the pi-durable fresh-live receipts and the run evidence were kept.
+- The native Claude Code receipt above (criterion 4) remains evidence for the unchanged bridge and SDK on the validation installation. It was not repeated for D1, and that installed root does not carry the D1 carrier.
+- Not run for the D1 checkpoint: CI for the shipped SHA, the Windows-carrier candidate and Linux acceptance of that same tarball, installing D1 on the operating host, npm publication and the registry proof.
+- The gate validated the manifest's 1506 claims across 94 lanes without executing the qualification body (#144).
+- The 2026-11-04 gate on the D1 checkpoint validated the manifest's 1513 claims across 94 lanes without executing the qualification body (#144).
+- Kill-power re-measured at this shipped SHA: none (all 1513 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-pack-pin-matcher"] 2/2 receipt bffbc106e427
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-dep-versions"] 5/5 receipt d890494fb815
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-acp-vendor-rejection"] 4/4 receipt ff9a31e78a1d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-pi-durable-carrier"] 59/59 receipt 0558e6e723a7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 434874ef6d6e surface b6cee8925072 -- ["bash","run.sh","check-pi-durable-carrier"] 66/66 receipt 822f2d8b950e
+
+## 0.50.0 — 2026-11-02
+
+Same-id resume now reaches every resumable backend on both launch rails. A dormant pi, pi-durable or Claude Code citizen reopens under its own garden id in a visible tmux window or, inside Herdr, a new Herdr tab, with no fallback from one rail to the other (#157). The CLI gains one description source, safe help and a thin `entwurf claude` entry (#153, continued in #157).
+
+What this release is not: it adds no MCP tool (the nine tools of 0.45.0 are unchanged) and no new authority. No resume submits a prompt. A Claude Code resume restores no model or permission flag. A pi resume still launches with the provider/model the transcript's first `model_change` records. Delivery still never starts a process. Herdr is not re-pinned to npm here. An npm lock must name a published version, and 0.50.0 has no published bytes while it is prepared, so `plugins/herdr/runtime-lock.json` returns to the closed `herdr-checkout` verification carrier, as earlier release candidates did. From the moment the prepare commit reaches main, a main-tracking Herdr install builds its runtime from the checked-out commit instead of npm, and a host already on the npm 0.45.0 runtime must run `herdr-plugin-deactivate` before it reinstalls. The published 0.45.0 pairing stays pinned by the Herdr tag `v2026.10.27-herdr.0.45.0`. The Herdr manifest version is unchanged; a separate snapshot re-pins npm after 0.50.0 is published.
+
+### Same-id resume across rails (#157)
+
+- **Pi inside Herdr.** `entwurf_resume_call` reopens a dormant pi citizen in a new Herdr tab through agent start. The rail is selected by the same `HERDR_ENV=1` predicate fresh call reads. Workspace drift and agent occupancy refuse before start, and a failure after the tab exists reports its recovery rather than "nothing opened".
+- **pi-durable, on tmux and Herdr.** A dormant pi-durable citizen reopens through an owner-fence reservation and `entwurf pi-durable --entwurf-adopt` with a closed bootstrap context; Herdr uses one `layout.apply`. The observation is adoption (`adopted`, `not-yet-adopted`, `reservation-lost`, `unobserved`), not readiness or recall. A reservation awaiting adoption under a live holder refuses a second resume and is never cleared automatically.
+- **pi-durable session handling.** It adds exact native session selection for the current cwd (no picker, no model override) and Herdr fresh through one layout request with lifetime fencing. Known reserve/withdraw writes survive release failures, and reservation holders are kept distinct from addressable citizens.
+- **Claude Code inside Herdr.** The target opens through ONE `layout.apply` running `claude --resume <session>`. ONE `pane.process_info` then reads the pane's direct child, and that child is joined by equality to the receiver marker's owner, under the same dormancy, startKey, fresh-binding and record checks as tmux. If the child cannot be read, the observation is `pane-process-unread`: it does not wait, close or retry. On the resume path only pi uses agent start, because agent start types into the pane's shell; a fresh Claude Code sibling inside Herdr still opens through agent start.
+
+### CLI (#153, #157)
+
+- **One description source.** `ENTWURF-CLI.json` is the description source. Exact help forms (`entwurf --help`, `help all`, `help <command>`, `<command> --help`) are answered before dispatch, and an undescribed name is refused. The root page is task-oriented and the documented catalog lives under `help all`. The guide topics `help team` and `help remote-pair` ship with `team.json.example`.
+- **`entwurf claude [args…]`** (#157 stage 4) execs the `claude` on PATH with argv, cwd, exit status and signals unchanged. It removes an inherited `PI_SESSION_ID`/`PI_AGENT_ID` and exports only `ENTWURF_CLAUDE_LAUNCH_ACTIVE=1`. Two recursion fences refuse a re-entry. Citizenship still comes from the hooks `install-meta-bridge` installed.
+- **Maintainer-facing.** Development gate dispatch is deduplicated with operator commands, help and exit behavior preserved.
+
+### Herdr plugin
+
+- **One receipt-owned operator link.** An explicit, PATH-qualified expose/withdraw pair carries a schema-3 activation floor, staged candidate admission and a link teardown that preflights everything first. Installed dev-bin mutations stay source-only.
+
+### Agent guidance
+
+- `ENTWURF.json` payload revision 11 → 19 (schemaVersion 6). It adds the Herdr pi resume rail (12), pi-durable inside Herdr (13), the 2048-character host-cap rewrite of the `entwurf_fresh_call` description and its restored contract phrases (14–15), the fresh-call cwd parameter's echo sources (16), pi-durable same-id resume (17–18) and Claude Code resume inside Herdr (19). Each is a reviewed amendment layer over preserved originals.
+
+### Upgrade
+
+- **Checkout-run hosts** refresh the bytes each surface actually loads. Ordinary Pi and pi-durable require `pnpm run build-bridge`, accepted output/SDK verification, then a new host process; copied hook/extension units require their owning installer. Follow [Applying new source to a running host](docs/setup-clean-host.md#applying-new-source-to-a-running-host) before restarting sessions. An already-running bridge keeps the modules it loaded.
+- **Claude Code hosts** re-run `entwurf install-meta-bridge`, which re-assembles the plugin copy, then restart open Claude Code sessions in the operator's own order, one by one. No working session is stopped automatically. A rollout is complete only once each participating reader is verified on the new bytes.
+- **npm consumers** re-run `entwurf setup` in the same scope, then `check-bridge`.
+- **Herdr plugin hosts** that already installed the npm 0.45.0 runtime keep running it until they reinstall; that pairing stays pinned by the Herdr tag `v2026.10.27-herdr.0.45.0`. An install that tracks main after this prepare builds its runtime from the checked-out commit through `herdr-checkout`, and a host switching from npm runs `herdr-plugin-deactivate` first. A separate snapshot re-pins npm 0.50.0 once it is published.
+
+### Dated native observations (BASELINE; not floors)
+
+- Herdr native Pi same-id resume n=1 (2026-11-01).
+- pi-durable Herdr public resume n=1 on a pre-final candidate.
+- Claude Code Herdr resume, n=1 ×2 (2026-11-02). Recall was unmeasured in the first run and measured blind in the second.
+- **Operator impact recorded with those runs.** The launcher relink was restored with approval. Claude Code 2.1.312 was lost from the shared vendor store; the writer pid was not measured and harmlessness is not established.
+- No named LIVE or release gate covers same-id resume inside Herdr or pi-durable same-id resume. Herdr fresh call has its own on-demand LIVE (`smoke-herdr-fresh-call-live`).
+
+### Release evidence
+
+- Pre-version landing: `6f4dc72`, exact-SHA push CI run 41427433295, all four required jobs successful. This is the landing SHA's evidence, not the prepared SHA's CI.
+- Prepare-time floor and LIVE gate: working tree over `6f4dc72`, patch `020a024c978cd5700f5e76fb60d59af55eb8c00bd1cd59357b9ed4f75042293a`, before the final evidence/upgrade wording. `release-gate --cut` ran once from 22:37:28 to 22:59:33 KST (1325 s), with `check:full` 1008 s exit 0, MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut OK. Scratch/log: `/tmp/entwurf-release-gate-0.50.0-r3.CMLPOf/release-gate.log`, SHA-256 `c66729b4bf26a36091e43697d1a9056b56dc2b659c472fb222d6e449accba086`; 99-file compiled manifest `69c4cafa8c80c1927853f71e2cfa473cdb292c79e1f86ade008c2070fd41a8c4`. [Shared receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6579130897). Codex CLI 0.166.0 used a test-owned app-server with models `gpt-6-luna` / `openai-codex/gpt-6.1-terra`.
+- Earlier prepare candidates remain RED: the first FULL failed on the npm lock/package mismatch; the first LIVE gate returned MUST 20/4/0 (stale OMP writer, two 1 MiB capture overflows, Codex 0.162.1 callback timeout); the second returned MUST 23/1/0 (the moved README floor declaration). The Codex timeout's cause remains unknown: queue acceptance is not a model-read receipt. No older LIVE/static results were combined into the final aggregate.
+- Operator-side changes outside the package: OMP birth/receive units were reinstalled through ownership-matched installers and their doctors passed; GLG updated Codex to 0.166.0. Claude Code launcher and 2.1.314/2.1.316 file fields/hashes matched before/after the final gate. This does not prove whole-HOME invariance, erase the earlier 2.1.312 loss, or prove every already-loaded reader was refreshed. The x02 unintended vendor invocations were stopped; other HOME writes/request usage remain unmeasured.
+- The gate validated the manifest's 1497 claims across 94 lanes without executing the qualification body (#144). Exact prepared-SHA CI, the mandatory M3w Windows carrier tarball and unchanged-file Linux acceptance, installed-host acceptance and operating rollout/restart need their own receipts. The local floor is not those proofs. npm publication is GLG's own action.
+- Kill-power re-measured at this shipped SHA: none (all 1497 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 674887de2ffb surface 3410eb4abb62 -- ["bash","run.sh","check-install-surface"] 39/39 receipt 96e54476fdea
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 29179171d2a5 surface 416486bb2dd7 -- ["bash","run.sh","check-install-surface"] 44/44 receipt 4c3aa18d303a
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 85f3fd0d966f
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 61/61 receipt 720cd58c7ade
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-fresh-call-dispatch"] 13/13 receipt 5b95fbbb0909
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-fresh-call-provider"] 3/3 receipt 2106ba968015
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface 06589a4717ad -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt 862a41c278d7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 0e04bf6e728a surface e67f76c5feb6 -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 61/61 receipt 6342ca495393
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-pi-durable-carrier"] 39/39 receipt 685a8c6dfa7d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-pi-durable-beside"] 46/46 receipt c3817aba8552
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-install-surface"] 44/44 receipt baa8ddb8c3d2
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2aaf8562497a surface e07908ea5d6a -- ["bash","run.sh","check-gate-manifests"] 52/52 receipt fbd7c0a7f297
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-herdr-fresh-call"] 59/59 receipt 593e9193286d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-fresh-call-dispatch"] 15/15 receipt 07b0b36dadca
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 8a186fd0790c
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-herdr-plugin"] 25/25 receipt a3f9c21cca50
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 1acef734a2be -- ["bash","run.sh","check-gate-manifests"] 52/52 receipt f9c17068de14
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-herdr-fresh-call"] 61/61 receipt 1be9d472a202
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-herdr-plugin"] 26/26 receipt 3124d7184d34
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 0e84ba092a95
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head d6129139ad97 surface 8d3a7b826d00 -- ["bash","run.sh","check-gate-manifests"] 52/52 receipt 22b2be63719d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 96604c251769
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-tests-beside-behavior"] 74/74 receipt de7bd99c0627
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt bda6d08af94f
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 80/80 receipt 930c572bd121
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 88e73a89ebac -- ["bash","run.sh","check-pi-durable-beside"] 51/51 receipt 29b846b0ead9
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 46c7c776c7fe surface 783f01aa8b0c -- ["bash","run.sh","check-pi-durable-carrier"] 51/51 receipt 709e9f7bb632
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 88/88 receipt 3634eaeb7043
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt 997eb11e3be3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt d63c171fe084
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 43594eba588a surface eede92f3dc48 -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt 65daf45dfff2
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-entwurf-v2-visible-resume"] 94/94 receipt 19b759779c6a
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt e07f2130adb5
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-claude-launch"] 12/12 receipt 3c218eb802e6
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-install-surface"] 44/44 receipt 47c25cef1581
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-mux-resume-call"] 17/17 receipt c12e1151be55
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 2734f524bfec surface 1075a5c8fc15 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt ec08a9060e91
+
+## v2026.10.27-herdr.0.45.0 — Herdr Entwurf plugin 0.45.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.45.0 and its
+`v0.45.0` tag remain unchanged. Core 0.45.0 is now published to npm; the publication is
+verified from the registry, not from observing who ran it.
+
+**Reading guide (2026-10-27).** The `## 0.45.0` section below is the text that shipped inside
+the 0.45.0 tarball. Its statement that the Herdr lock rides the `herdr-checkout` carrier while
+0.45.0 is unpublished predates later facts: `v0.45.0` and its GitHub release point at
+`191e425`, that SHA's push CI ran its four required jobs green, and npm `latest` is 0.45.0,
+byte-equal to the accepted Windows-bearing candidate. Until this snapshot lands, a
+main-tracking `herdr plugin install` acquires the checkout commit rather than an npm artifact.
+Neither the published tarball's CHANGELOG nor the core release page is amended by this
+snapshot.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.45.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that the 0.45.0
+  candidate rode to production npm source `@junghanacs/entwurf@0.45.0` with the registry's
+  measured sha512 (`sha512-/Uu7rLyS…59tbQ==`). The plugin manifest moves 0.41.2 → 0.45.0;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged. From
+  the `v2026.10.24-herdr.0.41.2` snapshot to `v0.45.0`, the changes under `plugins/herdr/`,
+  `scripts/herdr-runtime.mjs` and `scripts/fixtures/herdr-supply.json` were that lock's return
+  to `herdr-checkout` and the plugin README's candidate wording; the runtime helper and the
+  Herdr supply pin did not change.
+- **Pi stays at 1.4.** The acquired runtime carries the Pi 1.4.0 SDK set and accepts Pi
+  `>=1.4.0 <1.5`, the same range as the previous snapshot's 0.41.2.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.41.2
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed the 0.45.0 `herdr-checkout` candidate from main must explicitly deactivate by its
+  own absolute runtime path before reinstalling the npm-source snapshot. No operator
+  installation or active session is rewired by this release work, and a harness already
+  running keeps the runtime it started with.
+- **What the acquired runtime carries, and what this path does not.** The runtime ships core
+  0.45.0's bytes, including its nine-tool bridge, root `ENTWURF.json`, the pi-durable carrier
+  and the paused agy native push. Herdr wires and opens only `{pi, claude-code}`, so this
+  plugin path launches no pi-durable or agy session. Inside Herdr, `entwurf_resume_call` still
+  refuses as `herdr-resume-unsupported`.
+- **README.** The runtime paragraph and the Pi requirement name npm 0.45.0 and point at the
+  previous snapshots' 0.41.2 and 0.41.1 on the same Pi 1.4.0 SDK set.
+- **Current install docs.** The root README and the clean-host setup guide name the published
+  0.45.0 in their install commands and tool counts, and the root README names this snapshot as
+  the Herdr pin. Moving a live host onto 0.45.0 remains a separate operator decision for each
+  host.
+
+### Source-specific verification
+
+- Registry metadata reports `latest` 0.45.0 and `repair` 0.12.8-repair.1, 651 files. The
+  downloaded registry tarball is byte-equal (SHA256 and `cmp`) to the preserved accepted core
+  candidate (SHA256 `584fca5d623cce8e91c2ef0901ed54824e7b1d03042035e5e7547e854291c408`,
+  11473584 bytes); its independently computed sha512 and sha1 equal `dist.integrity` and
+  `dist.shasum`. No dist-tag snapshot was taken immediately before the operator's manual
+  publish, so `repair` is observed unchanged only against an earlier dated reading.
+- **Package consumer, reused.** Core make already ran its container consumer against those
+  same 0.45.0 bytes (acceptance log `4ccd048bcf79`, repoDigest `node@sha256:6dac556d…`, image
+  ID `sha256:55ab623b…`), so that result is reused here, not repeated.
+- **Registry-installed package (Pi).** A sandboxed `pi install npm:@junghanacs/entwurf@0.45.0`
+  (Pi 1.4.0) resolved its bridge to the installed root inside the sandbox; the installed
+  compiled bridge entry and `ENTWURF.json` equal the accepted tarball's members;
+  `--list-models entwurf` printed seven `entwurf` rows including the curated Claude anchors,
+  with no unknown-provider error. No model turn. The run started from an empty environment
+  (`env -i`, PATH only) with sandboxed HOME, XDG and agent roots. npm 11.16 listed the
+  package's install scripts as not yet covered by `allowScripts` and did not run them; the
+  tarball's executables already carry mode 0755.
+- **The npm runtime swap against the real registry**, by the registry-shipped
+  `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) in sandboxed user roots, 22/22
+  checks. The 0.41.2 runtime was seeded from its own committed lock (`94d0594`); the swap to
+  0.45.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256 equals
+  the accepted candidate. A manually seeded torn swap (not a killed process) was restored before
+  acquisition and reported `recovered: torn-swap-with-candidate`; an exact re-request acquired
+  nothing, and the owned removal reclaimed cache, runtime and journal. The helper probes no Pi,
+  so these cells certify neither a Pi upgrade nor Herdr's install/update relocation, harness
+  wiring, the installed CLI's deactivate path, a model turn, or recovery from a real kill.
+- **Affected deterministic gates** on this tree: lint and the sixteen Herdr, version-floor,
+  install-surface, v2-surface and gate-manifest checks the previous snapshot ran, each exit 0.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey. That journey is a main-ref receipt for the SHA it resolved,
+  not a tag-ref install claim. Earlier npm or checkout-carrier receipts cannot certify these
+  axes.
+
 ## 0.45.0 — 2026-10-26
 
 The text Entwurf hands to models is product code. A model chooses whether to resume, retry, wait or ask a person from the words in a tool description or a reject hint, so that wording is part of the contract, not decoration. Before this release those words lived as string literals scattered through the delivery, resume and launch modules, with no single place that said which text was current or which change had been reviewed. 0.45.0 gives the extracted text one versioned source, root `ENTWURF.json`, read by one strict reader and carried unchanged into the source, compiled and installed package, with the original pre-extraction text kept as an oracle and every semantic change recorded as a separate, reviewed amendment layer. The version moves from 0.41.2 straight to 0.45.0 to mark that milestone; there are no 0.42–0.44 releases.

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi or Claude Code siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi, pi-durable or Claude Code siblings ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.