@junghanacs/entwurf 0.45.0 → 0.51.0

package/scripts/check-claude-launch.ts

@@ -0,0 +1,341 @@
+/**
+ * check-claude-launch — deterministic gate for the Claude Code launch (`entwurf claude`, #157 stage 4).
+ * Hermetic: no real Claude Code, no network, no model turn, no write outside its own temp root. Linux
+ * only: the fake vendor reads its own environment from /proc/$$/environ (it runs in the Linux check job).
+ *
+ * SAME ORACLE AS check-pi-launch and check-copilot-launch: the subject is a process REPLACEMENT, so
+ * the truth is a FAKE VENDOR — a real executable named `claude` on a sandbox PATH that reports the
+ * argv, cwd, environment and pid it was actually handed. Nothing below is asserted by reading the
+ * launcher's source, and the launcher is driven through its PUBLIC address (`run.sh claude`),
+ * because the dispatcher's own argv handling — the help preflight included — is part of the contract.
+ *
+ * WHAT THE LAUNCH PROMISES, AND WHAT IT DOES NOT. It is a spelling: the vendor's argv, cwd, exit
+ * status and signal are Claude Code's own, and `--help` is Claude Code's help, not an Entwurf page.
+ * It adds nothing to the argv. Its only environment changes are the recursion sentinel and the
+ * REMOVAL of an inherited PI_SESSION_ID/PI_AGENT_ID pair, which is another citizen's identity. It
+ * does not promise a garden citizen: that comes from the meta-bridge plugin and hooks `setup`
+ * installed, which this launch neither checks nor supplies, so nothing here models them.
+ *
+ * WHY TWO RECURSION FENCES WHEN PI HAS ONE. pi's single fence rests on the flag it injects: a PATH
+ * `pi` symlinked to run.sh re-enters as the unknown verb `--entwurf-control`. This launch injects
+ * nothing, so the same symlink would re-enter with the operator's argv as the VERB. The resolved-path
+ * fence refuses that, and the cell measuring it hands the loop an EMPTY argv on purpose: with the
+ * fence mutated away, the re-entry prints the root page and exits 0 instead of running any verb.
+ *
+ * TWO CELLS CARRY NO MUTANT, and the reason is measured coupling rather than a gap. run.sh is
+ * `set -euo pipefail`, so dropping `exec` still propagates a non-zero vendor status (set -e exits
+ * with it) and turns a vendor death by signal into a status of 128+n. The mutation that breaks the
+ * exit or signal claim is therefore the one that breaks the pid claim, and the pid cell is asserted
+ * first so that mutant lands on exactly one QK. The exit and signal cells stand on their assertions.
+ */
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import {
+	chmodSync,
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	realpathSync,
+	rmSync,
+	symlinkSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
+const RUN_SH = path.join(REPO, "run.sh");
+const SENTINEL = "ENTWURF_CLAUDE_LAUNCH_ACTIVE";
+/** The variables bash itself maintains across a script and an exec — not the launcher's choice. */
+const BASH_OWNED = new Set(["SHLVL", "_", "PWD", "OLDPWD"]);
+
+let passed = 0;
+function ok(label: string, cond: boolean, detail = ""): void {
+	assert.ok(cond, detail ? `${label}\n${detail}` : label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const root = mkdtempSync(path.join(tmpdir(), "entwurf-claude-launch."));
+try {
+	const bin = path.join(root, "bin");
+	const work = path.join(root, "work");
+	mkdirSync(bin, { recursive: true });
+	mkdirSync(work, { recursive: true });
+	const envDump = path.join(root, "vendor.environ");
+
+	// The fake vendor, installed under the REAL name `claude`. It reports what exec handed it: its
+	// own initial environment is read from the kernel (/proc/$$/environ), not from its shell's view,
+	// so bash's own bookkeeping inside the fake is not mistaken for the launcher's.
+	const vendor = path.join(bin, "claude");
+	writeFileSync(
+		vendor,
+		`#!/usr/bin/env bash
+echo "PID=$$"
+echo "CWD=$(pwd -P)"
+echo "SENTINEL=[\${${SENTINEL}-<unset>}]"
+cat "/proc/$$/environ" >"$FAKE_CLAUDE_ENV_OUT"
+for a in "$@"; do printf 'ARG<%s>\\n' "$a"; done
+if [ -n "\${FAKE_CLAUDE_SIGNAL:-}" ]; then kill -s "$FAKE_CLAUDE_SIGNAL" "$$"; sleep 5; fi
+exit "\${FAKE_CLAUDE_EXIT:-0}"
+`,
+	);
+	chmodSync(vendor, 0o755);
+
+	// TOTAL sandbox, as the sibling launch gates: the launcher writes nothing, but it EXECS a vendor.
+	const sandboxEnv = {
+		HOME: path.join(root, "home"),
+		XDG_DATA_HOME: path.join(root, "xdg", "data"),
+		XDG_CONFIG_HOME: path.join(root, "xdg", "config"),
+		XDG_STATE_HOME: path.join(root, "xdg", "state"),
+		XDG_CACHE_HOME: path.join(root, "xdg", "cache"),
+		XDG_RUNTIME_DIR: path.join(root, "xdg", "runtime"),
+		PI_CODING_AGENT_DIR: path.join(root, "pi-agent"),
+		CLAUDE_CONFIG_DIR: path.join(root, "claude-config"),
+	};
+	for (const d of Object.values(sandboxEnv)) mkdirSync(d, { recursive: true });
+
+	// A PATH with no `claude` anywhere on it: every real entry that holds one is dropped, rather than
+	// emptying PATH (the launcher still needs bash, dirname and readlink).
+	const pathWithoutVendor = (process.env.PATH ?? "")
+		.split(":")
+		.filter((d) => d !== "" && !existsSync(path.join(d, "claude")))
+		.join(":");
+
+	/**
+	 * Every bash this gate starts gets a NON-SOCKET stdin. Node's default stdin is a socketpair, and
+	 * bash reads `-c` with a socket on stdin as a remote shell and sources the system bashrc — measured
+	 * here on NixOS, where that re-runs set-environment and resets PATH, dropping the sandbox bin
+	 * (S4CLI-F01-BASHC-REMOTE-SHELL-R1). The sibling gates never see it because they pass the
+	 * operator's whole environment; this one builds its environment from scratch to compare it.
+	 */
+	const STDIO: ["ignore", "pipe", "pipe"] = ["ignore", "pipe", "pipe"];
+
+	/** The caller's whole environment, built explicitly so the vendor's can be compared to it. */
+	function callerEnv(pathValue: string, extra: Record<string, string> = {}): Record<string, string> {
+		return { ...sandboxEnv, PATH: pathValue, LANG: "C.UTF-8", FAKE_CLAUDE_ENV_OUT: envDump, ...extra };
+	}
+
+	interface Run {
+		status: number | null;
+		signal: NodeJS.Signals | null;
+		out: string;
+		args: string[];
+		sentinel: string;
+		pid: string;
+		cwd: string;
+		env: Map<string, string> | null;
+	}
+	function launch(args: string[], env: Record<string, string>, cwd = work): Run {
+		rmSync(envDump, { force: true });
+		const r = spawnSync("bash", [RUN_SH, "claude", ...args], {
+			cwd,
+			encoding: "utf8",
+			env,
+			timeout: 30_000,
+			stdio: STDIO,
+		});
+		const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
+		const argv: string[] = [];
+		for (const line of out.split("\n")) {
+			const m = /^ARG<([\s\S]*)>$/.exec(line);
+			if (m) argv.push(m[1] as string);
+		}
+		let vendorEnv: Map<string, string> | null = null;
+		if (existsSync(envDump)) {
+			vendorEnv = new Map();
+			for (const entry of readFileSync(envDump, "utf8").split("\0")) {
+				if (entry === "") continue;
+				const eq = entry.indexOf("=");
+				vendorEnv.set(entry.slice(0, eq), entry.slice(eq + 1));
+			}
+		}
+		return {
+			status: r.status,
+			signal: r.signal,
+			out,
+			args: argv,
+			sentinel: /^SENTINEL=\[(.*)\]$/m.exec(out)?.[1] ?? "<no-launch>",
+			pid: /^PID=(.*)$/m.exec(out)?.[1] ?? "",
+			cwd: /^CWD=(.*)$/m.exec(out)?.[1] ?? "",
+			env: vendorEnv,
+		};
+	}
+	const withVendor = `${bin}:${pathWithoutVendor}`;
+
+	// ── 1. the dispatcher verb must not reach the vendor ────────────────────────
+	{
+		const r = launch(["--model", "x"], callerEnv(withVendor));
+		ok(
+			"[QK:CLAUDELAUNCH-VERB-DROPPED] the dispatcher verb never reaches the vendor — without the shift, `claude` arrives as a prompt argument",
+			r.status === 0 && r.pid !== "" && !r.args.includes("claude"),
+			`status=${r.status} argv=${JSON.stringify(r.args)}\n${r.out}`,
+		);
+	}
+
+	// ── 2. operator argv crosses byte-identical, and nothing is added to it ─────
+	{
+		const operator = ["--model", "a b", "", "-", "--", "한글 인자", "  spaced  ", "--help"];
+		const r = launch(operator, callerEnv(withVendor));
+		ok(
+			"[QK:CLAUDELAUNCH-ARGV-UNTOUCHED] the vendor's argv IS the operator's, element for element — empty strings, spaces, a bare dash, the terminator, non-ASCII and a trailing --help — with nothing injected",
+			r.status === 0 && JSON.stringify(r.args) === JSON.stringify(operator),
+			`expected: ${JSON.stringify(operator)}\nactual:   ${JSON.stringify(r.args)}`,
+		);
+	}
+
+	// ── 3. the vendor's own help, never an Entwurf page in its place ───────────
+	{
+		const bad = (["--help", "-h"] as const).flatMap((flag) => {
+			const r = launch([flag], callerEnv(withVendor));
+			return r.status === 0 && r.pid !== "" && JSON.stringify(r.args) === JSON.stringify([flag])
+				? []
+				: [`${flag}: status=${r.status} argv=${JSON.stringify(r.args)} out=${JSON.stringify(r.out.slice(0, 160))}`];
+		});
+		ok(
+			"[QK:CLAUDELAUNCH-VENDOR-HELP] `entwurf claude --help` and `-h` reach Claude Code itself — the help preflight lets this verb through instead of answering with the command's description",
+			bad.length === 0,
+			bad.join("\n"),
+		);
+	}
+
+	// ── 4. the caller's directory is the vendor's ───────────────────────────────
+	{
+		const r = launch([], callerEnv(withVendor));
+		ok(
+			"[QK:CLAUDELAUNCH-CWD-KEPT] the vendor starts in the caller's directory, not the package's — Claude Code keys its project and session to that directory",
+			r.status === 0 && r.cwd === realpathSync(work),
+			`expected=${realpathSync(work)} actual=${r.cwd}`,
+		);
+	}
+
+	// ── 5–7. the environment: a sentinel added, a foreign identity removed, nothing else ──
+	{
+		const caller = callerEnv(withVendor, { PI_SESSION_ID: "foreign-garden", PI_AGENT_ID: "pi-agent-fixture" });
+		const r = launch([], caller);
+		ok(
+			"[QK:CLAUDELAUNCH-SENTINEL-EXPORTED] the sentinel is EXPORTED, so a PATH `claude` that shells back to `entwurf claude` sees it on re-entry",
+			r.sentinel === "1",
+			`sentinel=${r.sentinel}`,
+		);
+		ok(
+			"[QK:CLAUDELAUNCH-CARRIERS-SCRUBBED] an inherited PI_SESSION_ID/PI_AGENT_ID pair is another citizen's identity and BOTH are gone from the vendor's environment — absent, not emptied",
+			r.env !== null && !r.env.has("PI_SESSION_ID") && !r.env.has("PI_AGENT_ID"),
+			`vendor env keys: ${JSON.stringify(r.env === null ? null : [...r.env.keys()].filter((k) => k.startsWith("PI_")))}`,
+		);
+		const expected = new Map(Object.entries(caller));
+		expected.delete("PI_SESSION_ID");
+		expected.delete("PI_AGENT_ID");
+		expected.set(SENTINEL, "1");
+		const diff: string[] = [];
+		const actual = r.env ?? new Map<string, string>();
+		for (const [k, v] of expected)
+			if (actual.get(k) !== v) diff.push(`expected ${k}=${JSON.stringify(v)}, got ${JSON.stringify(actual.get(k))}`);
+		for (const [k, v] of actual)
+			if (!expected.has(k) && !BASH_OWNED.has(k)) diff.push(`added ${k}=${JSON.stringify(v)}`);
+		ok(
+			`[QK:CLAUDELAUNCH-ENV-EXACT] beyond those two changes the vendor's environment IS the caller's (${expected.size} variables; ${[...BASH_OWNED].join(", ")} are bash's own) — no auth, model, permission or settings variable is decided here`,
+			r.env !== null && diff.length === 0,
+			diff.join("\n"),
+		);
+	}
+
+	// ── 8. the vendor's exit status is this command's exit status (no mutant: see header) ──
+	{
+		const r = launch([], callerEnv(withVendor, { FAKE_CLAUDE_EXIT: "7" }));
+		ok(
+			"[QK:CLAUDELAUNCH-EXIT-PASSTHROUGH] the vendor's exit status is the launch's exit status",
+			r.status === 7,
+			`status=${r.status}`,
+		);
+	}
+
+	// ── 9. exec, not fork: the pid survives ─────────────────────────────────────
+	{
+		const r = spawnSync("bash", ["-c", `echo "SHELL_PID=$$"; exec bash "${RUN_SH}" claude`], {
+			cwd: work,
+			encoding: "utf8",
+			env: callerEnv(withVendor),
+			timeout: 30_000,
+			stdio: STDIO,
+		});
+		const shellPid = /^SHELL_PID=(\d+)$/m.exec(r.stdout ?? "")?.[1];
+		const vendorPid = /^PID=(\d+)$/m.exec(r.stdout ?? "")?.[1];
+		ok(
+			"[QK:CLAUDELAUNCH-EXEC-KEEPS-PID] the vendor REPLACES this process — a fork would leave run.sh as a parent that owns nothing, between Claude Code and the terminal",
+			Boolean(shellPid) && shellPid === vendorPid,
+			`shell=${shellPid} vendor=${vendorPid}`,
+		);
+	}
+
+	// ── 10. a vendor death by signal is the caller's to see (no mutant: see header) ──
+	{
+		const r = launch([], callerEnv(withVendor, { FAKE_CLAUDE_SIGNAL: "TERM" }));
+		ok(
+			"[QK:CLAUDELAUNCH-SIGNAL-PASSTHROUGH] a vendor killed by a signal is reported as that signal, not as a shell's 128+n status",
+			r.status === null && r.signal === "SIGTERM",
+			`status=${r.status} signal=${r.signal}`,
+		);
+	}
+
+	// ── 11. an absent vendor is a NAMED refusal, never a quiet success ──────────
+	{
+		const r = launch([], callerEnv(pathWithoutVendor));
+		ok(
+			"[QK:CLAUDELAUNCH-VENDOR-ABSENT] with no `claude` on PATH the launch refuses by name and non-zero, and runs nothing",
+			r.status === 1 && r.out.includes("no 'claude' executable found on PATH") && r.pid === "",
+			`status=${r.status}\n${r.out}`,
+		);
+	}
+
+	// ── 12. a PATH hit that is not a regular file is refused before exec ────────
+	{
+		const fifoBin = path.join(root, "fifobin");
+		mkdirSync(fifoBin, { recursive: true });
+		const made = spawnSync("mkfifo", [path.join(fifoBin, "claude")], { encoding: "utf8" });
+		assert.equal(made.status, 0, `mkfifo failed: ${made.stderr}`);
+		chmodSync(path.join(fifoBin, "claude"), 0o755);
+		const r = launch([], callerEnv(`${fifoBin}:${pathWithoutVendor}`));
+		ok(
+			"[QK:CLAUDELAUNCH-NOT-REGULAR] an executable PATH `claude` that is not a regular file (a FIFO) is refused by name, not handed to exec",
+			r.status === 1 && r.out.includes("is not an executable regular file") && r.pid === "",
+			`status=${r.status}\n${r.out}`,
+		);
+	}
+
+	// ── 13. the sentinel fence ──────────────────────────────────────────────────
+	{
+		const r = launch([], callerEnv(withVendor, { [SENTINEL]: "1" }));
+		ok(
+			"[QK:CLAUDELAUNCH-RECURSION-FENCE] a re-entered launch refuses by name instead of spinning behind a hung terminal",
+			r.status === 1 && r.out.includes("recursive managed launch detected") && r.pid === "",
+			`status=${r.status}\n${r.out}`,
+		);
+	}
+
+	// ── 14. the resolved-path fence: a PATH `claude` that IS run.sh ─────────────
+	{
+		// Two hops, the first relative, so the walk itself is exercised: loop/claude -> ../hop/claude
+		// -> run.sh. The argv is EMPTY on purpose (see header): without this fence the re-entry would
+		// print the root page and exit 0, never run a verb.
+		const loopBin = path.join(root, "loop");
+		const hop = path.join(root, "hop");
+		mkdirSync(loopBin, { recursive: true });
+		mkdirSync(hop, { recursive: true });
+		symlinkSync(RUN_SH, path.join(hop, "claude"));
+		symlinkSync(path.join("..", "hop", "claude"), path.join(loopBin, "claude"));
+		const r = launch([], callerEnv(`${loopBin}:${pathWithoutVendor}`));
+		ok(
+			"[QK:CLAUDELAUNCH-SELF-EXEC-FENCE] a PATH `claude` that resolves through symlinks to this run.sh is refused by name — with nothing injected, re-entry would make the operator's argv an entwurf verb",
+			r.status === 1 && r.out.includes(`resolves to entwurf's own '${realpathSync(RUN_SH)}'`) && r.pid === "",
+			`status=${r.status}\n${r.out.slice(0, 400)}`,
+		);
+	}
+
+	console.log(`\ncheck-claude-launch: ${passed} checks passed`);
+} finally {
+	rmSync(root, { recursive: true, force: true });
+}

package/scripts/check-entwurf-v2-contract.ts

@@ -25,7 +25,7 @@
  *   - R5: taxonomy covers the table reasons + pre-claims bad-target /
  *     target-locked (so bucket B F2 won't reopen it), and
  *     is PRE-DISPATCH only (no send-fail-fallback member).
- *   - schema ↔ types drift guard: the TypeBox input/receipt property keysets and
+ *   - schema ↔ types drift guard: the pi-schema input/receipt property keysets and
  *     the StringEnum members match the hand-written contract constants.
  */
 
@@ -82,7 +82,7 @@ function eq(label: string, actual: unknown, expected: unknown): void {
 }
 
 // Pull the literal members out of a StringEnum / Optional(StringEnum) schema,
-// whichever shape typebox emits — so the schema↔const drift guard is real.
+// whichever shape the schema builder emits — so the schema↔const drift guard is real.
 function enumValues(schema: unknown): string[] {
 	const s = schema as { enum?: unknown[]; anyOf?: { const?: unknown }[] };
 	if (Array.isArray(s?.enum)) return s.enum.map(String);
@@ -626,8 +626,8 @@ ok(
 	!("action" in rej) && !("transport" in rej) && !("ownership" in rej),
 );
 eq("receipt.reject.reason enum === ENTWURF_V2_REJECT_REASONS", enumValues(rej.reason), [...ENTWURF_V2_REJECT_REASONS]);
-// ？6: reject.observedLiveness is a required-nullable union — Type.Union([StringEnum
-// (FACT_LIVENESSES), Type.Null()]) — NOT Optional and NOT a bare StringEnum. The
+// ？6: reject.observedLiveness is a required-nullable union — union([StringEnum
+// (FACT_LIVENESSES), nul()]) — NOT Optional and NOT a bare StringEnum. The
 // key is always present (required), the value may be a 4-value liveness OR null.
 const rejLiveness = rej.observedLiveness as { anyOf?: { type?: string }[] };
 eq("？6: receipt.reject.observedLiveness is a 2-branch union (liveness | null)", rejLiveness.anyOf?.length, 2);

package/scripts/check-entwurf-v2-surface.ts

@@ -176,7 +176,7 @@ function assertDormantHonesty(tag: string, rawText: string): void {
  * be satisfiable by adding a per-row action/routing field, which is why it is asserted on the
  * DESCRIPTION and paired with a negative that forbids the row-level fix. What the description owes
  * a caller is that `dead` is a reported fact carrying no delivery invitation. A separately
- * requested, proven-dormant Pi/Claude lifecycle can reopen the same id without submitting a prompt.
+ * requested, proven-dormant Pi/pi-durable/Claude lifecycle can reopen the same id without submitting a prompt.
  */
 function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
 	const text = rawBlock;
@@ -187,7 +187,7 @@ function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
 			/not an invitation to dispatch/.test(text) &&
 			/no entwurf_v2 delivery is available while it is dormant/.test(text) &&
 			/Only on an explicit operator request, the separate entwurf_resume_call/.test(text) &&
-			/proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt/.test(text),
+			/proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt/.test(text),
 	);
 	ok(
 		`${tag} — entwurf_peers does not turn delivery dormancy into a ban on every lifecycle verb`,

package/scripts/check-fresh-call-dispatch.ts

@@ -18,6 +18,11 @@
  *   FCD-NO-RAIL-PARAMETER     no caller-facing input can choose a rail
  *   FCD-NO-FALLBACK           an incomplete herdr context refuses by its herdr reason
  *   FCD-HERDR-BACKEND-FIRST   a non-pilot backend refuses before any preflight and any mutation
+ *   FCD-HERDR-PI-DURABLE-LAYOUT  inside herdr pi-durable reaches the layout branch, which is told
+ *                             only WHETHER the caller is a Codex citizen and never falls back from
+ *                             its missing record cwd to this process's own (#157 A-L1)
+ *   FCD-HERDR-NO-THREAD-ID    the herdr branch builds its request from an explicit field list in
+ *                             which the Codex thread id appears only as that boolean (#157 A-L1 D5)
  *   FCD-CODEX-PREFLIGHT-TMUX  the Codex preflight still gates the tmux rail, and only that rail
  *   FCD-ONE-NONCE             one nonce is minted per call and reaches the selected rail
  *   FCD-SURFACE-ROOT-ONLY     the one public surface (the bridge; pi reaches it through Pi's
@@ -28,6 +33,8 @@
  *   FCD-RECOVERY-VISIBLE      a post-split failure shows closed vs orphan-unreclaimed:reason
  *   FCD-ACP-MODEL-EXACT       a pi `entwurf/<id>` that is not an exact curated ACP id refuses on
  *                             either rail before anything runs (#128)
+ *   FCD-RESUME-RAIL-SHARED    a same-id visible resume reaches the same exact rail choice through
+ *                             its own entry point, with no fallback in either direction (#157 G1a)
  */
 
 import assert from "node:assert/strict";
@@ -36,6 +43,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
 	dispatchFreshCall,
+	dispatchResumeLaunch,
 	renderDispatchedFreshCall,
 	selectFreshCallRail,
 } from "../pi-extensions/lib/fresh-call-dispatch.ts";
@@ -180,25 +188,45 @@ async function main(): Promise<void> {
 			!herdrBranch.includes("codexCallerFreshPreflight"),
 	);
 
-	// #129: pi-durable joined the tmux fresh set, NOT the herdr pilot set (GLG, 2026-10-06: no herdr
-	// pi-durable support in 0.31). Same axis as the codex cell: refused by the herdr reason, nothing
-	// spawned, no tmux fallback, and its installed-carrier preflight is never asked on this branch.
+	// #157 A-L1 (main 0a6f9b relaying GLG's #157 grant; supersedes the #129 "not in herdr" cell):
+	// inside herdr pi-durable reaches the herdr LAYOUT branch, which never runs the herdr CLI. The
+	// root hands that branch one boolean — the caller IS a record-backed Codex citizen — and the
+	// branch, not this root, owns the pi-durable preflight. Both calls below are refused before any
+	// socket is opened (this env names none), so nothing here can reach a herdr server.
 	const durable = recordingSpawn();
-	const durableRefused = await dispatchFreshCall(
-		{ ...REQUEST, backend: "pi-durable", model: "loopback/scripted" },
+	const durableRequest = { ...REQUEST, backend: "pi-durable", model: "loopback/scripted" };
+	const durablePlain = await dispatchFreshCall(durableRequest, HERDR_ENV, durable.spawn);
+	const durableCodexCaller = await dispatchFreshCall(
+		{ ...durableRequest, callerNativeSessionId: "019a0000-0000-7000-8000-000000000000" },
 		HERDR_ENV,
 		durable.spawn,
 	);
 	ok(
-		"[QK:FCD-HERDR-PI-DURABLE-UNSUPPORTED] inside herdr pi-durable is not a pilot backend: it refuses by the herdr reason with nothing spawned, never falls back to a tmux window, and its runtime preflight is never consulted there",
-		durableRefused.rail === "herdr" &&
-			!durableRefused.result.ok &&
-			durableRefused.result.reason === "herdr-backend-unsupported" &&
+		"[QK:FCD-HERDR-PI-DURABLE-LAYOUT] inside herdr pi-durable is no longer refused as unsupported: with the caller's own process cwd it reaches the layout branch's socket-path refusal, while a known Codex caller with no record cwd is refused as codex-caller-cwd-unavailable instead of falling back to this process's cwd — the root passes Codex-ness as a boolean, nothing spawns the herdr CLI, no tmux fallback, and the root's herdr branch names no pi-durable preflight",
+		durablePlain.rail === "herdr" &&
+			!durablePlain.result.ok &&
+			durablePlain.result.reason === "herdr-socket-path-missing" &&
+			durableCodexCaller.rail === "herdr" &&
+			!durableCodexCaller.result.ok &&
+			durableCodexCaller.result.reason === "codex-caller-cwd-unavailable" &&
 			durable.calls.length === 0 &&
 			herdrBranchLocated &&
 			!herdrBranch.includes("piDurable"),
 	);
 
+	// #157 A-L1 D5: the Codex thread id is a tmux seat input and STOPS at this root. The herdr branch
+	// therefore spells its request field by field — a spread of the whole request would carry the id
+	// along even if no herdr code read it today — and names the id once, inside the boolean.
+	const threadIdMentions = herdrBranch.split("callerNativeSessionId").length - 1;
+	ok(
+		"[QK:FCD-HERDR-NO-THREAD-ID] the herdr branch hands its rail an explicit field list, not a spread of the request, and the Codex thread id appears in it exactly once — as `callerIsCodex: request.callerNativeSessionId !== undefined` — so only a boolean and the record cwd cross to herdr while the tmux request stays whole",
+		herdrBranchLocated &&
+			!/\.\.\.request\b/.test(herdrBranch) &&
+			threadIdMentions === 1 &&
+			herdrBranch.includes("callerIsCodex: request.callerNativeSessionId !== undefined,") &&
+			herdrBranch.includes("callerCwd: request.callerCwd"),
+	);
+
 	// ── the tmux rail keeps its pre-existing ordering ────────────────────────────────────
 	// The import line names the preflight too, so the body is what gets counted: the claim is
 	// "called once, on one path", not "the word appears once".
@@ -292,6 +320,8 @@ async function main(): Promise<void> {
 			backend: "pi",
 			requestedKind: "pi",
 			model: "m/1",
+			cwd: "/repo/dir",
+			cwdSource: "caller-process",
 			herdrAgentName: "entwurf-abc",
 			herdrWorkspaceId: "w7",
 			herdrTabId: "w7:t3",
@@ -354,6 +384,37 @@ async function main(): Promise<void> {
 			!unknown.text.includes("orphan-unreclaimed"),
 	);
 
+	// ── #157 G1a: a visible resume reaches the SAME rail choice ──────────────────────────
+	// The root's second entry point owns only the rail choice for a same-id visible resume. Its tmux
+	// half is whatever the surface hands in, so a recording stub stands for it; its herdr half is the
+	// real herdr resume launch, driven with an incomplete herdr context so it refuses before any
+	// runner exists. No existing cell exercises this entry point: a resume entry that read the marker
+	// loosely, or fell back to the surface's tmux mapping, would leave every cell above green.
+	{
+		const RESUME_INPUT = { backend: "pi", cwd: "/x/project", runtimeArgs: ["--session", "/x/s.jsonl"] } as const;
+		const tmuxCalls: unknown[] = [];
+		const tmuxLaunch = (input: typeof RESUME_INPUT) => {
+			tmuxCalls.push(input);
+			return { ok: false as const, reason: "tmux-stub" };
+		};
+		const resumeSpawn = recordingSpawn();
+		const inHerdr = await dispatchResumeLaunch(RESUME_INPUT, tmuxLaunch, { HERDR_ENV: "1" }, resumeSpawn.spawn);
+		const tmuxCallsInHerdr = tmuxCalls.length;
+		const elsewhere = [{ HERDR_ENV: "0" }, { HERDR_ENV: "true" }, { HERDR_ENV: "" }, { HERDR_ENV: " 1" }, {}].map(
+			(env) => dispatchResumeLaunch(RESUME_INPUT, tmuxLaunch, env, resumeSpawn.spawn),
+		);
+		ok(
+			"[QK:FCD-RESUME-RAIL-SHARED] a same-id visible resume reaches the SAME rail choice fresh call does, through its own entry point: exactly `HERDR_ENV=1` goes to the herdr resume launch and, with that herdr context incomplete, refuses by the herdr reason without ever calling the surface's tmux mapping; every other value, and an absent variable, goes to that tmux mapping with the record-derived input unchanged — a second, looser predicate or a fallback either way would reopen a citizen where the operator is not looking",
+			!inHerdr.ok &&
+				inHerdr.reason === "herdr-context-missing" &&
+				tmuxCallsInHerdr === 0 &&
+				resumeSpawn.calls.length === 0 &&
+				elsewhere.every((r) => !("then" in r) && r.reason === "tmux-stub") &&
+				tmuxCalls.length === elsewhere.length &&
+				tmuxCalls.every((input) => input === RESUME_INPUT),
+		);
+	}
+
 	console.log(`\n[check-fresh-call-dispatch] ${passed} assertions ok`);
 }
 

package/scripts/check-fresh-cut-gate.sh

@@ -63,6 +63,7 @@ export HOME="$SANDBOX/home"
 export XDG_DATA_HOME="$SANDBOX/home/.local/share"
 export XDG_STATE_HOME="$SANDBOX/home/.local/state"
 export XDG_CACHE_HOME="$SANDBOX/home/.cache"
+export XDG_CONFIG_HOME="$SANDBOX/home/.config"
 export PI_CODING_AGENT_DIR="$SANDBOX/home/.pi/agent"
 export ENTWURF_META_SESSIONS_DIR="$SANDBOX/store"
 export ENTWURF_META_MAILBOX_DIR="$SANDBOX/mailbox"
@@ -1460,6 +1461,11 @@ fake_pkg="$SANDBOX/nm/node_modules/@junghanacs/entwurf"
 mkdir -p "$fake_pkg/scripts"
 cp "$REPO/run.sh" "$fake_pkg/run.sh"
 cp "$REPO/scripts/meta-bridge-store-doctor.ts" "$fake_pkg/scripts/"
+# Sourcing run.sh with no argv still walks its dispatch to the root usage, which renders
+# ENTWURF-CLI.json through scripts/cli-help.mjs (#153). Without those two files that render fails
+# first, under run.sh's own errexit, and the doctor branch below is never reached.
+cp "$REPO/ENTWURF-CLI.json" "$fake_pkg/ENTWURF-CLI.json"
+cp "$REPO/scripts/cli-help.mjs" "$fake_pkg/scripts/"
 set +e
 out="$(RUNSH="$fake_pkg/run.sh" bash -c 'set --; source "$RUNSH" >/dev/null; preflight_v3_store install' 2>&1)"; rc=$?
 set -e
@@ -1485,19 +1491,27 @@ rm -rf "$SANDBOX/nm"
 # names — the point is not that failures are nonzero, it is that a caller can BRANCH.
 echo "[check-fresh-cut-gate] J. exit contract"
 
-# J1/J2 — the two states that need no host at all.
+# J1/J2 — the two states that need no host at all. Streams are kept apart: the leaf's own
+# usage line is now only the address of the description (#153), and the contract text itself —
+# exit numbers included — is the public page `entwurf meta-bridge-fresh-cut --help` prints, which
+# check-install-surface S9u holds against this verb's ce92dc7 text and FRESH_CUT_EXIT.
+fc_pointer='meta-bridge-fresh-cut: see `entwurf help meta-bridge-fresh-cut` (from that checkout'"'"'s root: `./run.sh help meta-bridge-fresh-cut`)'
 set +e
-help_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" --help 2>&1)"; rc=$?
+node --experimental-strip-types "${FRESH_CUT[@]}" --help >"$SANDBOX/j1.out" 2>"$SANDBOX/j1.err"; rc=$?
 set -e
-if [ "$rc" = 0 ]; then ok "J1 --help exits 0"; else bad "J1 --help exited $rc" "$help_out"; fi
-case "$help_out" in
-  *"EXIT CONTRACT"*) ok "J1b --help PRINTS the contract (an operator can read it where they hit it)" ;;
-  *) bad "J1b --help never printed the exit contract" "$help_out" ;;
-esac
+if [ "$rc" = 0 ]; then ok "J1 --help exits 0"; else bad "J1 --help exited $rc" "$(cat "$SANDBOX/j1.err")"; fi
 set +e
-bad_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" --wat 2>&1)"; rc=$?
+node --experimental-strip-types "${FRESH_CUT[@]}" --wat >"$SANDBOX/j2.out" 2>"$SANDBOX/j2.err"; rc2=$?
 set -e
-if [ "$rc" = 2 ]; then ok "J2 an unknown argument is USAGE (exit 2), never a store verdict"; else bad "J2 unknown arg exited $rc, want 2" "$bad_out"; fi
+if [ "$rc2" = 2 ]; then ok "J2 an unknown argument is USAGE (exit 2), never a store verdict"; else bad "J2 unknown arg exited $rc2, want 2" "$(cat "$SANDBOX/j2.err")"; fi
+if [ "$rc" = 0 ] && [ "$rc2" = 2 ] && [ ! -s "$SANDBOX/j1.out" ] && [ ! -s "$SANDBOX/j2.out" ] \
+  && [ "$(cat "$SANDBOX/j1.err")" = "$fc_pointer" ] && [ "$(wc -l <"$SANDBOX/j1.err")" = 1 ] \
+  && cmp -s "$SANDBOX/j1.err" "$SANDBOX/j2.err"; then
+  ok "J1b --help (exit 0) and an unknown argument (exit 2) print nothing on stdout and one stderr line pointing at \`entwurf help meta-bridge-fresh-cut\`"
+else
+  bad "[QK:FRESHCUT-HELP-POINTER] J1b the leaf's usage is not exactly the one pointer line on stderr with an empty stdout" \
+    "help rc=$rc stdout=$(head -c 200 "$SANDBOX/j1.out") stderr=$(head -c 400 "$SANDBOX/j1.err") | wat rc=$rc2 stdout=$(head -c 200 "$SANDBOX/j2.out") stderr=$(head -c 400 "$SANDBOX/j2.err")"
+fi
 
 # J3 — the success state, distinct from every failure below.
 reset_world prevgen

package/scripts/check-gate-qualification.ts

@@ -3467,30 +3467,35 @@ let manifestCount: number;
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
 		"demo-reproducibility": 12,
+		"dev-gate-dispatch": 9,
+		"cli-help-source": 36,
+		"claude-launch": 12,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
 		"pi-launch": 9,
-		"pi-floor": 3,
+		"pi-floor": 4,
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 95,
+		"pi-durable": 186,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
-		"fresh-call-dispatch": 15,
-		"fresh-cut": 3,
+		"fresh-call-dispatch": 18,
+		"fresh-cut": 4,
 		"gate-qualification": 10,
 		"herdr-placement": 13,
-		"herdr-plugin": 25,
+		"herdr-plugin": 26,
 		"herdr-plugin-profile": 14,
-		"herdr-activation": 34,
-		"herdr-plugin-build": 20,
+		"herdr-activation": 42,
+		"herdr-plugin-build": 25,
 		"herdr-dev-checkout": 4,
-		"herdr-runtime-bootstrap": 31,
-		"herdr-fresh-call": 38,
+		"herdr-operator-link": 19,
+		"herdr-runtime-bootstrap": 35,
+		"herdr-fresh-call": 61,
+		"herdr-resume-call": 24,
 		"herdr-supply": 11,
-		"meta-facts": 4,
-		"peer-facts": 8,
+		"meta-facts": 5,
+		"peer-facts": 9,
 		"meta-hook-session-switch": 25,
 		"meta-identity": 9,
 		"meta-retire": 4,
@@ -3501,7 +3506,7 @@ let manifestCount: number;
 		"pack-install": 9,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
-		"mux-resume-call": 15,
+		"mux-resume-call": 20,
 		"omp-birth": 13,
 		"omp-fresh": 25,
 		"omp-receive": 11,
@@ -3518,10 +3523,10 @@ let manifestCount: number;
 		"resume-launch-identity": 10,
 		"self-address": 8,
 		"setup-verdict": 14,
-		"source-install": 8,
+		"source-install": 11,
 		"typing-call-fence": 1,
 		"v2-surface": 16,
-		"v2-visible-resume": 41,
+		"v2-visible-resume": 62,
 		"win32-preview": 19,
 	};
 	const laneTally: Record<string, number> = {};