@junghanacs/entwurf 0.50.0 → 0.52.0

package/AGENTS.md

@@ -104,9 +104,10 @@ implement → affected focused gates → independent review → one amendment bu
 
 ## Type and Working Boundaries
 
-- Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. Root pi extensions use TypeBox through `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
+- Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. The pi-facing contract schema uses builders and schema types from `@earendil-works/pi-schema` and `StringEnum` from `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
 - Develop only on branches in this repository checkout; never use worktrees or tmp development clones. Isolated test fixtures and temporary evidence are not development checkouts.
 - Make surgical, one-contract changes. Removal repairs source and its proof together; a green gate never proves retired behavior.
+- A requested Pi SDK upgrade defaults to existing native authentication after coherent candidate installation, not a new login or credential copy. Do not re-ask that strategy each bump. Operating owner exit, consistent full session backup and the human-owned shutdown/reopen window remain gates; auth reuse grants no autonomous cutover, retirement or publication. The decision and #148 receipts are in [the SDK upgrade radius](./docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade).
 - Before commit, sweep repository-wide for retired authority vocabulary and landed-plan future tense. Historical tombstones may remain; live docs, source, gates, and usage must agree.
 - Prefer capability-domain language over identity rank. Use tabs unless the project formatter requires otherwise. GLG decides commit, push, and release gates.
 

package/CHANGELOG.md

@@ -4,6 +4,146 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.52.0 — 2026-11-12
+
+### Pi SDK 1.5.2 (#158)
+
+Entwurf 0.52.0 moves the exact ten-member Pi SDK set from 1.5.0 to 1.5.2 and declares host Pi `>=1.5.2 <1.6` (#158). At preparation time, the published npm baseline remains 0.51.0 / SDK 1.5.0; its marked installation recipes remain independent of this source candidate. The checkout's Herdr lock returns to the existing verification carrier rather than claiming unpublished npm 0.52.0 bytes. Source-checkpoint, preparation, operating and final-artifact evidence remain distinct, and no #155 receipt transfers to this release.
+
+- **Exact SDK set.** All ten `@earendil-works/*` members move from 1.5.0 to exactly 1.5.2, with the lockfile, the carrier's SDK manifest, the `run.sh` pin and probes, and the mutant pin literals. Measured on the registry tarballs: SHA-512 and SHA-1 match for all ten, and every one of the 16 member-to-member production edges is exactly 1.5.2. Two non-member dependency changes against 1.5.0: `pi-coding-agent` drops `grok-mermaid` 0.2.3 for `lovely-mermaid` 0.3.3, and `chord` adds an optional peer `react` 19.3.0. Whether either reaches an Entwurf consumer is not measured.
+- **Release-age exception.** The operator explicitly approved on 2026-11-11 an exception for exactly the ten SDK members at 1.5.2, added to `minimumReleaseAgeExclude`. The global release-age policy and the release-age treatment of other dependencies are unchanged.
+- **Maintainer: Chord `Context`.** The two owned type imports move from `@earendil-works/chord` to `@earendil-works/chord/context` for Chord's new root export; the carrier is regenerated with the official emitter, not edited by hand. Typecheck and consumer results belong to this candidate's own receipts.
+- **Scheduler.** SDK 1.5.2 carries the 1.5.1 scheduler notification fix. In an isolated six-member comparison using a faux provider, with no vendor-model calls or authentication, the unchanged upstream repro stayed stuck in 10 of 10 SDK 1.5.0 runs and settled in 10 of 10 SDK 1.5.2 runs. The public-API-only variants settled on both versions and did not reproduce the old race. This is bounded fixture evidence, not Entwurf carrier, operating-session, native SQLite or load-sweep acceptance.
+- **Native SQLite.** In an isolated cross-version fixture, 1.5.2 reopened a 1.5.0-written database without changing its bytes, appended 60 parallel tool calls and compacted, and a close and reopen stayed consistent; the schema version stayed 2. Operating-scale sessions, an interrupted write, a non-checkpointed WAL and concurrent access are not measured. A package downgrade is still not a data rollback.
+- **Documentation.** The install guide and Herdr README retain narrow published-scope regions for npm 0.51.0 (SDK 1.5.0), while the ACP row explicitly labels the source candidate's SDK 1.5.2 declaration. The durable guide gains a short candidate boundary covering ordinary Pi cache warming and the durable edit path, which this candidate does not change. The guide's `unreadable generation` advice now distinguishes reader-version skew from a genuinely unreadable generation.
+- **Herdr preparation.** An npm lock must name the checkout's own package version. While 0.52.0 is unpublished, this preparation returns `runtime-lock.json` to the existing closed `herdr-checkout` verification carrier, without inventing npm 0.52.0 bytes or integrity and without changing the plugin manifest version. Published 0.51.0 recipes retain their SDK 1.5.0 subject. An installed npm host keeps its existing runtime until an explicit source switch; deactivate before selecting the checkout source. A later re-pin to measured npm 0.52.0 bytes is separate work after publication.
+- **Preparation status.** The pre-version source checkpoint and later #159 candidates have separate frozen floors and receipts. An addon-less validation tarball was installed on one operating host; the operating coordinator returned under the same identity and exchanged a nonce. The subsequent P5 Native/LIVE run and final carrier-bearing artifact acceptance remain separate. Operating-scale or interrupted sessions and all-rail behavior are not certified by the bounded SDK fixtures.
+
+### Peer message replies (#159)
+
+Peer messages distinguish a requested result sent to its routed recipient from a final answer in the local session. Reply guidance preserves no-send instructions and does not impose an acknowledgment merely because an address is replyable.
+
+### Release evidence
+
+- Pre-version checkpoint: `b9fa0d2`. Its CI status is not recorded here. The preceding source worktree over `669315ccb22a` took frozen FULL r2, 971s, exit 0, after the initial stale-dist refusal was preserved and a managed bridge build completed. Its recorded index is `800cce5f40a67808145810ef14e5852ea091d1c5`, patch `e006e8032c045c40e6c06b1a94421348bbd2eedaa6a7a9eedcea8bbad7c022e8`; this is not the versioned 0.52.0 preparation's P4 or prepared-SHA CI. The branch handoff update followed that floor.
+- #159 candidate on `b9fa0d2` with tracked diff `7f523c44042a` and fixture `217e8ef8920c`: frozen FULL 977s exit 0; carrier S/H contact 91, send 20, native-module 15 and receive 22; addon-less validation-TGZ Linux container and private ownership rehearsal passed. These receipts bind that earlier candidate, not later edits.
+- Reviewed preparation candidate: HEAD `b9fa0d2aa43e`, tracked diff `8cbd3a3c9406e0f5c2c50878a23e52b088816f8feb0e0be9484cb462faf081d4`, untracked revision-20 fixture `217e8ef8920c09abe90cd2fe141a5b671ac94600ba6d2431fa056ea37c8fee42`. Frozen FULL ran 979s, exit 0, with unchanged seal; checkout carrier contact 91, send 19, native-module 14 and receive 21 passed (S/H only, vendor V not run). Addon-less validation TGZ `6c29185842806e3e14e28d3c2efd2da24c09e581772ed0a642277506565a60a1` passed Linux container acceptance; it is not the installed `d72afb…` TGZ or the final carrier artifact.
+- Native LIVE (P5): on the same reviewed dirty candidate, `release-gate --cut` ran on 2026-11-12 13:03–13:24 KST, MUST 24 PASS / 0 FAIL / 0 SKIP and BEHAVIOR 1 PASS / 0 FAIL / 0 SKIP, exit 0, unchanged seal. Codex app-server A and fixture seat S were separate tmux sessions; models were `gpt-6-luna` and `openai-codex/gpt-6.1-terra`. Preserved log SHA-256 `e37c9e103be830e9446df5f981ae54d8078141bee5ca83fdd5b65d20188b656d`. The P9 immediate census observed one reparented `/tmp` process: a pre-existing Emacs daemon from November 9, not a P5 child; evidence and unclassified roots were preserved. This is not prepared-SHA CI or final artifact acceptance.
+- Native Claude host: a fresh test-owned Claude Code session on the installed `d72afb…` validation root returned its exact callback and `entwurf_self`; its direct MCP child ran the installed 0.52.0 bridge, and installed `doctor-meta-bridge` passed while it was alive. Its own fixture was retired, with the record preserved. Sonnet was requested at launch; model usage for this particular turn was not independently extracted. The separate native-resume LIVE used `claude-sonnet-5-5` for both turns and passed 13 checks, with same-native-session marker recall.
+- Installation-validation tarball (unpublished, addon-less): SHA-256 `d72afb38425c1dab8dd9a7c489274e1a76071aab73874d8ba94a896f55d8a3fd`; distinct from the final carrier-bearing artifact.
+- Operating installation (2026-11-12): after normal owner exit and a consistent durable/ordinary-Pi backup, host Pi 1.5.2 and the addon-less validation tarball were installed; user-scope ownership moved to its root. The operating coordinator returned under the same garden/native ID with its original module and exchanged a nonce. This is one operating return, not all-rail or release acceptance.
+- Windows and final artifact: at preparation time, the carrier-bearing artifact had not yet been produced or accepted; M3w follows green exact prepared-SHA push CI in make.
+- Publication and Herdr npm re-pin: at preparation time, npm publication and its later Herdr re-pin remained separate human decisions.
+- Kill-power re-measured at this shipped SHA: none (all 1516 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 669315ccb22a surface 3bceca54266b -- ["bash","run.sh","check-dep-versions"] 5/5 receipt 2280c96ec0a3
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 669315ccb22a surface 3bceca54266b -- ["bash","run.sh","check-pack-pin-matcher"] 2/2 receipt 7e64ab9bff6e
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head b9fa0d2aa43e surface 60e424985df9 -- ["bash","run.sh","check-control-send-receipt"] 7/7 receipt 4df44c1e3e40
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head b9fa0d2aa43e surface 60e424985df9 -- ["bash","run.sh","check-entwurf-v2-surface"] 20/20 receipt 490e9f96b8bd
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head b9fa0d2aa43e surface 60e424985df9 -- ["bash","run.sh","check-mux-fresh-call"] 161/161 receipt fd3f4e91af7c
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head b9fa0d2aa43e surface 60e424985df9 -- ["bash","run.sh","check-agent-guidance-beside"] 14/14 receipt d34e4f436e4a
+
+## 0.51.0 — 2026-11-04
+
+Entwurf now runs on the Pi 1.5.0 SDK set (#155). The exact SDK closure grows from nine to ten members, the supported host Pi range moves to `>=1.5.0 <1.6`, and the pi-durable carrier follows the 1.5 durable API. An operating host moves to this version only through a planned cutover, because SDK 1.5's first write to a durable session is not readable by SDK 1.4.
+
+What this release is not: it adds no MCP tool (the nine tools are unchanged) and no new authority. It adopts no 1.5 feature beyond what the migration requires. Hosts that stay on the published 0.50.0 / Pi 1.4.0 SDK set keep following the published 0.50.0 instructions, which remain checked separately.
+
+### Pi SDK 1.5.0 (#155)
+
+- **Exact SDK set.** All ten `@earendil-works/*` members are pinned at exactly 1.5.0: chord, pi-agent-core, pi-ai, pi-codemode, pi-coding-agent, pi-durable, pi-mcp, pi-schema (new), pi-telemetry and pi-tui. The pi-durable overlay pin moves with them.
+- **Host range.** The supported host Pi range is derived from the pinned SDK and is now `>=1.5.0 <1.6`; setup and `install-user-scope` refuse a detected pi outside it. A 1.4 host is outside the range of this version; install host Pi 1.5 by exact version.
+- **Tool schemas on pi-schema.** pi-ai 1.5.0 no longer exports TypeBox's `Type`, and upstream pi-durable 1.5.0 drops its `typebox` dependency. The `entwurf_v2` contract schema and the pi-durable subagent tool are built with `@earendil-works/pi-schema` builders; the subagent tool's input stays open (`{ open: true }`) so it accepts what it accepted before. The optional `typebox` peer dependency and its `peerDependenciesMeta` entry are removed from the package.
+- **pi-durable carrier on the 1.5 durable API.** The carrier no longer calls the removed `viewState()`, `taskGraph()` and `subscribeCommits()`. The transcript shows the SDK's whole active transcript (`Conversation.context().entries`, head marker first), not the latest entries of the 1.5 conversation window: it is read once, a watch attached right after that read appends later entries in ID order, and a compaction, a reset or a window that skipped entries reads it again from the SDK (#155 D1). A read that lands after a switch, the close or the session's own failure is dropped, and a read that fails is reported on screen as stopped updating, without a retry. The task panel follows `watchTaskGraph()`, and commits are observed through `observeCommits()`, whose end decides nothing because SDK 1.5 ends it `failed` at a normal close as well. Whether a session ended closed or failed is read from the session end's `kind`; the 1.4 `reason` field is absent in 1.5 and would otherwise read every end as closed. Reports show `report.error`, compaction status shows its `trigger`, and a run that ended without an answer stays visible as `pi.live.runFailure`.
+- **Durable data and rollback boundary.** SDK 1.5 keeps SQLite schema version 2 but stores `pi.live` at version 3, `pi.generation` at 2 and `pi.tool` at 3; SDK 1.4 refuses a session after 1.5 has written it. Two synthetic sessions written by SDK 1.4, one closed and one killed, with a hashed golden manifest, are opened by 1.5 without a resume or new input. A storage open keeps schema version 2 and every row. A Harness open that only reads the root conversation, the live document and the task inspection stores no new document version and changes exactly the tables SDK 1.4's own reopen of the same file changed: none for the closed session, the `durable_metadata` and `tasks` rows for the killed one, where the open runs crash recovery. The first 1.5 write stores `pi.live` at the version SDK 1.4 refuses. This is fixture evidence for those two files. It does not show that the database is opened read-only, and it does not certify compatibility or recovery for operating data. Upstream states that restart-limited tasks no longer park in 1.5 and end visibly instead; this release does not measure that behaviour.
+- **Published recipes stay separate.** Documentation regions marked `entwurf:published @junghanacs/entwurf@0.50.0 pi 1.4.0` keep describing the published 0.50.0 package and are checked by `check-dep-versions` against a frozen record of that artifact, independent of the development floor.
+
+### Release and upgrade workflow
+
+- **Default radius for a Pi SDK upgrade.** A requested SDK upgrade reuses the existing native authentication after a coherent installation; it does not make a fresh login or credential copy a prerequisite. Isolated, authentication-free checks come first; the operating window keeps normal owner exit, a consistent backup of the whole durable-session directory and same-identity reattachment. The decision does not authorize a cutover, retirement or publication ([setup](docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade)). Setup also records the recurring SDK rail.
+- **Persistent release candidates.** `make` creates each candidate in a private, uniquely named directory under `${XDG_STATE_HOME:-~/.local/state}/entwurf-releases/<version>-<sha12>/` instead of `/tmp`, keeps failed candidates, and never relocates a candidate or adds a `current` alias.
+- **One human publish line.** After U0 passes and a named pre-publication receipt records both dist-tags, the handoff prints exactly one shell-quoted line, `cd ~/repos/gh/entwurf && npm publish <canonical tgz> --tag <latest|repair>`. U2 restores its baseline from that receipt rather than from the post-publish registry. The supported dist-tags are `latest` and `repair`.
+- The `entwurf-dev` skill is narrowed to the citizen lifecycle; release and upgrade ordering live in the release skill and setup.
+
+### Herdr plugin
+
+The first five bullets record the plugin's re-pin to the published npm 0.50.0 runtime, made after the 0.50.0 release (`f45a95a`); they describe that runtime's Pi 1.4.0 SDK set, not this release's. The last bullet is this release's change.
+
+- Pinned the published npm `@junghanacs/entwurf@0.50.0` with its measured registry sha512 and align the plugin manifest to 0.50.0. The downloaded registry tarball is byte-identical to the accepted Windows-carrier core artifact (SHA-256 `64ca198067d8ad5265f89a903efdaa3e7946bfe7ba3a83dd27009a878631afba`). This closes the prepare-time `herdr-checkout` window described below; the core tag, npm bytes and historical 0.50.0 release section are unchanged.
+- Kept the Pi 1.4.0 SDK set and host range `>=1.4.0 <1.5`. The owning install guides name 0.50.0; the root README's unpinned entrance is unchanged. A checkout-source installation must explicitly deactivate before reinstalling this npm-source pin; a settled npm-source host follows the existing rebind/ownership rules. No operator installation or working session is automatically changed.
+- Source-specific verification: registry metadata reports `latest=0.50.0`, `repair=0.12.8-repair.1` and 668 files. The downloaded registry tarball's SHA-512 and SHA-1 equal `dist.integrity` and `dist.shasum`; SHA-256 and `cmp` match the accepted core artifact. No immediate pre-publish dist-tag snapshot was collected by the agent, so `repair` preservation is observed against the earlier dated reading, not claimed as a measured publication delta. The unchanged tarball's Windows and Linux package-consumer acceptance is explicitly reused, not re-run.
+- A private registry-installed Pi 1.4.0 consumer resolved the bridge inside its own installed root and listed seven `entwurf` model rows without a model turn. Its registry-shipped `herdr-runtime.mjs` is byte-equal to this checkout's. That helper acquired real npm 0.45.0, swapped to 0.50.0, restored the previous runtime before acquiring again in a manually seeded `torn-swap-with-candidate` state, skipped acquisition on an exact re-request, and removed its owned sandbox runtime/cache/journal. This is not recovery from an actual kill or a harness activation proof.
+- The public-ref install/use/activation/deactivation journey and pushed-SHA CI receive their own post-push receipts; prior checkout-carrier or older npm receipts are not those measurements. No plugin snapshot tag is claimed by this commit.
+- **This prepare returns the lock to the verification carrier.** Core 0.51.0 has no published bytes while it is prepared, and an npm lock must name the checkout's own version, so `plugins/herdr/runtime-lock.json` goes back to the closed `herdr-checkout` source, as the 0.50.0 and earlier candidates did. No npm version or integrity is invented for 0.51.0 and the plugin manifest version is not bumped. An install that tracks this source builds its runtime from the checked-out commit; a host switching from npm runs `herdr-plugin-deactivate` first. Hosts that installed the npm 0.50.0 runtime keep running it (Pi 1.4.0 SDK set) until they reinstall. A separate step re-pins npm 0.51.0 once it is published.
+
+### Upgrade
+
+- **Operating hosts** move in one planned window, following the [SDK upgrade radius](docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade) and the cutover conditions in [#155](https://github.com/junghan0611/entwurf/issues/155): close the old owners normally and prove they exited, back up the whole durable-session directory (including `-wal`/`-shm`) as one consistent set before the first 1.5 open, install host Pi at the pinned exact version 1.5.0 rather than through a bare `pi update`, install this package and move the user-scope ownership with `entwurf takeover-user-scope`, check the doctors, then reopen the same identities. Installing an older package afterwards is not a data rollback: returning a session to SDK 1.4 requires restoring the consistent backup taken before the first 1.5 open, and work done after that open is not in it.
+- **Checkout-run hosts** refresh the bytes each surface actually loads. Ordinary Pi and pi-durable require `pnpm run build-bridge`, accepted output/SDK verification, then a new host process; copied hook/extension units require their owning installer. Follow [Applying new source to a running host](docs/setup-clean-host.md#applying-new-source-to-a-running-host) before restarting sessions. An already-running bridge keeps the modules it loaded.
+- **Claude Code hosts** re-run `entwurf install-meta-bridge`, then restart open Claude Code sessions in the operator's own order. An already-running bridge keeps the modules it loaded.
+- **npm consumers** re-run `entwurf setup` in the same scope, then `check-bridge`.
+
+### Release evidence
+
+- Source checkpoint: `c95bd66`, branch push CI run 41587081824, all four required jobs successful. This is that checkpoint's evidence, not the prepared SHA's CI.
+- Prepare-time floor: working tree over `c95bd66` (index tree `6824440955ce`), patch `7081abf50b08447c89739976b825a30c0ded390188c7a058c7f48d04e8be5417`, before the branch handoff edits and this evidence wording. The managed build left the 99-file compiled manifest byte-identical (`3c3c679a466c5489d921960f082f1024bf6774b2f4fa1115173bed68c6386d85`). `check:full` ran 959 s, exit 0. The checkout-only pi-durable cells passed against that compiled bridge: `check-pi-durable-contact` 91, `check-pi-durable-send` 19, its `native-module` cell 14 and `check-pi-durable-receive` 21, 0 failed (V not run). The candidate seal was identical before and after.
+- LIVE release gate: working tree over `c95bd66`, same index tree and compiled manifest, patch `c8295e54606dbe3f9aaa0abcadf3e4a818d3b1466525969b8e2bb2591c4b5289` (the floor's patch plus branch handoff edits, before this evidence wording). `release-gate --cut` ran once on 2026-11-03 from 21:03:41 to 21:24:44 KST (1262 s), with `check:full` 953 s exit 0, MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut OK. Scratch/log: `/tmp/entwurf-release-gate-0.51.0.WGGdxZ/release-gate.log`, 598,872 bytes, SHA-256 `059bf77d197a5c10fd0dc0d0697839edae59380d3d9c9c385c08164365ed3ede`; the operator evidence copy is byte-identical (`cmp`). The candidate seal (HEAD, index tree, porcelain, changed-path bytes, compiled manifest) was identical before and after the gate.
+- That gate ran on the operating host after the cutover below, so its LIVE steps used host Pi 1.5.0 and the installed 0.51.0 validation package with the existing native authentication. Codex CLI 0.166.0 used an operator-owned app-server started for this run in its own tmux session, not the gate's, with models `gpt-6-luna` / `openai-codex/gpt-6.1-terra`; it was stopped afterwards. The wrapper ran in the real HOME with `PI_SESSION_ID`, `PI_AGENT_ID`, `CI` and the Claude Code session variables removed, and both verify-deps settings at `error`. `CLAUDE_CONFIG_DIR` was not in that removal list: it was absent from a sample of the gate session's running process tree taken during the run, from the tmux global environment and from the launching shell, so its absence was sampled, not enforced by the wrapper. A corrected wrapper that also removes it was written during the run and has not been run.
+- Host residue after the gate, read-only: no reparented process from the gate and no process using its paths. Its scratch, the pi-durable fresh-live receipts and the chain smoke's records were kept as evidence. `check:full`'s `herdr-resume-call` and `mux-resume-call` tests leave two directories per prefix per run (eight here, at most 34 bytes each); they are recorded as a finding and were not deleted.
+- Installation-validation tarball: unpublished and addon-less, packed from the floor's candidate, SHA-256 `199e5f41d20e5b2665125868b7e3e27740e5985f7a25ac61902126b7ed638bf5` (11,611,560 bytes), accepted by the unchanged Linux container (`validation-acceptance.log` SHA-256 `e505f5e9ec3982ad3091ac6582a1d3832573b5933a42e0aaf02325b8f1f70efe`). It carries no Windows build and is not the release candidate, which `make` produces from the prepared SHA. An isolated rehearsal of the global ownership transition passed (old 0.50.0 owner, then a normal install refused with exit 6 and settings unchanged, then an explicit `takeover-user-scope` to 0.51.0; run log SHA-256 `4d84a7b3433f7097d606b83d097facec25f5ea9a9a6a1559a665f21e081a6c00`).
+- Operating cutover on the maintainer host, 2026-11-03 20:46–20:49 KST, under the [#155](https://github.com/junghan0611/entwurf/issues/155) conditions. Four operating owners were closed normally and classified dead by the product's owner check, with no durable file holder and no lock left. The whole durable-session directory (171 files, 487,281,652 bytes; source-before, backup and source-after manifests identical, SHA-256 `5c08bed1968fd1e26baa58112f0ce5c36874e147ccc5e9b4c69ec1a0d9070a46`) and the two Pi transcripts were backed up before the first 1.5 open. Host Pi 1.5.0 was installed by exact version once all ten SDK members had passed pnpm's one-day release age, with the global pnpm policy file unchanged. The validation tarball above was installed and `takeover-user-scope` moved ownership to its root. The doctors reported ownership (`owned — this root`) and runtime (nine tools boot) separately, and the ten SDK members resolve to 1.5.0 from that root. The same identities were then reopened and the main pi-durable citizen made real turns on 1.5. A pi-durable same-id resume through `entwurf_resume_call` came back without the operator's `--native-module`, as its bridge-only launch contract states; the operator restarted that citizen by hand with its module.
+- Native Claude Code host after the cutover (VERIFY pass criterion 4), 2026-11-03 21:37–21:39 KST: a fresh Claude Code fixture opened through `entwurf_fresh_call` called back with its exact launch nonce. Its receiver and sender markers join its record (native session id and attach incarnation, with the owner's start key re-measured live). Its direct MCP child is the 0.51.0 bridge from the installed root, reached through the bare `entwurf-bridge` user-scope command, and no 0.50.0 bridge runs under it. The installed `doctor-meta-bridge` passed while the fixture was alive, with the deployed writer and hook lock module matching source. This was measured on the validation installation, not the release artifact, and Claude Code sessions opened before the cutover were not restarted.
+- Not covered by the above: the operating root is the validation tarball, not the published artifact, and rebinding operation to the registry's 0.51.0 is a separate step after publication. Claude Code sessions that were already open keep the 0.50.0 bridge they loaded until they restart. One Claude Code citizen's dedicated MCP file still names the 0.50.0 root, pending its operator's own decision; that root stays installed. Exact prepared-SHA CI, the Windows-carrier candidate and its Linux acceptance, installed-host acceptance of the release artifact and the registry proof need their own receipts. npm publication is GLG's own action.
+- **D1 transcript repair after that gate.** The transcript change above (#155 D1) landed after the gate and the cutover above, as the checkpoint `20426b2` over `434874e`. It changes the pi-durable carrier and its pin, not the compiled bridge or the SDK set: the 99-file compiled manifest stays `3c3c679a466c…`. The carrier qualification group ran on working-tree candidates over `434874e`, before that checkpoint commit. Its first run was red: it killed 65 of 66 claims, and the `ACTIVE-SEED` claim failed for the wrong reason because the test's setup failed before its assertion ran. After a one-line observer fix in the test, a second run on the corrected working tree killed 66 of 66 with both controls green; that receipt (head `434874e`, surface `b6cee8925072`) is listed below as an earlier-candidate PARTIAL.
+- LIVE release gate on the D1 checkpoint:
+  - **Candidate.** HEAD `20426b2` (tree `ba596c153283`) with working patch `b8172a65fd356db69a5f00d52c54ab84aeb75496acefab815dc855978124ba5c`, which touches only this file and the branch handoff and predates this evidence wording. The compiled manifest `3c3c679a466c…` was byte-identical after a managed build.
+  - **Result.** `release-gate --cut` ran once on 2026-11-04, from 03:02:41 to 03:23:10 KST (1229 s); the wrapper around it, including the managed build and the seals, ran from 03:02:34 to 03:23:11. Its own `check:full` was the first MUST step and ran 963 s, exit 0; no separate offline full floor was run for this candidate. MUST PASS=24 FAIL=0 SKIP=0, BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut OK.
+  - **Integrity.** Log SHA-256 `d16537ca4455498c6a371bc80a869d0de70832d30d86d770ccbc8212427380c2`; the scratch original and the evidence copy are identical. The candidate seal was identical before and after the gate (`37446ea0a4f5…`).
+- How that gate reached the new source:
+  - **PATH.** `entwurf` on the gate's PATH resolved to this checkout's `run.sh` through a private directory holding only that link. `entwurf-bridge`, `entwurf-statusline` and `pi` stayed the installed 0.51.0 validation root.
+  - **Witness.** A read-only process sampler ran for the whole gate. It observed that the pi-durable fresh-live fixture's host ran this checkout's carrier bootstrap and resolver, that the host owned the new location whose garden is the smoke's pi-durable record, and that the host's `entwurf-bridge` child ran from this checkout's compiled bridge. The fixture's initial visible Pi ran the installed validation root's bridge.
+  - **Limit.** The sampler judged only that fixture; which root each other LIVE step loaded was not observed.
+- That gate's environment:
+  - **Host and auth.** It ran in the real HOME with the existing native authentication.
+  - **Removed variables.** Exactly these names were removed: `PI_SESSION_ID`, `PI_AGENT_ID`, `CI`, `CLAUDE_CONFIG_DIR`, `CLAUDECODE`, `CLAUDE_CODE_SESSION_ID`, `CLAUDE_CODE_ENTRYPOINT`, `CLAUDE_CODE_CHILD_SESSION`, `CLAUDE_CODE_MESSAGING_SOCKET`, `CLAUDE_CODE_MESSAGING_TOKEN`, `CLAUDE_PID`, `ENTWURF_CALLBACK_TARGET`, `ENTWURF_CALLBACK_NONCE` and `ENTWURF_META_SENDER_MARKER`. Both verify-deps settings were `error`.
+  - **Models.** Codex CLI 0.166.0 used `gpt-6-luna`, with `openai-codex/gpt-6.1-terra` for its callback Pi; the pi-durable fresh-live fixture's pi-durable host and its initial Pi used `openai-codex/gpt-6.1-sol`.
+  - **Codex app-server.** A dedicated app-server was started for this run in its own tmux session, not the gate's, and stopped after the gate. Before the gate, the launch helper's own listener check stopped with exit 3: it looked for the control path's text, but the socket is reached through Codex's rendezvous alias. A follow-up check found the same app-server process, with the same pid and start time, listening on the alias's target, and the gate ran against it.
+- Host residue after that gate (read-only, nothing deleted):
+  - No smoke private tmux server and no new reparented process naming `/tmp` were observed, and this run's own app-server, sampler and pi-durable host were gone; the one reparented process naming `/tmp` predates the run.
+  - `check:full`'s `herdr-resume-*` and `mux-resume-call-pd` tests again left two directories per prefix (eight, 0–34 bytes each), and the chain smoke left one.
+  - Its scratch, the pi-durable fresh-live receipts and the run evidence were kept.
+- The native Claude Code receipt above (criterion 4) remains evidence for the unchanged bridge and SDK on the validation installation. It was not repeated for D1, and that installed root does not carry the D1 carrier.
+- Not run for the D1 checkpoint: CI for the shipped SHA, the Windows-carrier candidate and Linux acceptance of that same tarball, installing D1 on the operating host, npm publication and the registry proof.
+- The gate validated the manifest's 1506 claims across 94 lanes without executing the qualification body (#144).
+- The 2026-11-04 gate on the D1 checkpoint validated the manifest's 1513 claims across 94 lanes without executing the qualification body (#144).
+- Kill-power re-measured at this shipped SHA: none (all 1513 committed claims not re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-pack-pin-matcher"] 2/2 receipt bffbc106e427
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-dep-versions"] 5/5 receipt d890494fb815
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-acp-vendor-rejection"] 4/4 receipt ff9a31e78a1d
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head fe4780ee5c82 surface 811db89aeab8 -- ["bash","run.sh","check-pi-durable-carrier"] 59/59 receipt 0558e6e723a7
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 434874ef6d6e surface b6cee8925072 -- ["bash","run.sh","check-pi-durable-carrier"] 66/66 receipt 822f2d8b950e
+
+### Final publication receipts — 2026-11-04 update
+
+These receipts complete publication after the earlier-candidate measurements above. The core tag and published npm bytes remain unchanged; the Herdr follow-up below is a later source commit, not part of the tagged core artifact.
+
+- **Shipping identity and CI.** Core `v0.51.0` is fixed at `32c31ea16487f9c8defa1ac07268b94d30ca5b27`. Its [push CI run 41704213407](https://github.com/junghan0611/entwurf/actions/runs/41704213407) passed all four required jobs: check, install-surface, artifact-consumer and macos-install-surface.
+- **One accepted artifact.** [Windows producer run 41706422290](https://github.com/junghan0611/entwurf/actions/runs/41706422290) produced the canonical Windows-carrier TGZ, 11,710,142 bytes, SHA-256 `04fcce26d0a6dec8b8bb9a7f14a843eee0defb313aedafa34080600853d36e4d`. The producer's packed artifact, Windows-installed artifact and preserved download have the same hash. Linux accepted that same file without repacking. The candidate and its original acceptance receipts remain preserved; a carrier-bearing macOS install was not measured.
+- **Human publication and registry proof.** npm records 0.51.0 at `2026-11-03T20:59:20.652Z`, after the operator's own publication. U2 restored the original pre-publication receipt (latest 0.50.0, repair 0.12.8-repair.1) and measured latest 0.51.0 with repair unchanged. The registry download is byte-identical to the accepted TGZ; its computed SHA-512 equals `dist.integrity`, and its SHA-1 equals `dist.shasum`. A private registry-installed Pi 1.5 consumer carried the same 668 files and listed the seven curated models without a model turn.
+- **Evidence correction, not a hidden retry.** The post-publication wrapper sealed its log before appending a final 203-byte line. The original manifest remains 27 OK / 1 FAIL; its expected hash equals the current log with that final line removed. A separate, self-excluding correction receipt binds the current 31 files (SHA-256 `394becc3371c384fa96554b53e82c5a50cda8721424f54b21cedd2cd276d51cd`). No registry/install run or publication was repeated to conceal the seal-ordering defect.
+
+### Herdr post-publication follow-up — ce5a720
+
+- **Published npm pairing.** [`ce5a720`](https://github.com/junghan0611/entwurf/commit/ce5a720) pins `@junghanacs/entwurf@0.51.0` with its measured registry SHA-512 and sets the plugin manifest to 0.51.0. The guides now describe the Pi 1.5.0 SDK set and host range `>=1.5.0 <1.6`; the README introduction includes retirement only on explicit request. Existing source-switch and same-source ownership conditions remain unchanged. The older prepare-time checkout-carrier statements above are historical, not the current main pin.
+- **Source-specific private proof.** The registry-installed helper acquired real npm 0.50.0, swapped to 0.51.0, checked the compiled bridge, three executable bins, nine verbs and 668 byte-identical files, skipped acquisition on an exact re-request and removed its owned state. A separate manually seeded torn-state test restored the previous runtime before acquiring 0.51.0; it is not a real-kill experiment. A private build-runner journey activated pi/Claude Code through the installed package and its inverse removed the owned wiring/runtime, leaving the contracted empty Pi settings shell. This is not a public-ref Herdr plugin-registry journey.
+- **Follow-up verification.** Sequential independent reviews and focused checks closed the six-file product/proof/documentation candidate over 32c31ea. The affected check-dep-versions PARTIAL killed 5/5 exactly once with their own QKs, both controls green and origin unchanged (receipt `c2edc00f5670a3915f0510b5b64eecd59119ed14e9691e05e0f1f7bc51ae1e44`); the other 1508 committed mutants were not executed. The frozen local FULL ran 963s, exit 0 / tee 0, with the seal unchanged; NEXT bookkeeping was reviewed afterwards. [Exact ce5a720 push CI run 41728277499](https://github.com/junghan0611/entwurf/actions/runs/41728277499) passed the four required jobs.
+- **Not an operating rollout.** The operating GR208e remains the pre-D1 validation installation until the operator installs the accepted bytes and normally restarts the affected processes. Public-ref Herdr install/use/deactivation, a new plugin snapshot/tag and operating loaded-app acceptance remain separate, unmeasured steps. Neither this follow-up nor the release-note update moves the core tag, republishes npm or changes working citizens automatically.
+
+### Install-handoff incident and recovery — ThinkPad, 2026-11-04
+
+- **Prepared is not installed.** The operator reported that the developer checkout had pulled `ce5a720` (SDK 1.5.0 source) while its dependencies were still SDK 1.4.0 and the prepared installation window was waiting for Enter. A local launch refused with `pi-durable-sdk-absent: carrier → @earendil-works/pi-schema wants 1.5.0, resolves nothing`. The installation had not run: its result file and backup did not yet exist. This was an approval-wait/install-completion handoff gap, not evidence of an SDK regression or lost conversation. The launcher correctly refused incomplete supply instead of opening the session with a mixed SDK set.
+- **Recovery evidence, reported from that host.** After the operator explicitly authorized the installation, the ThinkPad coordinator reported `result.exit=0`, a complete 41-file native-profile backup whose source-before/backup/source-after manifests matched, unchanged global policy, host Pi 1.5.0 and a verified exact SDK 1.5.0 closure (27 physical edges). It returned under the same garden/native session identities; the old owner was absent, and the new owner and direct compiled bridge resolved through the intended checkout. The receipt states that the installer itself opened no operating session. The actual invocation of the prepared resume script was not asserted. These are the remote host's measurements, not an Oracle re-run or general rollout proof; the over-50-active-entry and conversation-switch UI cases were not re-measured there.
+- **Reusable handoff rule.** Say prominently whether the installer has actually run or is still waiting for approval. A prepared window, a pulled source tree or a printed resume command is not installation success. Before presenting reopening as ready, require the installation's recorded exit 0 and coherent carrier/SDK verification; then use the intended same-session selector and original explicit native module. Keep normal old-owner exit and the consistent complete backup before the first new-SDK write. Never send Enter or install automatically to bypass the operator's approval.
+
 ## 0.50.0 — 2026-11-02
 
 Same-id resume now reaches every resumable backend on both launch rails. A dormant pi, pi-durable or Claude Code citizen reopens under its own garden id in a visible tmux window or, inside Herdr, a new Herdr tab, with no fallback from one rail to the other (#157). The CLI gains one description source, safe help and a thin `entwurf claude` entry (#153, continued in #157).

package/ENTWURF.json

@@ -6,8 +6,14 @@
 		"editing": "Preserve decoded strings exactly unless an explicit semantic amendment is intended. Review related consumers and independent oracles atomically. Accepted payload changes advance revision; history-only edits, routine releases and unrelated code changes do not. schemaVersion tracks reader/structural compatibility. A slotted hint holds only the text around its slot: the slot value (for record-less-socket, the fresh-cut command in both invocation forms) is supplied by its code owner and never copied here. Metadata is not delivered to models."
 	},
 	"schemaVersion": 6,
-	"revision": 19,
+	"revision": 20,
 	"history": [
+		{
+			"revision": 20,
+			"source": "b9fa0d2aa43ebefc1c3bd5bc864c84965b52289a",
+			"issue": "https://github.com/junghan0611/entwurf/issues/159",
+			"change": "Align delivery descriptions with completion and reply routing while preserving receipt, rail, and lifecycle boundaries."
+		},
 		{
 			"revision": 19,
 			"source": "2734f524bfeca6eb1a0ae092494d45576af9ebef",
@@ -126,11 +132,11 @@
 	"tools": {
 		"entwurf_v2": {
 			"descriptions": {
-				"mcp": "CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome, named per rail: a control receiver's acceptance boundary (`sent` / `queued-steer` / `queued-follow-up` / `accepted-unknown-boundary` — those four, or `mailbox-enqueued` on a re-resolved mailbox leg), a mailbox ENQUEUE receipt, a native-push INJECTION, a rejection, or lock-dirty. This receipt is not the colleague's reply or evidence of reading. EXISTING targets only; discover with entwurf_peers. A live socket can receive fire-and-forget. unsupported means only \"no control-socket probe,\" not reachability. The decider resolves the actual rail at dispatch time: a self-fetch mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; native-push has NO mailbox: dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate; agy (paused, #152) → native-push-paused, no probe. A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. owned-outcome was withdrawn. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode applies to a CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000 chars; send an artifact path + digest for more.",
-				"durable": "Send a message to an existing garden citizen by garden id through the entwurf-bridge (intent fire-and-forget). Returns the bridge's delivery receipt, or fails with its named rejection. This receipt is not the colleague's reply."
+				"mcp": "Send, reply or hand off to an existing garden id; the decider selects the live rail (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome, named per rail: a control receiver's acceptance boundary (`sent` / `queued-steer` / `queued-follow-up` / `accepted-unknown-boundary` — those four, or `mailbox-enqueued` on a re-resolved mailbox leg), a mailbox ENQUEUE receipt, a native-push INJECTION, a rejection, or lock-dirty. A receipt is not a reply or proof of reading. A local final is not delivery: when asked to reply, call entwurf_v2 for the requested recipient (normally the replyable sender); honor routing and no-send instructions. Discover existing targets with entwurf_peers. A live socket can receive fire-and-forget; unsupported means only \"no control-socket probe,\" not reachability. For a target without a live socket, the THIRD RESULT is rejection if neither mailbox nor native-push is available. An inactive self-fetch citizen is mailbox-undeliverable; native-push has NO mailbox: dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate; agy (paused) → native-push-paused, no probe. A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. This delivery verb never launches or resumes a process. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. A control-socket-DOMAIN dispatch takes a target lock; mailbox and native-push rails are lock-free. mode applies only to a CONTROL-SOCKET send. wants_reply requests a response without authorizing an action or requiring an automatic acknowledgment; an absent or false marker does not cancel a request in the message. message caps at 16000 chars; send an artifact path + digest for more.",
+				"durable": "Send, reply or hand off to an existing garden id through entwurf-bridge (intent fire-and-forget), returning a delivery receipt or named rejection. The receipt is not a reply or proof of reading. For a requested reply, send to the authorized recipient, normally the replyable sender; a local final is not delivery. Honor routing and no-send instructions; an absent or false wants_reply does not cancel a request, and an address alone needs no ACK."
 			},
 			"parameters": {
-				"intent": "fire-and-forget = send/reply/hand-off to an existing target after a current rail check. unsupported is not a reachability verdict; the decider picks a rail or REJECTS (self-fetch → mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate; a paused backend — agy, #152 — rejects as native-push-paused before any probe); set wants_reply to request an answer, not to wait for one. This is the ONLY intent: owned-outcome, which resumed a dormant citizen by launching a hidden background child, was withdrawn under the visible-first rule. It is not selectable, not deprecated-but-tolerated; a dormant socket citizen is currently unreachable by this verb and rejects as dormant-fire-forget-unsupported.",
+				"intent": "fire-and-forget sends, replies or hands off to an existing target after a current rail check. unsupported is not a reachability verdict: self-fetch uses a deliverable mailbox or rejects as mailbox-undeliverable; native-push injects when alive, rejects dead as native-push-target-dead and indeterminate as native-push-probe-indeterminate; paused agy rejects as native-push-paused before probing. wants_reply requests a response, not a wait. This delivery verb never launches or resumes a process; a dormant socket rejects as dormant-fire-forget-unsupported.",
 				"message": "Message / prompt to the colleague. In familiar language and natural sentences, convey what matters now and the context they need. Keep identifiers and evidence exact; trim repetition, not meaning. Hard cap 16000 chars; for larger payloads send a file/artifact path plus digest.",
 				"mode": "Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. The mailbox and native-push plans carry no mode, so it has no effect on those rails.",
 				"target": "Target garden id (use entwurf_peers to discover)",

package/README.md

@@ -1,9 +1,9 @@
 # entwurf
 
-`entwurf` connects independent agent harnesses as visible siblings. Open a fresh sibling, or reopen
-or message an existing one by its **garden id**. Every harness keeps its own runtime,
-authentication, tools and transcript; Entwurf adds identity, delivery, receipts and named
-lifecycle verbs.
+`entwurf` connects independent agent harnesses as visible siblings. Open a fresh sibling, or reopen,
+message or retire an existing one by its **garden id**—retirement only on your explicit request.
+Every harness keeps its own runtime, authentication, tools and transcript; Entwurf adds identity,
+delivery, receipts and named lifecycle verbs.
 
 ![entwurf — a forged screwdriver for visible sibling sessions](docs/assets/entwurf-hero.jpg)
 
@@ -86,13 +86,21 @@ entwurf pi-durable --resume
 entwurf pi-durable --session <native id>
 ```
 
-The package supplies Entwurf's thin app/TUI carrier and the exact pi SDK set it declares; the launch
-verifies both and refuses incomplete, drifted or mixed supply by name. No separate runtime checkout,
+The package supplies Entwurf's thin app/TUI carrier, emitted from its own canonical production
+source, and the exact pi SDK set it declares; the launch verifies both and refuses incomplete,
+drifted or mixed supply by name. No separate runtime checkout,
 patch, build or ordinary Pi CLI is needed. The contact adds garden identity and two-way mailbox
 communication; execution, models, auth, queues, storage and recovery stay the upstream SDK's
 ([Hard Rule 17](./AGENTS.md#hard-rules): **supply the missing surface; do not become the harness**).
-Selectors, native modules and refusals:
-[setup §2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable).
+On a CLI reopen, name the original `--native-module <absolute file>` or
+`--native-module-dir <absolute directory>` again if needed. Public garden-id
+`entwurf_resume_call` is bridge-only: it restores neither those modules nor the old seat. To retain
+them, use the explicit CLI in the terminal you choose, after confirming the old owner has exited.
+For an SDK upgrade, normally close the owner and back up the complete SQLite session file set,
+including WAL/SHM, before the first write; verify the exact version and artifact, then reopen the
+same identity. [Setup §2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable) owns
+selectors and refusals; the [SDK upgrade boundary](./docs/setup-clean-host.md#default-radius-for-a-requested-pi-sdk-upgrade)
+owns the operating and publication gates.
 
 ### Herdr workbench
 

package/VERIFY.md

@@ -239,12 +239,19 @@ holds that node and the badge counts it, `pending` while recovered), and the car
 `durableLayout` drawn by the published pi-tui renderer on a fake terminal across rows 1–8 × cols
 1–12, count changes and resizes, against the pinned upstream screen for the zero-task case. Its
 editor is a fixed stand-in: the real `CustomEditor`, overlays, emoji width and a consumer's own task
-are the visible-terminal and consumer subjects. The 1.2 bootstrap child also observes `--resume`
-reopening the chosen session and cancelling to nothing (#143). Two more sandboxed children reach the
-reference app's settings and prompt mapping: one drives the real bootstrap against a loopback
-WebSocket Responses endpoint, whose received frames decide the forwarded transport and its
-continuation and the reference compaction policy (the SDK's background summary beside the turn, held on the
-wire while the turn answers; blocking and overflow kept, #146); the other renders the carrier prompt's skills section with no model, against a fixture
+are the visible-terminal and consumer subjects. Another sandboxed child holds the active transcript the
+TUI renders (#155 D1): the carrier runtime over a session seeded through the SDK's public API, through
+an open with a commit between its read and its watch, appends, one commit past the window's 100, a
+switch away and back, compaction-like and reset head markers, a read held across a switch, a refused
+read and the close. Its oracles are the entry IDs the SDK returned and, after close, a non-participant
+open's `Conversation.context().entries`; the SDK boundary is steered test-only at the Conversation
+prototype the child and carrier share. The bootstrap child on the pinned set also observes `--resume`
+reopening the chosen session, by what its screen shows, and cancelling to nothing (#143). Two more
+sandboxed children reach the owned app's settings and prompt mapping: one drives the real bootstrap
+against a loopback WebSocket Responses endpoint, whose received frames decide the forwarded transport
+and its continuation and the SDK's compaction policy under those settings (the SDK's background summary beside the turn, held on the
+wire while the turn answers; blocking and overflow kept, #146), each placed summary, manual ones
+included, heading the screen's active transcript; the other renders the carrier prompt's skills section with no model, against a fixture
 of both settings scopes, an absolute entry, a same-name pair and a wrong-base decoy.
 `check-pi-runtime-version` asks the
 same installed verifier (`check-pi-durable-beside`) whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
@@ -269,8 +276,8 @@ constructed depth-3 mismatch refused by the verifier and seen by the oracle, the
 app's own model refusal before any birth — also with one installed `--native-module` initialized
 first, a reserved extension name refused before anything opens, one installed `--native-module-dir`
 initializing only its top-level `*.extension.mjs` (#134) and a directory without a module refused
-before anything opens — and the HOST kept a separate subject — a real pi 1.1.0
-binary (the previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
+before anything opens — and the HOST kept a separate subject — a real pi 1.2.0
+binary (below the supported range; a fixture version, not the pinned set's previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
 PASSes — not native admission. The carrier's rebuild
 equality is the owned source's emission (#141): the carrier claim `PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL`
 on every floor, `emit-pi-durable-carrier --check` as its CLI. The emitter's exact Node is red in the CI
@@ -374,7 +381,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.4.0 <1.5`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.5.2 <1.6`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -24,7 +24,7 @@ takes/helpers/tests are maintainer tooling and are deliberately excluded from th
 
 - Node at the `package.json#engines.node` floor; the checkout's pinned dependencies and
   current compiled bridge. After a source/bootstrap change, build with `pnpm run build-bridge`.
-- Pi at the checkout's supported floor (**current floor 1.4.0**); `entwurf` on PATH must be
+- Pi at the checkout's supported floor (**current floor 1.5.2**); `entwurf` on PATH must be
   the intended source stable-bin. Source evidence is not registry-package acceptance.
 - `herdr` on PATH at exactly `scripts/fixtures/herdr-supply.json#version`; `asciinema` v3.
 - Herdr's existing Pi integration at

package/docs/acp-backend-rail.md

@@ -135,7 +135,7 @@ Dep bump ledger. 0.38.0 (#145) changes only the pi SDK set; the ACP rows are unc
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | SDK exact `1.4.0`, host `>=1.4.0 <1.5` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. The published 0.36.0 through 0.37.1 shipped the 1.2.0 set (#141); 0.38.0 (#145) is the first to carry 1.3.0. Historical: the published 0.33.0 through 0.35.1 ship SDK exact 1.1.0, 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
+| pi runtime | SDK exact `1.5.2`, host `>=1.5.2 <1.6` | **exact** oracle + **closed range** | the #158 source candidate's declared SDK set and derived host range (the published 0.51.0 shipped SDK 1.5.0, #155), not a release or operating-host acceptance; an ordinary Pi host inside the range is accepted by the source's version predicate, and the ceiling moves only on measurement. The published 0.36.0 through 0.37.1 shipped the 1.2.0 set (#141); 0.38.0 (#145) is the first to carry 1.3.0. Historical: the published 0.33.0 through 0.35.1 ship SDK exact 1.1.0, 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.8.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.90.0` | **exact**, bundled | shipped since 0.36.1; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.296` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |

package/docs/external-mcp-host.md

@@ -11,9 +11,9 @@ the one-line registration; everything an operator needs to actually wire a host
 
   **Being garden-native is not the same as being replyable, and Copilot is the case that separates them.** Its hook writes a sender marker, so an `entwurf_v2` send carries its own garden id and the receiver learns who wrote — measured 2026-08-21 on Copilot CLI 1.0.80, where a live send arrived under its own garden id with `origin: "meta-session"` and `replyable: false`. Replyability arrived later and through a different process: a first-party extension (`run.sh install-copilot-receive`) that the CLI forks, which binds to the same V3 record and writes a receiver marker owned by its own pid (#82 RAIL 5). So a Copilot citizen is `replyable: true` exactly while that extension is armed for it, and `replyable: false` — honestly, with a real garden identity — when it is not installed, not launched with `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` (which is what `entwurf copilot` sets for one invocation), not yet born, or gone. Read the two facts off different rails: the sender marker answers *who sent this*; the receiver marker answers *can a reply land*. The onboarding obligations are in [`adding-a-harness.md`](./adding-a-harness.md) step 7, and the evidence boundary — the managed LIVE acceptance that moved receive to D6, and what D7-partial / D3-pending still exclude — is in [`DELIVERY.md`](../DELIVERY.md).
 
-**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and the only one that reads whether the target is live pi, dormant pi, a mailbox-backed self-fetch citizen (Claude Code, Copilot, OMP), or native-push Antigravity/Codex and routes correctly. Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation. Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?, placement?}`**, and reopen a DORMANT pi, pi-durable or Claude Code citizen under the same id with **`entwurf_resume_call {target}`**. **`entwurf_retire_call {target}`** (new in 0.41.0) attempts retirement of exactly one target, and only one the human operator explicitly requested; mounting or seeing the tool, a coordinator role or caller identity is not permission, and an unknown result is not a reason to replay.
+**Which verb an external agent should reach for:** to deliver to / reply to a garden id, use **`entwurf_v2`** — it is the canonical delivery surface and resolves the target's current rail: a live pi control socket, a deliverable self-fetch mailbox (pi-durable, Claude Code, Copilot or OMP), or probe-alive Codex native push. Dormant pi and undeliverable targets reject; Antigravity native push is paused and rejects before probing (#152). Discover targets with `entwurf_peers`, confirm your own identity with `entwurf_self`, drain a mailbox with `entwurf_inbox_read`, and use `entwurf_register_native` only as the explicit/manual fallback for binding an already-running agy conversation. Open a NEW sibling with **`entwurf_fresh_call {backend, model, task, cwd?, placement?}`**, and reopen a DORMANT pi, pi-durable or Claude Code citizen under the same id with **`entwurf_resume_call {target}`**. **`entwurf_retire_call {target}`** (new in 0.41.0) attempts retirement of exactly one target, and only one the human operator explicitly requested; mounting or seeing the tool, a coordinator role or caller identity is not permission, and an unknown result is not a reason to replay.
 
-Observed: Claude Code, Codex CLI, Antigravity CLI, GitHub Copilot CLI and OMP all reach this MCP bridge. Claude, Copilot and OMP become symmetric/replyable through mailbox-backed meta-sessions; agy and Codex use native-push. Codex's identity is request-scoped `_meta.threadId`, and its replyability requires that exact record plus a loaded app-server thread. Plain external hosts still need an identity lane to send.
+Observed: Claude Code, Codex CLI, Antigravity CLI, GitHub Copilot CLI and OMP all reach this MCP bridge. Claude, Copilot and OMP become replyable through deliverable mailbox-backed meta-sessions; Codex uses native push, while Antigravity's native-push rail is paused (#152). Codex's identity is request-scoped `_meta.threadId`, and its replyability requires that exact record plus a loaded app-server thread. Plain external hosts still need an identity lane to send.
 
 Prerequisites on the host running the external MCP client: