@junghanacs/entwurf 0.51.0 → 0.53.1

package/BASELINE.md

@@ -1,303 +1,39 @@
 # BASELINE TEST
 
-A short, language-paired interview any human operator can run against a
-freshly-bootstrapped entwurf session to confirm the bridge has not
-silently drifted into a different identity / context surface. Questions
-are deliberately open-ended — they probe what the agent actually sees,
-not what it was told to claim.
-
-Claude is the reference ACP backend. Cortex Code has a separate compact baseline
-because it has no system-prompt carrier and keeps its own native tool surface.
-Antigravity (`agy`) and Codex are native-push citizens rather than ACP backends and therefore
-have separate citizen/round-trip baselines. Codex's 0.153.4 explicit-`codex`-home acceptance
-receipt and protocol live in `DELIVERY.md`; neither is part of this ACP operator interview.
+A short interview a human operator runs against an `entwurf` ACP session before anything
+else, to confirm the bridge has not silently drifted into a different identity or context
+surface. The questions are open-ended on purpose: they probe what the agent actually sees,
+not what it was told to claim. It is a blind pass, so run it before the session has read
+[VERIFY.md](./VERIFY.md). A session that has already read VERIFY.md is reported as "blind axis
+not measured", not as a failure; nothing requires re-asking.
 
-## Release-host baseline
-
-This table is the operator-facing support/certification view. It complements the
-model interview below; a persuasive answer from the model cannot turn an unmeasured
-host into a certified one. Verdicts are one of **certified** (a real host ran the
-installed doctor green), **shape-only** (gates model the package, no live host),
-or **unverified**. Since 0.20.0 the table also carries two qualifiers:
-**CERTIFIED (CI)** marks a shape-only surface observed green on a CI runner — a
-runner is not a physical host, so bare **certified** still means a physical-host
-doctor green; and **NOT CERTIFIED — pending physical host** marks a rail whose
-missing evidence only a physical host can supply. That is an evidence boundary,
-not **UNSUPPORTED** — the deliberate never, which today names the native-Windows surfaces
-outside the experimental preview (rows below).
-
-| Surface | Verdict | Evidence |
-|---|---|---|
-| Node 24 Linux package consumer | shape-only | Required `artifact-consumer` CI |
-| Node 24 macOS package consumer (GitHub Actions runner, not a physical Mac) | shape-only · CERTIFIED (CI) | Required `macos-install-surface` CI run 34303884286 @ `70eda03` (`macos-latest`, 65 s, 10/10 steps): pack → clean consumer install → bin links → `entwurf --help` → `check-bridge` (7 tools) → harness-absent `setup` (all SKIP, computed green, zero no-write-axis writes, `auth.json` byte-identical). Certifies no harness rail. |
-| Claude Code exec form (observed at 2.1.217) | **certified** at 2.1.217; the supported floor is now `>=2.1.306` (#147 same-id resume), declared with no LIVE receipt at 2.1.306 itself; the dated n=1 lifecycle round trip below ran on 2.1.307 | Topology + floor gates, doctor oracle; B2 live NixOS session |
-| Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
-| Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
-| Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
-| macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental remains unscheduled; no cut has carried it. |
-| 0.23.1 release acceptance (observer-amended) | accepted by GLG | `pnpm run check:full` P4 exit 0 (577 s); second aggregate `release-gate --cut` at `/tmp/entwurf-release-gate-0.23.1-retry.UIFctR` reached MUST 23/1/0 and BEHAVIOR 1/0, with only `smoke-codex-fresh-live` red because luna dropped `$`/`@` sigils in its relay (`release-gate.log:6156-6157`). The observer-amended standalone cell reran that exact leg with Codex `gpt-5.6-terra`, Pi `openai-codex/gpt-5.6-luna`: 66 assertions, exit 0; A app-server PID `3969303` `$227` ≠ fixture S `$231`; artifact `.probe-artifacts/codex-fresh-live-eZmf6p/`; pipe-pane stdout sha256 `56ee73e046e16fa95ef093fccf037670bf28b53a054bb5eec2a3b3b3ff08d93a`. Luna sigil handling is a post-cut issue, not a production-byte change. |
-| 0.24.0 release acceptance (observer-amended) | accepted by GLG | `pnpm run build-bridge` then `pnpm run check:full` P4 exit 0 (594 s) on the prepared tree; aggregate `release-gate --cut` at `/tmp/entwurf-release-gate-0.24.0.anVBvk` (1h34m) reached MUST 22/2/0 and BEHAVIOR 1/0 with `check-gate-qualification` 739/739 killed at the candidate (`release-gate.log:5507`). The two MUST reds: `smoke-codex-fresh-live` (the Pi→Codex `<placeholder>` template relay audited for byte equality, ROADMAP 0.24.0 follow-up #3, same class as the 0.23.1 amendment) and `smoke-entwurf-chain-live` — delivery A→B (`entwurf_v2 control-socket → sent`) and B→C (B's sender envelope in C's stream) both landed, then hop 3 (ACP `claude-sonnet-5`) declined the relay on principle, naming the scratch `AGENTS.md` authority as self-vouching content (`release-gate.log:5841`); the same class hop 1 refused on the 0.22.0 gate (`f5d6e10`), not rerun (a second run is a coin flip on a model's judgement), ROADMAP follow-up #5. Standalone LIVE before the aggregate, each once with ambient identity stripped: mux-fresh-call 39/39, mux-lifecycle 81/81, omp-receive 11/11, herdr-fresh-call 31/32 after `149bef7` (the red is a claude child that called back and never attempted delivery, follow-up #1), omp-fresh 21/21 after `install-omp-bridge` (stale v1 birth unit on the host, doctor named it). P9 after the aggregate: 548 → 546 dirs, 2 roots / 756K reclaimed, operator store and control-socket dir unchanged. GLG: "릴리즈 하는데 문제 없는것 같은데? 기록하고 진행하자." |
-| Native Codex Linux caller-DIRECTORY axis (current; #95 lane C) | **certified** | 2026-09-16, Codex 0.153.4: 65-assertion LIVE, exit 0, at `b3e07dc` with a clean worktree. Same host and topology as the lane B row below (app-server `737636` in A `$30/@41/%45`; initial Pi `20260916T154902-556eb5` `$2/@58`, Codex `20260916T155037-10ddaa` `$2/@59`, Codex-opened Pi `20260916T155102-9add8a` `$2/@61`, `seat-source=codex-title-anchor`). **hop 1 (cwd requested):** pane `#{pane_current_path}` = rollout `session_meta.cwd` = record cwd = requested scratch = `/tmp/entwurf-codex-fresh-live-db65N2`, against app-server cwd `/home/junghan/repos/gh/entwurf` read from `/proc/737636/cwd`. **hop 2 (cwd NOT requested):** the outbound Pi's pane, its own birth-written record and the Codex caller's record all read that same scratch, and its receipt names the caller-record rule. Artifact `.probe-artifacts/codex-fresh-live-w4yJBw/`; stdout `.probe-artifacts/lane-c-live-20260916T154900.log` sha256 `712050e7a8cf03ece98e7f34029ae98a92e9b2a7fd96aff87d0c1e6ba2ee9af2`. Cleanup reclaimed `@58`/`@59`/`@61` with no failure; records and transcripts preserved; app-server and `$30` untouched. 65 and 56 are different contracts — lane C added the cwd axis on top of lane B. Long floors (qualification body, frozen `check:full`) NOT run at this SHA; GLG decides host vs CI. |
-| Native Codex Linux caller-seat topology (current; #95 lane B) | **certified** | 2026-09-16, Codex 0.153.4: 56-assertion LIVE, exit 0. App-server `737636` alone in session A `$30/@41/%45`; initial Pi `20260916T144205-e876ff` `$2/@46`, omitted-placement Codex `20260916T144230-d050d7` `$2/@47`, Codex-opened Pi `$2/@48`. A ≠ S is the decisive half: the app-server env names A, so S can only have come from the caller's pane title — receipt `seat-source=codex-title-anchor`. Artifact `.probe-artifacts/codex-fresh-live-nYcGC1/run-stdout.log` sha256 `ed60c2bd…`; the 43-assertion hop-1 run that measured the D1 retirement is kept at `codex-fresh-live-4aFCDD/run-stdout.log` sha256 `8392a603…`. Cleanup reclaimed `@46`/`@47`/`@48` with no failure; app-server and `$30` untouched. |
-| Native Codex Linux home topology (PAST CONTRACT — #95 D1 retired the fixed home 2026-09-16) | **certified** for 0.21.0 as shipped | 2026-09-12, Codex 0.153.4: 57-assertion explicit-home LIVE. Initial Pi `$150/@397`; operator app-server `$158/@390/%390`; omitted-placement Codex `$158/@398`; Codex-opened Pi `$158/@399`; exact callbacks and addressed delivery both ways. Receipt and digest: `DELIVERY.md`. Deterministic closure of that axis: qualification 460/460 across 43 lanes with origin/snapshot purity green, then frozen full floor exit 0 in 506s — both pre-amendment. **Observer-amended acceptance, 2026-09-12:** standalone LIVE 48 assertions exit 0, source audit `initial-pi=3/3`/`codex=3/3` completed exact, initial Pi `$150/@431`, Codex `$158/@432`, Codex-opened Pi `$158/@433`, all three reclaimed by their own source receipts; artifact `.probe-artifacts/codex-fresh-live-fZccoK/`. The 48 and 57 counts are different contracts, not a regression. **Release acceptance at that same fingerprint:** `check:full` exit 0 502s, LIVE release gate `--cut` MUST 24/0/0 · BEHAVIOR 1/0/0 · `cut: OK`, `check-gate-qualification` 475/475 across 43 lanes with origin purity green, and the aggregate's Codex leg repeating the 48-assertion acceptance (artifact `codex-fresh-live-2oId4C`). Unrestricted attached-TUI placement remains unsupported and unclaimed. |
-| Darwin install fence (meta/copilot/omp-bridge + omp-receive) | portable (Linux or Darwin) | Four installers accept Darwin; python3/node/harness presence holds the seat, not the platform name. A Darwin install is not a rail receipt. |
-| Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
-| setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |
-| macOS physical-host probe | shipped, unrun on a Mac | `scripts/raw-macos-measure/` — `/bin/sh`, cells M1–M9, 3.5 s; needs neither entwurf install nor login. Still unmeasured: Darwin foreign-process environ (`ps -Eww`) and whether macOS `python3` is a CommandLineTools stub. |
-| WSL2 Entwurf-only install + zero-token Pi citizen (GitHub Actions `windows-2025` runner, not a physical machine) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/wsl2-install-surface.yml` run 39098773010 @ `b03d646` ([#78 receipt](https://github.com/junghan0611/entwurf/issues/78#issuecomment-6245947301)). Guest kernel `6.18.40.1-microsoft-standard-WSL2`, host `wsl --list --verbose` VERSION 2, guest fstype quoted raw as `ext2/ext3`. The run's packed tgz digest is equal across producer, host and guest; guest Node 24.18.1; harness-absent `setup` green with protected auth/harness state unchanged. Pi 1.3.0 (sha512 pinned to the registry integrity) wired by `setup`: one V3 record whose filename is its gid, a gid-keyed control socket with a native connect, `peer-facts` alive; only `get_state` was sent and no `agent_start` was observed. Pi creating an empty `auth.json` is not a login. It certifies no harness rail. Linux-guest runtime evidence only: not native-Windows evidence, and not a substitute for the required Linux CI jobs. |
-| WSL2 delivery, non-pi harnesses, vendor turn, physical user machine | unverified | No receipt. Authentication and model turns were deliberately excluded from the CI cells' scope (not a CI impossibility); non-pi harnesses, delivery, fresh/resume and physical machines are unmeasured. |
-| native Windows experimental preview: Pi citizen + `entwurf_v2` delivery (GitHub Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0; ships in core 0.39.0; the evidence below is the feature-branch CI artifact at `3b65bdc`, and the released tarball's own Windows cells are preview run 39146098592 @ `551402c`) | shape-only | Released tarball: preview run 39146098592 @ `551402c` installed the core 0.39.0 tarball (sha256 `1d5693241b8c…`) and its eight cells (L0, L0c, R1, R2, T1, N1, B1, D1) PASS, with a faux model and no vendor turn. The text that follows is the earlier feature-branch receipt (same addon sha256 `9837893521ec…`, not the release pack). Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/windows-native-preview.yml` run 39123555360 @ `3b65bdc`, with the required `ci.yml` four jobs green at the same SHA (run 39123555224). Build: MSVC (VS 2026, toolset v145, SDK 10.0.26100.0), two builds byte-identical (`entwurf_win.node` sha256 `9837893521ec…`), imports advapi32 + kernel32 with `node.exe` the only delay-load; node-gyp 13.1.0 and the Node headers/`node.lib` pinned. The pack carries exactly the addon and its manifest; npm installed it into a sandboxed consumer prefix; Pi came from a tarball checked against its pinned SRI. Six addon cells PASS (final-component reparse and non-regular refusals on the read handle, no connect through a symlink to a pipe, one-deadline timeout with reclaim, pipe-name stability and loader refusals). B1: two `pi --entwurf-control` citizens, one V3 record each, record-derived pipes alive through the product probe, `peer-facts` alive, graceful exit with both addresses dead afterwards. D1: A's model called `entwurf_v2` toward B's garden id with a nonce; A's receipt `control-socket → sent`, B's model context and B's transcript `entwurf-message` entry from A carry it. The model is an offline pi-ai `fauxProvider`: no vendor turn and no comprehension claim. The transcript fact is the harness's assertion; the raw transcript is not archived. The run used the elevated Administrators owner branch, so user-SID-only privacy is not measured. Pi's `peerDependencies` warning was observed, not waived. Not evidence for any other harness on Windows. |
-| native Windows: own pre-existing pipe-name birth refusal, record link/rename syscalls, descendant cleanup after a forced kill, cross-user, mixed elevation, remote callers, user-SID-only privacy, physical user machine | unverified | No receipt; the preview cells name these as unmeasured. |
-| Remote pair (#107): one declared pi-durable pair, Linux server ↔ Linux notebook over operator SSH (feature branch, not a release) | one LIVE exchange recorded (L4, one pair, one run) | 2026-10-20, both hosts at branch commit `e632294`; that commit's exact-SHA CI run 39202248407 was green on all four jobs. B's native `entwurf_v2` → one SSH → A `remote-pair-receive` → A mailbox enqueue `2026-10-19T22-19-47-662Z-13c897.msg`; A's one reply → B inbox read at `2026-10-19T22:20:24.837Z`, with the matching nonce `107-live-20261020T071937-B-A-6e42d1`. Before the send, the selected compiled bridge hash, the post-build bridge start and the record/owner/sender joins were checked on both hosts; the user reopened both visible sessions. Receipt: [#107](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6278665895). |
-| Remote pair: OFF target, negative paths over real SSH, other rails, more than one pair, non-Linux hosts, GUI rendering of the received envelope | unverified | No receipt. The deterministic and installed cells (VERIFY) do not stand for these. |
-| native Windows: other harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over 16 MiB, reparse-backed store folders | UNSUPPORTED | Outside the preview's scope by decision; the preview loader refuses an install without the Windows addon by name. |
-
-### #147 candidate host boundary (2026-10-21; not a certification row)
+Order of a verification session:
+### Why this exists
 
-A checkout-started Pi wrote the new V3 `attachIncarnation` field while older hook/bridge
-readers still rejected it. The observed mixed-reader failures were rolled forward under a
-specific operator-approved repair, preserving the same garden/native identity; no manual
-record deletion, id rewrite, fresh-cut or old-shape rollback was used. Normal attach writes
-continued. Other installed native readers and the external Python mirror were identified as
-stale by source inspection; that is predicted impact, not a measured failure on every rail,
-and the complete G4 host rollout remains open. See [upgrade policy](./docs/fresh-cut-policy.md#upgrade-order).
-
-The candidate's internal Pi control `retire`, pidfd helper, request adapters and private
-injected dispatcher have source/fixture and candidate-local proof, not new native-host
-certification. Pi ACK is not exit/flush; CC fd-process exit is not conversation/children/flush.
-The current `>=2.1.306` floor and a historical B2 delivery receipt do not certify this
-lifecycle. A later CI green also cannot certify the operator's mixed-reader deployment.
-These two paragraphs are the 2026-10-21 state; the next section records what 2026-10-22 measured.
-
-### #147 Native round trip, 2026-10-22 (n=1)
-
-Not a certification row and not a release gate. One Linux host, source `a9c9459` (exact-SHA push
-CI green on its four required jobs), checkout compiled output rebuilt once under the dist lock
-after its previous bytes were preserved. The operator requested this bounded test-owned
-measurement; no working sibling was retired or restarted. Public record:
-[#147 checkpoint comment](https://github.com/junghan0611/entwurf/issues/147#issuecomment-6329217980).
-
-| Axis | Measured |
-|---|---|
-| caller | a fresh pi-durable citizen, identity from its exact nonce callback; its native store (read from an online read-only backup) offered all eight contact tools, the actual model was `openai-codex/gpt-6.1-sol`, and it made exactly four settled lifecycle calls — one retire and one resume per target |
-| ordinary Pi target | fresh, callback-identified. Retire returned `shutdown-requested`; separately, the original pane and control socket were gone, the record unchanged and the paired requested/outcome events present. Dormant `entwurf_v2` rejected. Resume returned separate LAUNCH and OBSERVATION; native session, `createdAt`, cwd and backend kept; transcript byte-identical across the promptless resume; a question omitting the answer recovered the pre-retirement fact |
-| native Claude Code target (CLI 2.1.307) | fresh, callback-identified, bound arm before retirement. Retire returned `exited`; separately, the last bound receiver owner was dead, the original pane gone, the record unchanged and the paired events present. Dormant delivery rejected as an undeliverable mailbox. Resume observed a NEW live owner with a new record-matched arm for the same native session and `createdAt`; transcript byte-identical across the promptless resume; blind recall succeeded |
-
-It does not show: conversation flush, descendant exit or model silence; the `>=2.1.306` floor
-itself (2.1.307 was the measured CLI); ACP-provider Pi, Herdr, pi-durable as a target, Windows or
-macOS; a release artifact; the `smoke-mux-lifecycle-live` MUST; or that any resident process
-reloaded new reader bytes.
-
-**G4 the same day (reader scope closed with Copilot runtime deferral; resident/runtime acceptance separate).** The five stale on-disk reader copies (Codex
-birth, OMP birth and receive, Copilot birth and receive) were preserved and rolled forward with
-their owning installers; their installed meta modules are byte-identical to the current source or
-compiled twin. Codex birth, both OMP units and Copilot receive passed install and doctor. Copilot
-birth passed install and doctor ownership but its doctor runtime axis is RED on a historical
-unrecovered hook error from 2026-10-14; that RED is retained, not cleared or counted as PASS.
-On 2026-10-22 GLG explicitly deferred Copilot Native runtime validation for this landing: Copilot
-is currently a free `auto` account, not a subscription, and GLG reports even a greeting taking over
-a minute to answer, making practical runtime validation unavailable. That latency is an operator
-report, not a benchmark re-measured here. No new Copilot model turn or log-clearing recovery was
-performed. This landing closes the on-disk reader/field-compatibility scope with that explicit
-Copilot runtime deferral; it does not certify Copilot runtime or resident-process reloads.
-The external Python mirror's nullable-field delta has a reviewed local checkpoint (not yet pushed),
-and its owner's one installed schema certification accepted 1,847 records with zero defects — field
-acceptance, not whole-parser equivalence. Resident processes remain unmeasured; broader runtime
-and release acceptance are not silently waived.
-
-### #157 Herdr Pi native round trip, 2026-11-01 (n=1)
-
-Not a certification row, release gate or other-backend acceptance. One private Linux aarch64 Herdr 0.9.5 server, source `c2032093f71b2dfc92bc49e9e85d96178a34b89a`, installed Pi 1.4.0 provenance and Node 24.18.1. Native Claude Code citizen915040 measured it; Astra567753 reviewed saved raw/records/transcripts and independently checked saved hashes/prefix/fact occurrence without another runtime probe. Main read the receipts and protocol/hash artifacts. Portable decisive evidence: [#157 runtime receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6553792285).
-
-| Axis | Measured |
-|---|---|
-| fixture | Private HOME/XDG/meta/control/lock/socket, empty target/caller cwds, existing real Pi agent-dir config/auth reference. Nix shell initialization overwrote PATH; a NEW fixture `.bashrc` prepended the existing pnpm bin. This is a PATH-supplemented fixture, not a pristine-HOME result; no operator profile/SDK was changed. |
-| seed/dormancy | Terminal seed ACK and a completed absolute transcript are bound by the V3 record to gardenId `20261101T135933-80116c`; the transcript header matches nativeSessionId `01a1957a-23ee-7314-a6d6-fca90682712e` and cwd, and its first model_change matches the canonical model. One test-owned pane close removed the original runtime/socket, preserving the record/transcript. No glob or manual record repair. |
-| actual public caller | Native Pi in private Herdr w1:p3 made exactly one resume toolCall with the target gid; its matching toolResult was non-error and carried separate LAUNCH/OBSERVATION for new tab w1:t2/pane w1:p4. Target gid/native/path kept; the returned pane joins the private server and target listener process. |
-| protocol/no-turn | One owner `get_info` RPC returned the same gid/cwd/model and idle=true. Stop-complete baseline and resume-complete/pre-recall transcript are both 65,049 B with SHA256 `aa7903edf56d6577466e42b59fa4ce86f5d3e3d85cfa04b70aff28e2f3188e29`; final 66,541 B keeps that exact prefix. |
-| recall/record set | One separately counted synthetic fixture sender used public `entwurf_v2`: control-socket sent, then the target recalled the unique seed value. The answer was absent from caller/recall/helper inputs. Records are exactly target/caller/sender, target identity preserved, locks empty. |
-| cleanup | One official private stop; saved raw supports the 12 tracked PID absences and four listener-path absences. 13 R4 visibility-helper rows remain, earlier helpers untouched. This is not total-descendant-zero. |
-
-A post-stop bookkeeping line failed to parse (unescaped find parentheses, exit2); it is retained. Separately authorized read-only recovery found no T/C/S gid entries in six real roots and matching before/after entry sets. This later snapshot proves neither a live-interval no-leak invariant nor unchanged file contents. Recovery also violated sequential-only scheduling with a seven-call batch: its racing first count was discarded and completed-producer sequential reads were used. These exceptions remain; review accepted the saved functional evidence, not a procedural-floor pass.
-
-Three logical user turns are not a measured provider-request count. Provider/billing, OAuth/vendor other writes, the null-to-filled transcriptPath transition and the MCP-timeout/cancellation boundary were not measured; the complete resume-ready seed transcript was observed, and the resume tool result returned in about 3 s. Confirmed real-agent-dir writes are two new transcripts and the target recall append. No pi-durable/Claude Code Herdr resume, registry artifact, aggregate MUST or release acceptance follows. Host artifacts: `/tmp/e157h/g1a-resume-r4/{RECEIPT.md,A10-READ-ADDENDUM.md}` and `raw/`.
-
-### #157 pi-durable exact native CLI selection, 2026-11-01 (n=1)
-
-Native checkout CLI evidence, not public garden-id resume or release acceptance. Subject: base `2aaf8562497abd78ff32a490929c80d233ad75bc` plus uncommitted B1 s2, work-surface SHA256 `e07908ea5d6aaab042ff1cd01a13fbd7c11c7932adf90019d875fdd35ad4799b`. Citizen915040 measured; Astra567753 independently read saved requests, kernel/process/marker/storage/cleanup artifacts and compared saved candidate seals; main read the receipts and decisive kernel/record artifacts. Notebook coordinator b22677 reviewed supplied source/receipt excerpts, not host-local bytes or runtime. [Portable source, PARTIAL and native CLI receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6555677872).
-
-| Axis | Measured |
-|---|---|
-| fixture/selection | One PATH-supplemented private Herdr0.9.5 server, Node24.18.1 and real Pi agent-dir reference. An input-free seed created gid `20261101T173050-ca665f` / native id `1793521850194-7520265c-2633-4740-8c21-0df272ede11d`. The second fixed command was `run.sh pi-durable --session <that native id>` in the same explicit cwd, with no provider/model/width/bootstrap/task/picker flags. This is the managed checkout CLI, not an installed-package invocation or an API-seam-only test. |
-| close/reopen binding | One intentional bound test-pane close; old host1045274/bridge1045313 then absent by ps and individual proc-stat ENOENT, with the known lock absent. Second layout result w1:t3/p3 and new terminal join actual host1046710/start65005448, compiled bridge1046764, private parent1044712 and new sender/receiver owner `linux:65005448`. Marker-candidate success alone was not accepted. |
-| identity/storage | One record retains gid/nativeId/cwd/createdAt; only recordUpdatedAt changes. Model/transcript/incarnation remain null; Herdr detection remains unknown. Only the same record-derived native directory/known lock were stat/listed; no external SQLite open/read/copy. Sizes/mtimes do not establish content preservation. |
-| cleanup/seal | One official private stop, eight specifically tracked PIDs absent, two scoped listener queries/socket paths absent, native lock absent and directory/metadata preserved. Eight visibility-helper rows remain, not all-descendants-zero. Source/index/NEXT/new files/launch7-carrier+pin/dist97 manifests compare equal across the observation. Six-root/gid snapshots are not interval/content non-leak proof. |
-
-The same s2 candidate has four separate affected PARTIAL receipts: carrier39/39, beside46/46, install-surface44/44 and manifest-head52/52 killed, green controls/restoration/stable seals; the other1179 mutants and FULL were not run. Separate bounded raw witnesses reached NOT-HERE's own missing-id refusal assertion and ENV's first-file-mode config name/version mismatch, not just integrity/shared-beforeAll failure. The initial declared95/actual100 inventory HEAD failure remains a failure before any mutant; its one-line declaration correction is part of s2. Earlier pre-inventory package/installed-consumer proof is not transferred to this exact candidate or to installed `--session` execution.
-
-Functional observation was accepted, not a clean-procedure floor. Retain five parallel read-only helper reads, semicolon status captures, bundled multi-rc observations and kernel/storage brace groups whose components lack individual statuses; actual printed PID/PPID/starttime/cwd/stat values were cross-joined, not inferred from outer0. Interactive G3 shell preflight was not repeated; non-interactive fixture checks were used. No unexpected error was recorded in retained observations, not universal error absence. No `entwurf_retire_call` or working-citizen retirement occurred; the authorized test runtime was intentionally closed once. No deliberate input does not prove provider/vendor/billing zero. Public pi-durable addressed resume/B3 fencing, stalled-owner safety, working watch/delivery, recall, headless use, content invariance, exact installed artifact, final native/CI/release acceptance remain separate. Host artifacts: `/tmp/e157h/b-l1/{RECEIPT-PARTIAL.md,RECEIPT-CLOSURE.md}` and `/tmp/e157h/g3-b1-native-session-r1/RECEIPT.md` with scoped raw.
-
-### #157 Herdr public pi-durable fresh, 2026-11-01 (n=1)
-
-Not a certification row, release gate, installed-artifact or other-backend acceptance. Subject: HEAD `d6129139ad9738a3bc0ade9b5ef3abbac4b7580f` plus the uncommitted A-L1 work surface (tracked diff SHA256 `bccf722d11796003294486f298fec088fe008e4b91cbf3f0cbcfc1ee7f8596b5`, 731-file source surface `79ff55b9b1fbad7d3c7864d9c7f8929a7996673da7146f3a879f09d2125c327c`), run on the checkout compiled bridge from the A-L1 package proof (97-file dist seal `e32433cb699c2141a60c9141516559d38079e81f5a14123925a5a72f377c2734`). One private Linux Herdr server (Herdr version and architecture not re-read in this run), Node 24.18.1 per `/proc/<pid>/exe`. Citizen915040 measured; Astra567753 independently accepted the saved raw, records, kernel/view/cleanup artifacts and seals (d74d42); main read the receipts. [Portable LIVE receipt](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6557466848).
-
-| Axis | Measured |
-|---|---|
-| fixture | New private HOME/XDG/meta/control/lock/socket root. The env allowlist is the G1a one plus the two `verify_deps_before_run=error` flags; existing real Pi agent-dir reference; PATH-supplemented like G1a (interactive preflight output identical after path normalization). No operator profile/SDK/PATH edits or credential copies; SDK/vendor OAuth refresh writes were not measured. |
-| topology | One workspace. Before launch: focused root pane w1:p1 in directory A, unfocused caller pane w1:p2 in directory B, A ≠ B. After launch: w1:p1 still focused in A. These are two end-point views; focus continuity and cross-workspace selection are not measured. |
-| actual public caller | Native Pi caller `20261101T203132-e82002` (openai-codex/gpt-6.1-sol; thinking level a separate entry) made exactly one `entwurf_fresh_call` toolCall with args exactly {backend `pi-durable`, model `openai-codex/gpt-6.1-sol`, the approved task} — no cwd, no placement, no other tool call. Its paired toolResult was non-error: the Herdr layout receipt with cwd B from "this agent's own process directory", the checkout `run.sh` runtime, tab w1:t2 / pane w1:p3, nonce `mux-fresh-call-c8406ed0bdefea1fdc2940a9`. A one-shot read-only matcher, statically preflighted on synthetic 0/6/7 cases first, passed 27/27 on the record-selected transcript. |
-| callback/join | The caller received exactly one `entwurf-message`: body the nonce alone, sender `20261101T203137-97561c` (pi-durable, cwd B, no wants_reply). That gid joins its private V3 record (pi-durable, native id `1793532696952-5eb222ef-08fd-46ee-a4c0-587cf1d0d330`, cwd B, model/transcript null), receiver and sender markers (owner 1244328, `linux:66079156`), process-info of the returned pane (bootstrap with the requested provider/model and the callback-first framed task as argv), `/proc` (cwd B, parent = the private server, starttime = the marker key, one child = the checkout compiled bridge) and the returned view (w1, new tab w1:t2, cwd B, observed unfocused). |
-| cleanup/seal | Revalidated test-owned close of w1:p3 only; one immediate observation found host and bridge absent and the native lock released. One official private stop; nine tracked PIDs and three named listener paths absent. Six real-root before/after listings equal (snapshots, not interval/content non-leak proof). New real-agent paths preserved: the caller transcript (70,038 B; C's `SEEN` turn was appended after the callback message arrived, and the file was identical at the recorded pre-/post-stop snapshots d07, d13 and d14) and the record-derived pi-durable native directory; no SQLite open/read/copy. L0 equals the package p2 seal and L1 equals L0, including all 97 dist bytes/modes/mtimes. |
+GLG's account: GLG used Claude inside pi and liked how it felt. When Anthropic changed its plan policy so that a subscription plan could no longer be used with pi, GLG started pi-shell-acp, this package's ancestor, a month before the change took effect ([GLG's note](https://notes.junghanacs.com/botlog/20260427T183210)). The goal was not "Claude through ACP works" but "Claude running through pi ACP keeps the feel and discipline it had in pi."
 
-Observed order: the caller's turn ended `LAUNCHED`, the callback arrived about 2.5 s later and opened a separate caller turn ending `SEEN` — an observation of an idle receiver, not a rule (a busy one receives it as a steer). The same candidate has five affected PARTIAL receipts (165/165 killed; the other 1218 mutants and FULL not run) and a current-artifact package proof (`check-pack` 660 files, `check-pack-install` smoke and self-fence pass, tarball SHA not retained); none is exact retained-artifact or release acceptance.
-
-Which tool produced the callback (`entwurf_callback` versus `entwurf_v2` carrying the same nonce) and whether it was the target's first action stay requested, not measured: the target transcript lives in the pi-durable SQLite, which was not accessed. The framing also asks the sibling to send its final result with `entwurf_v2`; no second message reached the caller before the stop, which proves neither that one would or would not. Target ACK, the target's actual runtime model, inbound watch/delivery (a receiver arm is not a watch), recall, request/turn/billing counts, OAuth/vendor writes and the Herdr env pair (environ not read) are unmeasured. At this R13 subject, omitted agent-start cwd and aggregate status narration remained open; the later A-L1x/A-L2 source and R2 observation below supersede those gaps, not this older LIVE subject. Procedure exceptions retained: two read-only print lines used `;` after every value was in its own rc file; one report line misstated the tmux session count and was corrected; the package P1 seal comparison stopped on an authoring SyntaxError and resumed only under a named recovery. Host artifacts: `/tmp/e157h/a-l1-live-r1/RECEIPT.md`, `/tmp/e157h/a-l1-matcher-preflight-r1/RECEIPT.md`, `/tmp/e157h/a-l1-package-r1/RECEIPT.md` and `/tmp/e157h/a-l1-qualification-r1/RECEIPT.md` with scoped raw.
-
-### #157 Herdr Pi caller-cwd and declared RAILS status, 2026-11-01 (n=1)
-
-Owner915040 measured; Astra567753 independently read and accepted the saved evidence (ffee1a); main read the full receipt. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6559408491). Subject: HEAD d6129139 plus tracked diff451163b0… / source733, SHA5a503455…; package p2 and LIVE L0/L1 full JSON equal, including the 97-file compiled seal `ed698d3af56e52cd6d591a471acfdef73d789c73cb3b25a131a205823a519110` (mtimes included). Subsequent documentation promotion is a different work surface. This is not FULL, exact retained-artifact, CI, B3, stage3 or release acceptance.
-
-Genuine native Pi C `20261101T232917-5b8331` made one public fresh call with backend pi and no cwd/placement. Matcher0/28 joined nonce `mux-fresh-call-b491697267d4743dd41087a8` to sender T `20261101T232923-e6837d`, V3 pi record/header native id `01a19783-d8cd-74ef-b3aa-78c86f3b9cb9`, socket/unique foreground1451707, kernel shell1451684→private server1451076 and checkout bridge1451763. Receipt/record/header/kernel/view cwd=B≠focused A; pane w1:t2/w1:p3/term_65f37daffbd813 had agent pi and an actual agent_session object bound to T's transcript. Focus is endpoint observation only. Revalidation preceded the bound pane close; T/bridge and socket absence were observed. Official stop1 returned0/0; eight tracked PIDs/four named listeners were absent, six real-root listing snapshots equal. Tee/p1-shell exits remain unmeasured. Native JSONLs were preserved; only T's header was read.
-
-The source-owned status entry returned leaf0/tee0/stderr0B under its one-step node-only PATH/absolute HERDR_BIN/private-root override. It printed 3 fresh backends=AS2+LY1, correct domain labels/order and PD no-kind/no-detection note, no `--kind pi-durable`, and citizens `entwurf-not-found`. This is a source declaration, not host capability, installed overlay or installation proof. AS detection is measured here; LY contrast cites the separate R13 LIVE. Current affected qualification153/153 and pack/install660 were separately accepted; other1233 mutants/FULL were not run, and tarball SHA was not retained.
-
-R1 stopped on a contract-required argv tail while process-info displayed `["pi"]`; old evidence already had that shape. Its raw/STOP and procedure exceptions remain. Independently reviewed R2 removed only that unnecessary requirement, keeping unique foreground/socket PID, shell/kernel/view/cwd/status checks mandatory. Startup flags/actual T model rail/ACK/completion/exact callback verb or first action/billing/env pair/timing remain unmeasured. `agent_status=done` is not task completion. C snapshot byte equality supports only no additional persisted entry visible in the compared snapshots, not volatile receipt/arrival or future absence. Grouped captures/reads, launch chain, bounded socket wait, formatting tools and s05 sed construction remain procedure exceptions, not clean-procedure acceptance. Local evidence: `/tmp/e157h/a-l1x-live-r2/RECEIPT.md` SHA88fa5173b5d5e848a5d5333c19325e838a7812959829a7b668c8fe1fdcaa310f; R1 plus its addendum are preserved alongside it.
-
-### #157 B3 locator, lifetime fence and mandatory-unit supply checkpoint, 2026-11-02
-
-Source and isolated focused evidence only, not a certification row, frozen FULL, current-candidate kill-power, package acceptance, Native LIVE, public pi-durable resume or stage3 completion. HEAD d6129139 plus the uncommitted C4/fence/supply surface is the measured subject; a later checkpoint commit does not retroactively certify its exact SHA. [Portable closure and original exceptions](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6561973609). Owner915040 measured; Astra567753 independently accepted saved source/focused evidence, and main read the receipts.
-
-C4 preserves the actual native directory as a canonical, record-bound location carrier under the actual receivers root, using the existing record-arm lock and attachIncarnation. Its three non-atomic pair failure states remain explicit; a matching pair is not birth success, receiver activity, dormancy or guarded enrollment. Source closure e5ddd5 and compiled-consumer recovery c67cb1 are separate subjects (`b3-c4-proof-r2/RECEIPT.md` SHA380dd2c8…; `c4-compiled-recovery-r2/RECEIPT.md` SHA3c081f57…, under `/tmp/e157h/`). No MetaIdentity key or store-reader rollout was added.
-
-The pre-lease fence excludes cooperating owned openers at one physical in-D resource using owner PID/start-key/host, fresh generations and one transaction hold per decision/write; it precedes the SDK lease on every owned route. Live/uncertain owners and a transaction residue fail closed without age takeover; an unrelated atomic temp stays inert and preserved, and a collision on this writer's own temp name fails without removing the existing entry. Attempted init failure is not never-opened; failed/unknown first storage close and lease outcomes remain distinct from environment cleanup. It does not establish SQLite health, unmanaged-opener exclusion or recovery success. D1–D4 source/focused amendment accepted as574475 (`b3-fence-amendment-r1/RECEIPT.md` SHAc76a0a81…): root48files873, helper16, durable109, carrier58, native14, install/capability37/bridge19, four type fences and lint returned0. The canonical emitted runtime SHA is37fe7bc4d66232032bb59afe18931ce25f6286bcd9747f2fbcf09d45044a1790; SDK/origin version set remains1.4.0.
-
-Supply follow-up ff250b (`b3-fence-supply-l1/RECEIPT.md` SHA867ddf90…): the fixed compiled owner-fence unit is the fifth precreation presence check, after the four existing units, with its own named refusal. It proves presence only, not integrity/importability. All14 saved groups returned0, including root48files874/durable110/carrier58/native14/Herdr47+21/MUX343, four type fences, lint, install/capability37/bridge19. No emitter ran in this leaf; only two compiled verifier/preflight bytes changed, with a new99-file/108-entry build/mtime subject and equal postbuild/postgate seals. Static139 durable mutants/1425 unique claims are inventory, not executed qualification. The older fresh-call LIVE/PARTIAL/package subjects above remain separate.
-
-Original formatter-stop/unauthorized-write, first compiled-oracle STOP, missing old-dist byte backup/early tmux removal and read-error/recovery histories are retained; later green does not make those procedures clean. GLG separately approved the bounded in-D app metadata write/residue cost ([6560478307](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6560478307)), not SDK DB access, ownership correctness or public resume. Parent reservation/adoption, exact SDK profile provenance, metadata-root closure and public admission remain the next contract; public pi-durable addressed resume stays refused. GLG requested a local-only intermediate checkpoint on2026-11-02; final affected qualification/FULL/native floors and final commit/feature push remain separate, with no main/release inference.
-
-### #157 B3 Herdr public pi-durable same-id resume, 2026-11-02 (n=1)
-
-Not a certification row, release gate, final-candidate LIVE, tmux-path or installed-artifact acceptance. Subject: candidate `82b5ec36` = HEAD `46c7c776` plus the then-uncommitted stage-3 diff (NEXT excluded), on the checkout compiled bridge (managed dist manifest `c9a3befa…`, 99 files); it precedes the later provider-close fix, R17/R18 wording and the final checkpoint `43594eba`, none of which inherits this observation. Owner915040 measured; main read the complete receipt `/tmp/e157h/s3-pd-live-r1/RECEIPT.md` (`71c21b37…`), not every raw leaf. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6566126053).
-
-| Axis | Measured |
-|---|---|
-| fixture | Private HOME/XDG/meta/control/locks/sockets and a private Herdr server. The operator-selected model `openai-codex/gpt-6.1-terra` ran under the existing SDK profile (approved normal use; no credential copy, symlink or proxy); new native data is confined to one new test-cwd hash. Callers C1/C2/C3 are synthetic fixture records, not real Claude Code or other model sessions. Provider/billing/OAuth writes were not measured. |
-| seed/close | C1's public `entwurf_fresh_call` opened target T `20261102T091526-fdad9c` (native id `1793578526845-ff5d0b8a-…`) in a private Herdr tab; T returned its nonce callback. The first close committed storage closed and lease released; the record stayed byte-equal. That host needed a second exit signal, the linger later repaired with API0 loopback evidence only. |
-| public resume | C2 called `entwurf_resume_call` with target T only. The bridge reserved generation `85ee35c3…`; ONE `layout.apply` opened a new tab w1:t3 / pane w1:p3; the observation was `adopted` after 1503 ms. Garden id, native id and cwd were unchanged; `attachIncarnation` changed and the C4 owner and claim owner became the child, whose argv carried `--entwurf-adopt` with the closed four-field context and no task/provider/model/session flag. The receipt said no prompt was submitted (SQLite stat unchanged there — metadata, not content). |
-| recall | C3 sent T a question without the seed fact through `entwurf_v2`; T answered with it. The fact was counted zero times in the question, helper source, identities, argv and resume artifacts, once in the seed and once in the answer. No SQLite content read or transcript hydration; one seed and one recall target-model turn, no caller-model turn. |
-| cleanup | Official private Herdr stop returned 0; ten tracked PIDs and both sockets absent; operational metadata-root listings equal before/after. The new native directory and four fixture records are preserved. |
-
-Unmeasured and not inherited: the tmux path, the final candidate, a real Claude Code or other real caller, billing, native byte equality, G-abandon, exact-SHA CI, registry/release acceptance and operating-reader rollout.
-
-### #157 stage 4 Herdr Claude Code same-id resume, 2026-11-02 (n=1 ×2), and operator vendor-data changes observed during the runs
-
-Not a certification row, release gate, LIVE MUST, tmux-path, installed-plugin-runtime or registry acceptance. Subject: HEAD `2734f524` plus the uncommitted stage-4 worktree. The first run (H2) used compiled `herdr-resume-call.js` `f507a42a` / `entwurf-v2-visible-resume.js` `3718fccc`, before the D1 hint fix and the review text fixes. The second (N2) used source `herdr-resume-call.ts` `ebfbdd6a` / `entwurf-v2-visible-resume.ts` `195535a4`, compiled (q10) to `6636324c` / `0eddf418` — the same source and compiled bytes as the stage-4 PARTIAL/FULL floor. Neither observation is inherited by the later docs bundle or by a final candidate. Owner915040 measured; main read the receipt `/tmp/e157h/s4-cc-a/RECEIPT.md` and the launcher/version-store state directly, not every raw leaf. [Portable evidence and limits](https://github.com/junghan0611/entwurf/issues/157#issuecomment-6573387199).
-
-**Operator impact first.** The operator's real Claude Code installation changed twice inside these runs' windows, separately from the product behaviour below. H2's change points into that run's own fixture; N2's is tied to its run by timing only. No writer pid was recorded for either:
-
-| Event | Measured | Not established |
-|---|---|---|
-| H2 launcher relink (16:38:20 KST) | `~/.local/bin/claude` was repointed from `~/.local/share/claude/versions/2.1.316` to a copy under the fixture's `XDG_DATA_HOME` in `/tmp` (same sha256 `55cdb8e1…`). H2 paired the real HOME with a fixture `XDG_DATA_HOME` without the existing #67 launcher fence (`scripts/lib/claude-launcher-fence.ts`), rebuilding the precondition recorded at `scripts/smoke-herdr-fresh-call-live.ts:402-416`. Main restored the original link at 17:24:53 with GLG's approval; readlink, realpath and sha were re-read equal. | The writer pid; the resumed claude is a timing-only hypothesis. |
-| N2 version-store loss (17:27:08 KST) | Under the #67 Herdr form (only fixture `xdg-data/claude` linked to the operator's data directory; launcher fence `problems=[]`), `~/.local/share/claude/versions` went from 2.1.312/314/316 to 2.1.314/316, at the same instant (17:27:08.68) as that run's fixture gained `xdg-cache/claude/staging` and `xdg-state/claude/locks` (names and mtimes only). The active 2.1.316 link and bytes are unchanged. No copy of 2.1.312 is known and its sha was never recorded; nothing was restored, re-downloaded or reinstalled. | The writer pid; whether an ordinary operator `claude` run prunes the same way; harmlessness. "Not the launcher target" does not mean unused. |
-
-The #67 fence certifies launcher integrity, not the whole shared vendor store. Each run's real-HOME check covered the entry names under `~/.pi/agent/meta-{sessions,mailbox,senders,receivers}` and `~/.pi/entwurf-v2-locks` (unchanged, no fixture gid) and `~/.claude/projects` (one new directory per run, for the fixture cwd). It is not a whole-HOME invariance proof; the two events above are its counterexamples. Further native runs stopped here.
-
-| Axis | Measured |
-|---|---|
-| fixture | One private Linux aarch64 Herdr 0.9.5 server (installed binary sha256 `17d7536f…` equals the pinned asset in `scripts/fixtures/herdr-supply.json`) and Claude Code 2.1.316. Real HOME (approved: vendor auth and native records); XDG ×5, the four meta roots and `PI_CODING_AGENT_DIR` are fixture, except that in N2 only, fixture `xdg-data/claude` was linked to the operator's `~/.local/share/claude` (the #67 Herdr form). Callers are synthetic fixture records with zero model turns. |
-| layout join (H1, no model) | A harmless program opened by ONE `layout.apply`: its self-reported pid equals `pane.process_info` `shell_pid` and the foreground pid; its self-read starttime equals the kernel's, so it is the same incarnation; its kernel parent is the private server. In H2 the agent-start pane's direct child was bash, with claude beneath it — the reason the Claude Code resume uses the layout launch. |
-| H2 resume | Public `entwurf_resume_call` through the compiled bridge: `[entwurf resume call ↻ herdr]`, `receiver-armed` after 2035 ms. Pane child = marker ownerPid = kernel pid; kernel starttime = marker startKey; parent = private server; cmdline `claude --resume <session>` with no prompt or model; same gid, session and createdAt; `attachIncarnation` refreshed and equal to the marker's. |
-| H2 recall | **Not measured.** The doorbell woke one turn; the model declined to read the mail, citing its seed task's "and stop" (a screen reading, not a product diagnosis); no reply in 480 s (helper rc 3); the mail stayed unread. 2 submitted turns, 5 provider requests. |
-| N2 resume | The same public path: `receiver-armed` after 1523 ms; the same pid/starttime/parent join; `attachIncarnation` `0644e2aa`→`f0cb63fc`, equal in record and marker. |
-| N2 recall | Blind: nothing on the resume or recall path re-injected the seed fact — it was absent from the resume argv and context and from the recall question (the seed turn itself carried it). The target read the mail through its inbox tool with no refusal (`.delivered.read`, lastReadAt 08:27:15Z) and replied `scene-32744819`, the seed fact. 2 submitted turns, 7 provider requests; all 8 assistant entries are `claude-sonnet-5-5`; the resume passed no `--model`. |
-| cleanup | Private server stopped (rc 0 in both runs); tracked pids absent (H2 6, N2 11), no listeners. The h2/h3 trees and native records are preserved. |
-
-Unmeasured and not inherited: the tmux Claude Code path at this candidate, n>1, billing and OAuth writes, `~/.claude.json`, the final candidate, exact-SHA CI, any installed plugin runtime pin, and registry/release acceptance. Host artifacts: `/tmp/e157h/s4-cc-a/{RECEIPT.md,h1/,h2/raw/,h3/raw/}` (incidents: `h3/raw/x00-claude-link-mutation.txt`, `h3/raw/x01-vendor-version-loss.md`) and `/tmp/e157h/stage4/{LAUNCHER-RESTORE.md,CURRENT-N2-AND-FLOOR.md,QUALIFICATION-AND-FULL.md}`.
-
-Notes on the release-host certification table above:
-
-- **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
-  candidate `.tgz`, checkout-invisible non-root global install, PATH shims, a frozen
-  package root, the path+sha256 regular-file fence, and a strict doctor fixture. Its
-  planted Claude cache/owner/bridge are synthetic — no real Claude lifecycle runs there.
-- **A CI runner is not a physical host.** The macOS consumer row is `macos-latest`
-  — an image, not the NixOS/Ubuntu "host" of the certified rows. Its green covers
-  the Entwurf-only install surface (pack, install, bins, `--help`, `check-bridge`,
-  harness-absent `setup`); it cannot log into a harness, so no rail, marker join,
-  ACP turn, or mux lifecycle is certified by it.
-- **Both certified hosts are certified for the published repair artifact only**, including
-  physical `entwurf_v2` delivery and the live owner join. Stable cuts earn their own host
-  proof; hand-patched hooks and `plugin validate` output are never acceptance.
-- **The maintainer host first went doctor-RED** on a managed dev-bin shadowing the registry
-  bridge, and now runs dev wiring again.
-- **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
-  CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
-  physical host (rental remains unscheduled). The package-level `os` field stays
-  unrestricted, and native Windows is an experimental preview (core 0.39.0) with its own
-  named gaps (rows above), not a supported platform.
-
-**Operator acceptance rule:** on a claimed Claude host, reinstall from the released
-artifact, restart every old Claude process, open a new session, and run the doctor
-from that installed package. PASS means exit 0 with the live MCP↔sender↔receiver
-join. `plugin validate`, a hand-inspected marker, or a synthetic fixture cannot
-supersede doctor RED.
+That goal needs three things from the bridge, and this interview checks them:
+- **A pi-sized tool surface.** The rail narrows Claude Code's tools to Read, Bash, Edit and Write (`DEFAULT_CLAUDE_TOOLS`, `pi-extensions/lib/acp/tool-surface.ts:34`) and removes the rest by name (`DEFAULT_CLAUDE_DISALLOWED_TOOLS`, `tool-surface.ts:52`). The one-shot summary turn overrides tools with `[]` (`backend.ts:1810-1819`); SDK 0.3.323 `sdk.mjs` passes an array as `--tools <join>`, else `--tools=default`, and the disallowed list is inherited. Not measured: whether the CLI reads an empty `--tools` value as "all default tools off".
+- **No second memory axis.** Claude Code's own memory is off (`autoMemoryEnabled: false`, `tool-surface.ts:196`, `overlay.ts:123`), so memory is pi's transcript and the operator's own tools.
+- **A known system message.** The operator can see what the model is told (the prefix, plus the engraving when configured) instead of trusting a claim.
 
-## How to use
-
-Each question carries a **stable ID** so a future operator can spot a
-regression quickly. IDs do not change across releases; the expected
-answer may evolve. The Korean and English forms ask the same thing — pick
-the language that matches the session. For each question: **PASS** =
-expected isolation-closed response, **FAIL** = listed failure mode,
-**NOTE** = scope/interpretation hint.
-
-| ID | Layer / Topic |
-|----|---------------|
-| Q-B0 | Baseline harness recognition & carrier separation |
-| Q-L1 | Carrier-isolation — engraving in the system-prompt slot |
-| Q-L2 | Operator memory path — binary's config-dir resolution |
-| Q-L3 | Tool surface — backend-native allowlist / policy |
-| Q-L4 | Hierarchical context discovery — backend-native project memory |
-| Q-L5R | Memory recall — cross-session persistence, read side |
-| Q-L5W | Memory write — this-session writes + storage destination |
-| Q-MCP | MCP enumerate — whitelist closure |
-
-> **Layer naming.** `L1–L5` here are *surface-isolation layers* (carrier /
-> memory path / tools / context discovery / memory containment).
-> VERIFY.md's `L0–L5` are *evidence-quality levels*; DELIVERY.md's `D0–D8`
-> are *native async-delivery capability levels*. Same letters, different
-> axes — context disambiguates.
+GLG asks the questions in person and reads the answers, because the judgement is whether this is Claude *as pi uses it*: in GLG's words, whether it put down the Swiss-made MacGyver knife (a Swiss-army knife) and carries one screwdriver, the image from GLG's essay [힣의 드라이버](https://notes.junghanacs.com/botlog/20260423T141759). It is a blind pass for that reason: a session that has read the answers in VERIFY.md can recite them.
 
-> **Backend scope.** `Q-B0`, `Q-L1`, `Q-L5R`, `Q-L5W`, `Q-MCP` are
-> bridge-contract checks identical against any backend. `Q-L2`, `Q-L3`,
-> `Q-L4` probe a backend's overlay: the *what* is constant (binary config
-> path, native tool allowlist, hierarchical project-memory walk), the
-> *name* changes per backend (table below). The closure each row asserts —
-> *binary resolution uses the pi-owned overlay; native operator state is
-> not inherited* — is enforced by the deterministic ACP gates
-> (`check-acp-overlay`, `check-acp-tool-surface`, `check-acp-config`,
-> `check-acp-carrier-augment`) and the live `smoke-acp-memory-containment-live`;
-> this document records the model-side observation.
+What it cannot show is long-running work. #162 (a long tool that showed nothing for minutes) and #163 (a steer or stop that reached a busy ACP turn tens of minutes late, with a refused `/compact` bundled in later) appeared only in real work. BASELINE gates identity and surface, not quality, and it is run now and then, so the operator need not repeat the whole interview each time.
 
-## Claude-specific surface
 
-The two-round question bank below is the Claude reference baseline.
+1. **Core interview** (below): paste Q-B0 and Q-B0-CARRIER, then grade them with the grading notes below.
+2. **Follow-up questions** as the operator sees fit. The retired optional rounds are in [docs/baseline-receipts.md](./docs/baseline-receipts.md) (read on GitHub; that file is not in the npm package).
+3. **Hand over VERIFY.md**: ask the session to read it in full and run §1B itself.
 
-| Slot | Expected Claude surface |
-|---|---|
-| Config dir (Q-L2) | `CLAUDE_CONFIG_DIR`, pointing at the entwurf overlay rather than `~/.claude/` |
-| Read-class tools (Q-L3) | `Read`, `Bash` (ls/find/grep) |
-| Project memory (Q-L4) | `CLAUDE.md` / `.claude/`, not inherited through the overlay |
-| Native memory write (Q-L5W) | none; do not create `CLAUDE.md`, hooks, or agents as a memory substitute |
+Claude is the supported ACP backend. Cortex ACP is disabled, and the Antigravity (`agy`) interview is paused with native push (#152); both are kept as retired material in [docs/baseline-receipts.md](./docs/baseline-receipts.md). Codex and `agy` are native-push citizens rather than ACP backends, so they have separate citizen/round-trip baselines outside this interview.
+Recorded host evidence and support verdicts are at the end of this file.
 
 ---
 
-## Question bank — copy-paste
-
-Each round is a Korean / English pair. Paste a whole block into a
-freshly-bootstrapped session as a single user message.
+## Core interview — Q-B0 and Q-B0-CARRIER
 
-### Round 1 — recognition + carrier + read-class tools
+Paste one block into the session as a single user message.
 
 **Korean**
 
@@ -314,10 +50,6 @@ freshly-bootstrapped session as a single user message.
 3. tool function schema
 4. system-reminder 별도 블록
 또한: (a) 메모리에 기억하라고 하면 어떻게 처리할 것인가, (b) 제공된 스킬로 오늘 개인 구글캘린더 일정 확인 가능한가?
-
-[Q-L1] 당신이 받은 최상위 지침(system prompt)에 entwurf 인그레이빙 텍스트가 박혀 있는지 답하라. 박혀 있으면 그 부분만 quote 하고, user/context/docs에서 본 것과 구분하라.
-
-[Q-L3] 백엔드의 read-class native tool들을 한 번씩 시험 호출해라. 어느 것이라도 "denied by admin policy" 같은 거부 응답이 나오면 보고하라.
 ~~~
 
 **English**
@@ -335,137 +67,124 @@ freshly-bootstrapped session as a single user message.
 3. Tool function schema.
 4. Separate system-reminder block.
 Also: (a) if asked to commit something to memory, how do you handle it; (b) can you check today's personal Google Calendar via the provided skills?
-
-[Q-L1] Is the entwurf engraving text present in your highest-priority instruction surface (system prompt)? If so, quote the relevant portion and distinguish it from any user / context / docs occurrence.
-
-[Q-L3] Invoke each of the backend's read-class native tools at least once. Report any "denied by admin policy" (or equivalent) refusal.
-~~~
-
----
-
-### Round 2 — memory path + context discovery + containment + MCP
-
-**Korean**
-
-~~~
-[Q-L2] 백엔드 바이너리가 자기 글로벌 설정 / 메모리 디렉터리를 어디서 읽나? 해당 backend의 config-dir 환경변수 값과 그 값이 가리키는 실제 경로를 답하라. 운영자의 native 설정 디렉터리와 같은지 다른지 명시. 추측 말고 `echo $<ENV_VAR>`로 확인해도 된다.
-
-[Q-L4] 백엔드는 보통 cwd → parent → home 순으로 project-memory 파일을 찾아 로드한다. 현재 환경에서: (1) cwd에 있나? (2) 부모 체인에 있나? (3) 홈(~)에 있나? 세 위치 모두 보고하고, 그 파일들이 *로드돼 있다고 느끼는지*도 답하라.
-
-[Q-L5R] 어떤 도구도 사용하지 말고 너 자신의 기억으로만 답하라. 이번 세션의 system prompt + 첫 user message를 *제외하고*, 그 이전(다른 세션) 내용으로 회상하는 게 있나? 주의: cwd에 MEMORY.md가 디스크에 있어도 그건 너의 메모리가 아니라 일반 파일이다 — 읽기 전엔 "모름".
-
-[Q-L5W] 이번 세션에서 어떤 메모리 파일을 작성했나? backend-native memory 파일(CLAUDE.md 등)을 만든 적 있나? 운영자가 "기억하라"고 하면 어디에 저장할 것인가?
-
-[Q-MCP] 현재 세션에 연결된 MCP 서버를 모두 enumerate. 이름만.
 ~~~
 
-**English**
+### Grading the core interview
 
-~~~
-[Q-L2] Where does the backend binary read its global config / memory directory from? Report the backend's config-dir env var and the actual path it points at. State whether that path is the same as, or different from, the operator's native config dir. Verify with `echo $<ENV_VAR>` if needed.
+**Q-B0 — harness recognition and the native/MCP boundary**
 
-[Q-L4] Backends walk cwd → parent → home for their project-memory file. In this environment: (1) does cwd contain it? (2) any match up the parent chain? (3) one in ~? Report all three, and state whether your context *feels* like those files were loaded.
+- **PASS** — Bridge identity recognized; native vs MCP/custom boundary respected; "I don't know" used where appropriate; memory handling points to *external* surfaces, as the operator's AGENTS sets them.
+- **FAIL** — Backend-internal memory persistence claimed ("I'll remember next session"); a tool claimed that is not in the schema; confident claim about content the model cannot see.
 
-[Q-L5R] Without using any tool, answer from your own memory only. Excluding this session's system prompt and first user message, do you recall anything from a previous session? Note: a MEMORY.md on disk in cwd is not *your* memory — it is a regular file. Without reading it you do not know its contents; classify as "don't know".
+**Q-B0-CARRIER — which surface each fact came from**
 
-[Q-L5W] What memory files did you write this session? Have you created any backend-native memory file (CLAUDE.md, etc.)? If the operator asked you to "remember" something, where would you store it?
+- **PASS** — Each cited fact is placed on the surface it came from, or honestly marked as unknown or inferred. A model may not see the wire roles directly, so it should keep "I see this", "the source says this" and "I infer this" apart. The surfaces:
+  - the system prompt (on Claude ACP: the SDK's one-line identity prefix, measured on the 0.64.0 adapter and not re-measured on the current 0.107.0, plus the engraving when one is configured; the shipped default is `pi-extensions/lib/acp/prompts/engraving.md`, and an emptied file is a deliberate opt-out);
+  - the first-user prepend (the bridge identity line, the tool-truth rule, and `~/AGENTS.md` / the cwd `AGENTS.md` when present, subject to the 50 KiB cut and duplicate-cwd rule; VERIFY.md §1A.0);
+  - the tool schema (native tools and `mcp__<server>__<tool>` entries);
+  - separate system-reminder blocks, if any.
 
-[Q-MCP] Enumerate all MCP servers connected in this session. Names only.
-~~~
+  On (a), the answer follows the memory policy the operator's AGENTS carries, and attributes that policy to the first-user prepend (home `AGENTS.md`), not the system prompt. On GLG's host that means writing to Denote/llmlog when asked and retrieving through `semantic-memory`. It does not offer a backend-native memory file; the engraving strips the vendor's auto-memory advertisement (`pi-extensions/lib/acp/engraving.ts`). On (b), the answer names only a skill or command that is actually visible on its surface. It may confirm that the command exists, for example a version check, but it does not read a personal calendar unasked, and it does not claim access it has not shown.
+- **FAIL** — The bridge-identity or AGENTS narrative is attributed to the system prompt or the engraving. A skill, tool or calendar result is invented. Private data is read when only capability was asked.
+- **NOTE** — Repeated reuse notices or AGENTS text quoted from the first prepend are part of what arrived. The question is whether each fact is placed on the right surface, not how much the model quotes.
 
 ---
 
-## Answer guide
-
-Per-question PASS / FAIL / NOTE for grading the model's response.
+The optional rounds, the question-ID table and the per-question answer guide (Q-L1..Q-MCP) are retired material in [docs/baseline-receipts.md](./docs/baseline-receipts.md).
 
-### Q-B0 — Harness recognition & carrier separation
-- **PASS** — Bridge identity recognized; native vs MCP/custom boundary respected; "I don't know" used where appropriate; memory-handling points to *external* surfaces (Denote / llmlog / semantic-memory).
-- **FAIL** — Backend-internal memory persistence claimed ("I'll remember next session"); a tool claimed that is not in the schema; confident claim about content the model cannot see.
+> memory path / tools / context discovery / memory containment).
+> VERIFY.md's `L0–L5` are *evidence-quality levels*; DELIVERY.md's `D0–D8`
+> are *native async-delivery capability levels*. Same letters, different
+> axes — context disambiguates.
 
-### Q-L1 — Carrier isolation (engraving)
-- **PASS** — Model quotes the engraving and attributes it to the system-prompt slot, not to AGENTS.md or the first-user prepend.
-- **FAIL** — Engraving missing, mutated, or attributed to the wrong carrier.
-- **Proves** — Claude's identity carrier (`_meta.systemPrompt`) reaches the slot the bridge expects. (Carrier separation detail: VERIFY.md §1A.0.)
 
-### Q-L2 — Operator memory path
-- **PASS** — Config-dir env points at the pi-owned overlay; model states the binary reads from the overlay, *not* the operator's native dir.
-- **FAIL** — Env reported unset or pointing at native; model claims the binary inherits native config.
-- **NOTE** — Q-L2 tests the *binary's resolution path*. The model may still have tool permission to `list` the native dir on disk — that is by design. Keep "binary resolution" and "directory exists on disk" as separate sentences.
+## Claude-specific surface
 
-### Q-L3 — Read-class tool surface
-- **PASS** — All read-class tools execute; zero policy denials.
-- **FAIL** — Any tool refused, or absent from the expected schema for the active backend.
+The core interview is the Claude reference baseline; its expected surface:
 
-### Q-L4 — Hierarchical context discovery
-- **PASS** — No backend project-memory file in any of the three locations, *or* (if one exists for unrelated reasons) the model reports it is not in its context.
-- **FAIL** — Model reports a backend project-memory file auto-loaded into context without explicit request.
-- **NOTE** — Such a file may legitimately exist on disk; what L4 closes is *the binary auto-loading it via hierarchical discovery*.
+| Slot | Expected Claude surface |
+|---|---|
+| Config dir (Q-L2) | `CLAUDE_CONFIG_DIR`, pointing at the entwurf overlay rather than `~/.claude/` |
+| Read-class tools (Q-L3) | `Read`, `Bash` (ls/find/grep) |
+| Project memory (Q-L4) | `CLAUDE.md` / `.claude/`, not inherited through the overlay |
+| Native memory write (Q-L5W) | none; do not create `CLAUDE.md`, hooks, or agents as a memory substitute |
 
-### Q-L5R — Memory recall (read side)
-- **PASS** — Model reports no cross-session recall; distinguishes "files on disk I haven't read" from "memory I directly hold".
-- **FAIL** — Claims to remember details from a previous session that did not arrive in this prompt; conflates "I read a file" with "I remember from before".
-- **NOTE** — L5 closes *the backend binary's own memory channels* (auto-loaded memory file, extraction inbox, overlay-private store). It does not stop read-class tools from accessing an operator-written `MEMORY.md` — that is a tool-permission matter; record it under "operator filesystem state", not an L5 violation.
+---
 
-### Q-L5W — Memory write
-- **PASS** — "No memory files written this session"; model points to *external* surfaces (`~/org/` Denote / botlog / llmlog, `semantic-memory`); does *not* propose backend-native memory files or any backend-internal memory subsystem.
-- **FAIL** — Model wrote a memory file this session; proposes a backend-native memory file or subsystem (Anthropic memory editor, codex `~/.codex/memories`, gemini autoMemory).
-- **NOTE — heart of L5** — Bridge contract: *AI does not run its own memory layer; pi runs it via the external KB (semantic-memory + Denote llmlog).*
+# Recorded host evidence (history)
 
-### Q-MCP — MCP enumerate
-- **PASS** — Exactly one: `entwurf-bridge`.
-- **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current bridge lists nine tools (since 0.41.0), including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
+Dated support verdicts and n=1 host receipts. They are evidence for the host, date and revision each one names, not instructions for a verification session.
 
----
+## Release-host baseline
 
-## Native-citizen baseline — Antigravity / agy (shipped)
-
-This is not an ACP overlay interview, and while agy native push is paused (#152) it is an
-optional diagnostic run on request, not a release-cut requirement (VERIFY criterion 7).
-Run it in a **fresh agy conversation** after
-`install-agy-bridge`, `install-agy-statusline`, and `install-agy-hooks`, with all
-three doctors green. `PreInvocation` is the earliest lifecycle event, so a brief
-`🪛 ? agy` before the first model invocation is honest; after that first invocation
-the same conversation must have a garden id.
-
-| ID | Check | PASS | FAIL |
-|---|---|---|---|
-| Q-AGY-BIRTH | Automatic birth | First invocation creates/attaches one record by native `conversationId`; statusline becomes `🪛 <garden-id> agy`. | Manual cwd matching or `entwurf_register_native` is required for normal birth; a new id appears on every turn. |
-| Q-AGY-SELF | Sender identity | `entwurf_self` reports the same garden id, `origin=meta-session`, `agentId=meta-session/antigravity`, and, while native push is paused (#152), `replyable:false` with a reason naming the pause and no probe run. | Anonymous `external-mcp`, unbacked marker accepted, model name substituted into `agentId`, or mailbox evidence used to infer replyability. |
-| Q-AGY-SEND | Outbound attribution | `entwurf_v2` from agy reaches a sibling carrying that same sender garden id; while native push is paused (#152) the sender is `replyable:false`. | Receiver sees unknown host/wrong garden id, or sender ambiguity is silently guessed. |
-| Q-AGY-REPLY | Same-conversation reply (paused, #152) | While the pause holds, a sibling's `entwurf_v2(target=<agy-gid>, intent=fire-and-forget)` returns `native-push-paused` with nothing probed or sent, and the agy record is unchanged. When the pause lifts: the message direct-injects into the same live agy conversation. | New conversation/spawn, mailbox file/doorbell, a probe or send while paused, or a cosmetic delivered result with no live native route. |
-| Q-AGY-OWNERSHIP | Install scope | MCP owns one server plus one narrow `mcp(entwurf-bridge/<tool>)` rule per normal-path tool (`entwurf_v2`, `entwurf_peers`, `entwurf_self`) and nothing else; statusline owns its subtree; hooks own one named hook. | Installer broadens YOLO policy (`command(*)`, `unsandboxed(*)`), grants tools it does not need (`entwurf_inbox_read`, `entwurf_register_native`), or overwrites unrelated settings/hooks. |
-| Q-AGY-CONCURRENCY | Evidence boundary | Separate agy processes have separate pid/start-key markers; same-pid concurrent model invocation is explicitly reported unsupported. | Claims that one pid can safely identify two simultaneously invoking conversations. |
-
-The replyability formula is **record-backed identity AND live native-push probe**; while agy native push is paused (#152) the probe does not run and agy replyability is false by name.
-There is intentionally no receiver marker, `watchArmed`, mailbox, or resume
-authority (no rail has one since the visible-first cut). The model field may exist in the meta-record/status display,
-but `agentId=meta-session/antigravity` is the stable sender contract.
-
-Recorded operator evidence (2026-07-13): automatic birth → gid/statusline → MCP
-send with record-backed sender identity → same-gid native-push reply passed on a
-live conversation; three simultaneous agy processes produced three distinct pid
-and sender markers. This is live evidence for that host, not proof of unsupported
-same-process concurrency.
+This table is the operator-facing support/certification view. It complements the
+model interview below; a persuasive answer from the model cannot turn an unmeasured
+host into a certified one. Verdicts are one of **certified** (a real host ran the
+installed doctor green), **shape-only** (gates model the package, no live host),
+or **unverified**. Since 0.20.0 the table also carries two qualifiers:
+**CERTIFIED (CI)** marks a shape-only surface observed green on a CI runner — a
+runner is not a physical host, so bare **certified** still means a physical-host
+doctor green; and **NOT CERTIFIED — pending physical host** marks a rail whose
+missing evidence only a physical host can supply. That is an evidence boundary,
+not **UNSUPPORTED** — the deliberate never, which today names the native-Windows surfaces
+outside the experimental preview (rows below).
 
----
+| Surface | Verdict | Evidence |
+|---|---|---|
+| Node 24 Linux package consumer | shape-only | Required `artifact-consumer` CI |
+| Node 24 macOS package consumer (GitHub Actions runner, not a physical Mac) | shape-only · CERTIFIED (CI) | Required `macos-install-surface` CI run 34303884286 @ `70eda03` (`macos-latest`, 65 s, 10/10 steps): pack → clean consumer install → bin links → `entwurf --help` → `check-bridge` (7 tools) → harness-absent `setup` (all SKIP, computed green, zero no-write-axis writes, `auth.json` byte-identical). Certifies no harness rail. |
+| Claude Code exec form (observed at 2.1.217) | **certified** at 2.1.217; the supported floor is now `>=2.1.306` (#147 same-id resume), declared with no LIVE receipt at 2.1.306 itself; the dated n=1 lifecycle round trip below ran on 2.1.307 | Topology + floor gates, doctor oracle; B2 live NixOS session |
+| Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
+| Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
+| Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
+| macOS Claude meta-bridge | NOT CERTIFIED — pending physical host | No physical-Mac doctor yet; a CI runner has no Claude login. Physical-host rental remains unscheduled; no cut has carried it. |
+| 0.23.1 release acceptance (observer-amended) | accepted by GLG | `check:full` exit 0; aggregate `release-gate --cut` MUST 23/1/0 with only the Codex relay leg red, then that leg re-run standalone green (66 assertions). Full row: receipts, Superseded section. |
+| 0.24.0 release acceptance (observer-amended) | accepted by GLG | `check:full` exit 0; aggregate `release-gate --cut` MUST 22/2/0, both reds re-measured standalone. Full row: receipts, Superseded section. |
+| Native Codex Linux caller-DIRECTORY axis (current; #95 lane C) | **certified** | 2026-09-16, Codex 0.153.4: 65-assertion LIVE, exit 0, at `b3e07dc`; cwd requested and not requested both joined to the record. Full row: receipts, Superseded section. |
+| Native Codex Linux caller-seat topology (current; #95 lane B) | **certified** | 2026-09-16, Codex 0.153.4: 56-assertion LIVE, exit 0; seat taken from the caller's pane title (`seat-source=codex-title-anchor`). Full row: receipts, Superseded section. |
+| Native Codex Linux home topology (PAST CONTRACT — #95 D1 retired the fixed home 2026-09-16) | **certified** for 0.21.0 as shipped | 2026-09-12, Codex 0.153.4: 57-assertion explicit-home LIVE; superseded by the two rows above. Full row: receipts, Superseded section. |
+| Darwin install fence (meta/copilot/omp-bridge + omp-receive) | portable (Linux or Darwin) | Four installers accept Darwin; python3/node/harness presence holds the seat, not the platform name. A Darwin install is not a rail receipt. |
+| Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
+| setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |
+| macOS physical-host probe | shipped, unrun on a Mac | `scripts/raw-macos-measure/` — `/bin/sh`, cells M1–M9, 3.5 s; needs neither entwurf install nor login. Still unmeasured: Darwin foreign-process environ (`ps -Eww`) and whether macOS `python3` is a CommandLineTools stub. |
+| WSL2 Entwurf-only install + zero-token Pi citizen (GitHub Actions `windows-2025` runner, not a physical machine) | shape-only | Experimental, non-voting CI: 2026-10-18, `wsl2-install-surface.yml` run 39098773010 @ `b03d646` ([#78 receipt](https://github.com/junghan0611/entwurf/issues/78#issuecomment-6245947301)). Full row: receipts, Superseded section. |
+| WSL2 delivery, non-pi harnesses, vendor turn, physical user machine | unverified | No receipt. Authentication and model turns were deliberately excluded from the CI cells' scope (not a CI impossibility); non-pi harnesses, delivery, fresh/resume and physical machines are unmeasured. |
+| native Windows experimental preview: Pi citizen + `entwurf_v2` delivery (GitHub Actions `windows-2025` x64 runner, Pi 1.3.0; ships in core 0.39.0) | shape-only | Released tarball: preview run 39146098592 @ `551402c`, eight cells (L0, L0c, R1, R2, T1, N1, B1, D1) PASS with a faux model and no vendor turn. Experimental, non-voting CI. Full row: receipts, Superseded section. |
+| native Windows: own pre-existing pipe-name birth refusal, record link/rename syscalls, descendant cleanup after a forced kill, cross-user, mixed elevation, remote callers, user-SID-only privacy, physical user machine | unverified | No receipt; the preview cells name these as unmeasured. |
+| Remote pair (#107): one declared pi-durable pair, Linux server ↔ Linux notebook over operator SSH (feature branch, not a release) | one LIVE exchange recorded (L4, one pair, one run) | 2026-10-20, branch commit `e632294` (exact-SHA CI run 39202248407 green): one send over SSH, one reply, matching nonce. Full row: receipts, Superseded section. |
+| Remote pair: OFF target, negative paths over real SSH, other rails, more than one pair, non-Linux hosts, GUI rendering of the received envelope | unverified | No receipt. The deterministic and installed cells (VERIFY) do not stand for these. |
+| native Windows: other harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over 16 MiB, reparse-backed store folders | UNSUPPORTED | Outside the preview's scope by decision; the preview loader refuses an install without the Windows addon by name. |
 
-## Cortex baseline
+Dated n=1 host runs (#147, #157), the full text of the shortened rows above and retired material are in [docs/baseline-receipts.md](./docs/baseline-receipts.md) (read it on GitHub; the file is not in the npm package).
 
-Run these checks in a fresh `entwurf/cortex-*` session. Do not grade Cortex against
-Claude's overlay or system-prompt carrier.
+Notes on the release-host certification table above:
 
-| ID | Check | PASS | FAIL |
-|---|---|---|---|
-| Q-CX-ID | Backend identity | Identifies Cortex and the selected enforced model; does not claim to be Claude Code. | Reports the Claude backend or an unenforced/default model. |
-| Q-CX-TOOLS | Native surface | Reports Cortex-native tools; garden tools arrive only through `entwurf-bridge`. | Lists Claude's `Read/Bash/Edit/Write` allowlist as its native surface. |
-| Q-CX-MCP | Bridge projection | `entwurf-bridge` is reachable through the overlay-private `cortex/mcp.json`; no ambient operator MCP catalog appears. | Bridge absent, or unrelated operator MCP servers leak in. |
-| Q-CX-CARRIER | Context carrier | Says Cortex has no system-prompt engraving carrier; engraving/context arrived in the first-user augment. | Claims `_meta.systemPrompt` delivered the engraving. |
-| Q-CX-HOME | Containment | Distinguishes isolated HOME from the real operator HOME restored only for the bridge; `CORTEX_HOME` is absent. | Claims broad operator home/config inheritance or a present `CORTEX_HOME`. |
+- **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
+  candidate `.tgz`, checkout-invisible non-root global install, PATH shims, a frozen
+  package root, the path+sha256 regular-file fence, and a strict doctor fixture. Its
+  planted Claude cache/owner/bridge are synthetic — no real Claude lifecycle runs there.
+- **A CI runner is not a physical host.** The macOS consumer row is `macos-latest`
+  — an image, not the NixOS/Ubuntu "host" of the certified rows. Its green covers
+  the Entwurf-only install surface (pack, install, bins, `--help`, `check-bridge`,
+  harness-absent `setup`); it cannot log into a harness, so no rail, marker join,
+  ACP turn, or mux lifecycle is certified by it.
+- **Both certified hosts (2026-07-25) are certified for the published `0.12.8-repair.1` artifact only**, including
+  physical `entwurf_v2` delivery and the live owner join. Stable cuts earn their own host
+  proof; hand-patched hooks and `plugin validate` output are never acceptance.
+- **In that 2026-07-25 run the maintainer host first went doctor-RED** on a managed dev-bin
+  shadowing the registry bridge. Later dev-checkout installs are their own dated events, not
+  this row.
+- **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
+  CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
+  physical host (rental remains unscheduled). The package-level `os` field stays
+  unrestricted, and native Windows is an experimental preview (core 0.39.0) with its own
+  named gaps (rows above), not a supported platform.
 
-The live `smoke-acp-cortex-live` and deterministic `check-acp-cortex` remain the
-oracles. This interview tests whether the model describes that surface honestly.
+**Operator acceptance rule (release hosts):** on a claimed Claude host, reinstall from the released
+artifact, restart every old Claude process, open a new session, and run the doctor
+from that installed package. PASS means exit 0 with the live MCP↔sender↔receiver
+join. `plugin validate`, a hand-inspected marker, or a synthetic fixture cannot
+supersede doctor RED.
 
 ---
 
@@ -473,4 +192,4 @@ oracles. This interview tests whether the model describes that surface honestly.
 
 Per-release counts, digests, host observations, and incident chronology live in
 [CHANGELOG.md](./CHANGELOG.md), release artifacts, issues, and git history. This
-file keeps only the current operator interview and support verdicts.
+file keeps only the current operator interview and support verdicts.