@junghanacs/entwurf 0.12.2 → 0.12.4

package/AGENTS.md

@@ -217,8 +217,8 @@ Code-level invariants pinned at the same time:
 
 ## Runtime Dependencies
 
-- `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.50.0`), `@agentclientprotocol/sdk` (`0.29.0`), `@anthropic-ai/sdk` (`0.100.1`). The Codex/Gemini ACP packages stay out of scope (native already reaches Codex; Gemini/major tools use native).
-- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.80.2 < 0.81` — devDep exact `0.80.2` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT the 0.80 provider-factory `providers/anthropic` subpath: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only the bare root, `/compat`, and `/oauth` for extensions — a `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.81` ceiling guards it; when 0.81 changes `compat` or the loader alias map, re-evaluate against whatever root/loader surface 0.81 then exposes.
+- `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.54.1`), `@agentclientprotocol/sdk` (`1.1.0`), `@anthropic-ai/sdk` (`0.100.1`). The Codex/Gemini ACP packages stay out of scope (native already reaches Codex; Gemini/major tools use native).
+- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.80.3 < 0.81` — devDep exact `0.80.3` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT the 0.80 provider-factory `providers/anthropic` subpath: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only the bare root, `/compat`, and `/oauth` for extensions — a `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.81` ceiling guards it; when 0.81 changes `compat` or the loader alias map, re-evaluate against whatever root/loader surface 0.81 then exposes.
 
 ## Working Style
 

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.4 — 2026-07-01
+
+### Fixed
+
+- **Installed `doctor-meta-bridge` no longer false-fails on node_modules strip-types.** The doctor previously ran `scripts/meta-bridge-store-doctor.ts` and `scripts/check-entwurf-v2-surface.ts` through Node strip-types even from an npm/pnpm-installed package. Node refuses type stripping under `node_modules` (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`), so real floor hosts reported false store-scan / v2-surface failures while development clones stayed green. The doctor now branches by package location: installed packages run the prebuilt `mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js` with plain `node` and defer the repo-only v2 source-shape gate after confirming the shipped source and runtime wiring; development clones keep the raw `.ts` gates.
+- **The store-doctor helper now ships as a node_modules-safe dist artifact.** The bridge build emits `dist/scripts/meta-bridge-store-doctor.js` alongside the MCP bridge closure, reusing the already-shipped `meta-session.js` dependency without adding a new runtime package lane. `check-pack` / `check-pack-install` require the artifact in the tarball and prove it scans a real fixture store under `node_modules` with plain `node`.
+- **Clean-host install docs call out the 0.12.4 doctor floor check.** The walkthrough now tells operators exactly which doctor lines prove the installed-vs-dev split and flags any `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` as a pre-0.12.4 or broken-tarball signal.
+
+### Verification
+
+- `pnpm check` passed on 2026-07-01 after the doctor/install-floor fix.
+- `./run.sh check-pack-install` passed with the new installed store-doctor scan and doctor-dispatch lock assertions.
+- Release-gate prep evidence: `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.4.PliLsd` passed on 2026-07-01; log `/tmp/pi-tmux-entwurf-release-gate-0124.log`; summary `MUST: PASS=17 FAIL=0 SKIP=0`, advisory `BEHAVIOR: PASS=0 FAIL=1` (`smoke-resident-garden-guard` post-`/gnew` autonomous `entwurf_self` identity turn; non-blocking).
+- `hejdev6` real floor host reproduced the pre-fix strip-types failure from an installed package and passed after installing the patched tarball: compiled store-doctor scanned `1 record(s)` with plain `node`, and installed `doctor-meta-bridge` reported store-scan ok plus v2-surface deferred.
+
+## 0.12.3 — 2026-07-01
+
+### Changed
+
+- **Claude ACP dependency lane refreshed for Sonnet 5.** The ACP runtime pins now use `@agentclientprotocol/claude-agent-acp@0.54.1` with `@agentclientprotocol/sdk@1.1.0`, while keeping the direct `@anthropic-ai/sdk@0.100.1` peer-resolution pin. The pi adapter floor is now `@earendil-works/pi-* >=0.80.3 <0.81`, matching the runtime catalog that exposes `claude-sonnet-5`.
+- **Curated Claude surface moves from Sonnet 4.6 to Sonnet 5.** `claude-sonnet-5` replaces `claude-sonnet-4-6` across the ACP provider, demo/default smoke targets, pi target registry, and release docs. The Sonnet-specific 200K cap was removed; Sonnet 5 now surfaces the verified 1M context window like the Opus anchor, with a 1M ceiling guard to prevent silent future inflation.
+- **Release and backend docs are version-neutral where the repo shape is stable.** The README now describes the durable repository shape instead of a point-in-time `0.12.x` state, and the clean-host/demo/verification docs reflect the current pi floor and Sonnet 5 defaults.
+- **Cortex and fresh-spawn planning docs realigned to the 0.12 substrate.** The ACP backend rail documentation and NEXT/ROADMAP planning notes now describe the as-built adapter seam and the mux-visible fresh-sibling lane without re-centering old v1/fat-bridge assumptions.
+
+### Fixed
+
+- **Live ACP smoke timeout cleanup no longer leaves stale timers after PASS.** Raw-turn, overlay, memory-containment, and session-reuse live smokes now clear their timeout handles when the awaited operation wins, so a successful live check exits promptly instead of lingering until the old timeout expires.
+- **Session-reuse live smoke now preserves its success evidence.** The two-turn reuse smoke no longer calls `process.exit(0)` on success, allowing the turn-2/PASS log and cleanup to drain naturally while the retained ACP child is still handled by the backend exit cleanup.
+- **Claude Code meta-bridge install state also disables workflow surfaces.** `enableWorkflows` and `workflowKeywordTriggerEnabled` are now managed false alongside the existing auto-memory, compaction, prompt-suggestion, progress, and auto-mode settings.
+- **Unsupported ACP Codex targets are not advertised.** The target registry keeps Codex on the native `openai-codex` provider only; `entwurf/gpt-5.4` and `entwurf/gpt-5.5` are removed until an ACP Codex backend exists.
+
+### Verification
+
+- `pnpm check` passed on 2026-07-01 after the dependency/model/doc updates; prep log `/tmp/pi-tmux-entwurf-prep-check-0123.log` ended with `EXIT=0`.
+- `LIVE=1 ./run.sh smoke-acp-raw-turn-live` passed with `claude-sonnet-5` and exited promptly after PASS.
+- `LIVE=1 ./run.sh smoke-acp-provider-live` passed with `claude-sonnet-5` through the pi provider path.
+- `LIVE=1 ./run.sh smoke-acp-session-reuse-live` passed with a two-turn reused ACP child; turn 2 recalled the turn-1 codeword from delta-only prompt scope.
+- `LIVE=1 ./run.sh release-gate /tmp/psa-release-gate-0.12.3.ZcRc8w` passed on 2026-07-01 with `MUST: PASS=17 FAIL=0 SKIP=0` and `BEHAVIOR: PASS=1 FAIL=0`; log `/tmp/pi-tmux-entwurf-release-gate-0123.log`.
+
 ## 0.12.2 — 2026-06-29
 
 ### Fixed

package/README.md

@@ -10,9 +10,7 @@ npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
-> **Public, active development.** Real working code, still young. Verify it in your own workflow before relying on it all day. Evidence calibration: [VERIFY.md](./VERIFY.md); native async-delivery capability levels: [DELIVERY.md](./DELIVERY.md).
-
-> **Current state for 0.12.1.** This repo is **entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code is shipped through the meta-bridge; pi is shipped through the control-socket adapter; Codex and Antigravity (`agy`) reach the garden with verified delivery probes, documented per launch mode in [DELIVERY.md](./DELIVERY.md), with shipped adapter/install lanes landing after the 0.12.0 doc cut. The ACP plugin is Claude-first; Cortex/vendor-governed ACP backends are future lanes.
+> **Repository shape.** This repo is **entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an ACP plugin**. Pi is one supported harness adapter — important because it supplies control sockets and hosts the ACP plugin today — but it is not the project subject. Claude Code is shipped through the meta-bridge; pi is shipped through the control-socket adapter. Codex and Antigravity (`agy`) have verified delivery probes documented per launch mode in [DELIVERY.md](./DELIVERY.md); shipped adapter/install lanes are tracked separately. The ACP plugin is Claude-first; Cortex/vendor-governed ACP backends are future lanes.
 
 <details>
 <summary>Watch archived pre-0.12 demo (2131×1142 GIF, click to expand)</summary>
@@ -55,7 +53,7 @@ native Claude Code
         → entwurf_self | entwurf_v2 | entwurf_inbox_read
 ```
 
-This meta-bridge installer/doctor is **Claude Code only** in the shipped 0.12.0 surface. Codex and Antigravity delivery probes are recorded in [DELIVERY.md](./DELIVERY.md) as verified adapter evidence, not yet shipped install surfaces.
+This meta-bridge installer/doctor is **Claude Code only** in the current shipped surface. Codex and Antigravity delivery probes are recorded in [DELIVERY.md](./DELIVERY.md) as verified adapter evidence, not yet shipped install surfaces.
 
 > **Direction.** Inverse of [`pi-acp`](https://github.com/svkozak/pi-acp). `pi-acp` lets external ACP clients talk *to* pi; `entwurf` lets garden citizens talk across harness boundaries — with pi as one adapter, not the center.
 
@@ -147,7 +145,7 @@ because Node refuses to strip `.ts` files under `node_modules`.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.80.2 <0.81`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.80.3 <0.81`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -183,6 +181,12 @@ entwurf install-meta-bridge
 entwurf doctor-meta-bridge
 ```
 
+On npm/pnpm-installed packages, `doctor-meta-bridge` must use prebuilt JS for its
+store scan and defer repo-only source-shape gates; Node refuses strip-types for
+raw `.ts` helpers under `node_modules`. If the doctor reports
+`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`, reinstall a current package before
+trusting the floor result.
+
 For manual configuration, [`pi/settings.reference.json`](./pi/settings.reference.json)
 shows the pi adapter settings shape, and the external-host examples below show
 plain MCP registrations.

package/VERIFY.md

@@ -44,7 +44,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 ### Verifying the two capabilities a gate cannot fully judge
 
 - **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2` with the correct intent — `fire-and-forget` for a live/replyable or meta-session target, `owned-outcome` only to wake a dormant record-backed pi citizen. Picking the wrong intent is rejected, never auto-fixed.
-- **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-4-6` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
+- **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
 
 ### What NOT to do — bypassing the operational path
 
@@ -102,7 +102,7 @@ pi install git:github.com/junghan0611/entwurf          # pi auto-clones + instal
 cd /path/to/consumer-project
 ~/.pi/agent/git/github.com/junghan0611/entwurf/run.sh install .   # wire bundled mcpServers
 pi --list-models entwurf                               # curated model surface
-pi --provider entwurf --model claude-sonnet-4-6 -p "reply with ok only"   # one-turn smoke
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
 ```
 
 Expected: the package appears under pi's `User packages`; `install .` logs `added entwurfProvider.mcpServers.entwurf-bridge` + `updated <project>/.pi/settings.json`; the smoke returns a one-word reply (full bootstrap → ACP session → bridge → clean shutdown). Note: `~/.pi/agent/git/.../entwurf` is pi-managed — do not edit it (a `pi update` overwrites). Step 2 is still required after `pi install git:…`.
@@ -115,7 +115,7 @@ pnpm install                                   # pnpm is the pinned packageManag
 pi install ./
 ./run.sh install /path/to/consumer-project
 pnpm check                                     # full deterministic floor
-pi --provider entwurf --model claude-sonnet-4-6 -p "reply with ok only"
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"
 LIVE=1 ./run.sh release-gate /path/to/consumer-project
 ```
 
@@ -140,7 +140,7 @@ Compare a fresh self-awareness report across axes: (1) same backend, different i
 
 ## 1A. Main Agent Evaluation — Is `entwurf` Claude strong enough?
 
-Separate from continuity gates. Gates prove "sessions continue"; this questionnaire examines tool self-awareness / native tool usability / MCP-boundary awareness / long-turn focus / quality vs direct Claude Code. Run it against `entwurf/claude-sonnet-4-6` via a direct `pi --provider entwurf` turn (or a live ACP session); accumulate turns by re-prompting the same target.
+Separate from continuity gates. Gates prove "sessions continue"; this questionnaire examines tool self-awareness / native tool usability / MCP-boundary awareness / long-turn focus / quality vs direct Claude Code. Run it against `entwurf/claude-sonnet-5` via a direct `pi --provider entwurf` turn (or a live ACP session); accumulate turns by re-prompting the same target.
 
 ### 1A.0 Two carrier surfaces — engraving vs pi-context-augment (load-bearing)
 

package/demo/README.md

@@ -17,7 +17,7 @@ Historical pre-0.12 demo, still linked from the top-level `README.md` as archive
    tools, names the carrier surface for each cited piece of
    information, and admits unknowns instead of fabricating.
 2. **Entwurf surface** — the same pane spawns a sibling via the
-   `entwurf` tool (`mode=sync`, cross-model — driver `claude-sonnet-4-6`,
+   `entwurf` tool (`mode=sync`, cross-model — driver `claude-sonnet-5`,
    sibling `gpt-5.4`), prints the Session ID, and quotes the sibling's
    one-line reply verbatim.
 
@@ -81,7 +81,7 @@ grep -E '(entwurf|model-switch)' demo/sender-debug.log
 | Var | Default | Meaning |
 |---|---|---|
 | `PEER_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | top pane backend (receives greeting) |
-| `SENDER_MODEL` | `entwurf/claude-sonnet-4-6` (≡ `pias`) | bottom pane backend (drives scenes) |
+| `SENDER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | bottom pane backend (drives scenes) |
 | `SCENE_DELAY` | `25` | seconds to wait for each scene's agent work |
 | `WARMUP` | `3` | seconds to wait for both pi banners |
 | `FINAL_PAUSE` | `5` | extra wait after scene 3 (peer reply lag) |
@@ -93,7 +93,7 @@ grep -E '(entwurf|model-switch)' demo/sender-debug.log
 
 | Var | Default | Meaning |
 |---|---|---|
-| `DRIVER_MODEL` | `entwurf/claude-sonnet-4-6` (≡ `pias`) | the driven pane — answers Q-B0 and spawns the sibling |
+| `DRIVER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | the driven pane — answers Q-B0 and spawns the sibling |
 | `SIBLING_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | cross-backend sibling spawned in scene 2 |
 | `SIBLING_CWD` | repo root | cwd passed to the entwurf sibling (drives `<project-context>` injection) |
 | `SCENE1_DELAY` | `60` | seconds for the long English baseline answer |
@@ -114,7 +114,7 @@ The demo launch lines correspond to your shell aliases:
 | Alias | Model id | Use as |
 |---|---|---|
 | `piao` | `entwurf/claude-opus-4-8` | `SENDER_MODEL` (precision scenes) |
-| `pias` | `entwurf/claude-sonnet-4-6` | `SENDER_MODEL` (default) |
+| `pias` | `entwurf/claude-sonnet-5` | `SENDER_MODEL` (default) |
 | `piat` | `entwurf/gpt-5.4` | `PEER_MODEL` (default) |
 | `piat5` | `entwurf/gpt-5.5` | either |
 | `piag` | `entwurf/gemini-3.1-pro-preview` | either |
@@ -137,7 +137,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.80.2)
+- `pi` on PATH (current floor 0.80.3)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/demo/demo-baseline.sh

@@ -8,7 +8,7 @@
 #      reply in the same pane (cross-model, mode=sync).
 #
 # Layout (tmux, 220x50):
-#   pane 0 (single) — driven pi (claude-sonnet-4-6) — receives both prompts.
+#   pane 0 (single) — driven pi (claude-sonnet-5) — receives both prompts.
 #
 # Recording: asciinema → baseline.cast → agg → baseline.gif
 
@@ -30,7 +30,7 @@ GIF="$PUBLISH_DIR/entwurf-demo.gif"
 DRIVER_LOG="$OUTDIR/baseline-debug.log"
 
 # Driven pi runs the bridge surface and answers both prompts.
-DRIVER_MODEL=${DRIVER_MODEL:-entwurf/claude-sonnet-4-6}   # pias
+DRIVER_MODEL=${DRIVER_MODEL:-entwurf/claude-sonnet-5}   # pias
 # Sibling spawned via entwurf in scene 2 — different backend for contrast.
 SIBLING_MODEL=${SIBLING_MODEL:-entwurf/gpt-5.4}            # piat
 SIBLING_CWD=${SIBLING_CWD:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}

package/demo/demo.sh

@@ -3,7 +3,7 @@
 #
 # Layout (tmux, 220x50):
 #   pane 0 (top)    — peer pi (codex, gpt-5.4)       — idle, waits for greeting
-#   pane 1 (bottom) — sender pi (claude-sonnet-4-6)  — driven by send-keys
+#   pane 1 (bottom) — sender pi (claude-sonnet-5)  — driven by send-keys
 #
 # Scenes (driven into sender pane):
 #   1. Spawn a sonnet sibling, store one fact.
@@ -32,7 +32,7 @@ SENDER_LOG="$OUTDIR/sender-debug.log"
 
 # Models match the user's piat / pias aliases.
 PEER_MODEL=${PEER_MODEL:-entwurf/gpt-5.4}        # piat
-SENDER_MODEL=${SENDER_MODEL:-entwurf/claude-sonnet-4-6}  # pias
+SENDER_MODEL=${SENDER_MODEL:-entwurf/claude-sonnet-5}  # pias
 
 # Pacing in seconds. Tuned from real runs: each scene's actual agent work
 # completes in ~5–15 s (Scene 1 sibling cold-spawn is the slowest; resume +
@@ -134,7 +134,7 @@ sleep "$WARMUP"
 # window/pane base-index configs.
 drive() {
   # Scene 1 — spawn + memory write
-  tmux send-keys -t "$SENDER_PANE" -l 'Demo scene 1. Spawn a claude-sonnet-4-6 sibling via the entwurf tool. provider: entwurf, model: claude-sonnet-4-6, cwd: /home/junghan/repos/gh/entwurf, mode: sync. Task body: "You are a sibling for a recorded demo. Remember one fact only — my favorite forge color is tempered indigo. Reply with one short sentence acknowledging. No tool calls, no repo exploration." After it returns, print only the Session ID line so I can see it.'
+  tmux send-keys -t "$SENDER_PANE" -l 'Demo scene 1. Spawn a claude-sonnet-5 sibling via the entwurf tool. provider: entwurf, model: claude-sonnet-5, cwd: /home/junghan/repos/gh/entwurf, mode: sync. Task body: "You are a sibling for a recorded demo. Remember one fact only — my favorite forge color is tempered indigo. Reply with one short sentence acknowledging. No tool calls, no repo exploration." After it returns, print only the Session ID line so I can see it.'
   tmux send-keys -t "$SENDER_PANE" Enter
   sleep "$SCENE_DELAY"
 

package/docs/setup-clean-host.md

@@ -4,9 +4,11 @@ End-to-end install of **entwurf** on a host with only `git` available — no
 node, no npm package, no pi binary, no dotfiles. The point is to validate the
 public install surface as an outside user would experience it.
 
-> **Scope.** This is the entwurf 0.12.1 install recipe. The base package install
+> **Scope.** This is the entwurf 0.12.4 install recipe. The base package install
 > is **neutral npm**, not `pi install npm:...`. Pi is an optional adapter lane for
-> the ACP provider / control-socket runtime.
+> the ACP provider / control-socket runtime. The 0.12.4 floor fix is explicitly
+> covered here: installed packages under `node_modules` must not run raw `.ts`
+> doctor helpers through Node strip-types.
 
 `entwurf` is a garden-citizen dispatch substrate and meta-bridge. It does not
 provide, copy, or mediate backend credentials — it lets the official backend CLI
@@ -30,7 +32,7 @@ ssh cleanhost 'uname -a; whoami; which git node npm pi claude 2>/dev/null'
 | Node | **24** recommended; `>=22.6.0` minimum | `engines.node` (Node strip-types / ESM runtime) |
 | npm | bundled with Node 24 | public package install path |
 | entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf` and `entwurf-bridge` bins |
-| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.80.2 <0.81` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
+| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.80.3 <0.81` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
 
 ## Stage 0 — Node 24 via nvm
 
@@ -72,9 +74,11 @@ MCP bridge can boot in Claude Code / Codex / Antigravity without pi present.
 ## Stage 2 — auth-free bridge boot
 
 Prove the installed MCP server answers `tools/list` from inside `node_modules`.
-This is the regression that 0.12.0 missed: Node refuses `--experimental-strip-types`
-for `.ts` under `node_modules`, so the installed package must boot the prebuilt
-JS under `mcp/entwurf-bridge/dist/`.
+This is the first `node_modules` strip-types regression fixed in 0.12.0: Node
+refuses `--experimental-strip-types` for `.ts` under `node_modules`, so the
+installed package must boot the prebuilt JS under `mcp/entwurf-bridge/dist/`.
+The 0.12.4 doctor fix below applies the same installed-vs-dev split to
+`doctor-meta-bridge` helper checks.
 
 ```bash
 node --input-type=module <<'JS'
@@ -109,7 +113,7 @@ If the host will run pi sessions or the Claude ACP provider through pi, install
 a compatible pi binary separately and wire the target project.
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.80.2
+npm install -g @earendil-works/pi-coding-agent@0.80.3
 pi --version
 
 mkdir -p ~/entwurf-smoke
@@ -126,7 +130,7 @@ Drift points:
   `entwurf-bridge`, and links `~/.pi/agent/entwurf-targets.json` to the package's
   `pi/entwurf-targets.json`.
 - Older pi versions may silently miss the provider/extension surface. Use the
-  pinned floor (`>=0.80.2 <0.81`) for release verification.
+  pinned floor (`>=0.80.3 <0.81`) for release verification.
 - A host that only uses the external MCP bridge can skip this stage until it
   needs `owned-outcome` spawn-bg resume or pi-native control sockets.
 
@@ -141,6 +145,19 @@ entwurf install-meta-bridge
 entwurf doctor-meta-bridge
 ```
 
+On an installed package (`.../node_modules/@junghanacs/entwurf`), the doctor must
+not try to strip-types-run raw `.ts` helpers. In the output, check for these two
+0.12.4 floor-regression signals:
+
+```text
+ok    full store scan: no corrupt records, duplicate nativeSessionId, body/filename drift, or backend↔wakeMode contradiction
+ok    check-entwurf-v2-surface: shipped surface source present; exhaustive source-shape gate is a repo/release invariant (not run under node_modules)
+```
+
+If either section reports `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`, the host
+is still running a pre-0.12.4 package or a broken tarball. Reinstall the current
+package and re-run `entwurf install-meta-bridge && entwurf doctor-meta-bridge`.
+
 A plain external MCP host can call tools but is non-replyable. A garden-native
 meta-session has a garden id, a mailbox, and a trusted sender marker; it can call
 `entwurf_self`, receive mailbox wakeups, and be replied to by garden id.
@@ -157,7 +174,7 @@ source ~/.bashrc
 claude login
 
 cd ~/entwurf-smoke
-pi --provider entwurf --model claude-sonnet-4-6 -p "reply with ok only"
+pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"
 ```
 
 If the backend CLI fails directly (`claude -p "ping"`), fix that upstream first.
@@ -171,7 +188,7 @@ a raw pi-assigned uuid hard-exits before any model turn.
 
 ```bash
 pi --session-id "$(entwurf new-session-id)" \
-  --entwurf-control --provider entwurf --model claude-sonnet-4-6
+  --entwurf-control --provider entwurf --model claude-sonnet-5
 # control socket: ~/.pi/entwurf-control/<garden-id>.sock
 ```
 

package/mcp/entwurf-bridge/dist/scripts/meta-bridge-store-doctor.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * meta-bridge-store-doctor — fail-loud full scan for meta-session records.
+ *
+ * The store is the authority for native→garden lookup. Doctor must therefore
+ * refuse corrupt records, duplicate nativeSessionId authorities, and body ↔
+ * filename drift instead of auto-pruning or silently picking one.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { parseMetaIdentity } from "../pi-extensions/lib/meta-session.js";
+const dir = process.argv[2];
+if (!dir) {
+    console.error("usage: node --experimental-strip-types scripts/meta-bridge-store-doctor.ts <meta-sessions-dir>");
+    process.exit(2);
+}
+const failures = [];
+const nativeToFiles = new Map();
+let scanned = 0;
+if (!fs.existsSync(dir)) {
+    console.log(`meta-store scan ok: ${dir} does not exist yet (0 records)`);
+    process.exit(0);
+}
+for (const filename of fs.readdirSync(dir).sort()) {
+    if (!filename.endsWith(".meta.json"))
+        continue;
+    scanned += 1;
+    const file = path.join(dir, filename);
+    try {
+        // dual-read (3D-4 commit1): parseMetaIdentity reads v1 AND v2 and normalizes,
+        // so doctor's gardenId/nativeSessionId checks survive the v2 cut.
+        const id = parseMetaIdentity(fs.readFileSync(file, "utf8"));
+        const expectedFilename = `${id.gardenId}.meta.json`;
+        if (filename !== expectedFilename) {
+            failures.push(`${filename}: body/filename drift — body gardenId=${id.gardenId}, expected filename ${expectedFilename}`);
+        }
+        const files = nativeToFiles.get(id.nativeSessionId) ?? [];
+        files.push(filename);
+        nativeToFiles.set(id.nativeSessionId, files);
+    }
+    catch (err) {
+        failures.push(`${filename}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+for (const [nativeSessionId, files] of nativeToFiles.entries()) {
+    if (files.length > 1) {
+        failures.push(`duplicate nativeSessionId ${JSON.stringify(nativeSessionId)} in ${files.join(", ")} — authority ambiguity; prune manually`);
+    }
+}
+if (failures.length > 0) {
+    for (const failure of failures)
+        console.error(`FAIL: ${failure}`);
+    process.exit(1);
+}
+console.log(`meta-store scan ok: ${scanned} record(s) scanned, no corrupt/duplicate/drift records`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -33,10 +33,18 @@
 	// Clear the root `exclude` (it filters out every `.ts`-extension lib file the
 	// bridge graph needs). Only node_modules must stay excluded.
 	"exclude": ["../../node_modules"],
-	// Just the bridge entry (+ the dependency-free protocol.js it reaches via an
-	// explicit `.js` import). tsc auto-follows the import graph — STATIC imports
-	// AND the lazy `await import("./entwurf-preflight.ts")` — and emits exactly the
-	// boot closure, nothing more. This tracks graph drift automatically and keeps
-	// the pi-lane-only acp/* (unreached at boot) out of the tarball.
-	"include": ["./src/index.ts", "../../protocol.js"]
+	// The bridge boot entry (+ the dependency-free protocol.js it reaches via an
+	// explicit `.js` import) PLUS the doctor's store-scan helper. tsc auto-follows
+	// the import graph — STATIC imports AND the lazy
+	// `await import("./entwurf-preflight.ts")` — and emits exactly that closure,
+	// nothing more (the pi-lane-only acp/* stays out of the tarball).
+	//
+	// WHY store-doctor rides THIS build: meta-bridge-doctor.sh's full store scan
+	// must run from an INSTALLED package (under node_modules, where strip-types is
+	// refused) — the same node_modules boundary start.sh crosses. Its only repo
+	// import is pi-extensions/lib/meta-session.ts, which the bridge graph ALREADY
+	// emits here, so it adds ONE leaf JS (dist/scripts/meta-bridge-store-doctor.js)
+	// and ZERO new deps. It is NOT in index.ts's boot closure, so
+	// check-entwurf-bridge-pi-free (which walks the index eager closure) is unaffected.
+	"include": ["./src/index.ts", "../../protocol.js", "../../scripts/meta-bridge-store-doctor.ts"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.2",
+	"version": "0.12.4",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -67,23 +67,23 @@
 	},
 	"packageManager": "pnpm@10.33.0",
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.50.0",
-		"@agentclientprotocol/sdk": "0.29.0",
+		"@agentclientprotocol/claude-agent-acp": "0.54.1",
+		"@agentclientprotocol/sdk": "1.1.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.80.2 <0.81",
-		"@earendil-works/pi-coding-agent": ">=0.80.2 <0.81",
-		"@earendil-works/pi-tui": ">=0.80.2 <0.81",
+		"@earendil-works/pi-ai": ">=0.80.3 <0.81",
+		"@earendil-works/pi-coding-agent": ">=0.80.3 <0.81",
+		"@earendil-works/pi-tui": ">=0.80.3 <0.81",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.80.2",
-		"@earendil-works/pi-coding-agent": "0.80.2",
-		"@earendil-works/pi-tui": "0.80.2",
+		"@earendil-works/pi-ai": "0.80.3",
+		"@earendil-works/pi-coding-agent": "0.80.3",
+		"@earendil-works/pi-tui": "0.80.3",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"typescript": "^6.0.2"

package/pi/entwurf-targets.json

@@ -1,20 +1,17 @@
 {
 	"$comment": "Entwurf Target Registry — exact (provider, model) allowlist. SSOT for what can be spawned via entwurf. See entwurf/AGENTS.md Entwurf Orchestration. Resume path intentionally bypasses this registry per Identity Preservation Rule.",
 	"$notes": {
-		"gpt-5.5": "High-end frontier target with 400K native codex context. Cost: ~$5 input / $30 output per 1M tokens on this tier — ~6x gpt-5.4. Do not make it the default. Use explicitly for long-context / high-quality work only. ACP-routed entries are `explicitOnly`: caller must pass provider=entwurf to route through the ACP bridge, otherwise bare `gpt-5.5` resolves to native openai-codex.",
-		"bareResolution": "Each bare model id resolves unambiguously because only the native openai-codex entry is non-explicitOnly. Bare `gpt-5.5` -> openai-codex/gpt-5.5. ACP route requires explicit provider.",
+		"gpt-5.5": "High-end frontier target with 400K native codex context. Cost: ~$5 input / $30 output per 1M tokens on this tier — ~6x gpt-5.4. Do not make it the default. Use explicitly for long-context / high-quality work only.",
+		"bareResolution": "Each bare Codex model id resolves through the native openai-codex provider. Bare `gpt-5.5` -> openai-codex/gpt-5.5. ACP Codex is not on this surface until the ACP backend is implemented.",
 		"gemini": "Gemini ACP targets are routed exclusively through entwurf's `gemini --acp` backend; the host pi removed its built-in google provider in v0.71.0. ACP entries are `explicitOnly` to keep the entwurf surface honest — there is currently no native pi alternative to disambiguate against, but the flag keeps the policy stable if pi reintroduces a google provider later. 3.1 Pro is the subscription-backed high-quality ACP target. Flash / 2.5 routing through ACP is intentionally not on this surface."
 	},
 	"entwurfTargets": [
-		{ "provider": "entwurf", "model": "claude-sonnet-4-6", "enabled": true },
+		{ "provider": "entwurf", "model": "claude-sonnet-5", "enabled": true },
 		{ "provider": "entwurf", "model": "claude-opus-4-8", "enabled": true },
 
 		{ "provider": "openai-codex", "model": "gpt-5.4", "enabled": true },
 		{ "provider": "openai-codex", "model": "gpt-5.5", "enabled": true },
 
-		{ "provider": "entwurf", "model": "gpt-5.4", "enabled": true, "explicitOnly": true },
-		{ "provider": "entwurf", "model": "gpt-5.5", "enabled": true, "explicitOnly": true },
-
 		{ "provider": "entwurf", "model": "gemini-3.1-pro-preview", "enabled": true, "explicitOnly": true }
 	]
 }

package/pi-extensions/lib/acp/acp-client.ts

@@ -1,5 +1,5 @@
 // ACP client adapter — the ONE place that touches the @agentclientprotocol/sdk
-// 0.29 fluent surface (`client({ name }).connect(stream)`).
+// 1.1 fluent surface (`client({ name }).connect(stream)`).
 //
 // The wire SDK deprecated the `new ClientSideConnection(toClient, stream)`
 // constructor in favour of the fluent `client()` builder. The two have
@@ -52,7 +52,7 @@ export interface AcpClientHandlers {
 }
 
 /**
- * Production factory — wrap the SDK 0.29 fluent `client()` into the
+ * Production factory — wrap the SDK 1.1 fluent `client()` into the
  * `AcpConnectionLike` seam the backend (and the live smokes) drive.
  *
  * Client-side handlers register by ACP method name; agent-side calls go through

package/pi-extensions/lib/acp/models.ts

@@ -50,18 +50,17 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-4-6", "claude-opus-4-8"] as const;
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-4-8"] as const;
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-4-8";
 
-// Anthropic's registry reports 1M for Claude 4.6+ models, but the public
-// entwurf surface deliberately distinguishes Sonnet vs Opus: Sonnet stays
-// at 200K, Opus surfaces at 1M. (The 0.11.0 ENTWURF_ACP_CLAUDE_CONTEXT env
-// override is a behavior-oracle nicety deferred past S0 — the loader/fence
-// slice only needs the anchor present and registered.)
+// Anthropic's registry reports 1M for both Sonnet 5 and Opus 4.8, and the
+// entwurf surface now exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// whole point of the 0.12.3 bump — it is the compact-free long-context floor the
+// earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
+// future registry value can't silently inflate the surface past what we verify.
 const CLAUDE_CONTEXT_DEFAULT = 1_000_000;
-const CLAUDE_SONNET_DEFAULT = 200_000;
 
 // `getModels("anthropic")` reads the static builtin model catalog only — no env
 // read, no credential access, no network — preserving the #26 auth-boundary
@@ -79,8 +78,7 @@ function requireRegistryModel(models: readonly RegistryModel[], id: string): Reg
 }
 
 function claudeContextWindow(model: { id: string; contextWindow: number }): number {
-	const cap = model.id === "claude-sonnet-4-6" ? CLAUDE_SONNET_DEFAULT : CLAUDE_CONTEXT_DEFAULT;
-	return Math.min(model.contextWindow, cap);
+	return Math.min(model.contextWindow, CLAUDE_CONTEXT_DEFAULT);
 }
 
 /**