@junghanacs/entwurf 0.13.0 → 0.13.1

package/scripts/mutants/acp-cortex.json

@@ -142,13 +142,13 @@
 				"\t\tawait setConfig.call(connection, { sessionId: acpSessionId, configId: \"model\", value: nativeModelId });",
 				"\t},",
 				"",
-				"\t// A connection change must invalidate a reused session (§4/§7). Flat,"
+				"\t// A connection change must invalidate a reused session (rail: Adapter contract). Flat,"
 			],
 			"replace": [
 				"\t\tawait setConfig.call(connection, { sessionId: acpSessionId, configId: \"model\", value: \"auto\" });",
 				"\t},",
 				"",
-				"\t// A connection change must invalidate a reused session (§4/§7). Flat,"
+				"\t// A connection change must invalidate a reused session (rail: Adapter contract). Flat,"
 			],
 			"gate": ["bash", "run.sh", "check-acp-cortex"],
 			"timeoutSeconds": 300,

package/scripts/mutants/acp-prompt-lifecycle.json

@@ -0,0 +1,100 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-prompt-lifecycle",
+	"mutants": [
+		{
+			"claim": "PROMPT-STALL-NOT-KILLED",
+			"title": "an absolute wall clock re-planted on the in-flight prompt — a turn that is still working is cut for being long",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\treturn await Promise.race([session.connection.prompt(promptArgs), lifecycle]);"],
+			"replace": [
+				"\t\treturn await Promise.race([\n\t\t\tsession.connection.prompt(promptArgs),\n\t\t\tlifecycle,\n\t\t\tnew Promise<never>((_, reject) => setTimeout(() => reject(new Error(\"prompt timed out after 100ms\")), 100)),\n\t\t]);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:PROMPT-STALL-NOT-KILLED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "ABORT-SENDS-PROTOCOL-CANCEL",
+			"title": "abort stops asking the agent to cancel its own turn — back to killing a child mid-tool instead of the protocol ending",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tsession.connection.cancel?.({ sessionId: promptArgs.sessionId });"],
+			"replace": ["\t\t\tvoid promptArgs;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:ABORT-SENDS-PROTOCOL-CANCEL]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "ABORT-ESCALATION-BOUNDED",
+			"title": "the post-abort grace ignores the bound it was given — an abort against a wedged agent waits on a clock the caller does not control",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tgraceTimer = setTimeout(escalateAbort, opts.graceMs);"],
+			"replace": ["\t\tgraceTimer = setTimeout(escalateAbort, 5_000);"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:ABORT-ESCALATION-BOUNDED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "CHILD-EXIT-DIAGNOSED",
+			"title": "a mid-prompt child death stops reporting HOW it ended — the operator is back to an undiagnosable connection error",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tconst parts = [\n\t\texit.code !== null ? `exit code ${exit.code}` : undefined,\n\t\texit.signal ? `signal ${exit.signal}` : undefined,\n\t].filter(Boolean);\n\treturn parts.length > 0 ? parts.join(\", \") : \"no exit status\";"
+			],
+			"replace": ["\treturn \"no exit status\";"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CHILD-EXIT-DIAGNOSED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "REUSE-CARRIES-CHILD-DIAGNOSTICS",
+			"title": "the reuse path drops the child's stderr tail again — exactly the live sonnet failure that showed only \"ACP connection closed\"",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail);"],
+			"replace": ["\t\t\tfinishError(err, aborted);"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:REUSE-CARRIES-CHILD-DIAGNOSTICS]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "PROMPT-ERROR-NOT-TRANSIENT",
+			"title": "a prompt-phase lifecycle failure worded as a timeout — pi reclassifies it as transient and cold-replays the whole prompt",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\t\"this turn has no answer\","],
+			"replace": ["\t\t\t\"the prompt timed out\","],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:PROMPT-ERROR-NOT-TRANSIENT]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "IDLE-DEATH-ANNOUNCED",
+			"title": "a backend session that died between turns is cleared but never announced — the next turn respawns silently and the operator never learns the session is gone",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst priorEnd = takeUnreportedChildEnd(sessionKey);\n\t\t\tif (priorEnd) {\n\t\t\t\tpushAcpLifecycleNotice(\n\t\t\t\t\tstate,\n\t\t\t\t\t`previous ${adapter.backend} session ended between turns (${describeChildEnd(priorEnd)}) — opening a new one`,\n\t\t\t\t);\n\t\t\t}"
+			],
+			"replace": ["\t\t\ttakeUnreportedChildEnd(sessionKey);"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:IDLE-DEATH-ANNOUNCED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "RETIRED-TEARDOWN-NOT-ANNOUNCED",
+			"title": "a teardown we performed ourselves is reported as a death — every ordinary turn-scoped turn cries wolf about its own cleanup",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t} else if (!session.retiring) {"],
+			"replace": ["\t} else {"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:RETIRED-TEARDOWN-NOT-ANNOUNCED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		}
+	]
+}

package/scripts/mutants/acp-stop-reason.json

@@ -0,0 +1,80 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-stop-reason",
+	"mutants": [
+		{
+			"claim": "STOP-REFUSAL-NOT-SUCCESS",
+			"title": "a model refusal reported as a finished answer — the turn has no content, yet pi seals it done/stop",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tcase \"refusal\":\n\t\t\treturn {\n\t\t\t\tstopReason: \"error\",\n\t\t\t\trawStopReason: stopReason,\n\t\t\t\terrorMessage: \"ACP backend stopped with: refusal (the model declined to answer; the turn is incomplete)\",\n\t\t\t};"
+			],
+			"replace": ["\t\tcase \"refusal\":\n\t\t\treturn { stopReason: \"stop\", rawStopReason: stopReason };"],
+			"gate": ["bash", "run.sh", "check-acp-stop-reason"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:STOP-REFUSAL-NOT-SUCCESS]",
+			"signatureSource": "scripts/check-acp-stop-reason.ts"
+		},
+		{
+			"claim": "STOP-TURNBUDGET-NOT-SUCCESS",
+			"title": "an exhausted per-turn request budget reported as success — the answer is cut short but pi seals it done",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tcase \"max_turn_requests\":\n\t\t\treturn {\n\t\t\t\tstopReason: \"error\",\n\t\t\t\trawStopReason: stopReason,\n\t\t\t\terrorMessage:\n\t\t\t\t\t\"ACP backend stopped with: max_turn_requests (the backend's per-turn request budget was exhausted; the turn is incomplete)\",\n\t\t\t};"
+			],
+			"replace": ["\t\tcase \"max_turn_requests\":\n\t\t\treturn { stopReason: \"stop\", rawStopReason: stopReason };"],
+			"gate": ["bash", "run.sh", "check-acp-stop-reason"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:STOP-TURNBUDGET-NOT-SUCCESS]",
+			"signatureSource": "scripts/check-acp-stop-reason.ts"
+		},
+		{
+			"claim": "STOP-UNKNOWN-NOT-SUCCESS",
+			"title": "the collapse-to-stop default returns: any reason this build has never seen becomes a clean success",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tdefault:\n\t\t\treturn {\n\t\t\t\tstopReason: \"error\",\n\t\t\t\trawStopReason: stopReason,\n\t\t\t\terrorMessage: `ACP backend stopped with an unrecognized reason: ${stopReason}`,\n\t\t\t};"
+			],
+			"replace": ["\t\tdefault:\n\t\t\treturn { stopReason: \"stop\", rawStopReason: stopReason };"],
+			"gate": ["bash", "run.sh", "check-acp-stop-reason"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:STOP-UNKNOWN-NOT-SUCCESS]",
+			"signatureSource": "scripts/check-acp-stop-reason.ts"
+		},
+		{
+			"claim": "STOP-ABSENT-NOT-SUCCESS",
+			"title": "a prompt result carrying NO stop reason treated as a finished turn instead of an error",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tcase undefined:\n\t\t\treturn {\n\t\t\t\tstopReason: \"error\",\n\t\t\t\terrorMessage: \"ACP backend ended the turn without a stop reason\",\n\t\t\t};"
+			],
+			"replace": ["\t\tcase undefined:\n\t\t\treturn { stopReason: \"stop\" };"],
+			"gate": ["bash", "run.sh", "check-acp-stop-reason"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:STOP-ABSENT-NOT-SUCCESS]",
+			"signatureSource": "scripts/check-acp-stop-reason.ts"
+		},
+		{
+			"claim": "STOP-RAW-PRESERVED",
+			"title": "the raw ACP reason is dropped on the way out, so no consumer can see what the backend actually said",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tif (verdict.rawStopReason !== undefined) state.output.rawStopReason = verdict.rawStopReason;\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-acp-stop-reason"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:STOP-RAW-PRESERVED]",
+			"signatureSource": "scripts/check-acp-stop-reason.ts"
+		},
+		{
+			"claim": "STOP-PENDING-SEED",
+			"title": "the stream state seeds success: an in-flight turn already reads as a finished stop before any terminal arrives",
+			"subject": "pi-extensions/lib/acp/event-mapper.ts",
+			"find": ["\t\tstopReason: \"pending\","],
+			"replace": ["\t\tstopReason: \"stop\","],
+			"gate": ["bash", "run.sh", "check-acp-stop-reason"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:STOP-PENDING-SEED]",
+			"signatureSource": "scripts/check-acp-stop-reason.ts"
+		}
+	]
+}

package/scripts/mutants/probe-ordering.json

@@ -76,14 +76,36 @@
 			"signatureSource": "scripts/check-probe-ordering.ts"
 		},
 		{
-			"claim": "PROBE-TIMEOUTS-MATCH-PRODUCTION",
-			"title": "probe prompt boundary drifting from production (120s was the raw smoke's value) — D readings would measure the wrong timeout",
+			"claim": "PROBE-BOOTSTRAP-TIMEOUTS-MATCH-PRODUCTION",
+			"title": "probe bootstrap boundary drifting from production — a bootstrap-phase D reading would measure the wrong timeout",
 			"subject": "scripts/lib/probe-acp-turn.ts",
-			"find": ["\tpromptMs: 600_000,"],
-			"replace": ["\tpromptMs: 120_000,"],
+			"find": ["\tsetModelMs: 30_000,"],
+			"replace": ["\tsetModelMs: 15_000,"],
 			"gate": ["bash", "run.sh", "check-probe-ordering"],
 			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-TIMEOUTS-MATCH-PRODUCTION]",
+			"signature": "[QK:PROBE-BOOTSTRAP-TIMEOUTS-MATCH-PRODUCTION]",
+			"signatureSource": "scripts/check-probe-ordering.ts"
+		},
+		{
+			"claim": "NO-PRODUCTION-PROMPT-CUTOFF",
+			"title": "an absolute wall-clock cutoff re-planted on the prompt — active turns die for being long and pi replays the whole prompt as a transient error",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["const ABORT_CANCEL_GRACE_MS = 5_000;"],
+			"replace": ["const PROMPT_TIMEOUT_MS = 600_000;\nconst ABORT_CANCEL_GRACE_MS = 5_000;"],
+			"gate": ["bash", "run.sh", "check-probe-ordering"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:NO-PRODUCTION-PROMPT-CUTOFF]",
+			"signatureSource": "scripts/check-probe-ordering.ts"
+		},
+		{
+			"claim": "PROMPT-HORIZON-NOT-PRODUCTION",
+			"title": "the harness's prompt observation horizon folded back into the production-pinned set — a probe-invented number would be reported as the turn contract",
+			"subject": "scripts/lib/probe-acp-turn.ts",
+			"find": ["\tsetModelMs: 30_000,\n};"],
+			"replace": ["\tsetModelMs: 30_000,\n\tpromptMs: 600_000,\n};"],
+			"gate": ["bash", "run.sh", "check-probe-ordering"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PROMPT-HORIZON-NOT-PRODUCTION]",
 			"signatureSource": "scripts/check-probe-ordering.ts"
 		},
 		{

package/scripts/mutants/release-gate.json

@@ -0,0 +1,105 @@
+{
+	"schemaVersion": 1,
+	"lane": "release-gate",
+	"mutants": [
+		{
+			"claim": "SKIP-EXIT-ONE-PROTOCOL",
+			"title": "the shell and TS halves name different skip codes — every honest skip silently reclassifies, and the summary says nothing",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["ENTWURF_STEP_SKIP_EXIT=97"],
+			"replace": ["ENTWURF_STEP_SKIP_EXIT=96"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:SKIP-EXIT-ONE-PROTOCOL]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "STEP-OUTCOME-SKIP-NOT-PASS",
+			"title": "the classifier rounds a skip up to PASS — the pre-P1 defect restored at its source: a step that declined is reported as acceptance",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["\t\t\"$ENTWURF_STEP_SKIP_EXIT\") printf 'SKIP\\n' ;;"],
+			"replace": ["\t\t\"$ENTWURF_STEP_SKIP_EXIT\") printf 'PASS\\n' ;;"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:STEP-OUTCOME-SKIP-NOT-PASS]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CUT-REFUSES-SKIP",
+			"title": "--cut stops refusing a MUST SKIP — the release procedure goes back to prose and a 14-SKIP run can be quoted as acceptance",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["\tif [ \"$cut\" = \"1\" ] && [ \"$skipc\" -gt 0 ]; then"],
+			"replace": ["\tif [ \"$cut\" = \"1\" ] && [ \"$skipc\" -lt 0 ]; then"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CUT-REFUSES-SKIP]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "NO-SMOKE-SKIPS-WITH-ZERO",
+			"title": "one LIVE smoke goes back to exiting 0 on its skip — the hole re-opens for that lane alone, which is how it survived unnoticed",
+			"subject": "scripts/smoke-acp-mcp-live.ts",
+			"find": ["\tskipLive(\"smoke-acp-mcp-live\", \"set LIVE=1 to run the real pi provider turn.\");"],
+			"replace": [
+				"\tconsole.error(\"[smoke-acp-mcp-live] skipped — set LIVE=1 to run the real pi provider turn.\");",
+				"\tprocess.exit(0);"
+			],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:NO-SMOKE-SKIPS-WITH-ZERO]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "LIVE-SKIP-IS-PROTOCOL-EXIT",
+			"title": "skipLive exits 0 — every smoke still LOOKS converted (imports, no old shape) while the aggregate reads all of them as PASS",
+			"subject": "scripts/lib/live-skip.ts",
+			"find": ["\tprocess.exit(LIVE_SKIP_EXIT);"],
+			"replace": ["\tprocess.exit(0);"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:LIVE-SKIP-IS-PROTOCOL-EXIT]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "WRAPPER-SKIP-IS-PROTOCOL-EXIT",
+			"title": "a run.sh smoke wrapper returns 0 on a missing prerequisite — the second skip surface, where cortex/matrix/spawn decline before their .ts is ever reached",
+			"subject": "run.sh",
+			"find": [
+				"    echo \"[entwurf:skip] smoke-acp-cortex-live — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run.\"",
+				"    return \"$ENTWURF_STEP_SKIP_EXIT\""
+			],
+			"replace": [
+				"    echo \"[entwurf:skip] smoke-acp-cortex-live — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run.\"",
+				"    return 0"
+			],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:WRAPPER-SKIP-IS-PROTOCOL-EXIT]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CUT-VERDICT-NAMES-CAUSE",
+			"title": "a cut blocked only by SKIP reports itself as a FAIL block — the record can no longer tell a broken call from an absent prerequisite",
+			"subject": "scripts/lib/step-outcome.sh",
+			"find": ["\t\tprintf 'cut: BLOCKED (MUST SKIP)\\n'"],
+			"replace": ["\t\tprintf 'cut: BLOCKED (MUST FAIL)\\n'"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CUT-VERDICT-NAMES-CAUSE]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "NO-SILENT-AGGREGATE-OMISSION",
+			"title": "the cross-harness delivery chain drops out of the aggregate — a green cut goes back to saying nothing about multi-harness delivery, with no doc stating the exclusion",
+			"subject": "run.sh",
+			"find": [
+				"  run_live_step \"smoke-entwurf-chain-live (P3: Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox, identity + receipt)\" gate bash \"$self\" smoke-entwurf-chain-live"
+			],
+			"replace": ["  : # the chain quietly dropped from the aggregate"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:NO-SILENT-AGGREGATE-OMISSION]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -7,16 +7,13 @@
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY (do not \" +",
-				"\t\t\"over-generalize it): the per-target lock is taken for a control-socket-DOMAIN dispatch, which is \" +",
-				"\t\t\"both the live send AND the dormant cell's spawn-bg resume — spawn-bg is a separate relaunch \" +",
-				"\t\t\"transport yet it still runs under that domain's lock. The mailbox and native-push rails are \" +",
-				"\t\t\"lock-free: the mailbox is guarded instead by active-receiver deliverability, and native-push by \" +",
-				"\t\t\"its adapter probe. The decider — not the \" +"
+				"\t\t\"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +",
+				"\t\t\"the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The \" +",
+				"\t\t\"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode \" +"
 			],
 			"replace": [
-				"\t\t\"(delivered / rejected / lock-retained / delivered-but-lock-dirty). LOCK POLICY: socket paths \" +",
-				"\t\t\"take a per-target lock; the mailbox path does not. The decider — not the \" +"
+				"\t\t\"native-push-no-resume-authority. LOCK POLICY: socket paths take a per-target lock; the mailbox path \" +",
+				"\t\t\"does not. mode \" +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -68,20 +65,34 @@
 			"title": "MCP long description merges the two owned rejects back under backend-liveness-unsupported",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently \" +",
-				"\t\t\"backend pi); on a live target it is rejected as owned-live-no-autosend. Neither self-fetch nor \" +",
-				"\t\t\"native-push has resume authority, but they reject under DIFFERENT reasons — self-fetch as \" +",
-				"\t\t\"backend-liveness-unsupported, native-push as native-push-no-resume-authority. \" +"
+				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → \" +",
+				"\t\t\"owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → \" +",
+				"\t\t\"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +"
 			],
 			"replace": [
-				"\t\t\"owned-outcome is ONLY for waking a DORMANT socket-domain citizen (spawn-bg resume, currently \" +",
-				"\t\t\"backend pi); on a live target it is rejected as owned-live-no-autosend, and on self-fetch and \" +",
-				"\t\t\"native-push alike it is rejected as backend-liveness-unsupported. \" +"
+				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → \" +",
+				"\t\t\"owned-live-no-autosend, and on self-fetch and native-push alike it is rejected as \" +",
+				"\t\t\"backend-liveness-unsupported. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MERGED-REJECT]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-DESC-FITS-HOST-CAP",
+			"title": "the v2 tool description grows back past the host's 2048-char cap — the INTENT contract is silently cut off before the model that must choose an intent ever reads it",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +"
+			],
+			"replace": [
+				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-DESC-FITS-HOST-CAP]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		}
 	]
 }

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -52,6 +52,7 @@ import * as readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { fetchControlSocketRuntimeInfo, formatRuntimeModel } from "../pi-extensions/lib/entwurf-control-rpc.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
@@ -160,10 +161,10 @@ function driveSelfTurn(child: ChildProcess, prompt: string): Promise<TurnCapture
 
 async function main(): Promise<void> {
 	if (process.env.LIVE !== "1") {
-		console.log(
-			"[smoke-acp-bundled-mcp-live] skipped — set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
+		skipLive(
+			"smoke-acp-bundled-mcp-live",
+			"set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
 		);
-		return;
 	}
 
 	const tmp = os.tmpdir();

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -45,6 +45,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
@@ -57,8 +58,7 @@ function fail(msg: string): never {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-carrier-augment-live] skipped — set LIVE=1 to run the real pi provider turn.");
-	process.exit(0);
+	skipLive("smoke-acp-carrier-augment-live", "set LIVE=1 to run the real pi provider turn.");
 }
 
 // Billing-reclassification canaries (핀1). The empty carrier must NOT trip metered

package/scripts/smoke-acp-cortex-live.ts

@@ -5,7 +5,7 @@
 //
 //   LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live
 //
-// WHY this exact axis. The CP0 audit (docs/acp-backend-rail.md §11-8) measured
+// WHY this exact axis. The CP0 audit (docs/acp-backend-rail.md, Cortex D1–D10) measured
 // three things no offline gate can prove:
 //   - D9/D10: cortex ignores the wire `mcpServers` param, so the bundled
 //     entwurf-bridge reaches a cortex session ONLY through the overlay-private
@@ -32,7 +32,7 @@
 // LIVE-only and OUTSIDE the claude-only AGGREGATE release floor (capability
 // dignity): a host that runs no cortex must not redden a claude release. That is
 // a wiring decision — shipping cortex still owes a deliberate run of this smoke,
-// and the aggregate gate's silence is not a pass (rail §11-8 tail).
+// and the aggregate gate's silence is not a pass (ACP rail verification boundary).
 // Honest skip when LIVE!=1, when `cortex` is not on PATH, or when
 // ENTWURF_ACP_CORTEX_CONNECTION is unset — the overlay denies the operator's
 // cortex settings.json (where a default connection would live), so the
@@ -53,6 +53,7 @@ import * as readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { upsertMetaSession, writeMetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
@@ -189,24 +190,17 @@ function driveTurn(child: ChildProcess, prompt: string): Promise<TurnCapture> {
 
 async function main(): Promise<void> {
 	if (process.env.LIVE !== "1") {
-		console.log(
-			"[smoke-acp-cortex-live] skipped — set LIVE=1 to run (spawns a real cortex ACP resident + one model turn).",
-		);
-		return;
+		skipLive("smoke-acp-cortex-live", "set LIVE=1 to run (spawns a real cortex ACP resident + one model turn).");
 	}
 	const connection = process.env.ENTWURF_ACP_CORTEX_CONNECTION?.trim();
 	if (!connection) {
-		console.log(
-			"[smoke-acp-cortex-live] skipped — set ENTWURF_ACP_CORTEX_CONNECTION=<snowflake connection> (the dual-HOME " +
-				"overlay denies the operator cortex settings.json, so the connection must ride the adapter's own seam).",
+		skipLive(
+			"smoke-acp-cortex-live",
+			"set ENTWURF_ACP_CORTEX_CONNECTION=<snowflake connection> (the dual-HOME overlay denies the operator cortex settings.json, so the connection must ride the adapter's own seam).",
 		);
-		return;
 	}
 	if ("CORTEX_HOME" in process.env) {
-		console.log(
-			"[smoke-acp-cortex-live] skipped — unset CORTEX_HOME first (the adapter refuses its presence, CP0 D3).",
-		);
-		return;
+		skipLive("smoke-acp-cortex-live", "unset CORTEX_HOME first (the adapter refuses its presence, CP0 D3).");
 	}
 
 	// One temp root holding the whole garden this smoke can see: store, mailbox