@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/mutants/v2-visible-resume.json

@@ -0,0 +1,215 @@
+{
+	"schemaVersion": 1,
+	"lane": "v2-visible-resume",
+	"mutants": [
+		{
+			"claim": "V2RESUME-LIVE-REFUSED",
+			"title": "the live check inverts, so a running citizen gets a second window on its own transcript",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (mapped.liveness === \"alive\") {"],
+			"replace": ["\t\tif (mapped.liveness === \"dead\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LIVE-REFUSED]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-INDETERMINATE-NO-START",
+			"title": "an inconclusive probe stops being a refusal, so a citizen that may be running is resumed anyway",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (mapped.liveness === \"indeterminate\") {"],
+			"replace": ["\t\tif (mapped.liveness === \"alive\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-INDETERMINATE-NO-START]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-CONFLICT-NO-START",
+			"title": "a corrupt control-socket address stops being a refusal and a citizen is stood up behind it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (\"addressConflict\" in mapped) {"],
+			"replace": ["\t\tif (\"addressConflictNever\" in mapped) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CONFLICT-NO-START]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-LOCKED-NO-RESOLVE",
+			"title": "a lock conflict is read as success, so the record is opened behind another holder's lock",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (!acquired.ok) {"],
+			"replace": ["\tif (!acquired.ok && acquired.conflict.reason !== \"target-locked\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LOCKED-NO-RESOLVE]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-NO-TRANSCRIPT-FAILS-LOUD",
+			"title": "the leaf's cause-rich throw is swallowed into a placeholder identity, so an unresumable citizen opens a window anyway",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\tlet identity: LaunchIdentity;",
+				"\t\ttry {",
+				"\t\t\tidentity = deps.resolveIdentity(targetGardenId);",
+				"\t\t} catch (err) {"
+			],
+			"replace": [
+				"\t\tlet identity: LaunchIdentity;",
+				"\t\ttry {",
+				"\t\t\tidentity = deps.resolveIdentity(targetGardenId);",
+				"\t\t} catch (err) {",
+				"\t\t\tif (!(err instanceof ResumeBackendUnsupportedError))",
+				"\t\t\t\treturn { ok: false, reason: \"target-invalid\", detail: String(err) };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-NO-TRANSCRIPT-FAILS-LOUD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-OBSERVE-IS-BOUNDED-WAIT",
+			"title": "the observation becomes a single immediate probe, which reports every real resume as unobserved (the socket answers ~2-4s later)",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tawait deps.sleep(intervalMs);"],
+			"replace": ["\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-OBSERVE-IS-BOUNDED-WAIT]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-UNOBSERVED-IS-REAL",
+			"title": "a timeout claims the socket answered, turning the one fact that says the citizen is back into a guess",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"replace": ["\t\t\treturn { kind: \"socket-alive\", socketPath, waitedMs: deps.now() - started };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-UNOBSERVED-IS-REAL]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-RELEASE-FAILURE-LOUD",
+			"title": "a release that did not release is folded into a green receipt, leaving a held lock nobody is told about",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (outcome !== \"released\") {"],
+			"replace": ["\t\tif (outcome !== \"released\" && outcome !== \"not-owned\" && outcome !== \"absent\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-RELEASE-FAILURE-LOUD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-ARGV-FROM-RECORD",
+			"title": "the launcher is handed the caller's own directory instead of the record's, so the citizen returns in the wrong project",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst launched = deps.launch({ cwd: identity.cwd, runtimeArgs });"],
+			"replace": ["\t\tconst launched = deps.launch({ cwd: process.cwd(), runtimeArgs });"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-ARGV-FROM-RECORD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-RECEIPTS-SEPARATE",
+			"title": "the launch receipt absorbs the observation, so 'a window opened' and 'the citizen is back' become one claim",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },"],
+			"replace": [
+				"\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle, kind: observation.kind } as ResumeLaunchReceipt,"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-RECEIPTS-SEPARATE]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-RENDER-SEPARATES",
+			"title": "the rendered text merges the two receipts into one sentence, so a reader cannot tell which fact is missing",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t`LAUNCH receipt: tmux created that window and was asked to start pi on the transcript above.\\n` +"
+			],
+			"replace": ["\t\t\t`Resume complete.\\n` +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-RENDER-SEPARATES]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-IDENTITY-BEFORE-WINDOW",
+			"title": "the liveness preflight runs BEFORE the record is read, so dormancy is judged for a citizen whose transcript has not been proven resumable yet",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tlet identity: LaunchIdentity;"],
+			"replace": ["\t\tawait deps.inspectSocket(targetGardenId);", "\t\tlet identity: LaunchIdentity;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-IDENTITY-BEFORE-WINDOW]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-TIMEOUT-RELEASES",
+			"title": "the timeout path launches a second time — the relaunch this rail refuses, hidden inside what reads as one bounded wait",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"replace": [
+				"\t\t\t(deps as VisibleResumeDeps).launch({ cwd: \"/tmp\", runtimeArgs: [] });\n\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-TIMEOUT-RELEASES]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-LOCK-BEFORE-LIVENESS",
+			"title": "the lock stops being taken first, so a competing resume can pass its own dead check while this one is launching",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tconst acquired = deps.acquireLock(targetGardenId);"],
+			"replace": ["\tawait deps.inspectSocket(targetGardenId);\n\tconst acquired = deps.acquireLock(targetGardenId);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LOCK-BEFORE-LIVENESS]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-NOT-PI-REFUSED",
+			"title": "an out-of-domain backend is reported as an error instead of a named refusal, so a fine record reads as a broken one",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tif (err instanceof ResumeBackendUnsupportedError) {"],
+			"replace": ["\t\t\tif (false && err instanceof ResumeBackendUnsupportedError) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-NOT-PI-REFUSED]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-NOT-PI-BY-FIELD",
+			"title": "the backend is re-derived instead of taken from the typed error, which is the second read this rail refuses",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi citizens stand a control socket up, ` +"
+			],
+			"replace": [
+				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi citizens stand a control socket up, ` +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-NOT-PI-BY-FIELD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-SHARED-ID-GRAMMAR",
+			"title": "the address grammar is re-implemented locally, where it can drift from the record, the lock path and the socket filename it becomes",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (!isValidSessionId(targetGardenId)) {"],
+			"replace": ["\tif (!/^\\d{8}T\\d{6}-[0-9a-f]{6}$/.test(targetGardenId)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-SHARED-ID-GRAMMAR]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		}
+	]
+}

package/scripts/new-session-id.ts

@@ -1,11 +1,16 @@
 /**
  * new-session-id — print one fresh garden-native sessionId and exit.
  *
- * The garden launcher (operator alias / wrapper) calls this so every
- * `--entwurf-control` session is born a garden citizen:
+ * NOT a launcher contract. #50 C2 retired the injection form
+ * (`pi --session-id "$(./run.sh new-session-id)" --entwurf-control …`): pi mints its
+ * own session id (a `uuidv7` is normal), `session_start` attaches that session to its
+ * meta-record, and the RECORD mints the garden id and keys the control socket on it.
+ * Injecting a garden-shaped id gives a session two address-shaped strings of which only
+ * one is an address. Launch is plain `pi --entwurf-control` (README §Garden launcher).
  *
- *   pi --session-id "$(./run.sh new-session-id)" --entwurf-control \
- *      --emacs-agent-socket server …
+ * What survives is this: the operator-facing generator for the same id grammar the
+ * record layer itself uses — one fresh id on stdout, for a caller that needs to mint a
+ * token deliberately, never as a launch argument.
  *
  * The id is `generateSessionId()` from entwurf-core — the single SSOT for the
  * locked `YYYYMMDDTHHMMSS-[0-9a-f]{6}` grammar. Do NOT reimplement the format in

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -52,6 +52,7 @@ import * as readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { fetchControlSocketRuntimeInfo, formatRuntimeModel } from "../pi-extensions/lib/entwurf-control-rpc.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
@@ -160,10 +161,10 @@ function driveSelfTurn(child: ChildProcess, prompt: string): Promise<TurnCapture
 
 async function main(): Promise<void> {
 	if (process.env.LIVE !== "1") {
-		console.log(
-			"[smoke-acp-bundled-mcp-live] skipped — set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
+		skipLive(
+			"smoke-acp-bundled-mcp-live",
+			"set LIVE=1 to run (spawns a real pi --entwurf-control resident + drives one model turn).",
 		);
-		return;
 	}
 
 	const tmp = os.tmpdir();

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -45,6 +45,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
@@ -57,8 +58,7 @@ function fail(msg: string): never {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-carrier-augment-live] skipped — set LIVE=1 to run the real pi provider turn.");
-	process.exit(0);
+	skipLive("smoke-acp-carrier-augment-live", "set LIVE=1 to run the real pi provider turn.");
 }
 
 // Billing-reclassification canaries (핀1). The empty carrier must NOT trip metered

package/scripts/smoke-acp-cortex-live.ts

@@ -5,7 +5,7 @@
 //
 //   LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live
 //
-// WHY this exact axis. The CP0 audit (docs/acp-backend-rail.md §11-8) measured
+// WHY this exact axis. The CP0 audit (docs/acp-backend-rail.md, Cortex D1–D10) measured
 // three things no offline gate can prove:
 //   - D9/D10: cortex ignores the wire `mcpServers` param, so the bundled
 //     entwurf-bridge reaches a cortex session ONLY through the overlay-private
@@ -32,7 +32,7 @@
 // LIVE-only and OUTSIDE the claude-only AGGREGATE release floor (capability
 // dignity): a host that runs no cortex must not redden a claude release. That is
 // a wiring decision — shipping cortex still owes a deliberate run of this smoke,
-// and the aggregate gate's silence is not a pass (rail §11-8 tail).
+// and the aggregate gate's silence is not a pass (ACP rail verification boundary).
 // Honest skip when LIVE!=1, when `cortex` is not on PATH, or when
 // ENTWURF_ACP_CORTEX_CONNECTION is unset — the overlay denies the operator's
 // cortex settings.json (where a default connection would live), so the
@@ -53,6 +53,7 @@ import * as readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { upsertMetaSession, writeMetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
@@ -189,24 +190,17 @@ function driveTurn(child: ChildProcess, prompt: string): Promise<TurnCapture> {
 
 async function main(): Promise<void> {
 	if (process.env.LIVE !== "1") {
-		console.log(
-			"[smoke-acp-cortex-live] skipped — set LIVE=1 to run (spawns a real cortex ACP resident + one model turn).",
-		);
-		return;
+		skipLive("smoke-acp-cortex-live", "set LIVE=1 to run (spawns a real cortex ACP resident + one model turn).");
 	}
 	const connection = process.env.ENTWURF_ACP_CORTEX_CONNECTION?.trim();
 	if (!connection) {
-		console.log(
-			"[smoke-acp-cortex-live] skipped — set ENTWURF_ACP_CORTEX_CONNECTION=<snowflake connection> (the dual-HOME " +
-				"overlay denies the operator cortex settings.json, so the connection must ride the adapter's own seam).",
+		skipLive(
+			"smoke-acp-cortex-live",
+			"set ENTWURF_ACP_CORTEX_CONNECTION=<snowflake connection> (the dual-HOME overlay denies the operator cortex settings.json, so the connection must ride the adapter's own seam).",
 		);
-		return;
 	}
 	if ("CORTEX_HOME" in process.env) {
-		console.log(
-			"[smoke-acp-cortex-live] skipped — unset CORTEX_HOME first (the adapter refuses its presence, CP0 D3).",
-		);
-		return;
+		skipLive("smoke-acp-cortex-live", "unset CORTEX_HOME first (the adapter refuses its presence, CP0 D3).");
 	}
 
 	// One temp root holding the whole garden this smoke can see: store, mailbox

package/scripts/smoke-acp-long-turn-live.ts

@@ -0,0 +1,185 @@
+// 0.13.1 — LIVE acceptance for the prompt-lifecycle contract. OUT of `pnpm check`.
+//
+//   LIVE=1 ./run.sh smoke-acp-long-turn-live
+//
+// THE CLAIM THIS PAYS FOR. `check-acp-prompt-lifecycle` proves against fakes
+// that a running prompt has no wall clock, and `check-probe-ordering` proves the
+// source carries none. Neither can prove the whole stack — pi's runner, its
+// retry policy, the real adapter, and a real model — lets a turn run past the
+// number we deleted. This smoke does exactly that and nothing else: it drives
+// ONE real turn whose tool work is deliberately longer than the retired 600s
+// cutoff, and requires it to finish as ONE turn.
+//
+// Two facts are asserted together, because the old defect was their PRODUCT:
+//
+//   survives    the reply carries the nonce and the turn took LONGER than the
+//               retired cutoff — a fixed wall clock would have killed it.
+//   not replayed
+//               the persisted transcript contains exactly ONE bootstrap notice
+//               ("[acp: preparing claude session]"). The old failure mode
+//               replayed the same full prompt from a COLD ACP session up to
+//               `retry.maxRetries` times, so every replay re-announced that
+//               bootstrap. One occurrence is the direct evidence that the answer
+//               came from the original prompt.
+//
+// The work is split into several tool calls under the backend's own per-command
+// tool cap rather than one huge wait, which is also the realistic shape of the
+// turns that were being killed (continuous tool activity, no output for minutes).
+//
+// WHY THE WORK IS NOT `sleep` (measured 2026-07-30, first LIVE attempt). Asking
+// for `sleep 240` produced a 22.9s turn with no nonce: the Claude backend's own
+// Bash tool refuses a FOREGROUND `sleep` ("Foreground `sleep` is blocked; use
+// Monitor with an until-loop"), so the model detached it, reported "Command
+// running in background", said it would wait, and ended the turn. The tool work
+// never happened, so nothing about the wall clock was measured. The blocking
+// command below waits the same wall time without invoking `sleep`, which is the
+// only reason the shape changed — the claim is unchanged.
+
+import { strict as assert } from "node:assert";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { skipLive } from "./lib/live-skip.ts";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const MODEL = process.env.ENTWURF_ACP_LONG_TURN_MODEL?.trim() || "claude-sonnet-5";
+const PROVIDER = "entwurf";
+
+/** The cutoff this cut removed. The turn must outlive it. */
+const RETIRED_CUTOFF_MS = 600_000;
+/** Seconds per tool call — each stays under the backend's own per-command cap. */
+const SLEEP_SECONDS = Number(process.env.ENTWURF_ACP_LONG_TURN_SLEEP_SECONDS) || 240;
+/** How many sequential waits to ask for (3 × 240s = 720s > the retired cutoff). */
+const SLEEP_ROUNDS = Number(process.env.ENTWURF_ACP_LONG_TURN_ROUNDS) || 3;
+/** Harness bound for the WHOLE smoke — an observation horizon, not a turn contract. */
+const SMOKE_HORIZON_MS = Number(process.env.ENTWURF_ACP_LONG_TURN_HORIZON_MS) || 2_400_000;
+
+function fail(msg: string): never {
+	console.error(`[smoke-acp-long-turn-live] FAIL: ${msg}`);
+	process.exit(1);
+}
+
+if (process.env.LIVE !== "1") {
+	skipLive("smoke-acp-long-turn-live", "set LIVE=1 to run the real long ACP turn.");
+}
+
+const nonce = `${process.pid.toString(36)}${Date.now().toString(36)}`;
+const expected = `LONGTURN_OK_${nonce}`;
+const sessionId = `long-turn-${nonce}`;
+
+const scratch = mkdtempSync(join(tmpdir(), "entwurf-long-turn-"));
+const sessionDir = mkdtempSync(join(tmpdir(), "entwurf-long-turn-sessions-"));
+const startedAt = Date.now();
+try {
+	// Blocks for SLEEP_SECONDS in the FOREGROUND without invoking `sleep` (see the
+	// header): select() with only a timeout is a plain wait, and the echo gives
+	// each round a visible completion marker in the transcript.
+	const waitCommand = `python3 -c "import select; select.select([], [], [], ${SLEEP_SECONDS})" && echo ROUND_COMPLETE`;
+
+	const prompt =
+		`Run exactly ${SLEEP_ROUNDS} shell commands with your shell tool, one at a time, waiting for each to print ` +
+		`ROUND_COMPLETE before starting the next. Each command is exactly: ${waitCommand}\n\n` +
+		`Each one blocks for about ${SLEEP_SECONDS} seconds, so give the shell tool a per-command limit of at least ` +
+		`${(SLEEP_SECONDS + 60) * 1000} ms. Run every command in the FOREGROUND and wait for its output — do not ` +
+		"detach it, do not run it in the background, do not poll for it, do not shorten it, and do not run them in " +
+		`parallel. When all ${SLEEP_ROUNDS} have printed ROUND_COMPLETE, reply with exactly ${expected} and nothing else.`;
+
+	const args = [
+		"--no-extensions",
+		"-e",
+		REPO_ROOT,
+		"--mode",
+		"text",
+		"--session-id",
+		sessionId,
+		"--session-dir",
+		sessionDir,
+		"-p",
+		"--approve",
+		"--provider",
+		PROVIDER,
+		"--model",
+		MODEL,
+		prompt,
+	];
+
+	console.error(`[smoke-acp-long-turn-live] repo:    ${REPO_ROOT}`);
+	console.error(`[smoke-acp-long-turn-live] cwd:     ${scratch}`);
+	console.error(`[smoke-acp-long-turn-live] model:   ${PROVIDER}/${MODEL}`);
+	console.error(`[smoke-acp-long-turn-live] work:    ${SLEEP_ROUNDS} × ${SLEEP_SECONDS}s foreground wait`);
+	console.error(`[smoke-acp-long-turn-live] expects: ${expected} after > ${RETIRED_CUTOFF_MS}ms`);
+
+	const res = spawnSync("pi", args, { cwd: scratch, encoding: "utf8", timeout: SMOKE_HORIZON_MS, env: process.env });
+	const elapsed = Date.now() - startedAt;
+
+	const stdout = res.stdout ?? "";
+	const stderr = res.stderr ?? "";
+	const combined = `${stdout}\n${stderr}`;
+	const tail = combined.split("\n").slice(-30).join("\n");
+
+	if (res.error) {
+		console.error(`[smoke-acp-long-turn-live] output tail:\n${tail}`);
+		fail(`pi spawn failed after ${elapsed}ms: ${res.error.message}`);
+	}
+	if (res.status !== 0) {
+		console.error(`[smoke-acp-long-turn-live] output tail:\n${tail}`);
+		fail(`pi exited ${res.status} (signal=${res.signal ?? "none"}) after ${elapsed}ms`);
+	}
+
+	assert.ok(
+		stdout.includes(expected),
+		`the long turn did not deliver its nonce ${expected} after ${elapsed}ms (stdout tail: ${JSON.stringify(stdout.slice(-400))})`,
+	);
+	assert.ok(
+		elapsed > RETIRED_CUTOFF_MS,
+		`the turn finished in ${elapsed}ms — under the retired ${RETIRED_CUTOFF_MS}ms cutoff, so it proves nothing. ` +
+			"Raise ENTWURF_ACP_LONG_TURN_ROUNDS / _SLEEP_SECONDS until the tool work outlasts the cutoff.",
+	);
+
+	// No cold replay: exactly one bootstrap in the persisted transcript.
+	const jsonl = readdirSync(sessionDir, { recursive: true })
+		.filter((f): f is string => typeof f === "string" && f.endsWith(".jsonl"))
+		.map((f) => readFileSync(join(sessionDir, f), "utf8"))
+		.join("\n");
+	assert.ok(jsonl.length > 0, `no session JSONL under ${sessionDir} — cannot judge replay`);
+	const bootstraps = jsonl.split("[acp: preparing claude session]").length - 1;
+	assert.equal(
+		bootstraps,
+		1,
+		`the transcript shows ${bootstraps} cold ACP bootstraps — a long turn must be answered by its ORIGINAL prompt, ` +
+			"not replayed from a fresh session (that replay is what turned one long turn into four)",
+	);
+	// The DEFECT's own signatures, not the word "timeout" anywhere: the model
+	// narrates its shell tool's per-command limit in this transcript, so a bare
+	// /timeout/i would fail an otherwise perfect run on the assistant's own prose.
+	// These three strings are what the old pairing actually emitted — the retired
+	// cutoff's message, and pi's retry-exhaustion wording.
+	const defectMarkers = [
+		/prompt timed out after/i,
+		/Aborted after \d+ retry attempts?/i,
+		/\bretry attempt \d+/i,
+	].filter((re) => re.test(combined));
+	assert.equal(
+		defectMarkers.length,
+		0,
+		`the run reported the retired cutoff or a pi retry — neither may happen to a healthy long turn ` +
+			`(matched ${defectMarkers.join(", ")}; tail: ${JSON.stringify(tail)})`,
+	);
+
+	console.log("[smoke-acp-long-turn-live] PASS — a real ACP turn outlived the retired wall clock and answered once");
+	console.log(`  model:    ${PROVIDER}/${MODEL}`);
+	console.log(`  elapsed:  ${elapsed}ms (> retired cutoff ${RETIRED_CUTOFF_MS}ms)`);
+	console.log(`  nonce:    ${expected} present in the assistant reply`);
+	console.log("  replay:   exactly 1 cold ACP bootstrap in the persisted transcript");
+	console.log("  retry:    no retry / timeout reported anywhere in the run");
+} finally {
+	for (const d of [scratch, sessionDir]) {
+		try {
+			rmSync(d, { recursive: true, force: true });
+		} catch {
+			// best-effort cleanup
+		}
+	}
+}

package/scripts/smoke-acp-mcp-live.ts

@@ -26,6 +26,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const PROBE_SERVER = join(REPO_ROOT, "scripts", "fixtures", "probe-mcp-server.ts");
@@ -39,8 +40,7 @@ function fail(msg: string): never {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-mcp-live] skipped — set LIVE=1 to run the real pi provider turn.");
-	process.exit(0);
+	skipLive("smoke-acp-mcp-live", "set LIVE=1 to run the real pi provider turn.");
 }
 
 const STUB_PATTERN = /AcpBackendNotImplementedError|not implemented in S0/i;

package/scripts/smoke-acp-memory-containment-live.ts

@@ -68,6 +68,7 @@ import {
 	DEFAULT_CLAUDE_TOOLS,
 } from "../pi-extensions/lib/acp/tool-surface.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_MEMORY_MODEL ?? "claude-sonnet-5";
 const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_MEMORY_ALLOW_PATH_FALLBACK === "1";
@@ -109,8 +110,7 @@ async function listMemoryFiles(dir: string): Promise<string[]> {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-memory-containment-live] skipped — set LIVE=1 to run the real memory-containment turn.");
-	process.exit(0);
+	skipLive("smoke-acp-memory-containment-live", "set LIVE=1 to run the real memory-containment turn.");
 }
 
 function resolveLaunch(): { command: string; args: string[]; source: string; acceptance: boolean } {

package/scripts/smoke-acp-ordering-probe-live.ts

@@ -50,6 +50,7 @@ import { type AcpClientHandlers, connectAcpClient } from "../pi-extensions/lib/a
 import type { AcpBackendAdapter } from "../pi-extensions/lib/acp/backend-adapter.ts";
 import type { ResolvedAcpConfig } from "../pi-extensions/lib/acp/config.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 import { driveProbeTurn, type ProbeMcpEnricher, ProbePhaseError } from "./lib/probe-acp-turn.ts";
 import {
 	AMBIENT_OVERRIDE_ENV,
@@ -103,8 +104,7 @@ function fail(msg: string): never {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-ordering-probe-live] skipped — set LIVE=1 to run the real paired probe.");
-	process.exit(0);
+	skipLive("smoke-acp-ordering-probe-live", "set LIVE=1 to run the real paired probe.");
 }
 
 for (const [label, d] of [

package/scripts/smoke-acp-overlay-live.ts

@@ -55,6 +55,7 @@ import {
 	DEFAULT_CLAUDE_TOOLS,
 } from "../pi-extensions/lib/acp/tool-surface.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_OVERLAY_MODEL ?? "claude-sonnet-5";
 const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_OVERLAY_ALLOW_PATH_FALLBACK === "1";
@@ -76,8 +77,7 @@ function withTimeout<T>(label: string, p: Promise<T>, ms: number): Promise<T> {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-overlay-live] skipped — set LIVE=1 to run the real overlay ACP turn.");
-	process.exit(0);
+	skipLive("smoke-acp-overlay-live", "set LIVE=1 to run the real overlay ACP turn.");
 }
 
 function resolveLaunch(): { command: string; args: string[]; source: string; acceptance: boolean } {

package/scripts/smoke-acp-provider-live.ts

@@ -26,6 +26,7 @@ import { mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
@@ -38,8 +39,7 @@ function fail(msg: string): never {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-provider-live] skipped — set LIVE=1 to run the real pi provider turn.");
-	process.exit(0);
+	skipLive("smoke-acp-provider-live", "set LIVE=1 to run the real pi provider turn.");
 }
 
 // A nonce makes the expected reply unique so a stray "OK" elsewhere in the

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.62.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.66.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).
@@ -34,6 +34,7 @@ import { Readable, Writable } from "node:stream";
 import { ndJsonStream, PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
 import { connectAcpClient } from "../pi-extensions/lib/acp/acp-client.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { skipLive } from "./lib/live-skip.ts";
 
 const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_RAW_TURN_MODEL ?? "claude-sonnet-5";
 const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK === "1";
@@ -59,8 +60,7 @@ function withTimeout<T>(label: string, p: Promise<T>, ms: number): Promise<T> {
 }
 
 if (process.env.LIVE !== "1") {
-	console.error("[smoke-acp-raw-turn-live] skipped — set LIVE=1 to run the real ACP turn.");
-	process.exit(0);
+	skipLive("smoke-acp-raw-turn-live", "set LIVE=1 to run the real ACP turn.");
 }
 
 // ---------------------------------------------------------------------------