@junghanacs/entwurf 0.13.1 → 0.14.0

package/pi-extensions/entwurf-control.ts

@@ -25,14 +25,14 @@
  * - Register the canonical `entwurf_v2` dispatch tool for existing garden citizens.
  * - Expose `entwurf_peers` facts for operator inspection (#50 C4: the socket-scan
  *   `/entwurf-sessions` command is gone — the record listing is the only surface).
- * - Maintain the resident control socket used by v2 live-send / spawn-bg paths.
+ * - Maintain the resident control socket used by the v2 live-send path.
  * - Attach this pi session to its meta-record at session_start (#50 C2) and key
  *   the control socket on the record's gardenId.
  *
  * Send-is-throw still applies at the control-socket protocol layer: a `send` RPC
  * ack confirms the receiver enqueued the message (`message_processed` semantics)
  * and does not wait for a peer turn result. Public v1 send surfaces were removed;
- * callers use `entwurf_v2`, whose decider chooses send / spawn-bg / mailbox.
+ * callers use `entwurf_v2`, whose decider chooses control-socket send / mailbox / native-push.
  *
  * Usage:
  *   pi --entwurf-control      (no id injection: pi owns its id, the record owns
@@ -758,8 +758,9 @@ async function handleCommand(
 		// (entwurf-bridge entwurf_v2, the pi-native entwurf_v2 senderProvider via buildLocalSenderEnvelope)
 		// pass the envelope structurally and never touch the message body — the
 		// canonical XML-style payload is the shared formatSenderInfoBlock SSOT
-		// (#50 C3: the dormant spawn-resume rail appends the same block to its
-		// prompt, so both rails render one shape).
+		// (#50 C3: this is the ONE renderer since the visible-first cut removed the
+		// dormant spawn-resume rail that used to append the same block to a resume
+		// prompt — a future VISIBLE resume must render through it, not beside it).
 		const senderInfoBlock = sender ? formatSenderInfoBlock(sender, wantsReply) : "";
 
 		const mode = command.mode ?? "steer";
@@ -938,7 +939,8 @@ function updateStatus(ctx: ExtensionContext | null, enabled: boolean, gardenId:
 // is GONE with the id it mirrored. A name was a second place the address lived; the
 // record is the only one now, so there is nothing left to keep in sync and nothing
 // to crash over. (The dormant-resume authorization that leaned on the `entwurf` tag
-// moved to record existence — see entwurf-v2-spawn-production.)
+// moved to record existence, and that resume rail has since been withdrawn entirely;
+// the record-authoritative remainder lives in resume-launch-identity.ts.)
 
 function updateSessionEnv(ctx: ExtensionContext | null, enabled: boolean, gardenId: string | null): void {
 	if (!enabled || !gardenId) {
@@ -985,7 +987,7 @@ function getStringFlagFromArgv(flagName: string): string | undefined {
 }
 
 // `--emacs-agent-socket <name>` exports PI_EMACS_AGENT_SOCKET so this session's
-// own Bash/emacsclient calls (and any spawn-bg child that inherits this env)
+// own Bash/emacsclient calls (and any child process that inherits this env)
 // target the right Emacs server socket — e.g. `emacsclient -s "$PI_EMACS_AGENT_SOCKET"`.
 // v2-only revival: the original ACP path injected this into the ACP child's spawn
 // env (acp-bridge.ts); with no ACP child on this branch, the consumer IS this pi
@@ -1042,6 +1044,8 @@ export default function (pi: ExtensionAPI) {
 	if (shouldRegisterControlTools(pi)) {
 		registerListSessionsTool(pi);
 		registerEntwurfV2Tool(pi);
+		registerFreshCallTool(pi);
+		registerResumeCallTool(pi);
 	}
 
 	// The in-process mint refusals (`/new`, `/fork`, `/clone`, RPC new_session) are
@@ -1258,23 +1262,19 @@ interface EntwurfV2SurfaceModule {
 	runAndRenderEntwurfV2FromSurface(
 		params: {
 			target: string;
-			intent: "fire-and-forget" | "owned-outcome";
+			intent: "fire-and-forget";
 			mode?: "steer" | "follow_up";
 			wants_reply?: boolean;
 			message: string;
 		},
-		opts: {
-			senderProvider: () => SenderEnvelope | undefined;
-			agentDir?: string;
-			prefixRoots?: readonly string[];
-		},
+		opts: { senderProvider: () => SenderEnvelope | undefined },
 	): Promise<{ text: string; isError: boolean }>;
 }
 
 function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 	const entwurfV2Parameters = Type.Object({
 		target: Type.String({ description: "Target garden id (use entwurf_peers to discover)" }),
-		intent: StringEnum(["fire-and-forget", "owned-outcome"] as const, {
+		intent: StringEnum(["fire-and-forget"] as const, {
 			description:
 				"fire-and-forget = send/reply/hand-off to a LIVE socket target (currently backend pi) or to any " +
 				"citizen with no socket liveness — the decider picks that citizen's rail, and a rail can also " +
@@ -1284,10 +1284,10 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 				"dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate (two rejects, " +
 				"not one). " +
 				"Set wants_reply for an answer. " +
-				"owned-outcome = wake a DORMANT socket-domain citizen via spawn-bg resume ONLY — on a live target " +
-				"rejected as owned-live-no-autosend, on self-fetch as backend-liveness-unsupported, on " +
-				"native-push as native-push-no-resume-authority (both lack resume authority, but the reasons " +
-				"differ because native-push IS probe-measured), and never auto-converted",
+				"This is the ONLY intent. The second one, owned-outcome, resumed a dormant citizen by launching " +
+				"a hidden background child and was withdrawn under the visible-first rule; it is not selectable, " +
+				"not deprecated-but-tolerated, and a dormant citizen is currently unreachable by this verb and " +
+				"rejects as dormant-fire-forget-unsupported.",
 		}),
 		message: Type.String({
 			description:
@@ -1298,7 +1298,7 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 			StringEnum(["steer", "follow_up"] as const, {
 				description:
 					"Injection style for a CONTROL-SOCKET send only: steer (immediate) or follow_up (after task). " +
-					"The mailbox, native-push, and spawn-bg plans carry no mode, so it has no effect on those rails.",
+					"The mailbox and native-push plans carry no mode, so it has no effect on those rails.",
 			}),
 		),
 		wants_reply: Type.Optional(Type.Boolean({ description: "Human-conversation reply hint (default false)" })),
@@ -1306,7 +1306,7 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 
 	type EntwurfV2Params = {
 		target: string;
-		intent: "fire-and-forget" | "owned-outcome";
+		intent: "fire-and-forget";
 		message: string;
 		mode?: "steer" | "follow_up";
 		wants_reply?: boolean;
@@ -1324,24 +1324,24 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 		label: "Dispatch (v2)",
 		description: `CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id alone
 does not say which rail that citizen answers on. Give target + intent; the decider picks transport from
-liveness (live socket citizen → control-socket send; dormant socket citizen → spawn-bg resume; deliverable
-self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection into its
-conversation) and reports ONE outcome (delivered / rejected / lock-retained / delivered-but-lock-dirty).
-EXISTING targets only; discover with entwurf_peers. INTENT — picking wrong is rejected, never
-auto-converted. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A citizen with NO socket
-liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only "no control-socket probe" —
-and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) gets the mailbox, a native-push
-backend (e.g. Antigravity) gets direct injection and has NO mailbox at all. THERE IS A THIRD RESULT: the
-mailbox delivers only to a DELIVERABLE citizen, so a terminated session, or a backend with no adapter here
-(e.g. codex), is mailbox-undeliverable, not queued for an inbox nobody drains. The native-push probe is
-3-valued: alive → injected; dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate
-(unestablished ≠ gone). owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live
-target → owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push →
-native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND the
-dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The mailbox
-and native-push rails are lock-free — deliverability and the adapter probe guard them. mode applies to a
-CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000
-chars; send an artifact path + digest for more.`,
+liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox;
+probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome
+(delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers.
+A peer entwurf_peers shows as liveness=alive → fire-and-forget. A citizen with NO socket liveness
+(liveness=unsupported) is ALSO fire-and-forget — unsupported means only "no control-socket probe" — and the
+decider picks its own rail: a self-fetch backend (e.g. Claude Code) gets the mailbox, a native-push backend
+(e.g. Antigravity) gets direct injection and has NO mailbox at all. THERE IS A THIRD RESULT: the mailbox
+delivers only to a DELIVERABLE citizen, so a terminated session, or a backend with no adapter here (e.g.
+codex), is mailbox-undeliverable, not queued for an inbox nobody drains. The native-push probe is 3-valued:
+alive → injected; dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate
+(unestablished ≠ gone). DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets
+dormant-fire-forget-unsupported — same receiver rule as the mailbox, no active drainer means no
+delivery. The intent that used to answer there, owned-outcome, resumed it by
+launching a hidden background child; it was withdrawn under the visible-first rule, so re-open the session
+yourself and dispatch again. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push
+rails are lock-free — deliverability and the adapter probe guard them. mode applies to a CONTROL-SOCKET
+send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000 chars; send an
+artifact path + digest for more.`,
 		parameters: entwurfV2Parameters,
 		async execute(
 			_toolCallId: string,
@@ -1381,8 +1381,10 @@ chars; send an artifact path + digest for more.`,
 						mode: params.mode,
 						wants_reply: params.wants_reply,
 					},
-					// agentDir / prefixRoots intentionally omitted here: the surface adapter falls back
-					// to the ENTWURF_PREFIX_ROOTS env SSOT for prefixRoots (5d-4); agentDir stays undefined.
+					// No trust-preflight inputs are passed, and none exist to pass: the preflight on this
+					// path guarded the resume verdict, so it left with `owned-outcome`. `senderProvider`
+					// is the whole options surface now — do NOT re-add an `ENTWURF_PREFIX_ROOTS` fallback
+					// here without a verdict that reads it (nothing on the dispatch path does).
 					{ senderProvider },
 				);
 				return {
@@ -1453,7 +1455,7 @@ function registerListSessionsTool(pi: ExtensionAPI): void {
 		name: "entwurf_peers",
 		label: "List Garden Citizens",
 		description:
-			"List the entwurf fact surface: garden citizens from meta-records (including active self-fetch meta receivers such as claude-code) with liveness, plus diagnostics. The record is the sole address axis (#50 C4) — a control socket no record claims surfaces as a record-less-socket diagnostic, never a peer row. Pair with entwurf_v2 to address a peer by garden id; this surface reports facts, never per-row routing verbs.",
+			"List the entwurf fact surface: garden citizens from meta-records (including active self-fetch meta receivers such as claude-code) with liveness, plus diagnostics. The record is the sole address axis (#50 C4) — a control socket no record claims surfaces as a record-less-socket diagnostic, never a peer row. Pair with entwurf_v2 to address a peer by garden id; this surface reports facts, never per-row routing verbs. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is currently unreachable by any verb, so listing it grants no action — appearing here is not an invitation to dispatch. It is facts-only and creates nothing: to open a NEW sibling use entwurf_fresh_call.",
 		parameters: Type.Object({}),
 		async execute(
 			_toolCallId: string,
@@ -1478,3 +1480,179 @@ function registerListSessionsTool(pi: ExtensionAPI): void {
 		},
 	});
 }
+
+// ============================================================================
+// Tool: entwurf_fresh_call
+// ============================================================================
+
+const MUX_FRESH_CALL_MODULE = "./lib/mux-fresh-call.ts";
+
+interface MuxFreshCallModule {
+	freshCall(
+		params: { backend: "pi" | "claude-code"; model: string; task: string; callerGardenId: string | null },
+		env?: NodeJS.ProcessEnv,
+	): { ok: boolean };
+	renderFreshCall(result: { ok: boolean }): { text: string; isError: boolean };
+}
+
+/**
+ * The caller identity for this surface is the RESIDENT's garden address — the one the record
+ * minted at session start and keyed the control socket on. It is read from this extension's own
+ * closure, never from a tool parameter and never from `process.env`.
+ *
+ * A caller that could pass an id could pass a WRONG one, and that value would become the address
+ * the sibling calls back to — docs/mux-launch-rail.md §6-b keeps the measured incident. So there
+ * is no parameter to be wrong with.
+ *
+ * A null resident id refuses LOUDLY rather than falling back: without an address to call back to,
+ * the launch would be a window with no way home.
+ */
+function registerFreshCallTool(pi: ExtensionAPI): void {
+	// Same TS2589 workaround as registerEntwurfV2Tool — see the comment block there.
+	const registerTool = pi.registerTool as (def: any) => void;
+	registerTool({
+		name: "entwurf_fresh_call",
+		label: "Open Fresh Sibling",
+		description: `Open ONE fresh visible sibling in the operator's own tmux session and hand it a first task. Two fixed
+backends only: pi, claude-code. The sibling's FIRST action is a callback to you carrying a nonce, and the
+sender envelope of that callback is its garden id — that is how you learn the address of something that did
+not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing else:
+it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls for the
+callback; if it never arrives the window is visible and can be read directly. For EXISTING citizens use
+entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the
+chosen runtime CLI (provider/model for pi; model id/alias for Claude Code); there are no arbitrary
+command/cwd/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
+processes on this host.`,
+		parameters: Type.Object({
+			backend: StringEnum(["pi", "claude-code"], {
+				description: "Which fixed runtime to open. Only these two; there is no arbitrary command.",
+			}),
+			model: Type.String({
+				minLength: 1,
+				maxLength: 200,
+				pattern: "^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$",
+				description: "Required runtime model: canonical provider/model for pi, or a Claude Code model id/alias.",
+			}),
+			task: Type.String({
+				minLength: 1,
+				maxLength: 16000,
+				description:
+					"What the sibling should do after it calls you back. Plain instructions; no secrets (see the tool description).",
+			}),
+		}),
+		async execute(
+			_toolCallId: string,
+			params: { backend: "pi" | "claude-code"; model: string; task: string },
+			_signal: AbortSignal | undefined,
+			_onUpdate: unknown,
+			_ctx: ExtensionContext,
+		) {
+			try {
+				const mux = (await import(MUX_FRESH_CALL_MODULE)) as unknown as MuxFreshCallModule;
+				const result = mux.freshCall({
+					backend: params.backend,
+					model: params.model,
+					task: params.task,
+					callerGardenId: residentGardenId,
+				});
+				const rendered = mux.renderFreshCall(result);
+				return {
+					content: [{ type: "text", text: rendered.text }],
+					isError: rendered.isError,
+					details: { isError: rendered.isError },
+				};
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return {
+					content: [{ type: "text", text: `entwurf_fresh_call error: ${msg}` }],
+					isError: true,
+					details: { error: msg },
+				};
+			}
+		},
+	});
+}
+
+// ============================================================================
+// Tool: entwurf_resume_call
+// ============================================================================
+
+const MUX_RESUME_CALL_MODULE = "./lib/mux-resume-call.ts";
+const V2_VISIBLE_RESUME_MODULE = "./lib/entwurf-v2-visible-resume.ts";
+
+interface MuxResumeCallModule {
+	resumeCall(
+		params: { cwd: string; runtimeArgs: readonly string[] },
+		env?: NodeJS.ProcessEnv,
+	): { ok: true; receipt: Record<string, string> } | { ok: false; reason: string };
+	RESUME_CALL_REJECT_HINT: Record<string, string>;
+}
+
+interface VisibleResumeModule {
+	visibleResume(target: string, deps: unknown): Promise<{ ok: boolean }>;
+	makeVisibleResumeDeps(launch: unknown): unknown;
+	renderVisibleResume(result: { ok: boolean }): { text: string; isError: boolean };
+}
+
+/**
+ * Unlike `entwurf_fresh_call`, this tool needs NO caller identity: a resume names an existing
+ * citizen, so the address is the parameter rather than something the sibling has to report back.
+ * What it needs instead is the per-gid lock, which is why the composition lives on the v2 side of
+ * the fence and only the LAUNCH is handed across (docs/mux-launch-rail.md §11).
+ */
+function registerResumeCallTool(pi: ExtensionAPI): void {
+	// Same TS2589 workaround as registerEntwurfV2Tool — see the comment block there.
+	const registerTool = pi.registerTool as (def: any) => void;
+	registerTool({
+		name: "entwurf_resume_call",
+		label: "Resume Dormant Citizen",
+		description: `Reopen ONE DORMANT pi citizen under its OWN garden id, in a visible window in the operator's own tmux
+session. The record supplies everything — which transcript, which model, which provider, which cwd — so the only
+input is the target id: there is no model override, no task, and no prompt. This runs NO turn: the window comes
+back with the conversation and waits, and talking to it is still entwurf_v2 fire-and-forget on the socket this
+call stands up. You get TWO receipts and they mean different things: a LAUNCH receipt (tmux made a window and was
+asked to start pi) and an OBSERVATION receipt (the control socket answered under the same id, or
+resume-unobserved). Unobserved is a real outcome, not an error to retry — the window is visible, so read it. A
+citizen that is already LIVE is refused: address it with entwurf_v2 instead. Only pi citizens have a same-id
+resume, because only they stand a control socket up.`,
+		parameters: Type.Object({
+			target: Type.String({
+				minLength: 1,
+				pattern: "^\\d{8}T\\d{6}-[0-9a-f]{6}$",
+				description: "Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers).",
+			}),
+		}),
+		async execute(
+			_toolCallId: string,
+			params: { target: string },
+			_signal: AbortSignal | undefined,
+			_onUpdate: unknown,
+			_ctx: ExtensionContext,
+		) {
+			try {
+				const mux = (await import(MUX_RESUME_CALL_MODULE)) as unknown as MuxResumeCallModule;
+				const v2 = (await import(V2_VISIBLE_RESUME_MODULE)) as unknown as VisibleResumeModule;
+				const launch = (input: { cwd: string; runtimeArgs: readonly string[] }) => {
+					const launched = mux.resumeCall(input);
+					return launched.ok
+						? { ok: true, handle: launched.receipt }
+						: { ok: false, reason: launched.reason, hint: mux.RESUME_CALL_REJECT_HINT[launched.reason] };
+				};
+				const result = await v2.visibleResume(params.target, v2.makeVisibleResumeDeps(launch));
+				const rendered = v2.renderVisibleResume(result);
+				return {
+					content: [{ type: "text", text: rendered.text }],
+					isError: rendered.isError,
+					details: { isError: rendered.isError },
+				};
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return {
+					content: [{ type: "text", text: `entwurf_resume_call error: ${msg}` }],
+					isError: true,
+					details: { error: msg },
+				};
+			}
+		},
+	});
+}

package/pi-extensions/lib/acp/backend.ts

@@ -602,6 +602,58 @@ export function actionableAcpBackendHint(message: string): string | undefined {
 	].join("\n");
 }
 
+/**
+ * pi 0.84 streamSimple hook contract (#63; upstream pi-mono #7372 → doc-only PR
+ * #7576): implementations must invoke `options.onPayload` before sending the
+ * provider request and use any returned replacement.
+ *
+ * On this rail the provider request is the ACP `session/prompt` params — so the
+ * hook receives the EXACT `{sessionId, prompt}` object after the wire content is
+ * fully built (augment / reuse delta included) and immediately before
+ * `connection.prompt`. That is the truthful analogue of the built-in providers'
+ * post-build/pre-send boundary. Replacement is honored fail-closed, never
+ * silently: it must be a non-null, non-array object, keep the bootstrapped
+ * `sessionId`, and carry a non-empty prompt array — prompt rewriting is
+ * upstream-granted power, but entwurf cannot truthfully deliver to an ACP
+ * session it did not open, and an emptied prompt would undo this rail's own
+ * non-empty-prompt invariant; either refuses the turn before the wire.
+ *
+ * `options.onResponse` is an EXPLICIT LOCAL NON-HTTP EXEMPTION and is never
+ * invoked anywhere on this rail: pi hard-types it as HTTP `{status, headers}`
+ * (and the `after_provider_response` extension event re-emits exactly that), and
+ * ACP's terminal result arrives only AFTER the session-update body was already
+ * consumed — both the shape and the "before consuming its body" ordering are
+ * unmappable, so any call would fabricate HTTP evidence that does not exist.
+ * The absence is pinned behaviorally by check-acp-stream-hooks.
+ */
+async function applyProviderPayloadHook<T extends { sessionId: string }>(
+	options: SimpleStreamOptions | undefined,
+	params: T,
+	model: Model<Api>,
+): Promise<T> {
+	const onPayload = options?.onPayload;
+	if (!onPayload) return params;
+	const replacement = await onPayload(params, model);
+	if (replacement === undefined) return params;
+	if (typeof replacement !== "object" || replacement === null || Array.isArray(replacement)) {
+		throw new Error(
+			"entwurf: before_provider_request returned a non-object replacement — the ACP prompt payload must stay a non-null, non-array object",
+		);
+	}
+	if ((replacement as { sessionId?: unknown }).sessionId !== params.sessionId) {
+		throw new Error(
+			"entwurf: before_provider_request changed the ACP sessionId — entwurf cannot truthfully deliver to a session it did not bootstrap; prompt rewriting is allowed, session identity is not",
+		);
+	}
+	const replacementPrompt = (replacement as { prompt?: unknown }).prompt;
+	if (!Array.isArray(replacementPrompt) || replacementPrompt.length === 0) {
+		throw new Error(
+			"entwurf: before_provider_request returned a replacement without a non-empty prompt array — an empty ACP prompt cannot be sent",
+		);
+	}
+	return replacement as T;
+}
+
 /**
  * streamSimple for the entwurf provider. Returns the event stream
  * synchronously and drives the ACP turn on a microtask.
@@ -1038,17 +1090,22 @@ export function streamAcpTurn(
 			// prompt could still sync-reject before the wire write; the next visible
 			// event after this is the backend's own first token / tool notice.
 			pushAcpLifecycleNotice(state, "sending prompt");
+			// #63: the pi streamSimple payload hook sees the EXACT wire params and may
+			// replace them (fail-closed integrity inside the helper). It runs while the
+			// bootstrap abort listener is still armed; the recheck below keeps an abort
+			// raised during a slow handler ahead of the wire write.
+			const wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);
+			if (signal?.aborted) throw new Error("aborted during payload hook");
 			// Hand the abort window over to the prompt driver: from here on an abort
 			// is a protocol `session/cancel` first, teardown only after the grace.
 			if (signal && onAbort) {
 				signal.removeEventListener("abort", onAbort);
 				onAbort = undefined;
 			}
-			const promptResult = await awaitAcpPromptTurn(
-				session,
-				{ sessionId: acpSessionId, prompt },
-				{ signal, graceMs: deps.abortGraceMs ?? ABORT_CANCEL_GRACE_MS },
-			);
+			const promptResult = await awaitAcpPromptTurn(session, wireParams, {
+				signal,
+				graceMs: deps.abortGraceMs ?? ABORT_CANCEL_GRACE_MS,
+			});
 
 			session.activePromptHandler = undefined;
 			session.busy = false;
@@ -1109,13 +1166,15 @@ export function streamAcpTurn(
 
 			// S2f visibility: about to send the delta to the resident child.
 			pushAcpLifecycleNotice(state, "sending prompt");
-			// A reuse turn has no bootstrap window at all — the prompt driver owns
-			// the whole abort surface (protocol cancel first, teardown after grace).
-			const promptResult = await awaitAcpPromptTurn(
-				session,
-				{ sessionId: session.acpSessionId, prompt },
-				{ signal, graceMs: deps.abortGraceMs ?? ABORT_CANCEL_GRACE_MS },
-			);
+			// #63: same hook boundary as a new turn — the reuse delta is the wire
+			// params here. The recheck keeps an abort raised during a slow handler
+			// ahead of the wire write; the prompt driver then owns the abort surface.
+			const wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);
+			if (signal?.aborted) throw new Error("aborted during payload hook");
+			const promptResult = await awaitAcpPromptTurn(session, wireParams, {
+				signal,
+				graceMs: deps.abortGraceMs ?? ABORT_CANCEL_GRACE_MS,
+			});
 
 			session.activePromptHandler = undefined;
 			session.busy = false;

package/pi-extensions/lib/acp/overlay.ts

@@ -2,8 +2,8 @@
 //
 // claude-agent-acp's SettingsManager loads the operator's `~/.claude/settings.json`
 // DIRECTLY (CLAUDE_CONFIG_DIR is the only knob that redirects that read). So the
-// operator's native `permissions.defaultMode` ("auto"), hooks, plugins, and
-// per-cwd memory/projects state would otherwise leak into entwurf ACP
+// operator's native `permissions.defaultMode` (whatever its current value), hooks,
+// plugins, and per-cwd memory/projects state would otherwise leak into entwurf ACP
 // sessions. The overlay redirects SettingsManager at a pi-owned directory whose
 // `settings.json` WE author (minimal, `hooks:{}`), while keeping exactly the
 // operator entries a backend needs (credentials, caches, built-in skills)
@@ -105,9 +105,11 @@ export const OVERLAY_BINARY_OWNED: ReadonlySet<string> = new Set([".claude.json"
 
 /**
  * Minimal overlay settings.json. Only fields with a reason to pin:
- *   - `permissions.defaultMode: "default"` neutralizes the operator's native
- *     "auto"; combined with the explicit `tools`/`permissionAllow` surface,
- *     "default" auto-passes every tool we expose without prompts.
+ *   - `permissions.defaultMode: "bypassPermissions"` is deliberate unattended
+ *     ACP operation: a tool call must never suspend a model turn on an interactive
+ *     permission prompt. This does not widen the callable surface — explicit
+ *     `tools`/`disallowedTools` still shape it, and `permissionAllow` still rides
+ *     the inline Claude settings — or bypass backend authentication.
  *   - `autoMemoryEnabled: false` — SDK opt-out for auto-memory (defense in
  *     depth; the tiny non-empty engraving/preset replacement is the primary
  *     write-containment lever for Claude ACP).
@@ -117,7 +119,7 @@ export const OVERLAY_BINARY_OWNED: ReadonlySet<string> = new Set([".claude.json"
 export function overlaySettingsJson(): string {
 	return `${JSON.stringify(
 		{
-			permissions: { defaultMode: "default" },
+			permissions: { defaultMode: "bypassPermissions" },
 			autoMemoryEnabled: false,
 			hooks: {},
 		},

package/pi-extensions/lib/entwurf-control-rpc.ts

@@ -37,12 +37,14 @@ export interface SenderEnvelope {
 
 /**
  * THE `<sender_info>` synthesis — the one place the sender envelope becomes
- * message text. Two consumers, one shape (#50 C3):
+ * message text. ONE consumer since the visible-first cut (#50 C3):
  *   - the live socket rail's RECEIVER (entwurf-control handleCommand("send")
- *     appends it to the delivered customMessage);
- *   - the dormant spawn-resume rail's SENDER (entwurf-v2-production appends it
- *     to the resume prompt, so a resumed citizen wakes knowing who called in
- *     exactly the shape a live delivery would have rendered).
+ *     appends it to the delivered customMessage).
+ *
+ * The second consumer was the dormant spawn-resume rail's SENDER, which appended
+ * the same shape to a resume prompt so a resumed citizen woke knowing who called.
+ * That rail is gone. The shape stays single-sourced here so a future VISIBLE
+ * resume renders an identical envelope rather than inventing a second one.
  * `wants_reply` is emitted only when explicitly true — an unset/false marker
  * renders nothing (etiquette marker, not transport contract).
  */

package/pi-extensions/lib/entwurf-core.ts

@@ -1,19 +1,18 @@
 /**
  * entwurf-core — sync entwurf execution, host-agnostic.
  *
- * DIRECT importers, MEASURED from the import graph (2026-07-27) — not from memory:
+ * DIRECT importers, RE-MEASURED from the import graph (2026-08-06) — not from memory:
  *   - pi-extensions/entwurf-control.ts (the pi adapter)
- *   - pi-extensions/lib/entwurf-v2-spawn-production.ts (v2 spawn-bg launch identity)
- *   - pi-extensions/lib/project-trust-handler.ts · lib/acp/augment.ts ·
- *     lib/native-push/adapter.ts
- *   - plus gates/smokes (check-shell-quote, check-package-source-routing, …)
+ *   - pi-extensions/lib/resume-launch-identity.ts (record-authoritative launch identity,
+ *     itself consumer-zero since the visible-first cut — see its header)
+ *   - plus gates/smokes (check-shell-quote, check-package-source-routing,
+ *     check-entwurf-session-identity, new-session-id, resolve-acp-bridge)
  *
- * The MCP bridge is a TRANSITIVE consumer, not a direct one, and the distinction is the
- * whole point: `mcp/entwurf-bridge/src/index.ts → entwurf-v2-surface.ts →
- * entwurf-v2-production.ts → entwurf-v2-spawn-production.ts → entwurf-core.ts`. So the old
- * header's claim — that the bridge imports this shared implementation the way a v1 tool
- * surface did — was false, but so is "the bridge does not reach it": it reaches it at
- * runtime, only for spawn-bg production.
+ * The MCP bridge does NOT reach this module on any path, and that changed with the cut:
+ * its one edge ran `index.ts → entwurf-v2-surface.ts → entwurf-v2-production.ts →
+ * entwurf-v2-spawn-production.ts → entwurf-core.ts`, and the spawn-production link was
+ * deleted with the `spawn-bg` transport. Do not restate the old "transitive consumer,
+ * for spawn-bg production" line; re-measure before claiming either way.
  *
  * NOT consumers on any path: `pi-extensions/entwurf.ts` (the v1 pi native tool surface) and
  * `pi-extensions/lib/entwurf-async.ts` were REMOVED in the 0.12 cutover. Do not reintroduce
@@ -131,9 +130,9 @@ export function normalizeCodexEntwurfModelForAcp(model?: string): string | undef
 // The Entwurf Target Registry is GONE (#50 C3). `pi/entwurf-targets.json` and its
 // reader chain (loadEntwurfTargets / resolveEntwurfTarget / EntwurfRegistryError +
 // the ~/.pi/agent symlink machinery) were the v1 "narrow door" for spawn-model
-// policy — but v2 never spawns from a model tuple: entwurf_v2 resumes an
-// already-identified record-backed citizen, and the model axis is the citizen's
-// own (Identity Preservation Rule). The last readers were the RT-dead
+// policy — but v2 never spawns at all, from a model tuple or otherwise: entwurf_v2
+// addresses an already-identified record-backed citizen, and the model axis is the
+// citizen's own (Identity Preservation Rule). The last readers were the RT-dead
 // buildSessionName mirror and the v1 spawn guard, both swept with this cut.
 // Bridge-extension routing for provider=entwurf survives below (getRegistryRouting
 // ← scripts/resolve-acp-bridge.ts) and takes a caller-supplied target — no file.
@@ -211,7 +210,8 @@ const SESSION_READ_CHUNK_BYTES = 64 * 1024;
  *     old name-mirror integrity check and the `requireEntwurf` name-tag
  *     authorization are gone (#50 C3): resume authorization is record existence,
  *     and transcript integrity is the caller's header-id ↔ record.nativeSessionId
- *     check (entwurf-v2-spawn-production.resolveResumeLaunchIdentity).
+ *     check (resume-launch-identity.resolveResumeLaunchIdentity — the leaf that
+ *     outlived the spawn-bg factory it used to sit in).
  */
 export interface RecordedSessionIdentity {
 	/** JSONL header `id` (pi's own session id — the record's `nativeSessionId`). */