@junghanacs/entwurf 0.16.0 → 0.16.1

package/pi-extensions/lib/acp/backend.ts

@@ -119,7 +119,13 @@ export interface AcpChildLike {
 	signalCode: NodeJS.Signals | null;
 	stdin: { destroy(): void; unref?(): void };
 	stdout: { destroy(): void; unref?(): void };
-	stderr: { on(event: "data", listener: (chunk: Buffer) => void): void; destroy(): void; unref?(): void };
+	stderr: {
+		on(event: "data", listener: (chunk: Buffer) => void): void;
+		/** Optional: absent on minimal fakes; the flush is best-effort, never load-bearing for liveness. */
+		once?(event: "close", listener: () => void): void;
+		destroy(): void;
+		unref?(): void;
+	};
 	kill(signal?: NodeJS.Signals | number): boolean;
 	unref(): void;
 	once(event: "exit" | "error", listener: (...args: unknown[]) => void): void;
@@ -210,6 +216,11 @@ interface BridgeSession {
 	 * nothing to diagnose it by (observed 2026-07-30 on a live sonnet reuse turn).
 	 */
 	stderrTail: string[];
+	/**
+	 * SESSION-scoped like `stderrTail`, and for the same reason: the launcher's
+	 * frame can arrive on a turn later than the one that spawned the child.
+	 */
+	launchObservation: AcpLaunchObservation;
 	/** How the child ended, once it has — folded into the prompt-phase error. */
 	exit?: { code: number | null; signal: NodeJS.Signals | null };
 	/**
@@ -367,6 +378,85 @@ const CHILD_END_SETTLE_MS = 500;
  */
 const ACP_CONNECTION_CLOSED_TEXT = "ACP connection closed";
 
+/**
+ * The launcher's control frame — see `claude-acp-launch.js`.
+ *
+ * Matched as an EXACT FULL LINE and nothing else. The vendor writes prose that
+ * mentions signals; a substring test would let vendor text manufacture an
+ * entwurf observation, which is precisely the confusion #72 cost three
+ * diagnosis passes. Our own frame is a fixed enum, so exact-line matching is
+ * sufficient AND necessary.
+ */
+const LAUNCH_SIGNAL_FRAME_PREFIX = "ENTWURF_ACP_LAUNCH_SIGNAL=";
+const LAUNCH_SIGNAL_FRAME_VALUES: ReadonlySet<string> = new Set(["SIGTERM", "SIGINT"]);
+
+/** A mutable, session-scoped record of a terminating signal the LAUNCHER caught. */
+export type AcpLaunchObservation = { signal?: "SIGTERM" | "SIGINT" };
+
+/**
+ * Split a stderr chunk stream into lines, consuming our own frames and passing
+ * everything else through to the tail untouched.
+ *
+ * Line-buffered because a chunk boundary can fall inside a frame; the trailing
+ * partial line is held, not emitted, so a frame split across two reads is still
+ * recognised exactly.
+ */
+function makeLaunchFrameFilter(observation: AcpLaunchObservation, onText: (text: string) => void) {
+	let held = "";
+	return {
+		write(chunk: string): void {
+			held += chunk;
+			let nl = held.indexOf("\n");
+			let passed = "";
+			while (nl !== -1) {
+				const line = held.slice(0, nl);
+				if (
+					line.startsWith(LAUNCH_SIGNAL_FRAME_PREFIX) &&
+					LAUNCH_SIGNAL_FRAME_VALUES.has(line.slice(LAUNCH_SIGNAL_FRAME_PREFIX.length))
+				) {
+					// FIRST caught signal wins: a later one is our own teardown racing
+					// the external kill, and reporting that would bury the cause.
+					observation.signal ??= line.slice(LAUNCH_SIGNAL_FRAME_PREFIX.length) as "SIGTERM" | "SIGINT";
+				} else {
+					passed += `${line}\n`;
+				}
+				held = held.slice(nl + 1);
+				nl = held.indexOf("\n");
+			}
+			if (passed) onText(passed);
+		},
+		/**
+		 * The child's LAST words may arrive without a trailing newline — a process
+		 * dying mid-write is exactly when that happens, and it is exactly when the
+		 * tail matters most. Line buffering would otherwise hold that fragment
+		 * forever, so the stream's close flushes it VERBATIM.
+		 *
+		 * No frame check here, deliberately: the launcher writes its frame with a
+		 * single `writeSync` including the newline, well under PIPE_BUF, so a
+		 * complete frame can never be the un-terminated remainder. Anything left
+		 * without a newline is vendor text by construction.
+		 */
+		flush(): void {
+			if (!held) return;
+			onText(held);
+			held = "";
+		},
+	};
+}
+
+/**
+ * What the operator is told about a caught signal — and what they are NOT told.
+ *
+ * Absence is reported as "not observed", never as "no signal": the launcher can
+ * only see what reached it, and an override launch (`CLAUDE_AGENT_ACP_COMMAND`)
+ * has no launcher at all. Attribution of the SENDER is not claimed here either —
+ * that needs the host's journal, which this process cannot read.
+ */
+function launchSignalLine(observation: AcpLaunchObservation | undefined): string | undefined {
+	if (!observation?.signal) return undefined;
+	return `[acp] launch observed ${observation.signal} before child exit (sender not attributed)`;
+}
+
 function isAcpConnectionClosure(err: unknown): boolean {
 	const message = err instanceof Error ? err.message : typeof err === "string" ? err : "";
 	return message.trim() === ACP_CONNECTION_CLOSED_TEXT;
@@ -921,14 +1011,24 @@ export function streamAcpTurn(
 		stream.end();
 	}
 
-	function finishError(err: unknown, aborted: boolean, stderrTail?: string[], lifecycle?: string): void {
+	function finishError(
+		err: unknown,
+		aborted: boolean,
+		stderrTail?: string[],
+		lifecycle?: string,
+		launchObservation?: AcpLaunchObservation,
+	): void {
 		finalizeAcpStreamState(state);
 		state.output.stopReason = aborted ? "aborted" : "error";
 		const base = err instanceof Error ? err.message : String(err);
 		// The FIRST failure stays first and verbatim (it is what the backend
 		// actually said); the lifecycle line is added, never substituted, so a
 		// reader can still match the transport's own text.
-		const diagnosed = lifecycle ? `${base}\n${lifecycle}` : base;
+		const withLifecycle = lifecycle ? `${base}\n${lifecycle}` : base;
+		// Its OWN line, above the vendor tail: an entwurf-owned observation must not
+		// have to be recovered by reading vendor prose.
+		const observed = launchSignalLine(launchObservation);
+		const diagnosed = observed ? `${withLifecycle}\n${observed}` : withLifecycle;
 		const tail = (stderrTail ?? []).join("").trim().slice(-1_000);
 		const full = tail ? `${diagnosed}\n--- backend stderr (tail) ---\n${tail}` : diagnosed;
 		// A-c: a real failure (not an abort) that looks like a context-window
@@ -1124,6 +1224,8 @@ export function streamAcpTurn(
 		/** Which phase a failure belongs to — flipped once the prompt is on the wire. */
 		let phase: "pre-prompt" | "prompt" = "pre-prompt";
 		const stderrTail: string[] = [];
+		// Session-scoped alongside the tail — see the field's note on the session type.
+		const launchObservation: AcpLaunchObservation = {};
 		const sessionKey = resolveSessionKey(opts, cwd);
 		try {
 			if (signal?.aborted) throw new Error("aborted before launch");
@@ -1156,10 +1258,18 @@ export function streamAcpTurn(
 			const spawned = child;
 
 			// Drain stderr (an unconsumed pipe can backpressure-deadlock a long turn).
-			spawned.stderr.on("data", (c: Buffer) => {
-				stderrTail.push(c.toString());
+			// The launcher's own control frames are consumed here and kept OUT of the
+			// tail: the tail is vendor evidence, the observation is an entwurf fact,
+			// and mixing the two is the overloading #72 was made of.
+			const consumeStderr = makeLaunchFrameFilter(launchObservation, (text) => {
+				stderrTail.push(text);
 				if (stderrTail.length > 50) stderrTail.shift();
 			});
+			spawned.stderr.on("data", (c: Buffer) => consumeStderr.write(c.toString()));
+			// `close` rather than `end`: it covers the destroy path our own teardown
+			// takes, and on the EOF-first death it lands inside the post-mortem
+			// settle window, so the flushed fragment is in the tail before we seal.
+			spawned.stderr.once?.("close", () => consumeStderr.flush());
 
 			// Abort during BOOTSTRAP (spawn → initialize → newSession → set-model):
 			// there is no prompt turn for the agent to cancel yet, so the child is
@@ -1211,6 +1321,8 @@ export function streamAcpTurn(
 				// this turn with the session, so a later reuse turn can still report
 				// the child's dying words.
 				stderrTail,
+				// SAME object the frame filter writes into, for the same reason.
+				launchObservation,
 				// Armed at spawn, before ANY turn can fail on this child — the latch
 				// must already exist when the `exit` listener below can fire.
 				childEnd: makeChildEndLatch(),
@@ -1345,7 +1457,13 @@ export function streamAcpTurn(
 			// own SIGTERM; the tail collected by then is sealed before our cleanup
 			// touches the stderr pipe.
 			const lifecycle = await diagnoseTransportClosure({ err, session, phase, aborted });
-			finishError(err, aborted, session?.stderrTail ?? stderrTail, lifecycle);
+			finishError(
+				err,
+				aborted,
+				session?.stderrTail ?? stderrTail,
+				lifecycle,
+				session?.launchObservation ?? launchObservation,
+			);
 			// error/abort → drop the (uncertain) session and close its child; an
 			// uncertain connection must never be reused (GPT ④).
 			if (child) {
@@ -1412,7 +1530,7 @@ export function streamAcpTurn(
 			// Without the session-scoped tail a mid-turn child death on a resident
 			// session surfaced as a bare "ACP connection closed" with nothing to read
 			// it by.
-			finishError(err, aborted, session.stderrTail, lifecycle);
+			finishError(err, aborted, session.stderrTail, lifecycle, session.launchObservation);
 			// error/abort on a reused session → drop it and close the child (GPT ④).
 			session.retiring = true;
 			retainedChildren.delete(session.child);

package/pi-extensions/lib/acp/claude-acp-launch.js

@@ -0,0 +1,100 @@
+// entwurf-owned launcher for the Claude ACP backend (#72).
+//
+// WHY THIS FILE EXISTS — it is not a wrapper for its own sake.
+//
+// The vendor bin is named `claude-agent-acp`, and that name is not ours: any
+// harness on the host that spawns the same package produces a process with the
+// same name. On GLG's oracle host a janitor installed for a DIFFERENT harness
+// (openclaw's acpx, upstream PR #245) selects `claude-agent-acp` by argv
+// SUBSTRING and SIGTERMs anything older than 900s. entwurf's child is retained
+// across turns, so its age is the age of the SESSION, not of a turn — every
+// session older than 15 minutes was shot at every 5 minutes. Measured: 12 of 12
+// anomalous terminations across two boots, pid- and timestamp-locked (receipts
+// in `scripts/raw-acp-child-exit-measure/README.md` §ANSWERED).
+//
+// So this launcher does two things, and deliberately nothing else:
+//
+//   1. NAMESPACE. It carries a name that is ours, so a name-matching janitor
+//      stops selecting our process. The vendor is `import`ed INTO this same
+//      process — not spawned as a child. That distinction is what keeps this
+//      inside #72's repair fence: with no child to restart, this cannot become
+//      the supervisor/watcher/retry the issue forbids. Any variant that spawns
+//      the vendor breaks the fence and must not be written.
+//
+//   2. OBSERVE A CAUGHT SIGNAL. The vendor's own handler turns SIGTERM/SIGINT
+//      into `dispose(); process.exit(0)`, so by the time entwurf sees the child
+//      end there is an exit code 0 and NO signal — a clean external kill and a
+//      vendor fault are indistinguishable. Registering first lets us record
+//      that a terminating signal was caught, before the vendor erases it.
+//
+// WHAT THIS COSTS, STATED SO NOBODY DISCOVERS IT LATER. Once the name split is
+// in place, a host janitor that scans for the vendor name can no longer see
+// entwurf's children AT ALL — including ones that genuinely leaked. If pi is
+// SIGKILLed so `teardownChild` never runs, this adapter reparents to PID 1 and
+// matches neither that janitor's name phase nor its orphan phase (which looks
+// for a bare `claude`). That leak class now belongs to entwurf: after the split,
+// we own our own cleanup story and cannot expect someone else's timer to cover
+// it. This is a deliberate trade — being killed mid-turn is worse than leaking
+// a process on an abnormal exit — but it is a trade, not a free win.
+//
+// ARGV IS NOT OURS TO TOUCH. The vendor reads `--cli` / `--version` /
+// `--hide-claude-auth` from `process.argv`, and builds its own re-invocation
+// command from `process.argv.slice(1)` for the terminal-auth advert. Under this
+// launcher that advert becomes `node <this file> --cli auth login …`, which
+// keeps working ONLY because we consume no flags and resolve the vendor
+// ourselves. Never give this file an option of its own.
+
+import { readFileSync, writeSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * The one line entwurf's stderr drain looks for, matched as an EXACT full line.
+ * A fixed enum, never interpolated from vendor text: the backend must be unable
+ * to mistake vendor prose (which mentions signals) for our own observation.
+ */
+const SIGNAL_FRAME_PREFIX = "ENTWURF_ACP_LAUNCH_SIGNAL=";
+
+/** Signals the vendor normalizes to exit 0, and which are therefore invisible downstream. */
+const OBSERVED_SIGNALS = /** @type {const} */ (["SIGTERM", "SIGINT"]);
+
+for (const signal of OBSERVED_SIGNALS) {
+	process.on(signal, () => {
+		// writeSync, not console.error: a handler may run while the process is
+		// tearing down and an async write can be dropped.
+		try {
+			writeSync(2, `${SIGNAL_FRAME_PREFIX}${signal}\n`);
+		} catch {
+			// stderr already gone — the observation is best-effort, never fatal.
+		}
+		// THE SINK GUARD. Registering a handler SUPPRESSES node's default
+		// termination. If we are still the only listener — the vendor has not
+		// registered yet, or its import failed — this observer would make the
+		// process immune to the very signal it is observing, including entwurf's
+		// own teardown SIGTERM. Stand down and let the signal land for real.
+		if (process.listenerCount(signal) === 1) {
+			process.removeAllListeners(signal);
+			process.kill(process.pid, signal);
+		}
+	});
+}
+
+// Resolution lives INSIDE the same try as the import so both failures speak with
+// one voice: a missing package and a broken package are the same event to an
+// operator reading stderr, and only one of them would otherwise be legible.
+try {
+	const require = createRequire(import.meta.url);
+	const pkgJsonPath = require.resolve("@agentclientprotocol/claude-agent-acp/package.json");
+	const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+	const binPath = typeof pkgJson.bin === "string" ? pkgJson.bin : pkgJson.bin?.["claude-agent-acp"];
+	if (!binPath) throw new Error("@agentclientprotocol/claude-agent-acp resolved but exposes no bin entry");
+	// Same process, no argv touched. The vendor bin has no main-module guard, so
+	// importing it starts the agent exactly as executing it would.
+	await import(pathToFileURL(join(dirname(pkgJsonPath), binPath)).href);
+} catch (err) {
+	// Fail loud and DIE. No retry, no fallback: a launcher that survives its own
+	// failure is the hidden supervisor #72 forbids.
+	writeSync(2, `entwurf acp launcher: vendor import failed: ${err instanceof Error ? err.stack : String(err)}\n`);
+	process.exit(1);
+}

package/run.sh

@@ -119,7 +119,7 @@ run_vitest() {
 usage() {
   cat <<'EOF'
 Usage:
-  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
+  ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): mode-first (source bootstrap only on a checkout), then per-component PASS/SKIP/FAIL for pi (presence+floor)/claude/agy/copilot (all four units: birth→MCP→receiver→footer, independently)/omp (four units: birth→MCP→tools.xdev setting→receiver, independently) + stable dev bins + v2 install smoke; absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness or touches credentials
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
   ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
@@ -218,6 +218,8 @@ Usage:
   ./run.sh install-copilot-mcp        # #82 RAIL 5: register ONE entwurf-bridge server in ~/.copilot/mcp-config.json (adopt / create / REFUSE symlink), type:local, install-state under $XDG_DATA_HOME/entwurf/copilot-mcp/
   ./run.sh uninstall-copilot-mcp      # honest inverse of install-copilot-mcp from install-state
   ./run.sh doctor-copilot-mcp         # static ownership/config/boot doctor; RED only when install-state exists
+  ./run.sh install-omp-config         # #87 follow-on: write the ONE operator setting omp's tool hand requires — `tools.xdev: false` in <omp agent dir>/config.yml. Owns exactly the line(s) it adds (recorded in install-state), refuses a symlinked config, refuses a config it cannot parse, and refuses an EXPLICIT operator `xdev: true` by name rather than overwriting a decision. Without it the vendor default wraps every MCP tool behind `xd://` and the doorbell announces a tool the model cannot call
+  ./run.sh uninstall-omp-config       # honest inverse from install-state: takes back exactly the recorded line(s), removes the file only when entwurf created it, REFUSES when the config changed since install
   ./run.sh install-omp-bridge         # #87: install the OMP BIRTH extension into <omp agent dir>/extensions/entwurf-meta-omp (index.ts|js + lib + capability registry). No launcher and no bake — an omp hook is an in-process extension. Refuses when an inherited PI_CODING_AGENT_DIR/PI_CONFIG_DIR/PI_PROFILE makes the target agent dir ambiguous (ledger M6), and refuses ANY pre-existing artifact at the unit path that entwurf holds no ownership state for — a shape is not a proof of ownership
   ./run.sh uninstall-omp-bridge       # honest inverse from install-state (exact unit dir + recorded entry; no-state host REFUSES; state deleted LAST). Records already minted are preserved
   ./run.sh doctor-omp-bridge          # #87: runtime axis (importable unit, writer/registry parity, mint vs sender-marker errors on SEPARATE axes, scope-fence receipts, a root-grammar preflight that goes RED on a relative ENTWURF_META_* override instead of reporting on some other directory, CERTIFIED omp record count via meta-facts under the omp root policy — never a text grep, live omp processes carrying inherited PI_SESSION_ID/PI_AGENT_ID) + ownership axis. PI_CODING_AGENT_DIR is the vendor's own agent dir here and is reported as ignored, never as contamination. Zero records = NOT-YET, never red
@@ -250,7 +252,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.30 must leak, @0.84.3 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.40 must leak, @0.84.4 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -1825,13 +1827,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.85+ at the current 0.84.3 pin) whose
+// pi (past the declared ceiling — 0.85+ at the current 0.84.4 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.84.3` an existing 0.83.x host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.3 <0.85`).
+// install resolves: at `>=0.84.4` an existing 0.84.3 host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.4 <0.85`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2729,6 +2731,17 @@ check_acp_prompt_lifecycle() {
   run_ts scripts/check-acp-prompt-lifecycle.ts
 }
 
+check_acp_launch_namespace() {
+  # #72: the Claude ACP child must launch under a name entwurf OWNS. A janitor
+  # installed on the host for ANOTHER harness selects the vendor process name
+  # `claude-agent-acp` by argv substring and SIGTERMs it by age; entwurf retains
+  # its child across turns, so its age is the session's. This gate holds the
+  # name split, holds the launcher transparent (the vendor still answers
+  # --version through it), and keeps an explicit operator override verbatim.
+  section "ACP launch namespace (#72 — no vendor process name in our argv)"
+  run_ts scripts/check-acp-launch-namespace.ts
+}
+
 check_acp_stream_hooks() {
   # Deterministic gate for the pi 0.84 streamSimple hook contract on the ACP rail
   # (#63; upstream pi-mono #7372 → doc-only #7576). before_provider_request
@@ -3067,15 +3080,15 @@ check_pack() {
 # The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
 # self-test below. The version BOUNDARY is load-bearing: a pnpm .pnpm entry is
 # `<name>@<version>` followed by either `_<peer-hash>` or end-of-name (measured pnpm 11.20.0
-# on this tree), so an unbounded substring match would bless a lookalike such as `@0.84.30`
+# on this tree), so an unbounded substring match would bless a lookalike such as `@0.84.40`
 # while announcing the pinned floor — a false-green oracle (found by independent review,
 # 2026-08-25).
 pack_install_leaked_pi() {
-  grep '^@earendil-works+pi-' | grep -Ev '@0\.84\.3(_|$)' || true
+  grep '^@earendil-works+pi-' | grep -Ev '@0\.84\.4(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise the
-# false-green shape (it contains no 0.84.30), so the oracle is proven against a fixture
+# false-green shape (it contains no 0.84.40), so the oracle is proven against a fixture
 # listing. Expected: the two lookalikes leak, the pinned version passes bare and with a
 # peer-hash suffix. Exposed as its own snapshot-safe subcommand because the heavy
 # check-pack-install cannot run inside the qualification snapshot (no install environment),
@@ -3084,13 +3097,13 @@ pack_install_leaked_pi() {
 check_pack_pin_matcher() {
   local matcher_probe
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.84.3' \
-    '@earendil-works+pi-ai@0.84.3_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.84.30' \
-    '@earendil-works+pi-agent-core@0.84.2' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.84.30
-@earendil-works+pi-agent-core@0.84.2' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.84.30/0.84.2 lookalikes and pass 0.84.3 bare or with a peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.84.4' \
+    '@earendil-works+pi-ai@0.84.4_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.84.40' \
+    '@earendil-works+pi-agent-core@0.84.3' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.84.40
+@earendil-works+pi-agent-core@0.84.3' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.84.40/0.84.3 lookalikes and pass 0.84.4 bare or with a peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
   echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with a peer-hash)"
@@ -3320,7 +3333,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.84.3`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.84.x`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3335,24 +3348,24 @@ _check_pack_install_impl() {
   # first time. Unpinned they would float exactly like pi-agent-core did in the
   # 2026-07-21 incident above. pi-telemetry joined the explicit pin list on
   # 2026-08-31: it arrives transitively (pi-agent-core and pi-ai both carry
-  # `^0.84.3` carets on it), and upstream's 0.84.4 patch publish (2026-08-28
+  # `^0.84.x` carets on it), and upstream's 0.84.4 patch publish (2026-08-28
   # 22:04Z) floated that caret in this lockfile-less temp install, turning CI
-  # red through the leak assertion below. The bump itself stays a separate
-  # hard-cut lane (#87 thread / NEXT "Do not touch: Pi 0.84.4") — pinning the
-  # drift shut is how the verified 0.84.3 runtime stays OURS to hold. The leak
+  # red through the leak assertion below. That explicit pin is what held the
+  # line until the bump lane ran; the verified floor is 0.84.4 as of
+  # 2026-09-01, and the pin moved WITH it rather than being retired. The leak
   # assertion below still covers every other pi package, including any package
   # a future pi bump adds to the closure.
   echo "[check-pack-install] pnpm add into $tmp (with 0.84.x peers + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.84.3" \
-    "@earendil-works/pi-coding-agent@0.84.3" \
-    "@earendil-works/pi-tui@0.84.3" \
-    "@earendil-works/pi-agent-core@0.84.3" \
-    "@earendil-works/pi-client@0.84.3" \
-    "@earendil-works/pi-protocol@0.84.3" \
-    "@earendil-works/pi-telemetry@0.84.3" \
+    "@earendil-works/pi-ai@0.84.4" \
+    "@earendil-works/pi-coding-agent@0.84.4" \
+    "@earendil-works/pi-tui@0.84.4" \
+    "@earendil-works/pi-agent-core@0.84.4" \
+    "@earendil-works/pi-client@0.84.4" \
+    "@earendil-works/pi-protocol@0.84.4" \
+    "@earendil-works/pi-telemetry@0.84.4" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3362,17 +3375,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.84.3. Anything else means an unpinned caret floated and the
+  # must be the pinned 0.84.4. Anything else means an unpinned caret floated and the
   # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.84.3". Fail loud instead of proving the wrong floor.
+  # printing "pinned pi 0.84.4". Fail loud instead of proving the wrong floor.
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.3):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.4):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.3"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.4"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4983,6 +4996,52 @@ setup_all() {
     fi
   fi
 
+  # ── omp (oh-my-pi) ── presence-driven composition, same shape as copilot. OMP
+  # was admitted as a garden citizen in v0.16.0 with installers, doctors and
+  # inverses for every unit — but it was never composed HERE, so the one-command
+  # surface left the fifth backend to a hand-run verb list and the operator setting
+  # to a documentation step. That gap is what `docs/adding-a-harness.md` step 10
+  # now closes for every future harness: an onboarding is not finished until setup
+  # composes it. Four units, each independent: birth (who the citizen is) → MCP
+  # hand (what it can call) → the tools.xdev operator setting (whether those calls
+  # are REACHABLE) → receiver (whether a reply can land). OMP_BIN pins the PROBE
+  # for hermetic gates; the unit scripts address `omp` on PATH.
+  local omp_rc
+  if ! command -v "${OMP_BIN:-omp}" >/dev/null 2>&1; then
+    setup_result omp SKIP "omp not on PATH — zero OMP wiring written"
+  else
+    section "omp units (native harness detected: oh-my-pi)"
+    omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-bridge-install.sh) || omp_rc=$?
+    if [ "$omp_rc" -eq 0 ]; then
+      setup_result omp-birth PASS "birth extension installed — verify: ./run.sh doctor-omp-bridge"
+    else
+      setup_result omp-birth FAIL "detected omp, but the birth extension install did not complete (see above) — repair, then re-run setup"
+    fi
+    omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-mcp-bridge.sh install) || omp_rc=$?
+    if [ "$omp_rc" -eq 0 ]; then
+      setup_result omp-mcp PASS "MCP server registered — verify: ./run.sh doctor-omp-mcp"
+    else
+      setup_result omp-mcp FAIL "detected omp, but the MCP registration did not complete (see above) — repair, then re-run setup"
+    fi
+    # The operator setting is a component of its own because its FAIL is a real
+    # disagreement, not a broken install: an explicit `tools.xdev: true` is the
+    # operator's decision and the writer refuses it by name. Naming that as a
+    # component FAIL puts the choice in front of the operator instead of silently
+    # shipping a citizen whose tools nobody can call.
+    omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-config-xdev.sh install) || omp_rc=$?
+    if [ "$omp_rc" -eq 0 ]; then
+      setup_result omp-config PASS "tools.xdev: false written — verify: ./run.sh doctor-omp-mcp"
+    else
+      setup_result omp-config FAIL "detected omp, but the tools.xdev operator setting did not land (see above) — resolve it, then re-run setup"
+    fi
+    omp_rc=0; (cd "$REPO_DIR" && bash scripts/omp-receive-install.sh) || omp_rc=$?
+    if [ "$omp_rc" -eq 0 ]; then
+      setup_result omp-receive PASS "receiver extension installed — verify: ./run.sh doctor-omp-receive"
+    else
+      setup_result omp-receive FAIL "detected omp, but the receiver extension install did not complete (see above) — repair, then re-run setup"
+    fi
+  fi
+
   # ── core bridge boundary ── deterministic preflight lives in `pnpm run
   # check:full`; live substrate acceptance lives in `LIVE=1 ./run.sh
   # release-gate <scratch> --cut`. Setup is the install path, so it verifies the
@@ -5003,7 +5062,7 @@ setup_all() {
   local entry rest s_name s_verdict s_fails=""
   for entry in "${SETUP_RESULTS[@]}"; do
     s_name="${entry%%|*}"; rest="${entry#*|}"; s_verdict="${rest%%|*}"
-    printf '  %-14s %-4s %s\n' "$s_name" "$s_verdict" "${rest#*|}"
+    printf '  %-18s %-4s %s\n' "$s_name" "$s_verdict" "${rest#*|}"
     if [ "$s_verdict" = "FAIL" ]; then s_fails="$s_fails $s_name"; fi
   done
   echo ""
@@ -6121,6 +6180,20 @@ case "$cmd" in
   smoke-omp-mcp-state)
     (cd "$REPO_DIR" && bash scripts/smoke-omp-mcp-state.sh)
     ;;
+  install-omp-config)
+    # #87 follow-on: the ONE operator setting omp's tool hand requires (`tools.xdev: false`).
+    # A separate unit from install-omp-mcp because it answers a different question — the MCP
+    # hand registers the server, this decides whether the registered tools are REACHABLE. It
+    # owns exactly the line it adds and refuses an explicit operator `xdev: true` by name.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-config-xdev.sh install "$@")
+    ;;
+  uninstall-omp-config)
+    # honest inverse from install-state: takes back exactly the recorded line(s), removes the
+    # file only when entwurf created it, and REFUSES when the config changed since install.
+    shift || true
+    (cd "$REPO_DIR" && bash scripts/omp-config-xdev.sh uninstall "$@")
+    ;;
   install-omp-bridge)
     # #87: the OMP BIRTH install. Not a mode of the Claude or Copilot installer, and for a
     # structural reason rather than a stylistic one: an omp "hook" IS an in-process
@@ -6453,6 +6526,9 @@ case "$cmd" in
   check-acp-prompt-lifecycle)
     check_acp_prompt_lifecycle
     ;;
+  check-acp-launch-namespace)
+    check_acp_launch_namespace
+    ;;
   check-acp-stream-hooks)
     check_acp_stream_hooks
     ;;