@junghanacs/entwurf 0.16.0 → 0.17.1

package/scripts/check-copilot-birth-hook.ts

@@ -495,7 +495,7 @@ function makeFakeHost(label: string, opts: FakeOpts): FakeHost {
 				? '  "plugin list") echo "not authenticated" >&2; exit 1 ;;'
 				: opts.pluginListRaw !== undefined
 					? `  "plugin list") echo "Installed plugins:"; cat ${JSON.stringify(rawList)}; exit 0 ;;`
-					: '  "plugin list") echo "Installed plugins:"; sed "s/^/  • /;s/$/ (v$VER)/" "$STATE"; exit 0 ;;',
+					: '  "plugin list") echo "Live Plugins (loaded from a local marketplace directory, never copied):"; sed "s/^/  • /;s/$/ (v$VER) (enabled)/" "$STATE"; exit 0 ;;',
 			'  "plugin uninstall")',
 			opts.uninstallFails
 				? '    echo "boom" >&2; exit 1 ;;'
@@ -1065,6 +1065,33 @@ function writeBoundState(host: FakeHost): void {
 		inst.status !== 0 && (inst.stderr ?? "").includes("malformed") && !existsSync(instHost.stateFile),
 	);
 }
+{
+	// Copilot CLI 1.0.81 (measured 2026-08-31) appends its own state token after the
+	// version and an indented `from <path>` continuation line. The grammar admits that
+	// ONE optional `(enabled)`/`(disabled)` token — reading it as part of the version
+	// made every surface refuse a perfectly healthy host. Anything else in the tail
+	// stays malformed, so the admission cannot widen into "ignore whatever follows".
+	const liveRaw = `Live Plugins (loaded from a local marketplace directory, never copied):\n  • ${OURS} (v${SHIPPED_VERSION}) (enabled)\n      from /home/nobody/.assembled`;
+	const docHost = makeFakeHost("doctor-state-token-row", { installed: [OURS], pluginListRaw: liveRaw });
+	writeBoundState(docHost);
+	writeFileSync(docHost.mktState, `${MKT}\t${docHost.asm}\n`);
+	mkdirSync(path.join(docHost.asm, PLUGIN), { recursive: true });
+	const doc = runVerb(docHost, "doctor-copilot-bridge");
+	ok(
+		"[QK:COPILOT-ROW-STATE-TOKEN-ADMITTED] a `(vX) (enabled)` row plus its `from` continuation line parses as the installed version — no malformed refusal on a healthy 1.0.81 host",
+		doc.stdout.includes(`${OURS} (v${SHIPPED_VERSION}) is registered in Copilot`) &&
+			!doc.stdout.includes("malformed") &&
+			!(doc.stderr ?? "").includes("malformed"),
+	);
+	const foreignHost = makeFakeHost("install-foreign-tail-row", {
+		pluginListRaw: `  • ${OURS} (v${SHIPPED_VERSION}) (whatever)`,
+	});
+	const foreign = runVerb(foreignHost, "install-copilot-bridge");
+	ok(
+		"an UNKNOWN trailing token is still malformed — the admission is exactly the two measured state words",
+		foreign.status !== 0 && (foreign.stderr ?? "").includes("malformed") && !existsSync(foreignHost.stateFile),
+	);
+}
 {
 	// B defect 4: a pluginVersion carrying whitespace would be truncated by the
 	// space-separated fact transport (`cut -d' ' -f3`) into a FABRICATED version and a

package/scripts/check-gate-qualification.ts

@@ -799,10 +799,12 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 	const EXPECTED_LANE_MUTANTS: Record<string, number> = {
 		"acp-augment": 10,
 		"acp-cortex": 12,
+		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
-		"acp-prompt-lifecycle": 10,
+		"acp-prompt-lifecycle": 15,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
+		"acp-usage-accounting": 12,
 		"agy-permission": 6,
 		"bridge-boot-resume": 3,
 		"bridge-command-boot": 9,
@@ -829,7 +831,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
-		"setup-verdict": 10,
+		"setup-verdict": 13,
 		"source-install": 2,
 		"v2-surface": 7,
 		"v2-visible-resume": 17,

package/scripts/check-omp-fresh-preflight.ts

@@ -155,6 +155,16 @@ function pythonXdev(agentDir: string): "false" | "true" | "unreadable" {
 		["a top-level xdev outside tools", "xdev: false\ntools:\n  approvalMode: yolo\n"],
 		["tab indentation (not YAML for the vendor)", "tools:\n\txdev: false\n"],
 		["broken flow scalar", "tools: [oops\n"],
+		// The shape the VENDOR's own settings writer produces: `key:` on one line with an
+		// indented flow collection under it. The python leaf's block-only reader returned
+		// None for the WHOLE file here, so an untouched operator config classified as
+		// `unreadable` and doctor-omp-mcp went RED for a reason unrelated to tools.xdev
+		// (measured on a real host, omp 18.0.0). Agreement alone could never catch it —
+		// both halves collapse `unreadable` and `true` into "not false" — so the direct
+		// assertion below is the one that holds the reader to the vendor's own output.
+		["the vendor's own writer output (empty flow map sibling)", "modelRoles: \n  {}\ntools: \n  xdev: false\n"],
+		["a populated flow map sibling", "modelRoles: \n  {default: xai/grok}\ntools: \n  xdev: false\n"],
+		["a flow sequence sibling", "disabledProviders: \n  [openrouter, google]\ntools: \n  xdev: false\n"],
 	];
 	const root = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-omp-xdev-"));
 	try {
@@ -173,6 +183,23 @@ function pythonXdev(agentDir: string): "false" | "true" | "unreadable" {
 				pythonSaysFalse === (ts === false),
 			);
 		}
+		// Agreement is not enough on the vendor's own shapes: two readers that BOTH fail
+		// closed agree perfectly and still leave the doctor red on a healthy host. These
+		// name the answer instead of comparing the halves.
+		for (const [label, yaml] of CONFIGS) {
+			if (
+				!label.startsWith("the vendor's own writer output") &&
+				!label.startsWith("a populated flow map") &&
+				!label.startsWith("a flow sequence")
+			)
+				continue;
+			const dir = fs.mkdtempSync(path.join(root, "vendor-"));
+			fs.writeFileSync(path.join(dir, "config.yml"), yaml as string);
+			ok(
+				`[QK:OMP-XDEV-VENDOR-SHAPE-READABLE] the python leaf READS tools.xdev on ${label} — a flow collection elsewhere in the file is not an unreadable config`,
+				pythonXdev(dir) === "false",
+			);
+		}
 	} finally {
 		fs.rmSync(root, { recursive: true, force: true });
 	}

package/scripts/check-setup-qualification.sh

@@ -42,11 +42,23 @@ for _f in copilot-bridge-install.sh copilot-bridge-oracle.sh copilot-mcp-bridge.
   copilot-receive-bridge.sh copilot-statusline-bridge.sh copilot-statusline-config.py; do
   cp "$REPO_DIR/scripts/$_f" "$PKG/scripts/$_f"
 done
+# OMP composition surface (Cells E/F): same discipline — every omp unit script is a real
+# tracked file here, because the claims are about what the composition actually reaches.
+for _f in omp-bridge-install.sh omp-bridge-oracle.sh omp-mcp-bridge.sh omp-mcp-config.py \
+  omp-tool-surface.py omp-config-xdev.sh omp-config-xdev.py omp-receive-install.sh; do
+  cp "$REPO_DIR/scripts/$_f" "$PKG/scripts/$_f"
+done
 cp -r "$REPO_DIR/pi" "$PKG/pi"
 cp "$REPO_DIR/pi-extensions/lib/session-id.js" "$PKG/pi-extensions/lib/session-id.js"
 printf '%s\n' '// dist stub: copied+digested by the receive installer, never executed here' \
   > "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
 cp "$PKG/pi-extensions/lib/session-id.js" "$PKG/mcp/entwurf-bridge/dist/pi-extensions/lib/session-id.js"
+# The omp units select the same compiled closure in installed mode. Same stub discipline:
+# the installers copy and digest these bytes, they never execute them here.
+for _e in meta-bridge-omp.js meta-bridge-receive-omp.js; do
+  printf '%s\n' '// dist stub: copied+digested by the omp installers, never executed here' \
+    > "$PKG/mcp/entwurf-bridge/dist/pi-extensions/$_e"
+done
 
 # Fake pnpm: resolvable (so an unconditional require_cmd would pass), but any
 # INVOCATION writes a marker and exits uniquely — the bootstrap tripwire.
@@ -56,12 +68,12 @@ printf '#!/usr/bin/env bash\necho invoked > "%s"\nexit 97\n' "$MARKER" > "$SB/bi
 chmod +x "$SB/bin/pnpm"
 
 ABSENT="$SB/definitely-absent"
-run_setup() { # $1=HOME-root $2=project $3=PATH $4=PI_BIN $5=COPILOT_BIN(optional, default absent) → OUT/RC
+run_setup() { # $1=HOME-root $2=project $3=PATH $4=PI_BIN $5=COPILOT_BIN(opt) $6=OMP_BIN(opt) → OUT/RC
   mkdir -p "$1/.pi/agent" "$2"
   set +e
   # ONE physical line by contract: check-install-surface S5c is a line-scoped static tripwire,
   # so the sandbox env assignments must ride the same line as the run.sh drive they guard.
-  OUT="$(HOME="$1" XDG_DATA_HOME="$1/.local/share" XDG_STATE_HOME="$1/.local/state" XDG_CACHE_HOME="$1/.cache" XDG_CONFIG_HOME="$1/.config" PI_CODING_AGENT_DIR="$1/.pi/agent" PATH="$3" PI_BIN="$4" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="${5:-$ABSENT}" bash "$PKG/run.sh" setup "$2" 2>&1)"
+  OUT="$(HOME="$1" XDG_DATA_HOME="$1/.local/share" XDG_STATE_HOME="$1/.local/state" XDG_CACHE_HOME="$1/.cache" XDG_CONFIG_HOME="$1/.config" PI_CODING_AGENT_DIR="$1/.pi/agent" PATH="$3" PI_BIN="$4" CLAUDE_BIN="$ABSENT" AGY_BIN="$ABSENT" COPILOT_BIN="${5:-$ABSENT}" OMP_BIN="${6:-$ABSENT}" ENTWURF_OMP_AGENT_DIR="$1/.omp/agent" bash "$PKG/run.sh" setup "$2" 2>&1)"
   RC=$?
   set -e
 }
@@ -79,6 +91,8 @@ want "A: no auth.json.bak and credential bytes identical [QK:SETUP-CREDENTIAL-FR
   "[ ! -e '$HOME_A/.pi/agent/auth.json.bak' ] && [ \"\$(sha256sum '$HOME_A/.pi/agent/auth.json' | cut -d' ' -f1)\" = '$AUTH_SHA' ]"
 want "A: an absent copilot is one zero-state SKIP — no unit composed, no .copilot written [QK:SETUP-COPILOT-ABSENT-SKIP]" \
   "printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && [ ! -e '$HOME_A/.copilot' ]"
+want "A: an absent omp is one zero-state SKIP — no unit composed, no .omp written [QK:SETUP-OMP-ABSENT-SKIP]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && [ ! -e '$HOME_A/.omp' ]"
 want "A control: mode named first, pi/claude/agy SKIP, bins PASS, core FAIL, NON-GREEN summary" \
   "printf '%s' \"\$OUT\" | head -n 1 | grep -q 'mode: installed package' && printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'bins: PASS' && printf '%s' \"\$OUT\" | grep -q 'core: FAIL' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
 
@@ -122,5 +136,29 @@ want "D: the failing-vendor birth is a named FAIL, never a cosmetic PASS [QK:SET
 want "D control: detected copilot never reads SKIP, and the summary names copilot-birth NON-GREEN" \
   "! printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN' && printf '%s' \"\$OUT\" | grep -q 'copilot-birth'"
 
+# ── Cell E: omp PRESENT — the four units compose, and the SETTING is a real writer ──
+# The omp unit scripts never spawn the vendor (they probe `omp` on PATH and write into the
+# agent dir), so a stub binary is a faithful presence pin. Two claims live here: the
+# composition reaches omp at all, and the tools.xdev writer refuses an EXPLICIT operator
+# `true` by name rather than overwriting a decision it disagrees with.
+STUB_OMP="$SB/stub-omp"; mkdir -p "$STUB_OMP"
+printf '#!/usr/bin/env bash\necho "omp/18.0.0"\n' > "$STUB_OMP/omp"
+chmod +x "$STUB_OMP/omp"
+run_setup "$SB/home-e" "$SB/proj-e" "$STUB_OMP:$SB/bin:$PATH" "$ABSENT" "" "$STUB_OMP/omp"
+# One assertion on purpose: the four PASS rows AND the artifacts behind them. Split in two,
+# the row half alone passes a composition that reports PASS without running the unit.
+want "E: a detected omp composes all four units — own rows, each backed by its ARTIFACT rather than an exit code [QK:SETUP-OMP-INDEPENDENT]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-mcp: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-config: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS' && ! printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && [ -d '$SB/home-e/.omp/agent/extensions/entwurf-meta-omp' ] && [ -d '$SB/home-e/.omp/agent/extensions/entwurf-receive-omp' ] && [ -f '$SB/home-e/.omp/agent/mcp.json' ]"
+want "E control: the setting reached the config the vendor reads (effective xdev-off)" \
+  "[ \"\$(python3 '$PKG/scripts/omp-tool-surface.py' '$SB/home-e/.omp/agent' | awk '/^verdict /{print \$2}')\" = 'xdev-off' ]"
+# Now the disagreement branch: an operator who wrote xdev: true explicitly owns that value.
+mkdir -p "$SB/home-f/.omp/agent"
+printf 'tools: \n  xdev: true\n' > "$SB/home-f/.omp/agent/config.yml"
+run_setup "$SB/home-f" "$SB/proj-f" "$STUB_OMP:$SB/bin:$PATH" "$ABSENT" "" "$STUB_OMP/omp"
+want "F: an EXPLICIT operator tools.xdev:true is refused by name, never overwritten [QK:SETUP-OMP-CONFIG-NO-OVERWRITE]" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-config: FAIL' && grep -q 'xdev: true' '$SB/home-f/.omp/agent/config.yml' && ! grep -q 'xdev: false' '$SB/home-f/.omp/agent/config.yml'"
+want "F control: the disagreement is a component FAIL that leaves the other omp units composed" \
+  "printf '%s' \"\$OUT\" | grep -q 'omp-birth: PASS' && printf '%s' \"\$OUT\" | grep -q 'omp-receive: PASS' && printf '%s' \"\$OUT\" | grep -q 'NON-GREEN'"
+
 echo ""
 echo "check-setup-qualification: $PASS checks passed (mutation-attribution oracle only — behavior evidence lives in smoke-setup-verdict and check-pack-install)"

package/scripts/copilot-bridge-oracle.sh

@@ -77,13 +77,20 @@ PY
 #   QUALIFIED is absent, present exactly once with a parsed nonempty version, or in a
 #   shape nobody may act on. rc 0 prints `absent` or `one <version>`; rc 1 with the
 #   reason on stderr for a MALFORMED exact row (claims our qualified id but does not
-#   parse as `<qualified> (v<nonempty>)`) or MULTIPLE exact rows. Longer tokens that
-#   merely contain the qualified id remain foreign and are ignored, same as above.
+#   parse as `<qualified> (v<nonempty>)`, optionally followed by the vendor's own
+#   `(enabled)`/`(disabled)` state token — measured on Copilot CLI 1.0.81) or MULTIPLE
+#   exact rows. Longer tokens that merely contain the qualified id remain foreign and
+#   are ignored, same as above.
 copilot_exact_row_version() {
 	local list_text="$1" qualified="$2"
 	LIST_TEXT_ENV="$list_text" QUALIFIED_ENV="$qualified" python3 - <<'PY'
-import os, sys
+import os, re, sys
 qualified = os.environ["QUALIFIED_ENV"]
+# The measured row tail. Copilot CLI 1.0.81 appends its own state token after the
+# version (`... (v0.1.0) (enabled)`), so the grammar carries that OPTIONAL trailing
+# `(enabled)`/`(disabled)` explicitly instead of reading it as a garbled version.
+# Anything else in the tail is still malformed.
+ROW_TAIL = re.compile(r"\(v(?P<version>[^()]*)\)(?:[ \t]+\((?:enabled|disabled)\))?\Z")
 versions = []
 for raw in os.environ["LIST_TEXT_ENV"].splitlines():
     row = raw.strip()
@@ -100,10 +107,11 @@ for raw in os.environ["LIST_TEXT_ENV"].splitlines():
     if not parts or parts[0] != qualified:
         continue  # foreign row, including longer ids that merely contain ours
     rest = parts[1] if len(parts) == 2 else ""
-    if not (rest.startswith("(v") and rest.endswith(")")):
-        print(f"malformed exact row for {qualified}: {row!r} does not parse as '<qualified> (v<version>)'", file=sys.stderr)
+    match = ROW_TAIL.fullmatch(rest)
+    if match is None:
+        print(f"malformed exact row for {qualified}: {row!r} does not parse as '<qualified> (v<version>)' with an optional '(enabled)'/'(disabled)' state token", file=sys.stderr)
         sys.exit(1)
-    version = rest[2:-1]
+    version = match.group("version")
     if not version:
         print(f"malformed exact row for {qualified}: empty version in {row!r}", file=sys.stderr)
         sys.exit(1)

package/scripts/fake-copilot-vendor.sh

@@ -4,7 +4,9 @@
 # cannot drift: smoke-setup-verdict's copilot-present cell and check-pack-install's
 # installed copilot-present consumer row. The answer shapes are the MEASURED CLI's
 # (copilot 1.0.80, 2026-08-27) — the same shapes check-copilot-birth-hook.ts bakes
-# into its own TS fake: `plugin list` prints qualified ids with a `(vX)` suffix,
+# into its own TS fake: `plugin list` prints qualified ids with a `(vX)` suffix
+# followed by the vendor's `(enabled)` state token and an indented `from <path>`
+# continuation line (measured on copilot 1.0.81, 2026-08-31),
 # `plugin marketplace list` prints `<name> (Local: <abs path>)`, and `--force`
 # anywhere is refused loudly (the real `marketplace remove --force` uninstalls that
 # marketplace's plugins as a side effect; no entwurf surface may reach for it).
@@ -51,7 +53,7 @@ case "\$1 \$2 \$3" in
   "plugin marketplace remove") awk -F"\t" -v n="\$4" '\$1 != n' "\$MKTS" > "\$MKTS.tmp"; mv "\$MKTS.tmp" "\$MKTS"; exit 0 ;;
 esac
 case "\$1 \$2" in
-  "plugin list") echo "Installed plugins:"; sed "s/^/  • /;s/\$/ (v\$VER)/" "\$STATE"; exit 0 ;;
+  "plugin list") echo "Live Plugins (loaded from a local marketplace directory, never copied):"; while read -r id; do [ -n "\$id" ] && { echo "  • \$id (v\$VER) (enabled)"; echo "      from $dir"; }; done < "\$STATE"; exit 0 ;;
   "plugin uninstall") grep -Fvx "\$3" "\$STATE" > "\$STATE.tmp"; mv "\$STATE.tmp" "\$STATE"; exit 0 ;;
   "plugin install") echo "\$3" >> "\$STATE"; exit 0 ;;
 esac

package/scripts/lib/pi-record-discovery.ts

@@ -16,13 +16,60 @@
  * runs of the acp socket smokes).
  */
 
+import { existsSync } from "node:fs";
 import * as fsp from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 
 function sleep(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * pi's own cross-process locks. `FileAuthStorageBackend` (pi `dist/core/auth-storage.js`) guards
+ * `auth.json` AND `models-store.json` with `proper-lockfile`, and every boot reads through it, so
+ * these two directories are the ones a killed resident can leave behind.
+ */
+const PI_LOCK_PATHS = ["auth.json.lock", "models-store.json.lock"].map((name) =>
+	path.join(os.homedir(), ".pi", "agent", name),
+);
+
+/**
+ * The bound a LIVE smoke must give a `pi` boot — and the reason it is NOT "how long a boot takes".
+ *
+ * MEASURED 2026-09-03 on the release host, in the smokes' own spawn shape:
+ *  - an undisturbed boot → V3 record is **1008–1212ms across 80 consecutive boots** (5.1–5.4s under
+ *    4× CPU oversubscription), so a bound in the tens of seconds is not about boot cost;
+ *  - pi reads its auth/models store under a `proper-lockfile` lock whose stale window is
+ *    `staleMs = 30_000` (pi `dist/core/auth-storage.js`), and a contender that finds the lock held
+ *    retries for exactly that long before taking it over;
+ *  - SIGTERM lands inside that window often enough to matter — sweeping 24 kill offsets across a
+ *    boot left `~/.pi/agent/models-store.json.lock` orphaned once (at +375ms), because the signal
+ *    ends the process before `proper-lockfile`'s release ever runs;
+ *  - with such an orphan present, the very next boot measured **30_148ms** (and 1_114ms immediately
+ *    after, once the stale takeover had cleared it).
+ *
+ * So a 30_000 bound is the single worst value available: it expires 148ms INSIDE the takeover, and
+ * the record lands just after the smoke has stopped looking — an empty stderr, a live child, and no
+ * record in any store. That is what blocked two of the three 0.17.0 `--cut` runs on C1b, while
+ * `smoke-entwurf-chain-live` — same two-resident dance, 45_000 — passed all three. This constant is
+ * that value, shared so no smoke sits on the cliff again. Raise it if pi's `staleMs` ever grows;
+ * it must stay strictly greater than that window plus a boot.
+ */
+export const PI_BOOT_TIMEOUT_MS = 45_000;
+
+/**
+ * Which pi locks are on disk right now, for a failure diagnostic — a boot that overran its bound
+ * while one of these exists overran it for a NAMED reason, not a mysterious one. Read-only: a lock
+ * is arbitrated by pi's own stale protocol and must never be deleted by a smoke, because a live
+ * holder and an orphan look identical from here.
+ */
+export function describePiLockResidue(): string {
+	const present = PI_LOCK_PATHS.filter((lock) => existsSync(lock));
+	if (present.length === 0) return "none held (so a boot overrun here is not the pi lock-stale window)";
+	return `${present.join(", ")} — a boot contending with this waits out pi's ${30_000}ms stale window before taking over`;
+}
+
 export async function waitForPiRecord(storeDir: string, timeoutMs: number, pollMs = 100): Promise<string | null> {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {

package/scripts/mutants/acp-launch-namespace.json

@@ -0,0 +1,34 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-launch-namespace",
+	"mutants": [
+		{
+			"claim": "CLAUDE-LAUNCH-IS-NAMESPACED",
+			"title": "the default launch names the vendor bin directly again — the child re-enters the process-name space a janitor for another harness scans by substring, which is the whole of #72",
+			"subject": "pi-extensions/lib/acp/backend-adapter.ts",
+			"find": ["\tconst launcher = fileURLToPath(new URL(\"./claude-acp-launch.js\", import.meta.url));"],
+			"replace": ["\tconst launcher = require.resolve(\"@agentclientprotocol/claude-agent-acp/dist/index.js\");"],
+			"gate": ["bash", "run.sh", "check-acp-launch-namespace"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:CLAUDE-LAUNCH-IS-NAMESPACED]",
+			"signatureSource": "scripts/check-acp-launch-namespace.ts"
+		},
+		{
+			"claim": "CLAUDE-LAUNCH-IS-TRANSPARENT",
+			"title": "the launcher consumes an argv slot of its own — the vendor's argv.slice(1) self-reinvocation and its own flags stop working behind a name split that still looks correct",
+			"subject": "pi-extensions/lib/acp/claude-acp-launch.js",
+			"find": ["\tawait import(pathToFileURL(join(dirname(pkgJsonPath), binPath)).href);"],
+			"replace": [
+				"\tif (process.argv.includes(\"--version\")) {",
+				"\t\tconsole.log(\"entwurf launcher\");",
+				"\t\tprocess.exit(0);",
+				"\t}",
+				"\tawait import(pathToFileURL(join(dirname(pkgJsonPath), binPath)).href);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-launch-namespace"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:CLAUDE-LAUNCH-IS-TRANSPARENT]",
+			"signatureSource": "scripts/check-acp-launch-namespace.ts"
+		}
+	]
+}

package/scripts/mutants/acp-prompt-lifecycle.json

@@ -54,8 +54,8 @@
 			"claim": "REUSE-CARRIES-CHILD-DIAGNOSTICS",
 			"title": "the reuse path drops the child's stderr tail again — exactly the live sonnet failure that showed only \"ACP connection closed\"",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle);"],
-			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle);"],
+			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle, session.launchObservation);"],
+			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle, session.launchObservation);"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:REUSE-CARRIES-CHILD-DIAGNOSTICS]",
@@ -117,6 +117,71 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:CHILD-END-SILENCE-BOUNDED]",
 			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "LAUNCH-SIGNAL-EVIDENCE-STRUCTURED",
+			"title": "the caught-signal observation is dropped from the report — an externally killed child again reads as a clean vendor exit, the exact ambiguity #72 cost three diagnosis passes",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tconst diagnosed = observed ? `${withLifecycle}\\n${observed}` : withLifecycle;"],
+			"replace": ["\t\tconst diagnosed = withLifecycle;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:LAUNCH-SIGNAL-EVIDENCE-STRUCTURED]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "LAUNCH-FRAME-NOT-IN-TAIL",
+			"title": "the launcher's control frame is echoed into the vendor stderr tail — entwurf's own fact is laundered back into vendor evidence",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tspawned.stderr.on(\"data\", (c: Buffer) => consumeStderr.write(c.toString()));"],
+			"replace": [
+				"\t\t\tspawned.stderr.on(\"data\", (c: Buffer) => {",
+				"\t\t\t\tconsumeStderr.write(c.toString());",
+				"\t\t\t\tstderrTail.push(c.toString());",
+				"\t\t\t});"
+			],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:LAUNCH-FRAME-NOT-IN-TAIL]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "LAUNCH-SIGNAL-EXACT-FRAME-ONLY",
+			"title": "the frame is matched by prefix without its fixed enum — vendor prose can forge an entwurf-owned observation",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\t\tif (",
+				"\t\t\t\t\tline.startsWith(LAUNCH_SIGNAL_FRAME_PREFIX) &&",
+				"\t\t\t\t\tLAUNCH_SIGNAL_FRAME_VALUES.has(line.slice(LAUNCH_SIGNAL_FRAME_PREFIX.length))",
+				"\t\t\t\t) {"
+			],
+			"replace": ["\t\t\t\tif (line.includes(LAUNCH_SIGNAL_FRAME_PREFIX)) {"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:LAUNCH-SIGNAL-EXACT-FRAME-ONLY]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "STDERR-TAIL-FLUSHES-PARTIAL-LINE",
+			"title": "the line buffer never flushes its unterminated remainder — a child that dies mid-write loses the dying words the stderr tail exists to carry",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tspawned.stderr.once?.(\"close\", () => consumeStderr.flush());"],
+			"replace": ["\t\t\tvoid consumeStderr;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:STDERR-TAIL-FLUSHES-PARTIAL-LINE]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
+		},
+		{
+			"claim": "LAUNCH-FRAME-SPANS-CHUNKS",
+			"title": "the frame is matched per read instead of per line — a frame split across a chunk boundary is missed, and the external kill goes unreported exactly as it did in the field",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\theld += chunk;"],
+			"replace": ["\t\t\theld = chunk;"],
+			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:LAUNCH-FRAME-SPANS-CHUNKS]",
+			"signatureSource": "scripts/check-acp-prompt-lifecycle.ts"
 		}
 	]
 }

package/scripts/mutants/acp-stream-hooks.json

@@ -144,9 +144,11 @@
 			"claim": "ACPHOOK-ONRESPONSE-NEVER-CALLED",
 			"title": "someone 'completes' the hook contract by fabricating an HTTP 200 response on turn success — exactly the false evidence the exemption exists to forbid",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\tfunction finishSuccess(promptResult: { stopReason?: string }): void {"],
+			"find": [
+				"\tfunction finishSuccess(adapter: AcpBackendAdapter, session: BridgeSession, promptResult: AcpPromptResponse): void {"
+			],
 			"replace": [
-				"\tfunction finishSuccess(promptResult: { stopReason?: string }): void {",
+				"\tfunction finishSuccess(adapter: AcpBackendAdapter, session: BridgeSession, promptResult: AcpPromptResponse): void {",
 				"\t\tvoid options?.onResponse?.({ status: 200, headers: {} }, model);"
 			],
 			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],

package/scripts/mutants/acp-usage-accounting.json

@@ -0,0 +1,181 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-usage-accounting",
+	"mutants": [
+		{
+			"claim": "ACP-TURN-AGGREGATE-NOT-PROJECTED",
+			"title": "the turn's ROUND-TRIP AGGREGATE is projected back onto pi's four per-request usage fields — re-plants the exact 2026-09-02 defect: pi's own isContextOverflow then read 42 + 4,185,084 against a 1,000,000 window and compacted a live session whose context was 223,516",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tsealTurnUsage(adapter, session, promptResult);"],
+			"replace": [
+				"\t\tsealTurnUsage(adapter, session, promptResult);",
+				"\t\tconst reprojected = promptResult?.usage;",
+				"\t\tif (adapter.sealsTurnAccounting && reprojected) {",
+				"\t\t\tstate.output.usage.input = reprojected.inputTokens ?? 0;",
+				"\t\t\tstate.output.usage.output = reprojected.outputTokens ?? 0;",
+				"\t\t\tstate.output.usage.cacheRead = reprojected.cachedReadTokens ?? 0;",
+				"\t\t\tstate.output.usage.cacheWrite = reprojected.cachedWriteTokens ?? 0;",
+				"\t\t}"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-TURN-AGGREGATE-NOT-PROJECTED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CONTEXT-OCCUPANCY-PRESERVED",
+			"title": "the seal stops writing the session's context occupancy into totalTokens — pi's calculateContextTokens then falls through to summing the four (all zero) usage fields, so the status-line percentage and auto-compaction read a long session as empty",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tif (typeof session.contextOccupancyTokens === \"number\") {",
+				"\t\t\tstate.output.usage.totalTokens = session.contextOccupancyTokens;",
+				"\t\t}"
+			],
+			"replace": [
+				"\t\tif (typeof session.contextOccupancyTokens === \"number\") {",
+				"\t\t\tstate.output.usage.totalTokens = 0;",
+				"\t\t}"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CONTEXT-OCCUPANCY-PRESERVED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CONTEXT-OCCUPANCY-CARRIED",
+			"title": "the seal stops carrying the session's last known context occupancy — a turn whose usage_update never arrived now emits a token partition with a zero totalTokens, so pi falls through to that partition and reads a long session as nearly empty",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tif (typeof occupancy === \"number\") session.contextOccupancyTokens = occupancy;",
+				"\t\tif (typeof session.contextOccupancyTokens === \"number\") {",
+				"\t\t\tstate.output.usage.totalTokens = session.contextOccupancyTokens;",
+				"\t\t}"
+			],
+			"replace": ["\t\tif (typeof occupancy === \"number\") session.contextOccupancyTokens = occupancy;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CONTEXT-OCCUPANCY-CARRIED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-TURN-COST-SUM-MATCHES-SDK",
+			"title": "the backend's RUNNING SESSION TOTAL is assigned to the turn cost again instead of the adjacent diff — the arithmetic that displayed a $24.261 session as $444.370",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\t\tsession.sdkCumulativeCostUsd = observed;",
+				"\t\t\t\tstate.output.usage.cost.total = diff;",
+				"\t\t\t\tturnCostUsd = diff;"
+			],
+			"replace": [
+				"\t\t\t\tsession.sdkCumulativeCostUsd = observed;",
+				"\t\t\t\tstate.output.usage.cost.total = observed;",
+				"\t\t\t\tturnCostUsd = diff;"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-TURN-COST-SUM-MATCHES-SDK]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-COST-BASELINE-HELD-WHEN-MISSING",
+			"title": "a turn with no cost notification zeroes the baseline instead of holding it — the next diff then re-attributes every dollar the session had already spent",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tstate.output.usage.cost.total = 0;",
+				"\t\t} else {",
+				"\t\t\tconst diff = observed - (session.sdkCumulativeCostUsd ?? 0);"
+			],
+			"replace": [
+				"\t\t\tsession.sdkCumulativeCostUsd = 0;",
+				"\t\t\tstate.output.usage.cost.total = 0;",
+				"\t\t} else {",
+				"\t\t\tconst diff = observed - (session.sdkCumulativeCostUsd ?? 0);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-COST-BASELINE-HELD-WHEN-MISSING]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-COST-RESET-NOT-SILENT",
+			"title": "a running total that goes backwards is absorbed silently — the turn reports a negative cost, nobody is told, and the only observation that could settle what a conversation reset does to the total is destroyed",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tif (diff < 0) {"],
+			"replace": ["\t\tif (diff < -1_000_000) {"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-COST-RESET-NOT-SILENT]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CORTEX-USAGE-UNTOUCHED",
+			"title": "the seal stops being gated on the adapter DECLARING measured semantics — claude's accounting is sealed onto a backend nobody measured, minting the same unmeasured accounting this lane exists to end",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tif (!adapter.sealsTurnAccounting) return;"],
+			"replace": ["\t\tvoid adapter.sealsTurnAccounting;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CORTEX-USAGE-UNTOUCHED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-TURN-ACCOUNTING-ATTACHED",
+			"title": "the vendor's four turn totals stop riding their own key — pi's four fields are 0 and nothing else carries the numbers, so the cache-effect badge has no inputs and a paid-for prefix rewrite reaches the operator as silence",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\t(state.output.usage as unknown as { acp?: AcpTurnAccounting }).acp = aggregate;"],
+			"replace": ["\t\t\tvoid aggregate;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-TURN-ACCOUNTING-ATTACHED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CACHE-REBILL-REPORTED",
+			"title": "the re-billed-prefix bound drops its ΣcacheWrite term, so a full prefix rewrite after an idle gap no longer clears the notice floor — the operator runs on a cache-effect badge while having already paid to rewrite the whole prefix",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\t? (priorOccupancy as number) - (priorIoSum as number) - Math.max(0, (occupancy as number) - cacheWriteForBound)"
+			],
+			"replace": ["\t\t\t? (priorOccupancy as number) - (priorIoSum as number) - Math.max(0, occupancy as number)"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CACHE-REBILL-REPORTED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-REBILL-NEVER-EXCEEDS-WRITE",
+			"title": "the re-billed claim loses its physical cap, so a context shrink (organic compaction) announces a six-figure cache miss over a turn that wrote a thousand tokens — a fact the operator has no way to disbelieve",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tconst missLowerBound = rawBound === undefined ? undefined : Math.min(rawBound, cacheWriteForBound);"
+			],
+			"replace": ["\t\tconst missLowerBound = rawBound;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-REBILL-NEVER-EXCEEDS-WRITE]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-ACCOUNTING-PREFERS-WIDEST",
+			"title": "the accounting-grade model_usage rows stop being preferred, so the turn silently reports MAIN-LOOP-ONLY tokens against an all-inclusive cost denominator — the cache-effect badge understates itself exactly when compaction or a subagent ran, and nothing says so",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tif (Array.isArray(rows) && rows.length > 0) {"],
+			"replace": ["\tif (Array.isArray(rows) && rows.length > 99) {"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-ACCOUNTING-PREFERS-WIDEST]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-REBILL-MAIN-LOOP-SCOPE",
+			"title": "the re-billed bound takes cacheWrite from the WIDE accounting rows instead of the main loop, so a warm main prefix announces a six-figure miss (and this turn's dollar figure) because an internal/compaction call wrote extra cache — mixing occupancy's scope with model_usage's",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tconst cacheWriteForBound = mainLoop !== undefined ? mainLoop.cacheWrite : 0;"],
+			"replace": ["\t\tconst cacheWriteForBound = aggregate !== undefined ? aggregate.cacheWrite : 0;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-REBILL-MAIN-LOOP-SCOPE]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		}
+	]
+}