@junghanacs/entwurf 0.16.1 → 0.17.2

package/AGENTS.md

@@ -104,7 +104,9 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 
 ## Issue queue — a manual sweeper, not a backlog
 
-- OPEN issues are live contracts only, capped at five. A sixth means something closes first; the cap does not bend.
+- **Two caps, and the inner one is what disciplines the work.** OPEN issues are capped at **ten** in total; of those, **implementation issues — the ones that will go out on a branch — are capped at five**. A sixth implementation issue means one closes first; that inner cap does not bend.
+- **What sits outside the implementation five:** research issues, and issues GLG keeps open to look at. These are not slots to be earned or swept — a research lane may stay open across releases, and a north-star issue other repos read may never close. They still count toward the ten, so the queue cannot grow without limit.
+- Classify by destination, not by size: if closing it produces a diff, it is an implementation issue. If closing it produces a decision, a document, or nothing, it is not.
 - A slot is earned by a current defect or executable contract, not by importance, age, or possible future value.
 - Direction, philosophy, frozen invariants and observations without a current action live in `ROADMAP.md`, durable docs, or closed history.
 - Nothing stays open "in case." If a closed problem recurs, it returns as a new issue carrying the new evidence.
@@ -140,7 +142,7 @@ LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 - The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. Neither tier includes `check-gate-qualification`, which is scheduled separately (below).
 - **Kill-proof discipline (gate qualification).** A gate is a test only if re-planting a closed defect turns it red for the claimed reason. `check-gate-qualification` proves that automatically: committed mutants in `scripts/mutants/` must be KILLED at their `[QK:<claim>]` signature inside an isolated snapshot repo (control→mutant→restore→control; the real checkout is never written). Gates a release touches carry such manifests; assertion counts are never evidence — claim IDs + killed mutant IDs are. `check-agy-permission-matrix` holds the enumerated permission contract space; matrix cells change by axis/rule edits, never by appending cases.
 - **When changing a contract/gate:** name the production subject and an oracle independent of it; give the failing assertion a stable `[QK:<claim>]` label and add/update the exact-once mutant in `scripts/mutants/*.json`; if the contract is combinatorial, update the literal matrix axes/cells/exclusions together with their declared counts; then verify the focused gate, and let qualification and the full floor follow the scheduling contract below — once on the frozen candidate, not once per amendment. `MUTANT-STALE`/`SURVIVED`/`WRONG-REASON`/`CONTROL-RED`/`HANG`/`IMPURE` are red — never substitute an assertion count for a kill.
-- Run LIVE gates with `PWD` in scratch so session artifacts do not land in the repo.
+- Run LIVE gates with `PWD` in scratch so session artifacts do not land in the repo. Strip `CLAUDE_CONFIG_DIR`, `PI_SESSION_ID`, and `PI_AGENT_ID` from the gate process — a live pi/ACP session exports them into children, where they strip Claude hooks or capture a fresh-call callback.
 - Release acceptance and evidence levels are defined in [VERIFY.md](./VERIFY.md); recorded host evidence is in [BASELINE.md](./BASELINE.md).
 - A failed gate or evidence downgrade blocks commit/release. Pipes can be connected and the water can still taste wrong.
 

package/CHANGELOG.md

@@ -4,6 +4,339 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.17.2 - 2026-09-03
+
+### Added
+
+- **An arriving letter is now visible to the operator, not just to the model (#98).** A sibling's
+  mail landed, was read, and left one line on the receiving screen — `Stop hook feedback` — with no
+  sender, no count, no garden id. Three surfaces changed, each measured in the
+  `scripts/raw-async-delivery/` lab before any product edit:
+  - **The doorbell says what it is.** The shipped `FileChanged` hook declares
+    `rewakeSummary: "entwurf inbox: sibling mail arrived"` and
+    `rewakeMessage: "entwurf mailbox notice:"`. The model no longer wakes to
+    `Stop hook blocking error from command "FileChanged"` — mail arriving was being named an error.
+    Both fields are `@internal` in the vendor and unsanitized, so `check-hook-launch-topology` lints
+    them (declared, no newline, not whitespace-only, length bound, no `[` in the prefix that would
+    double the doorbell's own `[entwurf inbox]`) and `smoke-meta-async-drift` carries both as
+    markers — a silent `@internal` removal is a future this repo cannot measure live.
+  - **The status line carries an unread badge.** `✉N` counts exactly what `entwurf_inbox_read`
+    would hand back (`*.msg` + `*.msg.delivered`, `.read` excluded — the same union as
+    `readMetaInbox`). No badge at zero. **`✉?` when the count could not be TAKEN** (no python3,
+    unusable garden id, unreadable directory): a measurement failure must not look like an empty
+    inbox.
+  - **A send names the file it enqueued.** `entwurf_v2 meta-mailbox → enqueued (2026-…-113443.msg)`.
+    `enqueueMetaMessage` already returned `messagePath`; the mailbox hand was flattening it to
+    `{success:true}`. Deliberately not a read stamp: at enqueue time `lastReadAt` belongs to the
+    PREVIOUS message, and surfacing it would read as "my message was read".
+
+### Fixed
+
+- **A dead-socket send that falls back to the mailbox now names its file too (#98).** A
+  control-socket delivery whose socket was gone re-resolves to the mailbox and writes a `.msg`
+  exactly like the primary rail, but the sender's line said only `fallback-sent` — the one mailbox
+  delivery with no per-message identifier. The receipt is carried through `SendDrive` →
+  `ControlSocketSendResult` → `ExecutedOutcome` → surface. A socket-to-socket retry writes no file
+  and carries none; a `rejected` enqueue carries none; a dep that omits it degrades to the bare
+  outcome rather than printing `undefined`.
+- **entwurf no longer owns the compaction switch (#94).** `autoCompactEnabled` and
+  `env.DISABLE_AUTOCOMPACT` moved from `MANAGED_SETTINGS_SCALARS` to `RETIRED_SETTINGS_SCALARS`,
+  the path `skipDangerousModePermissionPrompt` already walked. Retirement moves **ownership, not
+  state**: `relinquish_retired_scalar()` restores the install-state snapshot only when the current
+  value still equals the last managed one, so retirement alone turns compaction on for nobody —
+  turning it on is a separate operator act, and entwurf writing that value again would undo the
+  return. The doctor now stays green for an operator who turned compaction back on.
+  - **A correction that belongs in the record:** `env.DISABLE_AUTOCOMPACT` was a **no-op** at Claude
+    Code 2.1.259 — the only key that actually suppressed compaction was `autoCompactEnabled`. The
+    conclusion is unchanged; the reason narrows to one key.
+  - The lineage is also corrected. 0.5.0 *did* ship a pi-side compaction guard in real code;
+    `378c682` (v2 subtraction) deleted it and `623a4ea` later cleared the docs that outlived it by
+    seven days. The "zero code backing" in that commit message was a grep result at that moment, not
+    a claim that the guard never existed.
+
+### Changed
+
+- **Three shipped comments stopped repeating two claims this release retired.** `doorbell.sh`,
+  `raw-async-delivery/README.md` and `smoke-meta-async-drift.sh` said that `asyncRewake` ignores
+  `rewakeMessage` and that stdout is dropped. Measured against three vendor binaries (2.1.236 /
+  2.1.258 / 2.1.259), both are false: `rewakeMessage` *replaces* the prefix, and the body is
+  `stderr || stdout`. The marker strings were correct while their stated reasons were dead — a
+  sentinel nobody could act on. The lab README now carries the receipts under
+  `## Inherited facts corrected`, and the watcher documents what it observes rather than which
+  backends it expects.
+- `lastDeliveredAt` is documented as a **reserved slot nobody stamps**, in five comments and four
+  test cells that had been pinning it green as `=== null` while 933 files carried a `.delivered`
+  suffix. The per-message facts are the suffixes (`.msg` → `.delivered` → `.read`); `state.json`
+  holds only the garden's last enqueue/read. Removing the field is a separate migration (its reader
+  is doubly strict and 182 v1 files are on disk), tracked apart from this release.
+
+### Upgrade note
+
+**Run `entwurf setup` once after upgrading — every rail, not just Claude.** Two separate debts:
+
+- The Claude plugin's hook template gained `rewakeSummary` and `rewakeMessage`, so until
+  `install-meta-bridge` runs, `doctor-meta-bridge` reports
+  `installed manifest DIFFERS … Re-run install-meta-bridge`.
+- **This release changed `lib/meta-session.ts`, and four install paths deploy that file** —
+  `install-meta-bridge` (Claude), `install-omp-bridge` and `install-omp-receive` (OMP),
+  `install-copilot-bridge` (Copilot). Every one of them that is installed on the host now carries a
+  STALE writer until it is re-installed, and its own doctor says so by name. Re-installing only the
+  Claude rail leaves the others stale — measured on oracle during this cut, where it blocked
+  `smoke-omp-receive-live` and turned the first `--cut` run red.
+
+`entwurf setup` is presence-driven and re-synthesizes exactly the units this host has, which is why
+it is the upgrade command rather than any single `install-*`. An already-open Claude Code session
+keeps the old manifest until it restarts.
+
+0.17.1 was tagged and released on GitHub but **not published to npm**; it is superseded by this
+version.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.259, node 24.18.1, pi 0.84.4, omp 18.0.0).
+
+- **`pnpm run check:full` — exit 0** (432s on the prepared tree; 437s on the pre-version HEAD).
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.17.2b.WW12BK --cut` — `cut: OK`,
+  exit 0.** **MUST PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**. Run 20:39→21:26 KST
+  with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`. Log:
+  `/tmp/entwurf-release-gate-0.17.2b.WW12BK/release-gate.log`. It carried `check:full` (429s) and
+  `check-gate-qualification` (**347/347 KILLED**) as MUST steps.
+- **The first `--cut` attempt was RED, and that is the receipt for the upgrade note above.**
+  `smoke-omp-receive-live` failed with `STALE writer: source=634d5b96ed50 installed=229fef123589`
+  on `~/.omp/agent/extensions/entwurf-receive-omp/lib/meta-session.ts` — MUST PASS=22 FAIL=1,
+  `cut: BLOCKED`. Both OMP extensions on the host still carried the pre-release writer because only
+  the Claude rail had been re-installed. `install-omp-bridge` + `install-omp-receive` moved both to
+  `634d5b96ed50`, `doctor-omp-bridge` and `doctor-omp-receive` went PASS, and the re-run was green.
+  Nothing in the product changed between the two runs.
+- **#94 measured on a live host.** After one `install-meta-bridge`, the install-state ledger no
+  longer carries `autoCompactEnabled` or `env.DISABLE_AUTOCOMPACT`, and `~/.claude/settings.json`
+  was **byte-identical** to its pre-install backup — the return does not rewrite the value it
+  returns. `doctor-meta-bridge` went FAIL→PASS, `smoke-meta-install-state` PASS,
+  `check-meta-doctor-oracle` PASS including the two new cells (`an operator who turned compaction
+  back ON is not drift`, `install-state still owns a retired scalar → FAIL naming its own cause`).
+- **#98 B measured across the whole suffix lifecycle** in an isolated mailbox root: no badge at 0,
+  `✉1` on `.msg`, `✉2` after `.msg.delivered`, unchanged by a `.read` file, back to no badge when
+  all are read, and `✉?` on an unreadable directory.
+- **`smoke-meta-async-drift` ends `pass=12 fail=0 drift=1`, exit 1** — the drift is
+  `codex 0.147.0` outside the `0.144.x` pin and **pre-dates this release**. Both markers this
+  release added (`rewakeMessage`, `rewakeSummary`) are present. The pin bump is deliberately not in
+  this lane.
+- **Exact-SHA CI on the pre-version HEAD `4124e42`** — `check`, `install-surface`,
+  `artifact-consumer` all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33742448634
+
+## 0.17.1 - 2026-09-03
+
+### Fixed
+
+- **The C1b red that blocked two of the three 0.17.0 `--cut` runs: a LIVE smoke was waiting exactly
+  as long as pi's lock-stale window, and losing by 148ms.** The cause is measured end to end, and
+  none of it is a product regression:
+  1. pi guards `auth.json` AND `models-store.json` with `proper-lockfile` and reads through that
+     lock on every boot (`dist/core/auth-storage.js`), retrying a held lock for `staleMs = 30_000`
+     before taking it over.
+  2. `terminateChild`'s SIGTERM ends a resident before `proper-lockfile`'s release ever runs, so a
+     kill that lands inside the lock window orphans the lock directory. Sweeping 24 kill offsets
+     across a boot reproduced it once, at +375ms.
+  3. With `~/.pi/agent/models-store.json.lock` orphaned, the next boot → V3 record measured
+     **30_148ms** — and **1_114ms** immediately afterwards, once the stale takeover had cleared it.
+  4. `smoke-entwurf-v2-matrix-live`'s `BOOT_TIMEOUT_MS` was `30_000`: it stopped looking 148ms
+     before C1b's record landed. Hence the exact signature the blocked cuts left — empty stderr, no
+     record in any store, and (confirmed in both runs from the host's own process-audit trail) a
+     child that was alive for the entire 30s and was killed by the smoke at +30s.
+  The control was in the same three runs: `smoke-entwurf-chain-live` does the same two-resident
+  dance with `BOOT_TIMEOUT_MS = 45_000` and passed 3/3 while matrix-live failed 2/3.
+  - **The bound is now shared and carries its receipt.** `PI_BOOT_TIMEOUT_MS = 45_000` lives in
+    `scripts/lib/pi-record-discovery.ts` next to the measurements above, and the five smokes that
+    sat on the 30s cliff (`smoke-entwurf-v2-matrix-live`, `smoke-acp-socket-citizen-live`,
+    `smoke-acp-bundled-mcp-live`, `smoke-acp-v2-send-live`, `smoke-acp-cortex-live`) now derive
+    from it. 30s was the single worst value available: it expires *inside* the takeover.
+    `smoke-resident-garden-guard` already used 90s and needed no change.
+  - **A boot overrun now names the lock.** `describePiLockResidue()` reports which pi locks are held
+    at failure time — read-only, because a live holder and an orphan look identical from outside and
+    only pi's own stale protocol may arbitrate them.
+- **Both blocked smokes now say WHICH failure they hit**, which is what made the cause findable.
+  `smoke-entwurf-v2-matrix-live` watches each resident (pid, exit code/signal and how many ms in, a
+  signal-0 liveness probe taken in the catch before the reaper runs, and a **per-child** stderr tail
+  — the old single shared buffer could not say whether C1 or C1b spoke; an empty tail now prints as
+  `(empty)` rather than being skipped). `smoke-mux-lifecycle-live` attaches window forensics when a
+  nonce callback never comes — pane-pid liveness, `list-panes`, and the last 40 lines of
+  `capture-pane`, for both cells. Its launch receipt already tells a human "the window is visible
+  and can be read directly"; on a headless gate nobody is there and the window is torn down seconds
+  later. Every diagnostic step is best-effort so it can never become the failure.
+
+  The mux pi-native nonce timeout (the second blocked cut) is NOT this bug and stays open: 300s is
+  ten times the stale window, and the codex rail was healthy in that same run (`chain-live` and
+  `smoke-omp-fresh-live` both passed on it). The forensics above are what the next occurrence will
+  answer with.
+
+### Verification
+
+- `pnpm run check:toolchain` (biome + `tsc` ×3) — green.
+- **The repair measured against the exact failing condition.** With `models-store.json.lock`
+  planted as an orphan, `LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live` is **17/17 PASS in 34s** —
+  the stale wait absorbed. The same condition measured 30_148ms to birth, i.e. red under the old
+  30_000 bound.
+- **Boot cost, undisturbed**: 1008–1212ms across 80 consecutive boots in the smokes' spawn shape
+  (5.1–5.4s under 4× CPU oversubscription). The bound is not sized for boot cost; it is sized to
+  clear pi's stale window.
+- **The new matrix-live diagnostic exercised on a real failure path**, at 0 model tokens, by
+  pointing the smoke at a bogus provider: `resident C1: pid=… EXITED code=1 signal=null at +1057ms
+  — it was gone before the wait ended`, with that child's own stderr beneath it.
+- `LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live` — **17/17 PASS** on the real
+  `openai-codex/gpt-5.6-luna` target (undisturbed run).
+- `LIVE=1 ./run.sh smoke-mux-lifecycle-live` — **81 checks passed, exit 0** (real model turns on
+  both pi cells and the claude-code cell).
+- 15 iterations of the gate's own C1b neighbourhood (`smoke-resident-garden-guard` → `check-bridge`
+  → `doctor-pi-provider` → `smoke-entwurf-v2-matrix-live`) reproduced nothing — recorded because it
+  is what ruled out host load and prior-smoke residue and sent the search to pi's lock.
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.17.1.hb5Q5j --cut`** — **MUST
+  PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, exit 0, `cut: OK`. Run on `665191d`,
+  2026-09-03 09:46:37 → 10:35:42 KST, with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u
+  PI_AGENT_ID`. Log: `/tmp/entwurf-release-gate-0.17.1.hb5Q5j/release-gate.log`. This carried
+  `pnpm run check:full` (451s) and `./run.sh check-gate-qualification` (**347/347 KILLED**) as MUST
+  steps. **This is the green `--cut` 0.17.0 never got**: both cells that blocked it — C1b in
+  `smoke-entwurf-v2-matrix-live` and the pi-native nonce in `smoke-mux-lifecycle-live` — passed
+  here, on the same host, in one run.
+- **Exact-SHA CI on `665191d`** — `check` (34m20s, carrying `check:full` and
+  `check-gate-qualification`), `install-surface`, `artifact-consumer`, all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33697821117
+
+## 0.17.0 - 2026-09-02
+
+### Verification
+
+Each receipt carries its own scope; none of them is transferable to another commit or host.
+
+- **`LIVE=1 ./run.sh release-gate <scratch> --cut`** — **MUST PASS=23 FAIL=0 SKIP=0**,
+  BEHAVIOR PASS=1 FAIL=0 SKIP=0, exit 0, `cut: OK`. Run on commit `0379764`, tracked tree
+  `cb1a3dc69b521909f0fe6f956e5c0fa36e885d5955f91271dd8e63d30cd918fb`, 2026-09-02
+  20:14:51 → 21:04:41 KST. Frozen log: `/tmp/entwurf-0.17.0-evidence/ACCEPTED-cut-release-gate.log`.
+  This run carried `pnpm run check:full` and `./run.sh check-gate-qualification`
+  (**346/346 KILLED**) as MUST steps. **It is not the 0.17.0 acceptance SHA:** `9479750`
+  changed source after it.
+  `CHANGELOG.md` is in `package.json` `files` and `check:full → check:package → check-pack`
+  enumerates it (`npm pack --dry-run`, required/forbidden names — not a cardinality lock).
+  `NEXT.md` is not in `files`. Working-tree cleanliness at cut start was an operator
+  observation, not a line in the gate log.
+- **Four reds along the way, all real, none smoothed.** A formatter rejection of the new mutant
+  manifest; a doc-floor gate catching the ROADMAP ledger entry quoting the ADAPTER's
+  `engines.node ">=22"` as though it were entwurf's own; a qualification run that aborted RED on its
+  own self-fence because the worktree was edited mid-run — kept in the record because a
+  qualification predating the final bytes is not a receipt, and the fence is what says so; and
+  `check-bridge-delivery` failing "artifact is not stale" after the review amendment edited three
+  `.ts` files without rebuilding the MCP bridge. That last one is why the tree hash above is quoted
+  twice: `mcp/entwurf-bridge/dist/` is gitignored, so the rebuild moved no candidate byte, and the
+  two receipts really do cover the same tree. None of the four would have been caught by typecheck
+  plus the focused gate.
+- **The first `--cut` attempt was RED — MUST PASS=18 FAIL=5 SKIP=0 — and every one of the five was
+  the operator's own environment, not this release.** Recorded because the failure wore a
+  convincing disguise: it read as a broken host. `static` was the stale bridge artifact above,
+  re-created when a `git checkout`/`merge` bumped every tracked `.ts` mtime past the built `dist`.
+  The other four came from running the gate **inside a live entwurf ACP Claude session**, which
+  exports two carriers into every child it spawns. `CLAUDE_CONFIG_DIR` points at the ACP overlay,
+  whose `settings.json` is `hooks: {}` by design — so the Claude Code children the live smokes
+  launch are born with no entwurf SessionStart hook and mint no meta-record, failing
+  `smoke-claude-native-resume-live`, `smoke-entwurf-chain-live` and `smoke-mux-lifecycle-live` on
+  citizen birth. The same variable made `doctor-meta-bridge` report `installed: absent` and
+  `claude mcp list` deny `entwurf-bridge`; with it unset the doctor reads
+  `installed: v3 (229fef123589)` matching source and assembled exactly. `PI_SESSION_ID` did the
+  analogous damage on the omp axis: `smoke-omp-fresh-live` reported a 240s nonce-callback timeout,
+  but the sibling was alive — it was born at 19:58:21 KST and called back at 19:58:28 to the
+  AMBIENT caller id rather than the caller the smoke had minted, so the smoke watched the right
+  mailbox and saw nothing. That smoke's own source anticipates this exact disguise
+  (`scripts/smoke-omp-fresh-live.ts:186`, "the failure would masquerade as a silent sibling").
+  Re-run with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`, all five turned green and
+  nothing else changed. That gap — VERIFY.md named `PWD` in scratch but not the carriers — is what
+  cost the first cut its 52 minutes; VERIFY.md and AGENTS.md now name the strip.
+- **Qualification lane size.** On the `0379764` cut the total was **335 → 346**, eleven new claims
+  in `scripts/mutants/acp-usage-accounting.json` (absent on the 0.16.1 base). `9479750` adds a
+  twelfth, `ACP-REBILL-MAIN-LOOP-SCOPE`. Standalone `./run.sh check-gate-qualification` on
+  `fee89d3` is **347/347 KILLED** (36m19s, log `/home/junghan/.pi/background/1788355846036-bg03.log`).
+  That is a qualification receipt, not a `--cut` receipt.
+- **Three recuts on the D1 tree, all `cut: BLOCKED`.** Each ran
+  `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID LIVE=1 ./run.sh release-gate <scratch> --cut`.
+  All three: MUST PASS=22 FAIL=1 SKIP=0, BEHAVIOR PASS=1. None of the FAILs is D1.
+  1. `/tmp/entwurf-cut-0.17.0.WdTkH7` — `smoke-entwurf-v2-matrix-live` C1b: second
+     `pi --entwurf-control` wrote no hidden-store record in 30s, stderr empty. Isolated re-run:
+     17/17 PASS.
+  2. `/tmp/entwurf-cut2-0.17.0.XQcOuR` — `smoke-mux-lifecycle-live` pi-native nonce
+     `mux-fresh-call-4bd6391e9783fb24fb1ee74a` never arrived in 300s (claude-code cell passed;
+     v2-matrix passed this run). Same shape as the 0.16.1 mux-lifecycle retry.
+  3. `/tmp/entwurf-cut3-0.17.0.sfZ8WC` — C1b 30s again. Isolated re-run: 17/17 PASS.
+     mux-lifecycle PASS this run.
+  GLG 2026-09-03: no fourth cut. Make proceeds with this gap named here, not rounded up to
+  `cut: OK`.
+- **`smoke-acp-raw-turn-live`** — PASS on the moved pin, quoted from the accepted `--cut` run's own
+  output rather than from a session message: launch source
+  `package:@agentclientprotocol/claude-agent-acp` (not PATH fallback), `protocolVersion=1`, model
+  `claude-sonnet-5`, `stopReason=end_turn`, reply `"OK"`, 62,998 bytes NDJSON. This is the dep-bump
+  track's own named lock, not a substitute for it. An earlier standalone run of the same smoke
+  reported 58,189 bytes and another 58,178; the byte count is per-run and is not a fixed
+  fingerprint, which is precisely why the number cited here is the one the gate printed.
+- **Recurrence corpus measurement** — cited from the in-source comment at
+  `pi-extensions/lib/acp/backend.ts` (`priorTurnInputOutputSum`): 2,398 of 2,410 adjacent pairs
+  (99.50%), 2026-05 → 2026-09. The raw pair inventory is not in the frozen receipts; treat it as
+  an operator observation recorded in source, not as a cut receipt.
+
+### Changed
+
+- **ACTION REQUIRED — ACP accounting consumers must read `usage.acp`.** Claude ACP
+  `PromptResponse.usage` is the sum across a turn's API round trips, not one request's
+  prompt shape. The turn's accounting totals now travel at
+  `usage.acp.{input,output,cacheRead,cacheWrite}`; pi's four request-shaped fields remain
+  zero, while `usage.totalTokens` remains the vendor's context-occupancy reading. Consumers
+  that display ACP token/cache accounting must read the new key — `agent-config`'s
+  `pi-extensions/glg-footer.ts` does so at `47b9b95`. The numerator is taken from the
+  vendor's ACCOUNTING-GRADE `_meta.quota.model_usage` rows (summed) in preference to the
+  main-loop-only `PromptResponse.usage`, because the cost denominator is an adjacent diff of
+  the backend's running total and already has that wider scope. Deterministic receipts:
+  `scripts/check-acp-usage-accounting.ts` CELLs 1/1b drive pi's real overflow and context
+  readers with the incident-scale 4,185,084 cache-read aggregate on a 223,516-token context,
+  and CELL 1e drives both token carriers at once so a silent fallback to the narrow one
+  cannot pass for a preference.
+- **ACTION REQUIRED — the certified Claude ACP dependency coordinates move together, and
+  this release REQUIRES them.** The bundled Claude adapter is
+  `@agentclientprotocol/claude-agent-acp` **0.70.0 → 0.73.0**, its wire SDK is
+  `@agentclientprotocol/sdk` **1.3.0 → 1.4.0**, and the resolved transitive
+  `@anthropic-ai/claude-agent-sdk` is **0.3.232 → 0.3.257**. This is not a refresh riding
+  along with the fix: `_meta.quota.model_usage` does not exist before adapter 0.71.0 (added
+  by upstream `fad4d10`, "report per-model token usage on prompt responses"), so the
+  accounting above has no accounting-grade numerator without this bump. Three adapter minors
+  are folded into one certification; the per-bump measurement — declared-dependency deltas
+  per tag, the zod floor narrowing at 0.71.0, lock peer-resolution, the reachable/unreachable
+  split of the new surface, and the re-measured MCP readiness boundary — is recorded in the
+  ROADMAP "Dep bump(별도 트랙)" ledger. Re-run the ACP support gates on any locally
+  overridden adapter command before treating that command as covered by these coordinates.
+
+### Fixed
+
+- **Claude ACP no longer presents a turn aggregate as one request to pi.** That projection
+  caused pi's raw overflow reader to compact a live 223,516-token session under a
+  1,000,000-token window, invented two phantom cache misses, and silenced the one real miss
+  after a 401-minute idle gap. The aggregate is retained as accounting evidence, context
+  occupancy remains separate and is carried forward across a turn that reports none, and a
+  material re-billed prefix is reported as a PROVEN LOWER BOUND rather than silently hidden.
+  Turn cost remains the adjacent difference of the SDK's cumulative estimate, never a local
+  reprice. A backend with no measured semantics (cortex) is still sealed not at all.
+- **The re-billed-prefix bound no longer mixes main-context occupancy with wide accounting IO.**
+  `readTurnAccounting` prefers `_meta.quota.model_usage`, whose rows also count Task subagents,
+  sidechains, and internal compaction. Feeding that `cacheWrite` into a bound whose occupancy is
+  main-context inflates the lower bound through both remaining terms, so a warm main prefix can
+  announce a miss and attach this turn's dollar figure to it. The bound and its stored prior now
+  read `PromptResponse.usage` (main loop) only; `usage.acp` stays the wide totals. Deterministic
+  oracle: `scripts/check-acp-usage-accounting.ts` CELL 1f.
+- **A backwards session total no longer asserts a cause it has not measured.** The operator
+  diagnostic for a decreasing cumulative cost previously named a conversation reset as "the
+  known cause". The adapter's `conversation_reset` handler only switches to a fresh
+  conversation and touches no cost (0.73.0 `dist/acp-agent.js:3675-3682`); the documented
+  mechanism lives in claude-agent-sdk instead, which states that a mid-session `/clear`
+  resets the running total (`sdk.d.ts:4884`). The notice now reports the observation, names
+  `/clear` in the vendor's own word rather than paraphrasing it into a different noun, states
+  explicitly that the adapter's `conversation_reset` event is NOT that mechanism, and says plainly
+  that the cause is not measured here. Naming the disproven event as the documented cause was the
+  release's own thesis being violated inside its own diagnostic; it was caught in review.
+
 ## 0.16.1 - 2026-09-01
 
 ### Verification

package/VERIFY.md

@@ -165,8 +165,15 @@ cd "$REPO_DIR" && ./run.sh setup "$PROJECT_DIR"
 
 ### 1.2 Live acceptance (optional)
 
+Put `PWD` in scratch so session artifacts do not land in the repo. LIVE gates inherit
+the caller's environment: a pi or ACP session exports `PI_SESSION_ID` / `PI_AGENT_ID` /
+`CLAUDE_CONFIG_DIR` into every child, which masquerades as the smoke's identity or
+strips Claude hooks (`hooks: {}` overlay). Strip those carriers:
+
 ```bash
-LIVE=1 ./run.sh release-gate /path/to/consumer-project --cut
+cd /path/to/scratch
+env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID \
+  LIVE=1 /path/to/entwurf/run.sh release-gate /path/to/scratch --cut
 pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
 ```
 

package/docs/acp-backend-rail.md

@@ -92,11 +92,11 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.15.1` | shipped baseline | the package contract these rows belong to |
-| pi runtime | devDep exact `0.84.3`, peer `>=0.84.3 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.3; hosts inside the range are accepted, and the ceiling moves only on measurement |
-| ACP wire SDK | `@agentclientprotocol/sdk 1.3.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.70.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
-| Claude Agent SDK | `0.3.232` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
+| Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
+| pi runtime | devDep exact `0.84.4`, peer `>=0.84.4 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.4; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.73.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
 | Node | `>=24` (`engines.node`) | **floor** | single axis, derived everywhere else |
@@ -141,8 +141,10 @@ different reasons, and collapsing them would hide a real risk**:
 - **Capability-gated.** AIR typed session failures, the 0.69.0 AIR file-change report, terminal
   output widgets and nested subagent transcripts each test a client capability entwurf does not
   send, so the adapter itself keeps the legacy path.
-- **Advertised but never called.** Some surfaces carry no capability prerequisite at all — 0.70.0's
-  `providers/list` / `providers/set` / `providers/disable` are advertised unconditionally. They are
+- **Advertised but never called.** Some surfaces carry no capability prerequisite at all — the
+  `providers/list` / `providers/set` / `providers/disable` trio added in 0.70.0 is advertised
+  unconditionally, and 0.71.0–0.73.0 add native subagents, async tasks, message-specific session
+  forks, AI-generated session titles and permission-mode kinds on the same footing. They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
 
@@ -255,13 +257,22 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.70.0 nor the Cortex landing adds a client-side
-readiness fence, and `mcpServerStatus()` is not called by the common loop.
-(Re-measured at the 0.68.0 → 0.70.0 bump: AIR typed failures and the 0.69.0 AIR
-file-change report are both capability-gated and unadvertised by entwurf; 0.70.0's
-`providers/set` / `providers/disable` are advertised unconditionally by the adapter but
-entwurf calls neither, so no session's provider state is transitioned; goal extension is
-still not a fence. This bump changes no readiness behavior and closes no part of #72.)
+path. Neither `claude-agent-acp` 0.73.0 nor the Cortex landing adds a client-side
+readiness fence over a session's declared MCP servers, and entwurf's common loop
+calls `mcpServerStatus()` nowhere.
+(Re-measured at the 0.70.0 → 0.73.0 bump, not inherited from the previous one.
+`mcpServerStatus` call sites in `src/acp-agent.ts` went 0 → 2, new in 0.71.0 via
+`0cbbaf3` (MCP OAuth, LLM-25012) — so the ADAPTER now calls it where it previously
+did not. Both sites were read at `v0.73.0 src/acp-agent.ts:1618` and `:1711`: each is
+gated behind `supportsMcpOAuth(query)`, and the polling one waits only on a server
+that already reported `needs-auth`, never on every declared server before
+`newSession` returns. That is an auth handshake, not a readiness fence, so the
+boundary below is unchanged. The other reachable-surface findings also re-measured:
+AIR typed failures and the AIR file-change report stay capability-gated and
+unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
+unconditionally and uncalled; native subagents, async tasks, session forks, session
+titles, permission-mode kinds and clear-context planning are all new-but-uncalled.
+This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
 

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/acp-client.js

@@ -16,7 +16,7 @@
 // This module owns the `AcpConnectionLike` seam so the backend and the live
 // smokes both drive ONE adapter — the SDK method-name mapping lives here only,
 // and the backend's orchestration + the gate fakes stay untouched.
-import { AGENT_METHODS, CLIENT_METHODS, client } from "@agentclientprotocol/sdk";
+import { AGENT_METHODS, CLIENT_METHODS, client, } from "@agentclientprotocol/sdk";
 /**
  * Production factory — wrap the SDK 1.1 fluent `client()` into the
  * `AcpConnectionLike` seam the backend (and the live smokes) drive.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -121,6 +121,13 @@ export const claudeAdapter = {
         // `_adapterSettings` here.
         return {};
     },
+    // MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
+    // session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
+    // and a context-occupancy scalar (`used`; both read at 0.73.0
+    // `dist/acp-agent.js:2918-2924`). Both are measured, so backend.ts seals them.
+    // The token partition is NOT declared here: ACP's only token carrier is a
+    // per-turn round-trip aggregate, which is not what pi's four fields mean.
+    sealsTurnAccounting: true,
 };
 // ---------------------------------------------------------------------------
 // Registry — modelId → adapter
@@ -259,6 +266,14 @@ export const cortexAdapter = {
         const settings = adapterSettings;
         return { cortexConnection: settings?.cortexConnection ?? null };
     },
+    // NO sealsTurnAccounting — a DELIBERATE, permanent absence, not an omission to be
+    // filled in later by symmetry with claude. Nobody has measured what cortex's
+    // ACP `usage` (and its usage_update cost, if it sends one) MEAN: whether the
+    // token counts are a turn delta or a session total, and against which price
+    // table. Until that measurement exists, the honest report is no report:
+    // backend.ts seals nothing for a backend without this flag, so cortex's
+    // emitted usage is byte-identical to what it was before #93. Declaring this
+    // with a guess would mint exactly the silent misaccounting #93 exists to end.
 };
 const ADAPTERS = [claudeAdapter, cortexAdapter];
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-mailbox.js

@@ -36,16 +36,23 @@ import { enqueueMetaMessage } from "./meta-session.js";
  * legacy mailbox path used). `plan.wantsReply` is threaded into the body — v2 carries the
  * caller's intent, a DELIBERATE divergence from the legacy hard-coded `false`. An enqueue
  * throw PROPAGATES; it is never converted to `{success:false}`.
+ *
+ * #98 R — the SEND receipt: `enqueueMetaMessage` already returns the exact `.msg` path it
+ * wrote ("Returns the paths so a sender can show exactly what was queued"), and this body
+ * used to flatten it to `{success:true}`. It now carries that ONE field through. Nothing
+ * else from the enqueue result crosses: no timestamps, and specifically no `lastReadAt` —
+ * see the `RpcSendResult` note. The path is reported verbatim from the enqueue result, not
+ * re-derived from the plan, so it can never disagree with the file that was actually written.
  */
 export function executeMetaMailboxSend(plan, sender, deps) {
     const body = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
-    deps.enqueue({
+    const enqueued = deps.enqueue({
         gardenId: plan.targetGardenId,
         body,
         sessionsDir: plan.sessionsDir,
         mailboxDir: plan.mailboxDir,
     });
-    return { success: true };
+    return { success: true, messagePath: enqueued.messagePath };
 }
 /**
  * Build the production `sendViaMailbox(plan, lock)` adapter the 5c-2a send hand consumes.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -49,7 +49,12 @@ export async function executeDispatch(decision, deps) {
                     kind: "executed",
                     receipt,
                     transport,
-                    outcome: { transport: "control-socket", outcome: r.outcome, rejectReason: r.rejectReason },
+                    outcome: {
+                        transport: "control-socket",
+                        outcome: r.outcome,
+                        rejectReason: r.rejectReason,
+                        messagePath: r.messagePath,
+                    },
                 };
             }
             catch (err) {
@@ -80,7 +85,14 @@ export async function executeDispatch(decision, deps) {
                 if (r.success !== true) {
                     throw new Error("entwurf-v2-runner: meta-mailbox send returned success:false (contract violation; a mailbox has no in-band reject).");
                 }
-                return { kind: "executed", receipt, transport, outcome: { transport: "meta-mailbox", success: true } };
+                return {
+                    kind: "executed",
+                    receipt,
+                    transport,
+                    // #98 R: carry the enqueue receipt verbatim. `undefined` stays `undefined` —
+                    // the runner never substitutes a guessed path for a missing one.
+                    outcome: { transport: "meta-mailbox", success: true, messagePath: r.messagePath },
+                };
             }
             catch (err) {
                 return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -58,7 +58,7 @@ export async function executeControlSocketSend(plan, lock, deps) {
         drive = { outcome: "failed", error: err };
     }
     finalizeRelease(policy, deps, held, drive);
-    return { outcome: drive.outcome, rejectReason: drive.rejectReason };
+    return { outcome: drive.outcome, rejectReason: drive.rejectReason, messagePath: drive.messagePath };
 }
 /** Drive the 1차 send and route a connect failure through the F3 split. */
 async function driveSend(plan, lock, deps) {
@@ -122,7 +122,10 @@ async function driveDeadFallback(plan, lock, deps) {
             // hand never reaches for the mailbox on its own; only the resolver routes here.
             try {
                 const r = await deps.sendViaMailbox(rePlan, lock);
-                return { outcome: r.success ? "fallback-sent" : "rejected" };
+                // #98 R: this leg writes a `.msg` exactly like the primary mailbox rail, so it
+                // owes the sender the same per-message receipt. Carried only on success — a
+                // `rejected` enqueue wrote no file to name.
+                return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : { outcome: "rejected" };
             }
             catch (err) {
                 return { outcome: "failed", error: err };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -18,6 +18,7 @@
  *   - `runAndRenderEntwurfV2FromSurface` — assemble production deps + run + render, so the root
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
+import { basename } from "node:path";
 import { makeProductionEntwurfV2Deps } from "./entwurf-v2-production.js";
 import { runEntwurfV2 } from "./entwurf-v2-runner.js";
 import { FRESH_CUT_PRESCRIPTION } from "./meta-session.js";
@@ -109,8 +110,13 @@ export function renderEntwurfV2Result(result) {
             if (o.transport === "control-socket") {
                 const delivered = o.outcome === "sent" || o.outcome === "fallback-sent";
                 const reason = o.rejectReason ? ` (reason: ${o.rejectReason})` : "";
+                // #98 R, fallback leg: a dead socket that re-resolved to the mailbox wrote a
+                // `.msg` — name it, exactly as the primary mailbox rail does. Absent on a
+                // socket-to-socket retry (no file) and on every non-mailbox outcome, so the
+                // line degrades to the bare outcome rather than printing "undefined".
+                const enqueued = o.messagePath ? ` (enqueued ${basename(o.messagePath)})` : "";
                 return {
-                    text: `entwurf_v2 control-socket → ${o.outcome}${reason}`,
+                    text: `entwurf_v2 control-socket → ${o.outcome}${reason}${enqueued}`,
                     isError: !delivered,
                 };
             }
@@ -121,8 +127,17 @@ export function renderEntwurfV2Result(result) {
                     isError: false,
                 };
             }
-            // meta-mailbox
-            return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
+            // meta-mailbox. #98 R: name the FILE that was enqueued, so the sender's transcript
+            // carries a per-message identifier instead of a bare literal. Only the basename —
+            // the directory is `<meta-mailbox>/<target garden id>/`, which the caller already
+            // typed. Deliberately NOT a read stamp: at enqueue time `lastReadAt` belongs to the
+            // PREVIOUS message, so printing it would claim a read that has not happened.
+            // A dep that omits the receipt falls back to the old literal rather than printing
+            // "undefined" — the delivery still happened.
+            return {
+                text: `entwurf_v2 meta-mailbox → enqueued${o.messagePath ? ` (${basename(o.messagePath)})` : ""}`,
+                isError: false,
+            };
         }
         case "execution-failed": {
             if (result.releaseFailed && result.finalizedOutcome) {