@junghanacs/entwurf 0.16.1 → 0.17.2

package/scripts/check-entwurf-v2-mailbox.ts

@@ -158,6 +158,32 @@ function recordingEnqueue(): {
 	ok("6: successful enqueue → {success:true}", res.success === true && res.error === undefined);
 }
 
+// ── 6b. #98 R: the enqueue result's messagePath is the SEND receipt ──────────
+// Reported VERBATIM from the enqueue result, never re-derived from the plan — a
+// re-derived path could disagree with the file that was actually written.
+{
+	const enq = recordingEnqueue();
+	const res = executeMetaMailboxSend(mailboxPlan(), SENDER, { enqueue: enq.fn });
+	ok("6b: result carries the enqueue's messagePath verbatim", res.messagePath === `/fake/mailbox/${GID}/m.msg`);
+}
+{
+	// The path is taken from the RESULT, not from `plan.mailboxDir` + gardenId: an enqueue
+	// that lands somewhere else (env override, tilde expansion, a resolved symlink) must be
+	// reported where it actually landed.
+	const res = executeMetaMailboxSend(mailboxPlan(), SENDER, {
+		enqueue: (opts) => ({
+			gardenId: opts.gardenId,
+			recordPath: "/elsewhere/rec.json",
+			messagePath: "/elsewhere/queued-here.msg",
+			signalPath: "/elsewhere/inbox.signal",
+		}),
+	});
+	ok(
+		"6b: a messagePath outside the plan's mailboxDir is still reported as-is",
+		res.messagePath === "/elsewhere/queued-here.msg",
+	);
+}
+
 // ── 7. production adapter: ignores lock entirely (poison LockClaim) ───────────
 {
 	const enq = recordingEnqueue();
@@ -223,6 +249,13 @@ function recordingEnqueue(): {
 	for (const forbidden of ["releaseLock", "inspectSocket", "probeSocket", "resolveDispatch", "resolveTarget"]) {
 		ok(`9: lib code has no '${forbidden}' (no release / no routing seam)`, !code.includes(forbidden));
 	}
+	// #98 R, the negative half stated as an assertion: a SEND receipt may never carry a
+	// read/delivery stamp. At enqueue time `lastReadAt` holds the PREVIOUS message's read,
+	// so carrying it here would let a sender read "my message was read" off a stamp that
+	// says nothing of the kind. The per-message read receipt is the `.read` suffix.
+	for (const forbidden of ["lastReadAt", "lastDeliveredAt", "readAt"]) {
+		ok(`9: lib code never carries '${forbidden}' into the send receipt`, !code.includes(forbidden));
+	}
 }
 
 console.log(`\ncheck-entwurf-v2-mailbox: ${passed} checks passed`);

package/scripts/check-entwurf-v2-runner.ts

@@ -212,6 +212,24 @@ async function main(): Promise<void> {
 			"4: executed{meta-mailbox, success}",
 			res.kind === "executed" && res.outcome.transport === "meta-mailbox" && res.outcome.success === true,
 		);
+		// #98 R: a dep that reports no path leaves the outcome's receipt undefined. The
+		// runner must not invent one — a guessed path is worse than no path.
+		ok(
+			"4: no enqueue receipt from the dep → messagePath stays undefined (never invented)",
+			res.kind === "executed" && res.outcome.transport === "meta-mailbox" && res.outcome.messagePath === undefined,
+		);
+	}
+
+	// ── 4a: #98 R — the mailbox enqueue receipt is carried through verbatim ───
+	{
+		const { deps } = makeDeps({ mailbox: { result: { success: true, messagePath: "/fake/mailbox/g/2026.msg" } } });
+		const res = await executeDispatch(executeDecision(MAILBOX_PLAN, null), deps);
+		ok(
+			"4a: executed{meta-mailbox} carries the dep's messagePath verbatim",
+			res.kind === "executed" &&
+				res.outcome.transport === "meta-mailbox" &&
+				res.outcome.messagePath === "/fake/mailbox/g/2026.msg",
+		);
 	}
 
 	// ── 4b: native-push execute → sendNativePush(plan, null), lock-free (봉인 4) ──

package/scripts/check-entwurf-v2-send.ts

@@ -213,6 +213,9 @@ async function main(): Promise<void> {
 			fallbackSend: { result: { success: true } },
 		});
 		ok("dead → re-resolve(control) success → fallback-sent", result.outcome === "fallback-sent");
+		// A socket retry hands the body to a live receiver and writes no file: no receipt to
+		// invent (#98 R is a per-FILE identifier, not a per-delivery one).
+		ok("dead → socket retry carries NO messagePath (no file exists)", result.messagePath === undefined);
 		ok("dead → deadFallback called exactly once", trace.deadFallbackCalls === 1);
 		ok("dead → re-resolve used the alt socket", trace.socketSends[1]?.socketPath === "/fake/ctl/alt.sock");
 		ok("dead → release ×1", trace.releases.length === 1);
@@ -277,9 +280,16 @@ async function main(): Promise<void> {
 		const sent = await run({
 			firstSend: { throwCode: "ECONNREFUSED" },
 			deadFallback: { kind: "execute", plan: MAILBOX_PLAN },
-			fallbackSend: { result: { success: true } },
+			fallbackSend: { result: { success: true, messagePath: "/fake/mb/gid/2026-fallback.msg" } },
 		});
 		ok("dead → re-resolve(mailbox) enqueue → fallback-sent", sent.result.outcome === "fallback-sent");
+		// #98 R, fallback leg: this enqueue wrote a file, so the sender gets its name — the
+		// same per-message receipt the primary mailbox rail hands back. Dropping it here was
+		// the one mailbox delivery with no identifier.
+		ok(
+			"dead → mailbox fallback carries the #98 R messagePath",
+			sent.result.messagePath === "/fake/mb/gid/2026-fallback.msg",
+		);
 		ok("dead → mailbox helper called once", sent.trace.mailboxSends.length === 1);
 		ok("dead → mailbox reached only via resolver, release ×1", sent.trace.releases.length === 1);
 
@@ -289,6 +299,8 @@ async function main(): Promise<void> {
 			fallbackSend: { result: { success: false } },
 		});
 		ok("dead → mailbox enqueue success:false → rejected", refused.result.outcome === "rejected");
+		// No file was written, so there is nothing to name — never echo a dep's stray path.
+		ok("dead → rejected enqueue carries NO messagePath", refused.result.messagePath === undefined);
 	}
 
 	// ── 9: single-release across every outcome (release at most once) ─────────

package/scripts/check-entwurf-v2-surface.ts

@@ -361,20 +361,92 @@ async function main(): Promise<void> {
 			cr.isError && cr.text.includes("dormant-fire-forget-unsupported"),
 		);
 
+		// control-socket fallback-sent that re-resolved to the MAILBOX: same file, same
+		// receipt. Before this the fallback leg was the one mailbox delivery whose sender
+		// line carried no per-message identifier.
+		const fallback: EntwurfV2RunResult = {
+			kind: "executed",
+			receipt: { ...SUCCESS_RECEIPT, transport: "control-socket" },
+			transport: "control-socket",
+			outcome: {
+				transport: "control-socket",
+				outcome: "fallback-sent",
+				messagePath: "/home/x/.pi/agent/meta-mailbox/20260903T134455-e55e87/2026-09-03T09-58-02-114Z-ab12cd.msg",
+			},
+		};
+		const fb = renderEntwurfV2Result(fallback);
+		ok("2: fallback-sent is a delivery (not an error)", !fb.isError && fb.text.includes("fallback-sent"));
+		ok(
+			"2: fallback-sent names the enqueued FILE (#98 R, fallback leg)",
+			fb.text.includes("2026-09-03T09-58-02-114Z-ab12cd.msg"),
+		);
+		ok(
+			"2: fallback-sent prints the basename, not the whole path",
+			!fb.text.includes("/home/x/") && !fb.text.includes("meta-mailbox/20260903T134455-e55e87"),
+		);
+		ok(
+			"2: fallback-sent carries NO read stamp (same ban as the primary rail)",
+			!/lastReadAt|lastDeliveredAt/i.test(fb.text),
+		);
+		// A socket-to-socket retry writes no file. No receipt, and no "(enqueued undefined)".
+		const fallbackSocket: EntwurfV2RunResult = {
+			kind: "executed",
+			receipt: { ...SUCCESS_RECEIPT, transport: "control-socket" },
+			transport: "control-socket",
+			outcome: { transport: "control-socket", outcome: "fallback-sent" },
+		};
+		const fbs = renderEntwurfV2Result(fallbackSocket);
+		ok(
+			"2: socket-retry fallback-sent degrades to the bare outcome (no file to name)",
+			fbs.text === "entwurf_v2 control-socket → fallback-sent" && !fbs.isError,
+		);
+
 		// The two spawn-bg render cells (lock-retained / socket-alive) were deleted with the
 		// transport itself. Nothing renders them anymore, and `EntwurfV2Transport` no longer
 		// admits the literal — a cell kept here would only prove the type is still wrong.
 
-		// meta-mailbox → enqueued
+		// meta-mailbox → enqueued, carrying the #98 R send receipt (the enqueued FILE).
 		const mailbox: EntwurfV2RunResult = {
+			kind: "executed",
+			receipt: { ...SUCCESS_RECEIPT, transport: "meta-mailbox" },
+			transport: "meta-mailbox",
+			outcome: {
+				transport: "meta-mailbox",
+				success: true,
+				messagePath: "/home/x/.pi/agent/meta-mailbox/20260903T134455-e55e87/2026-09-03T07-19-31-803Z-113443.msg",
+			},
+		};
+		const mb = renderEntwurfV2Result(mailbox);
+		ok("2: meta-mailbox → not error + enqueued", !mb.isError && mb.text.includes("enqueued"));
+		ok(
+			"2: meta-mailbox names the enqueued message FILE (#98 R send receipt)",
+			mb.text.includes("2026-09-03T07-19-31-803Z-113443.msg"),
+		);
+		// The basename alone — printing the whole path would put the operator's home and the
+		// target garden id (which the caller just typed) into every send line.
+		ok(
+			"2: meta-mailbox prints the basename, not the whole path",
+			!mb.text.includes("/home/x/") && !mb.text.includes("meta-mailbox/20260903T134455-e55e87"),
+		);
+		// The assertion #98 asks for BY NAME: an enqueue receipt must never carry a read
+		// stamp. At enqueue time `lastReadAt` is the PREVIOUS message's read, so surfacing it
+		// would read as "my message was read" — the misreading that opened the issue.
+		ok(
+			"2: meta-mailbox carries NO read stamp (lastReadAt is forbidden on a send receipt)",
+			!/lastReadAt|lastDeliveredAt|\bread\b/i.test(mb.text),
+		);
+		// A dep that hands back no receipt must degrade to the old literal — never
+		// "enqueued (undefined)". The delivery happened either way.
+		const mailboxNoReceipt: EntwurfV2RunResult = {
 			kind: "executed",
 			receipt: { ...SUCCESS_RECEIPT, transport: "meta-mailbox" },
 			transport: "meta-mailbox",
 			outcome: { transport: "meta-mailbox", success: true },
 		};
+		const mbn = renderEntwurfV2Result(mailboxNoReceipt);
 		ok(
-			"2: meta-mailbox → not error + enqueued",
-			!renderEntwurfV2Result(mailbox).isError && renderEntwurfV2Result(mailbox).text.includes("enqueued"),
+			"2: meta-mailbox with no receipt degrades to the bare literal (never 'undefined')",
+			!mbn.isError && mbn.text === "entwurf_v2 meta-mailbox → enqueued",
 		);
 
 		// native-push → delivered (no retry)

package/scripts/check-gate-qualification.ts

@@ -804,6 +804,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"acp-prompt-lifecycle": 15,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
+		"acp-usage-accounting": 12,
 		"agy-permission": 6,
 		"bridge-boot-resume": 3,
 		"bridge-command-boot": 9,

package/scripts/check-hook-launch-topology.ts

@@ -58,7 +58,20 @@ const PLUGIN_SRC = path.join(REPO_DIR, "pi", "meta-bridge", "entwurf-meta-receiv
 const LAUNCHER = path.join(PLUGIN_SRC, "scripts", "hook-launch.sh");
 const PLACEHOLDER = "${CLAUDE_PLUGIN_ROOT}";
 
-type Leaf = { type?: string; command?: string; args?: string[]; asyncRewake?: boolean; timeout?: number };
+type Leaf = {
+	type?: string;
+	command?: string;
+	args?: string[];
+	asyncRewake?: boolean;
+	timeout?: number;
+	rewakeSummary?: string;
+	rewakeMessage?: string;
+};
+
+/** #98 A/A″ length ceiling for the two rewake strings. The operator row is ONE line in a
+ * terminal status area; the model prefix is glued in front of the doorbell's stderr. There
+ * is no engine cap on the config path (see the lint block below), so this is ours. */
+const REWAKE_MAX_LEN = 80;
 const manifest = JSON.parse(readFileSync(path.join(PLUGIN_SRC, "hooks", "hooks.json"), "utf8")) as {
 	hooks: Record<string, Array<{ matcher?: string; hooks: Leaf[] }>>;
 };
@@ -99,6 +112,62 @@ for (const event of OWNER_EVENTS) {
 	ok("FileChanged: timeout stays declared", typeof bell.timeout === "number" && bell.timeout > 0);
 }
 
+// ── 1b. #98 A/A″: the two rewake strings, and the lint the engine does NOT do ─
+// WHY A LINT AT ALL. Measured on Claude 2.1.236/2.1.258/2.1.259 (#98 Phase 1): the
+// stdout-JSON form of `rewakeSummary` is sanitised by the engine
+// (`.trim().replace(/\s+/g," ").slice(0,cap)`), but the hooks.json CONFIG form is not —
+// it reaches the operator's row verbatim, guarded only by the schema's `min(1)`. Two
+// concrete failures that guard cannot see:
+//   - a value containing a newline breaks the one-row status area;
+//   - a whitespace-only value passes `min(1)` and draws a BLANK row, which is worse than
+//     the default `Stop hook feedback` because it looks like nothing arrived.
+// (A third, `<summary>` missing entirely → the whole notification is hidden, is covered
+// by asserting the field is present and non-empty at all.)
+{
+	const bell = leafOf("FileChanged");
+	// A″ — the model-facing prefix. It REPLACES `Stop hook blocking error from command "…":`,
+	// so without it every arriving letter is named an error in the transcript.
+	ok(
+		"FileChanged: rewakeMessage is declared (model wakes to mail, not to a 'blocking error')",
+		typeof bell.rewakeMessage === "string",
+	);
+	// A — the operator-facing row. Static by nature: the renderer draws this ONE string, so
+	// it cannot carry the unread count (the statusline badge does that half).
+	ok(
+		"FileChanged: rewakeSummary is declared (operator row is not 'Stop hook feedback')",
+		typeof bell.rewakeSummary === "string",
+	);
+	for (const field of ["rewakeSummary", "rewakeMessage"] as const) {
+		const value = bell[field];
+		ok(
+			`FileChanged: ${field} is a single line (a newline would break the one-row status area)`,
+			typeof value === "string" && !/[\r\n]/.test(value),
+		);
+		ok(
+			`FileChanged: ${field} is not whitespace-only (min(1) passes a blank row; we must not)`,
+			typeof value === "string" && value.trim().length > 0,
+		);
+		ok(
+			`FileChanged: ${field} is <= ${REWAKE_MAX_LEN} chars (unsanitised config path, no engine cap)`,
+			typeof value === "string" && value.length <= REWAKE_MAX_LEN,
+		);
+	}
+	// Prefix hygiene (#98 (b)): the model body is `rewakeMessage + " " + stderr`, and the
+	// doorbell's stderr ALREADY opens with `[entwurf inbox]`. A bracketed prefix here would
+	// render `[entwurf …] [entwurf inbox] …` — one tag per line, and the stderr owns it.
+	ok(
+		"FileChanged: rewakeMessage carries no bracket tag (doorbell stderr already opens with [entwurf inbox])",
+		typeof bell.rewakeMessage === "string" && !bell.rewakeMessage.includes("["),
+	);
+	// The doorbell's own opening tag, read from the shipped script rather than assumed —
+	// if someone changes the stderr tag, the no-duplicate-prefix rule above must be re-read.
+	const doorbellSrc = readFileSync(path.join(PLUGIN_SRC, "scripts", "doorbell.sh"), "utf8");
+	ok(
+		"doorbell stderr still opens with the [entwurf inbox] tag the prefix rule assumes",
+		doorbellSrc.includes('echo "[entwurf inbox]'),
+	);
+}
+
 // ── 2. no shell-form regression anywhere in the shipped manifest ─────────────
 // The retired form is recognizable by its carrier; assert the whole file is free of
 // it rather than only the leaves we happen to read above.

package/scripts/check-mailbox-receipt-state.ts

@@ -120,6 +120,12 @@ try {
 		now: new Date("2026-03-01T12:05:00.000Z"),
 	});
 	ok("stamp lastReadAt: state.json created on first stamp", fs.existsSync(mailboxReceiptStatePath(mailboxDir, GID)));
+	// The two `lastDeliveredAt === null` pins below are FIELD-ISOLATION pins, not a
+	// "waiting for the doorbell" state. #98 5a: no writer stamps lastDeliveredAt at all —
+	// the shipped doorbell.sh does not touch state.json — so this null is the field's
+	// permanent value. state.json holds garden-wide last-activity; the per-message receipts
+	// are the file suffixes (`.msg` → `.msg.delivered` → `.msg.delivered.read`). Removing
+	// the field is a migration over existing on-disk v1 states (#98 5b), not a comment fix.
 	ok(
 		"stamp lastReadAt: only lastReadAt set, others null (읽음이 남는다)",
 		afterRead.lastReadAt === "2026-03-01T12:05:00.000Z" &&

package/scripts/check-meta-doctor-oracle.sh

@@ -631,6 +631,79 @@ else
 fi
 unset FAKE_MCP_TAIL
 
+# M14 — a MANAGED SETTINGS SCALAR drifted. Added with #94, which retired the two
+# compaction keys and so deleted two of this doctor's drift cells. Until now the
+# mutation set planted only hook/cache/receiver/MCP/delivery defects: not one cell
+# asked whether the managed-scalar sweep still detects anything at all. That made
+# "retiring these two costs no detection power" an unprovable claim — the gate
+# could not have noticed if the whole sweep had gone silent. `verbose` stands in
+# for the ten scalars that remain owned; it is the cheapest of them and carries no
+# policy weight of its own.
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["verbose"] = True
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "a managed settings scalar (verbose) drifted" "settings verbose missing/drifted at verbose"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["verbose"] = False
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+
+# M15 (negative) — the same sweep must NOT claim a RETIRED key. Planted here is the
+# EXACT state oracle sat in on 2026-09-02, the one that opened #94: Claude Code had
+# put `autoCompactEnabled` back to true while entwurf's `env.DISABLE_AUTOCOMPACT`
+# stayed "1". Under the old code that drift is what turned the doctor red; under #94
+# both keys are the operator's and it must be green.
+#
+# Two things this cell will not do. It does not plant entwurf's own former desired
+# value (`false`), which is green under BOTH codes and so could not tell "retired"
+# apart from "still checked, message reworded". And it does not REMOVE the env key
+# to make the state tidier: leaving "1" in place is the stronger claim, because a
+# retired key must be ignored while still carrying the value we used to force, not
+# merely once the operator has finished cleaning up after us.
+cp "$CLAUDE_CONFIG_DIR/settings.json" "$TMP/settings-m15.bak"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["autoCompactEnabled"] = True
+d.setdefault("env", {})["DISABLE_AUTOCOMPACT"] = "1"
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+run_doctor
+if [ "$DOC_RC" -eq 0 ]; then
+  ok "an operator who turned compaction back ON is not drift (retired keys leave the doctor green)"
+else
+  bad "compaction re-enabled by the operator still reddens the doctor (the keys are not really retired):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  FAIL' | sed 's/^/        /')"
+fi
+cp "$TMP/settings-m15.bak" "$CLAUDE_CONFIG_DIR/settings.json"
+
+# M16 — the ONE nudge a retired key still owes. `check()` refuses while the ledger
+# still carries ownership entwurf has not yet relinquished, which is the state an
+# upgraded host is in between `git pull` and `install-meta-bridge`. No other
+# mutation reaches that branch, so without this cell the whole retirement path
+# could stop refusing and every gate would stay green.
+cp "$CLAUDE_CONFIG_DIR/entwurf.install-state.json" "$TMP/state-m16.bak"
+python3 - "$CLAUDE_CONFIG_DIR/entwurf.install-state.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["files"]["settings"]["keys"]["autoCompactEnabled"] = {
+    "kind": "scalar",
+    "path": ["autoCompactEnabled"],
+    "original": {"existed": False, "value": None},
+}
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "install-state still owns a retired scalar (upgrade not yet relinquished)" "install-state still owns retired scalar autoCompactEnabled"
+cp "$TMP/state-m16.bak" "$CLAUDE_CONFIG_DIR/entwurf.install-state.json"
+
 # --- 5. the control must still hold after every restore ----------------------
 echo "[control] re-run after all mutations were reverted"
 run_doctor

package/scripts/check-meta-mailbox-state-write.ts

@@ -10,7 +10,11 @@
  *    (enqueue/read no longer touch the record — invariant ⑤);
  *  - enqueue stamps state.lastEnqueuedAt, read stamps state.lastReadAt, and the
  *    enqueue receipt survives the read (field isolation on the state store);
- *  - lastDeliveredAt is never invented by read (doorbell owns delivery-time);
+ *  - lastDeliveredAt is never invented by read. #98 5a corrects why: NOBODY stamps it —
+ *    the shipped doorbell.sh writes nothing to state.json — so it is a reserved slot that
+ *    is null on every citizen. The per-message receipts are the file SUFFIXES
+ *    (`.msg` → `.msg.delivered` → `.msg.delivered.read`); state.json carries only the
+ *    garden-wide last enqueue/read. Removing the field is a migration, not this gate (#98 5b);
  *  - an empty inbox is a no-op on BOTH the record (untouched) and the state
  *    (state.json never created) — invariant ⑥;
  *  - a state-store drift makes the read throw fail-loud (partial failure surfaces).
@@ -95,7 +99,10 @@ try {
 	const stateAfterRead = readMailboxReceiptState({ gardenId: gidA, mailboxDir });
 	ok("read: state.lastReadAt stamped", stateAfterRead.lastReadAt === RD_ISO);
 	ok("read: enqueue receipt SURVIVES the read (field isolation)", stateAfterRead.lastEnqueuedAt === ENQ_ISO);
-	ok("read: lastDeliveredAt never invented by read (doorbell owns it)", stateAfterRead.lastDeliveredAt === null);
+	ok(
+		"read: lastDeliveredAt never invented by read (reserved slot, no writer — see header)",
+		stateAfterRead.lastDeliveredAt === null,
+	);
 
 	// --- empty inbox: no-op on BOTH record and state --------------------------
 	const gidB = seed("n-state-b");

package/scripts/check-meta-manifest-schema.py

@@ -114,7 +114,25 @@ if hooks is not None:
                 # argv. The marketplace/plugin manifests below stay minimal: the closed-
                 # schema lesson that produced this gate was about a DECORATIVE key
                 # (`description`), and that lesson is untouched.
-                subset(f"hooks.{event}[{j}].hooks[{k}]", h, {"type", "command", "args", "asyncRewake", "timeout"})
+                #
+                # rewakeSummary/rewakeMessage (#98, 2026-09-03) join the same category:
+                # load-bearing, not decorative. They are the ONLY way the doorbell names
+                # itself — without `rewakeSummary` the operator's row is the engine default
+                # `Stop hook feedback` (no sender, no count, no garden id), and without
+                # `rewakeMessage` the model wakes to `Stop hook blocking error from command
+                # "FileChanged":`, i.e. an arriving letter announced as an error. Both were
+                # measured to load from a local plugin's hooks.json with no first-party gate
+                # on Claude 2.1.236/2.1.258/2.1.259, and `claude plugin validate` accepts
+                # them (install-meta-bridge runs it). On a host old enough not to know them,
+                # the #51 measurement above applies unchanged: the key is accepted and the
+                # value silently dropped, so the surface degrades to today's default rather
+                # than failing the install. Their VALUES are linted (single line, non-blank,
+                # length) by check-hook-launch-topology; this gate pins only the keyset.
+                subset(
+                    f"hooks.{event}[{j}].hooks[{k}]",
+                    h,
+                    {"type", "command", "args", "asyncRewake", "timeout", "rewakeSummary", "rewakeMessage"},
+                )
 
     # Every hook launches through the shipped launcher in EXEC form: `command` is
     # hook-launch.sh and the baked argv travels in `args`. No shell is on the path, so

package/scripts/check-meta-session.ts

@@ -455,8 +455,16 @@ check("readMetaInbox: drains a fresh .msg, returns the body, stamps lastReadAt (
 		assert.equal(read.readAt, T1.toISOString(), "readAt returned");
 		const st = readMailboxReceiptState({ gardenId: fx.gardenId, mailboxDir: fx.mailboxDir });
 		assert.equal(st.lastReadAt, T1.toISOString(), "lastReadAt stamped in mailbox state = the honest read receipt");
-		// #5 honesty: lastDeliveredAt is the doorbell's to stamp; readMetaInbox must NOT invent it.
-		assert.equal(st.lastDeliveredAt, null, "lastDeliveredAt left null (read does not record a delivery time)");
+		// #5 honesty: readMetaInbox must NOT invent a delivery time. #98 5a corrects the old
+		// reason next to this pin ("the doorbell's to stamp"): the shipped doorbell.sh writes
+		// nothing to state.json, so lastDeliveredAt is a RESERVED SLOT no writer fills — this
+		// null is permanent, not "not yet". The per-message delivery fact is the `.delivered`
+		// file suffix; state.json only ever holds garden-wide last-activity.
+		assert.equal(
+			st.lastDeliveredAt,
+			null,
+			"lastDeliveredAt left null (nobody stamps it; the .delivered suffix is the per-message receipt)",
+		);
 	} finally {
 		fx.cleanup();
 	}

package/scripts/lib/pi-record-discovery.ts

@@ -16,13 +16,60 @@
  * runs of the acp socket smokes).
  */
 
+import { existsSync } from "node:fs";
 import * as fsp from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 
 function sleep(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * pi's own cross-process locks. `FileAuthStorageBackend` (pi `dist/core/auth-storage.js`) guards
+ * `auth.json` AND `models-store.json` with `proper-lockfile`, and every boot reads through it, so
+ * these two directories are the ones a killed resident can leave behind.
+ */
+const PI_LOCK_PATHS = ["auth.json.lock", "models-store.json.lock"].map((name) =>
+	path.join(os.homedir(), ".pi", "agent", name),
+);
+
+/**
+ * The bound a LIVE smoke must give a `pi` boot — and the reason it is NOT "how long a boot takes".
+ *
+ * MEASURED 2026-09-03 on the release host, in the smokes' own spawn shape:
+ *  - an undisturbed boot → V3 record is **1008–1212ms across 80 consecutive boots** (5.1–5.4s under
+ *    4× CPU oversubscription), so a bound in the tens of seconds is not about boot cost;
+ *  - pi reads its auth/models store under a `proper-lockfile` lock whose stale window is
+ *    `staleMs = 30_000` (pi `dist/core/auth-storage.js`), and a contender that finds the lock held
+ *    retries for exactly that long before taking it over;
+ *  - SIGTERM lands inside that window often enough to matter — sweeping 24 kill offsets across a
+ *    boot left `~/.pi/agent/models-store.json.lock` orphaned once (at +375ms), because the signal
+ *    ends the process before `proper-lockfile`'s release ever runs;
+ *  - with such an orphan present, the very next boot measured **30_148ms** (and 1_114ms immediately
+ *    after, once the stale takeover had cleared it).
+ *
+ * So a 30_000 bound is the single worst value available: it expires 148ms INSIDE the takeover, and
+ * the record lands just after the smoke has stopped looking — an empty stderr, a live child, and no
+ * record in any store. That is what blocked two of the three 0.17.0 `--cut` runs on C1b, while
+ * `smoke-entwurf-chain-live` — same two-resident dance, 45_000 — passed all three. This constant is
+ * that value, shared so no smoke sits on the cliff again. Raise it if pi's `staleMs` ever grows;
+ * it must stay strictly greater than that window plus a boot.
+ */
+export const PI_BOOT_TIMEOUT_MS = 45_000;
+
+/**
+ * Which pi locks are on disk right now, for a failure diagnostic — a boot that overran its bound
+ * while one of these exists overran it for a NAMED reason, not a mysterious one. Read-only: a lock
+ * is arbitrated by pi's own stale protocol and must never be deleted by a smoke, because a live
+ * holder and an orphan look identical from here.
+ */
+export function describePiLockResidue(): string {
+	const present = PI_LOCK_PATHS.filter((lock) => existsSync(lock));
+	if (present.length === 0) return "none held (so a boot overrun here is not the pi lock-stale window)";
+	return `${present.join(", ")} — a boot contending with this waits out pi's ${30_000}ms stale window before taking over`;
+}
+
 export async function waitForPiRecord(storeDir: string, timeoutMs: number, pollMs = 100): Promise<string | null> {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {

package/scripts/meta-bridge-doctor.sh

@@ -468,11 +468,18 @@ if diff:
 # template equality above, not from a loose per-field test. It says the wake wiring is
 # DECLARED as shipped; it does NOT say exit-2 → wake holds at runtime (#51 B2).
 bell = leaf("FileChanged")
+# The two rewake strings are REPORTED, not optional: this line's whole job is to say what
+# the wake wiring DECLARES, and since #98 the declaration includes what the operator and the
+# model actually see when a letter lands. Omitting them would report a contract the manifest
+# no longer fully states — the exact class of half-truth #98 exists to remove. They are safe
+# to index: the exact-template equality above already ran, so a manifest missing either field
+# never reaches here.
 doorbell = (
     f"ok FileChanged doorbell matches the shipped static contract exactly "
     f"(command={bell['command']}, args={bell['args']}, asyncRewake={bell['asyncRewake']}, "
-    f"timeout={bell['timeout']}); runtime exit-2 wake was observed at Claude 2.1.217 (#51 B2) but "
-    "is not re-proven by this static read"
+    f"timeout={bell['timeout']}, rewakeSummary={bell['rewakeSummary']!r}, "
+    f"rewakeMessage={bell['rewakeMessage']!r}); runtime exit-2 wake was observed at Claude "
+    "2.1.217 (#51 B2) but is not re-proven by this static read"
 )
 
 # Resolve the argv EXACTLY the way Claude does for an exec form: substitute the
@@ -563,7 +570,15 @@ PY
     bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
   fi
   SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
-  if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q ' cc | s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
+  # The identity row may carry the #98 B unread badge between `cc` and the model letter:
+  # ` ✉N` when mail is waiting, nothing when the mailbox is empty, ` ✉?` when the count
+  # could not be taken. All three are healthy renders, so the shape test admits any of them.
+  if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -qE ' cc( ✉([0-9]+|\?))? \| s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
+  # The synthetic feeds a session_id with no meta-record, so the garden id does not
+  # resolve and there is no mailbox to count. `✉?` is the required answer: a statusline
+  # that drew nothing there would be claiming "no mail" about a mailbox it never opened —
+  # the exact silence #98 was opened to remove.
+  if printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '✉?'; then ok "statusline badge distinguishes 'could not count' (✉?) from zero on the no-record synthetic"; else bad "statusline badge omitted ✉? for the no-record synthetic (a false zero would be indistinguishable from an empty mailbox)"; fi
 else
   bad "cannot validate statusline without python3"
 fi

package/scripts/meta-bridge-state.py

@@ -66,16 +66,24 @@ LEGACY_PERMISSION_ALLOW = ["mcp__pi-tools-bridge__*"]
 
 # Claude Code single-driver policy scalars owned by entwurf for the native
 # meta-bridge install. These are not theming/personal hooks; they close background
-# autonomy/suggestion/compaction surfaces so Claude Code behaves like the same
-# single forged screwdriver that entwurf already enforces for ACP backends.
+# autonomy/suggestion surfaces so Claude Code behaves like the same single forged
+# screwdriver that entwurf already enforces for ACP backends.
+#
+# COMPACTION IS NOT ONE OF THEM (#94). entwurf neither enables nor disables it on
+# any rail, and the ACP side reached that state first: 0.5.0 really did carry a
+# pi-side compaction surface in CODE (`session_before_compact` cancelling by
+# default, `assertLegacyCompactionKnobUnset`, `smoke-compaction-policy`), the v2
+# subtraction removed it (`378c682`, 2026-06-16), and `623a4ea` (06-23) then
+# removed the documentation that had outlived the code by a week. As of #94 the
+# native rail stops owning `autoCompactEnabled` / `env.DISABLE_AUTOCOMPACT` too.
+# Backend-native context management is allowed; we add no guard and only measure.
+# Both keys live in RETIRED_SETTINGS_SCALARS below.
 MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("cleanupPeriodDays", ["cleanupPeriodDays"], 365),
-    ("env.DISABLE_AUTOCOMPACT", ["env", "DISABLE_AUTOCOMPACT"], "1"),
     ("promptSuggestionEnabled", ["promptSuggestionEnabled"], False),
     ("awaySummaryEnabled", ["awaySummaryEnabled"], False),
     ("autoMemoryEnabled", ["autoMemoryEnabled"], False),
     ("verbose", ["verbose"], False),
-    ("autoCompactEnabled", ["autoCompactEnabled"], False),
     ("showTurnDuration", ["showTurnDuration"], False),
     ("terminalProgressBarEnabled", ["terminalProgressBarEnabled"], False),
     ("useAutoModeDuringPlan", ["useAutoModeDuringPlan"], False),
@@ -89,6 +97,14 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
 # exactly once, then uninstall can no longer restore over the operator's choice.
 RETIRED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
+    # #94 — compaction returns to the operator. RETIRED, never deleted outright:
+    # a deleted entry would be ORPHANED in an existing install-state, and
+    # uninstall() walks every ledger entry through restore_entry(), so it would
+    # put the suppression back over an operator who had since enabled compaction.
+    # Only this list's relinquish path pops the entry so uninstall can no longer
+    # reach it.
+    ("env.DISABLE_AUTOCOMPACT", ["env", "DISABLE_AUTOCOMPACT"], "1"),
+    ("autoCompactEnabled", ["autoCompactEnabled"], False),
 ]
 
 _managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}
@@ -607,7 +623,9 @@ def check(repo: Path, asm: Path) -> None:
         if existed and type(value) is type(last_managed_value) and value == last_managed_value:
             print(
                 f"NOTE: settings {name}={json.dumps(last_managed_value)} is operator-owned; "
-                f"entwurf no longer suppresses or restores this warning choice"
+                f"entwurf no longer sets or restores this value. It still carries the value "
+                f"entwurf last managed, which is not drift and is not a defect — a retired "
+                f"key has no desired value to drift from."
             )
 
     checks = [