@junghanacs/entwurf 0.17.2 → 0.18.1

package/AGENTS.md

@@ -90,7 +90,7 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 
 - **control-socket domain (currently `pi`)**: socket liveness, per-target lock, live send, and a dormant cell that rejects.
 - **No relaunch transport exists inside delivery.** `spawn-bg` — a detached, window-less resume child — was removed under the visible-first rule, not deprecated behind a reject, and `entwurf_v2` still starts no process: a dormant socket-domain citizen is refused as `dormant-fire-forget-unsupported`. Reopening one is the separate lifecycle verb `entwurf_resume_call`, which is pi-only (`target-not-pi` otherwise), returns a LAUNCH receipt and an OBSERVATION receipt that are never merged, releases its per-gid lock on every path, and on an unobserved socket leaves the visible window open rather than retrying. No watcher, no retry, no supervisor. Do not re-route it through `entwurf_v2` and do not describe a spawn domain that does not exist.
-- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs.
+- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs. A live marker is not by itself an armed doorbell: where the watch owner IS the process the sender marker is keyed to (`ownerKind: claude-code-cli`), that owner may switch sessions in place, so deliverability also requires its sender marker to still name the same garden. That join is `ownerKind`-scoped by construction — a Copilot watch lives in a forked child with its own pid, so the join does not exist there and must never be applied to it (#101).
 - **native-push domain (currently Antigravity)**: adapter probe + direct injection; no mailbox and no resume authority.
 - `origin: "pi-session" | "meta-session" | "external-mcp"` records sender provenance. It is not the citizen identity schema and not a hierarchy.
 - `entwurf_peers` reports record citizens and liveness facts only. It never embeds routing verbs or socket addresses for peers.
@@ -139,7 +139,7 @@ LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live   # o
 LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 ```
 
-- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. Neither tier includes `check-gate-qualification`, which is scheduled separately (below).
+- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. The full tier carries `check-gate-manifests` (the qualification HEAD, through `check:hermetic`); the everyday core does not, and neither tier carries the mutant-executing `check-gate-qualification`, which is scheduled separately (below).
 - **Kill-proof discipline (gate qualification).** A gate is a test only if re-planting a closed defect turns it red for the claimed reason. `check-gate-qualification` proves that automatically: committed mutants in `scripts/mutants/` must be KILLED at their `[QK:<claim>]` signature inside an isolated snapshot repo (control→mutant→restore→control; the real checkout is never written). Gates a release touches carry such manifests; assertion counts are never evidence — claim IDs + killed mutant IDs are. `check-agy-permission-matrix` holds the enumerated permission contract space; matrix cells change by axis/rule edits, never by appending cases.
 - **When changing a contract/gate:** name the production subject and an oracle independent of it; give the failing assertion a stable `[QK:<claim>]` label and add/update the exact-once mutant in `scripts/mutants/*.json`; if the contract is combinatorial, update the literal matrix axes/cells/exclusions together with their declared counts; then verify the focused gate, and let qualification and the full floor follow the scheduling contract below — once on the frozen candidate, not once per amendment. `MUTANT-STALE`/`SURVIVED`/`WRONG-REASON`/`CONTROL-RED`/`HANG`/`IMPURE` are red — never substitute an assertion count for a kill.
 - Run LIVE gates with `PWD` in scratch so session artifacts do not land in the repo. Strip `CLAUDE_CONFIG_DIR`, `PI_SESSION_ID`, and `PI_AGENT_ID` from the gate process — a live pi/ACP session exports them into children, where they strip Claude hooks or capture a fresh-call callback.
@@ -157,7 +157,7 @@ implement → affected focused gates → independent review → one amendment bu
 
 - **Inner loop:** run only the gates whose subject changed. Do not open the full floor to learn what a focused gate already answers.
 - **Review before floor:** independent review and its corrections close as one bundle before the full floor runs.
-- **Qualification is scheduled, not ambient.** `check-gate-qualification` is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every push, and release-gate carries it as a MUST step.
+- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every branch push, and release-gate carries it as a MUST step. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all; the same SHA's branch run already carries every job, and that branch run is the exact-SHA evidence a release quotes.
 - **Full floor once** (`pnpm run check:full`), on the frozen commit candidate. While it runs, nothing edits the worktree or index — including the NEXT boot sectors; a moved candidate voids the run's evidence.
 - **pre-commit is not the floor.** `.husky/pre-commit` carries only fast static checks (whitespace, lint, typecheck); the full floor is owned by this protocol, not by the hook. Do not grow the hook back, and do not build receipt/cache machinery to prove the protocol was followed.
 - **Release/LIVE acceptance is untouched.** VERIFY.md floors keep full strength; a shorter inner loop never lowers release evidence.
@@ -172,6 +172,7 @@ implement → affected focused gates → independent review → one amendment bu
 | `pi-extensions/lib/entwurf-v2-*.ts` | v2 contract, decider, transports, runner, production wiring; visible resume keeps launch injected |
 | `pi-extensions/lib/mux-*.ts` | same-tmux placement plus narrow fresh-call and visible-resume launch compositions |
 | `pi-extensions/lib/entwurf-fact*.ts` | record citizens + transport-specific liveness facts |
+| `pi-extensions/lib/entwurf-peer-observe.ts` | the IO half of the observed peer facts (receiver / transcript) |
 | `pi-extensions/lib/native-push/` | native-push adapter/probe/register leaf |
 | `pi-extensions/acp-provider.ts` | `entwurf` provider registration |
 | `pi-extensions/lib/acp/` | ACP adapter rail, config/overlay, augment, turn loop, event mapping |
@@ -184,8 +185,8 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.4 <0.85` with devDep exact `0.84.4`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
-- ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
+- pi runtime range is `>=0.85.1 <0.86` with devDep exact `0.85.1`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- ACP pins are recorded in `package.json` and owned by `check-acp-sdk-surface`, which is the vitest contract `test/acp-sdk-surface.contract.test.ts` (`./run.sh check-acp-sdk-surface` is a transition shim into it, not a `scripts/` gate). `check-dep-versions` is the **pi** pin's oracle and reads no ACP pin — do not cite it for one. Do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style
 

package/CHANGELOG.md

@@ -4,6 +4,305 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.18.1 - 2026-09-06
+
+Two lanes, both landing on `main` after `v0.18.0`: the CI evidence-budget stage 1 (#102, from
+research #99) and the dependency bump (#104 — pi, claude-agent-acp, and the OMP adoption rule
+GLG decided to carry with them). They are not one cause; they are one release.
+
+### Upgrade note — this one asks something of the operator
+
+**The pi floor moved, and entwurf does not install harnesses.** The supported range is now
+`>=0.85.1 <0.86`, so a host still carrying pi 0.84.x is BELOW it. `entwurf setup` says so by
+name — `pi FAIL — detected pi <version> is outside the supported range >=0.85.1 <0.86 — Pi
+wiring not written` — and writes no pi wiring rather than wiring a runtime it cannot vouch
+for. That refusal is the design (Hard Rule 17), not a bug to work around.
+
+The order matters:
+
+1. **Upgrade pi yourself first.** `pi update`, or `pnpm add -g @earendil-works/pi-coding-agent@0.85.1`
+   for a pnpm-global install. entwurf never does this for you.
+2. **Then `entwurf setup`** — one command, as always. This release changes no deployment
+   writer (`pi-extensions/lib/meta-session.ts`, the four `install-*` paths and the packaged
+   plugins are byte-identical to 0.18.0), so unlike the 0.17.2 and 0.18.0 upgrades there is no
+   stale-writer trap here. What setup does need to redo is the pi wiring it refused to write
+   while the runtime was below floor.
+3. **Restart any pi session you had open.** A running pi process keeps the binary it started
+   with, and this release's changed extension surfaces (`entwurf-control.ts` and four ACP
+   modules) are loaded at session start. A live 0.84.4 session stays a 0.84.4 session.
+
+Hosts without pi are unaffected: absence is still an explicit setup SKIP, not a failure.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.263, node 24.18.1, pi 0.85.1,
+omp 18.0.0).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.1.PtUm0r --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0.
+  2026-09-06 18:30:51 → 19:23:40 KST (52m49s). Log preserved at
+  `<scratch>/release-gate.log`.
+  - `check-gate-qualification` as its MUST step: **369/369 KILLED**.
+  - `smoke-acp-raw-turn-live` — the Dep-bump track's designated lock for an ACP adapter
+    move — PASS on 0.75.1: launch source `package:@agentclientprotocol/claude-agent-acp`
+    (not a PATH fallback), model `claude-sonnet-5`, `protocolVersion=1`,
+    `stopReason=end_turn`, 65,780 bytes of NDJSON captured.
+  - Both #91 drift sentinels green: `smoke-omp-receive-live`, and `smoke-omp-fresh-live`
+    with 21 assertions (step 9 clause 7) — on omp **18.0.0**, below the documented weak
+    floor of 18.1.10, which is exactly what "the floor records what was proven, not what is
+    permitted" means.
+- `pnpm run check:full` on the prepared tree: exit 0, 480s.
+- Pre-push landing run for the implementation HEAD `c247594`: CI run `34018205091`,
+  `check` + `install-surface` + `artifact-consumer` all `success` (`check` 34m14s,
+  `check:full` 328s, qualification 369/369).
+
+**The first `--cut` was BLOCKED, and the reason was not this release.** MUST PASS=20 FAIL=3
+SKIP=0: `smoke-entwurf-chain-live`, `smoke-mux-lifecycle-live` and `smoke-omp-fresh-live`
+each failed waiting on a sibling that never took its turn, and all three drive their sibling
+on `openai-codex/*` while every Claude-rail step passed. Measured at the time: the codex
+weekly window was at **100%**. The chain's own timeout instrumentation is what made this
+readable rather than mysterious — it printed `terminus fixture at timeout: ownerPid=… alive=true
+ownerAlive=true watchArmed=true`, so the mailbox was provably healthy and the chain had simply
+stalled upstream. After the quota reset the same gate went green with no code change. Recorded
+because an exhausted subscription rail looks exactly like a broken product until someone
+measures it.
+
+### Changed
+
+- **The qualification HEAD runs in the everyday floor; the mutant BODY stays scheduled (#102).**
+  Across 549 CI runs the qualification step went red five times and **none of the five came from
+  mutant execution** — three died in the head in four or five seconds, two were a gate already red
+  on a clean tree (#99 B-3). So the head stops waiting behind the ~28-minute body.
+  `check-gate-qualification` gains a `--manifests-only` entrypoint, shipped as
+  `run.sh check-gate-manifests` and placed in `check:hermetic` (~8s): runner self-test, manifest-set
+  validation against the origin index, and the declared lane inventory — **zero mutants executed and
+  no snapshot of this repo**. The body runs the same head first; its contract, output and
+  mutant-execution semantics are unchanged.
+- **CI push is filtered to branch refs (#102).** All 66 semver-tag runs in this repo's history
+  rebuilt a SHA a branch push had already built, and not one reported a fact its branch run had not
+  (the single non-green tag run failed at the same step as its main run, two seconds later). The
+  exact-SHA evidence a release quotes is the branch run, which is what the release skill's oracle
+  already selects.
+- **`check-omp-birth-hook` joins `check:hermetic` (#102).** It was the one gate a committed mutant
+  named that ran nowhere else, so the control-pre of a 28-minute run was the only thing in the repo
+  that could notice it going red. `check-release-gate-outcomes` cell 9 now owns that as a contract:
+  every mutant-named gate is inside `check:full` **or** states its exclusion in prose an operator
+  reads (`scripts/check-setup-qualification.sh` takes the second arm, as its own header declared).
+- **pi runtime 0.84.4 → 0.85.1** (#104): devDep exact ×3, peer range `>=0.85.1 <0.86` ×3, the
+  `run.sh` pack-install pins, `pnpm-workspace.yaml`, the lockfile, and the five baseline docs
+  `check-dep-versions` binds. **0.85.0 is deliberately skipped**: its published `exports` advertised
+  `./client` and `./experimental/plugin` at `dist/*` paths the tarball does not contain, which
+  upstream named and fixed in 0.85.1 ("SDK import failures caused by unintentionally publishing
+  internal experimental code and dependencies in 0.85.0") by making both subpaths source-only.
+  entwurf imports neither, so it never reached us — but the landing coordinate is 0.85.1.
+- **`@agentclientprotocol/claude-agent-acp` 0.73.0 → 0.75.1** (#104). The other two ACP pins do
+  **not** move: all four tags v0.73.0–v0.75.1 declare the same `@agentclientprotocol/sdk 1.4.0`,
+  `@anthropic-ai/claude-agent-sdk 0.3.257`, `zod ^4.0.0` and `engines.node >=22`, so
+  `@anthropic-ai/sdk` stays pinned at `0.100.1` against an unchanged `>=0.93.0` peer floor.
+- **Compaction now reaches operators as a tool lifecycle, not assistant text** (upstream #991, in
+  0.75.0). A compacting turn shows a `[tool:start] Compact conversation` / `[tool:…]` notice pair
+  where 0.73.0 wrote `Compacting completed.` into the assistant's own text. No mapper change was
+  needed and no accounting path is touched; the measurement, the join through the production event
+  mapper, and the limits are in `scripts/raw-acp-compaction-measure/README.md` and
+  `docs/acp-backend-rail.md` §11-8.
+- **OMP gets a documented *weak* floor instead of a version gate (#91).** entwurf still detects omp
+  by presence alone — no `entwurf.ompFloor`, no coherence gate, no exact pin — because a floor is
+  the answer to a vendor that fails SILENTLY, which OMP has never been observed to do, and its
+  contact surface is guarded by two release-gate MUST smokes that go loudly red. What is recorded
+  instead is the last version with a LIVE receipt (**18.1.10**, 2026-09-04 thinkpad), the rule that
+  the number moves only when a new receipt exists, and the two sentinels
+  (`smoke-omp-fresh-live`, `smoke-omp-receive-live`). Code change: none.
+  `docs/setup-clean-host.md` §4b.
+
+### Fixed
+
+- **An undeclared pi 0.85.x break, caught by our own typecheck (#104).** `pi-tui`'s `Container`
+  gained a `private mouseLayout?` in the 0.85.0 mouse work (0.84.4's `Container` had no private
+  member at all) while `Box` declares a separate private field of the same name, so TypeScript's
+  private-member identity rule broke the `Box → Container` structural assignment that had held
+  through 0.84.4 (`TS2322` at `entwurf-control.ts`). Upstream's Breaking section names only
+  `createGatewayBindingFetch`. The repair narrows the annotation to what the vendor contract
+  actually asks for — `MessageRenderer` returns `Component | undefined` — which is what the helper
+  always needed.
+- **The pack-install pin-leak matcher was blind to a new closure member (#104).** pi 0.85.0 added
+  `@earendil-works/chord` as a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and
+  pi-protocol — inside the runtime closure, with a name carrying no `pi-` prefix. Measured on a real
+  0.85.1 install tree, `@earendil-works+chord@0.85.1` sits beside the seven pi entries and the
+  `^@earendil-works+pi-` filter did not see it, so an unpinned caret would have floated while
+  `check-pack-install` printed a verified pin — the same class as the 2026-07-21 `pi-agent-core`
+  incident, and it made the "covers every other pi package" comment false. The matcher now filters on
+  the org prefix, chord is pinned explicitly, and the self-test splits into two cells so each
+  property fails under its own name. New claim `[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]` with
+  its exact-once replant; inventory **368 → 369 mutants across 40 lanes**.
+- **`check-pack-install`'s "every harness absent" row was not actually absent of OMP.** The row
+  pins harness probes away with explicit `*_BIN` seams, and `OMP_BIN` was never added when 0.16.0
+  admitted OMP — the two sibling fixtures (`smoke-setup-verdict.sh`,
+  `check-setup-qualification.sh`) both got it. On a host that HAS `omp` on PATH the row's premise
+  was therefore false: setup detected omp, and the omp config/receiver installers refused —
+  correctly — because the row also exports `PI_CODING_AGENT_DIR`, which omp reads too, leaving the
+  target directory ambiguous. The product was right and the fixture was wrong. It stayed invisible
+  because CI runners carry no omp **and** `release_gate()` does not run this gate (it is
+  `prepublishOnly` plus the CI install-surface job), so no green floor ever covered it. Measured
+  here with a control: a clean clone of the pre-bump HEAD fails at the same row for the same
+  reason. The seam is added to both setup rows, and the zero-state probe now requires **five**
+  SKIPs so a sixth harness cannot be admitted while this seam is left behind again.
+- **`VERIFY.md` still advertised a pi range two bumps stale, and now nothing can leave it there.**
+  It sat outside `check-dep-versions`' `BASELINE_DOCS`, so nothing read it; it has joined that
+  list (six docs). Its declaration is a plain range, so the existing range scan binds it — no new
+  prose pattern was added for it.
+- **`AGENTS.md` claimed `check-dep-versions` checks the ACP pins.** It does not — it is the **pi**
+  pin's oracle and reads no ACP pin (`run.sh:1820-1919`). The ACP pins are owned by
+  `check-acp-sdk-surface`, which is the vitest contract `test/acp-sdk-surface.contract.test.ts`;
+  the `run.sh` name is a transition shim into it.
+
+### Added
+
+- **`scripts/raw-acp-compaction-measure/`** — a raw measurement probe (not a gate, in no check
+  tier) that drives one live `/compact` turn on the pinned adapter and replays the captured
+  notifications through the production event mapper, so the vendor wire and our rendered notice sit
+  in one receipt.
+- Four new qualification claims from #102, each with its exact-once replant:
+  `MANIFEST-SET-INTEGRITY-REFUSED` and `LANE-INVENTORY-DECLARED` (new `gate-qualification` lane,
+  replanting the 08-20 / 08-21 / 08-28 catches), `MUTANT-GATES-INSIDE-FULL-FLOOR` and
+  `CI-TAG-PUSH-NOT-REBUILT` (`release-gate` lane).
+
+### Notes
+
+- **`allowBuilds: esbuild: false`.** chord's only dependency is esbuild, and its arrival made
+  `pnpm install` stop on `ERR_PNPM_IGNORED_BUILDS` until the key carried a decision. Denied like the
+  other two entries: nothing here executes esbuild.
+- **`bridge-command-boot`'s three agy gates moved to the `run.sh` argv the other manifests use**,
+  merging a duplicate group (#102). Group count is unchanged at 52 — the merge removes one and the
+  new head gate adds one — so the saving is a 66s control pair traded for a 16s one, not fewer
+  groups.
+
+## 0.18.0 - 2026-09-04
+
+### Fixed
+
+- **A Claude window that changes which session it serves no longer leaves an armed receiver behind
+  (#101).** One process serves one garden at a time but can change which: open a bare `claude` and
+  then `/resume` or `/clear` inside it, and a second `SessionStart` arrives under the same pid,
+  seconds later, naming a different session. The garden it stopped serving kept a receiver marker
+  naming a LIVE owner, so dispatch read an armed doorbell nobody held — a sibling's message was
+  reported as sent and then sat unread in that mailbox for over 50 minutes (oracle, 2026-09-04; that
+  unread letter is what opened the issue).
+  - **Deliverability now asks about *now*, not *ever*.** `watchArmed` was a copy of the identity
+    match; it is a measurement — the receiver owner's own sender marker
+    (`meta-senders/<backend>/<pid>.json`) must still name the same garden. Both consumers, the v2
+    production seam and `entwurf_self`, go through one shared composition, so a citizen's
+    self-report and dispatch cannot disagree.
+  - **The hook retires what it stopped serving** — the marker only, never the record (a record is a
+    citizen's identity, not sweepable state), only a marker its own pid owns, and only on an
+    arm-capable event. `UserPromptSubmit` cannot emit `watchPaths`, so retiring on a keystroke would
+    disarm the session the operator is sitting in with no way to re-arm. The vendor's `source` is
+    logged on every line and branched on nowhere: the switch is settled by what is on disk.
+  - **The join is scoped by the marker's `ownerKind`, not by backend** — today that is
+    `claude-code-cli`. A Copilot watch lives in a forked extension child with its own pid while its
+    sender marker carries the CLI's `process.ppid`, so applying the same check there would make
+    every Copilot citizen permanently `mailbox-undeliverable`. That is a scope decision with a
+    measured reason, not an omission.
+
+### Added
+
+- **A rejected delivery now names which receiver axis failed (#101).** A bare `mailbox-undeliverable`
+  sent one sibling hunting for a live session it had read as dead. The rejection now says whether
+  the doorbell is not armed, the owner is not alive, or there is no record.
+- **`entwurf_peers` separates a live citizen from a phantom (#101).** Every claude-code row reads
+  `liveness=unsupported`, so two rows were byte-identical whether or not anyone was home. Each row
+  now carries two observed facts — `receiver=` (doorbell state) and `transcript=` (whether a
+  conversation was ever written):
+
+  ```text
+  - 20260904T072015-e09b66  liveness=unsupported  receiver=active    transcript=exists
+  - 20260904T093135-ac7a1a  liveness=unsupported  receiver=inactive  transcript=absent
+  ```
+
+- **`check-meta-hook-session-switch` (28 assertions) and the first mutant lane the Claude hook has
+  ever had (#101).** The gate drives the shipped launcher twice under one fake owner pid and
+  requires that exactly one of the two gardens is deliverable — and that it is the one the operator
+  is sitting in. `scripts/mutants/meta-hook-session-switch.json` carries **17 claims**, 1:1 with the
+  gate's `[QK:…]` labels, each re-planting the defect this lane closed and requiring the gate to go
+  red at its claimed signature. Three of those six new mutants exist because cross-review found two
+  QK labels with no mutant behind them and three real weakenings walking straight through: the
+  join's `ownerKind` scope, the sender marker's start-key guard, and its backend equality.
+
+### Changed
+
+- **One inherited sentence about the resume picker is retired, and it was retired by measurement
+  (#101).** The diagnosis said the picker fires `SessionStart` twice — a placeholder id, then the
+  picked one. Six LIVE cells on this host (Claude Code 2.1.260, hook log verbatim in
+  `scripts/raw-claude-session-switch/README.md`) show it fires **once**, carrying the real id,
+  whether the id comes from the picker or from argv. The two-`SessionStart` shape is a bare `claude`
+  followed by an in-session `/resume` or `/clear` — which is exactly what the field case did, four
+  seconds before its second envelope. The repair is unaffected (either way one pid stops serving one
+  garden), so only the prose moved, in four places. Compaction, manual and automatic, re-fires
+  `SessionStart` for the **same** native id and retires nothing; the same-garden rule already
+  covered it.
+- **A `UserPromptSubmit` envelope is trusted for the receiver join, on a measured footing.** The
+  cross-review threat model ("a stale or out-of-order UPS") was withdrawn rather than defended: it
+  claimed the sender pointer is untrustworthy for the join while the same pointer stays authoritative
+  for sender identity — two incompatible readings of one file. Across the raw lab's four pids, every
+  `UserPromptSubmit` named the native id its own pid's preceding `SessionStart` had established,
+  **8 of 8**. The arm-capable restriction stays on its own footing.
+- **Three LIVE smokes stopped depending on a fixture the new join reads as retired.** Five smokes
+  seeded a receiver marker with no sender marker beside it — three of them release MUSTs — so each
+  would have failed on its own fixture rather than on the rail it exists to prove. They now seed
+  both and sandbox the senders root, the shape `smoke-mux-lifecycle-live` and `smoke-omp-fresh-live`
+  already had. `smoke-entwurf-chain-live` additionally gives its terminus an owner **outside hop 1's
+  ancestry**: seeding it under the smoke's own pid put two garden citizens on one host process and
+  the bridge refused the hop outright with `ambiguous sender identity`.
+
+### Upgrade note
+
+**Run `entwurf setup` once after upgrading — every rail, not just Claude.** This release changes
+`pi-extensions/lib/meta-session.ts` and the Claude hook, and **four install paths deploy that
+file** — `install-meta-bridge` (Claude), `install-omp-bridge` and `install-omp-receive` (OMP),
+`install-copilot-bridge` (Copilot). Every one of them present on the host now carries a STALE
+writer until it is re-installed, and its own doctor says so by name. Re-installing only the Claude
+rail leaves the others stale, and that does not surface until a LIVE gate turns red — measured in
+the 0.17.2 cut, where it blocked `smoke-omp-receive-live` and made the first `--cut` run BLOCKED.
+
+`entwurf setup` is presence-driven and re-synthesizes exactly the units this host has, which is why
+it is the upgrade command rather than any single `install-*`. An already-open Claude Code session
+keeps the old manifest until it restarts — and, for this release specifically, an already-open
+session also keeps the old hook, which is the code that retires a switched-away receiver.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.260, node 24.18.1, pi 0.84.4, omp 18.0.0).
+
+- **`pnpm run check:full` — exit 0**, 440s on the prepared tree and 446s inside the release gate.
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.0c.xZlKjZ --cut` — `cut: OK`,
+  exit 0.** **MUST PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**. Run 18:57→19:48 KST
+  on `faee8f6`, with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`. Log:
+  `/tmp/entwurf-release-gate-0.18.0c.xZlKjZ/release-gate.log`. It carried `check:full` and
+  `check-gate-qualification` (**364/364 KILLED**, up from 347 — the 17 new claims are this lane's
+  `MHSS-*`) as MUST steps.
+- **This lane's own gate: `check-meta-hook-session-switch` — 28 assertions passed**, and all 17
+  `MHSS-*` mutants killed at their claimed signatures inside that qualification run.
+- **The three LIVE smokes whose fixtures this lane changed are green**, including
+  `smoke-entwurf-chain-live` — **24 assertions**, four citizens across three harnesses, and its new
+  pre-flight cell `fixture: the terminus is a deliverable citizen at the moment the chain starts`
+  passed before the chain ran.
+- **One unattributed `smoke-entwurf-chain-live` failure is on the record and is NOT closed.** During
+  the lane (2026-09-04 16:58 KST) one run rejected at hop 3 with `mailbox-undeliverable (observed
+  liveness: unsupported)`; the runs before and after it passed and it has not reproduced. A
+  start-key race and an early idle-owner exit were excluded by measurement; a memory-pressure
+  hypothesis is neither confirmed nor refuted (no OOM or kill entries in the host journal for that
+  window). The instrument that will split the next occurrence shipped in this release — the fixture
+  pre-flight assertion above, plus a `terminus fixture at timeout:` line naming owner liveness and
+  both receiver facts.
+- **The first `--cut` attempt of this cut was BLOCKED, and the cause was operator error, not the
+  product.** `check-gate-qualification` aborted with `origin HEAD changed during qualification`
+  because a commit was created while the gate was running. Every other MUST step in that run passed
+  (`MUST PASS=22 FAIL=1 SKIP=0`). The run above is the re-measurement on a frozen HEAD. One LIVE
+  gate run before that was killed by the host harness's low-memory watchdog rather than by any
+  assertion, and was re-run under tmux.
+- **Exact-SHA CI on the pre-version HEAD `e56eee0`** — `check`, `install-surface`,
+  `artifact-consumer` all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33853363923
+
 ## 0.17.2 - 2026-09-03
 
 ### Added

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — all but the separately scheduled `check-gate-qualification`, which CI runs on every push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on every branch push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -157,7 +157,7 @@ cd ~/repos/gh/entwurf
 
 The full source setup requires Node 24, pnpm, and Python 3 on PATH. Harnesses are
 optional-by-presence: `setup` runs the frozen dependency install, then composes what the operator
-already installed — a compatible `pi` (`>=0.84.4 <0.85`), Claude Code, agy, and the Copilot CLI
+already installed — a compatible `pi` (`>=0.85.1 <0.86`), Claude Code, agy, and the Copilot CLI
 each get their wiring completed when detected, an absent harness is an explicit zero-state SKIP,
 and a detected harness that cannot be completed (including a below-floor `pi`) is a named FAIL
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
@@ -188,7 +188,7 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.84.4 <0.85`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.85.1 <0.86`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -433,6 +433,7 @@ pnpm run check:full                     # full deterministic floor (adds the her
 # source-maintainer only — qualification snapshots the git work surface, and both
 # commands are source-contract gates rather than installed operator checks:
 ./run.sh check-agy-permission-matrix    # AGY permission contract space as a literal table (declared cells + stated exclusions)
+./run.sh check-gate-manifests           # the qualification HEAD alone: self-test + manifest-set validation + declared lane inventory, zero mutants run (in check:hermetic)
 ./run.sh check-gate-qualification       # kill-proof: committed defect mutants must turn their gates red for the claimed reason
 
 # agy LIVE acceptance — requires an already-running conversation:
@@ -450,9 +451,12 @@ LIVE=1 ./run.sh release-gate /tmp/scratch --cut # the single cut gate (MUST + BE
 LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live  # Cortex is on-demand: the aggregate does not re-certify it
 ```
 
-`pnpm run check:full` includes the AGY permission contract matrix; the committed-mutant
-gate qualification is scheduled separately (`./run.sh check-gate-qualification` — the CI
-`check` job runs it on every push, and release-gate carries it as a MUST step). A gate a
+`pnpm run check:full` includes the AGY permission contract matrix and the qualification
+HEAD (`check-gate-manifests` — runner self-test, manifest-set validation, declared lane
+inventory, zero mutants executed); the committed-mutant EXECUTION is scheduled separately
+(`./run.sh check-gate-qualification` — the CI `check` job runs it on every branch push,
+and release-gate carries it as a MUST step; a tag push runs no CI, since the same SHA's
+branch run already carries every job). A gate a
 release touches must kill its known defect for the claimed `[QK:<claim>]` reason —
 the descriptions above name what each smoke covers, and no check count is quality
 evidence on its own. Gate qualification needs the git work surface, while the matrix

package/VERIFY.md

@@ -40,8 +40,8 @@ Verification here is not a benchmark. In production we exchange short turns and
 
 ### The canonical floor — two entry points
 
-- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
+- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every branch push, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, because the same SHA's branch run already carries every job and is the exact-SHA evidence a release quotes) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
@@ -137,7 +137,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.84.3 <0.85`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.85.1 <0.86`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -139,7 +139,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.84.4)
+- `pi` on PATH (current floor 0.85.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -93,9 +93,9 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
-| pi runtime | devDep exact `0.84.4`, peer `>=0.84.4 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.4; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.73.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.75.1` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
@@ -144,9 +144,19 @@ different reasons, and collapsing them would hide a real risk**:
 - **Advertised but never called.** Some surfaces carry no capability prerequisite at all — the
   `providers/list` / `providers/set` / `providers/disable` trio added in 0.70.0 is advertised
   unconditionally, and 0.71.0–0.73.0 add native subagents, async tasks, message-specific session
-  forks, AI-generated session titles and permission-mode kinds on the same footing. They are
+  forks, AI-generated session titles and permission-mode kinds on the same footing. 0.74.0–0.75.1
+  extend the same list: the `authStatus` extension (0.75.0, #1080), Markdown-rendered usage
+  statistics (0.75.0, #1085) and restored session forks (0.75.1, #1089). The `--hide-claude-auth`
+  subscription refusal (0.74.0, #1079) is unreachable for a second reason — `[측정 2026-09-06]`
+  entwurf passes that flag nowhere (repo grep, 0 hits). They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+- **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
+  synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
+  `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
+  assistant text. Our mapper routes every `tool_call`/`tool_call_update` through
+  `renderToolUpdate` (`event-mapper.ts`), so this is not a type break; what changes is what an
+  operator SEES in a compacting turn. See §11-8 for the measurement.
 
 Adopting either class requires a separate observed need plus a complete rendering/lifecycle/evidence
 contract. An optional upstream feature is not a core-value gap.
@@ -257,17 +267,19 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.73.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.75.1 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.70.0 → 0.73.0 bump, not inherited from the previous one.
-`mcpServerStatus` call sites in `src/acp-agent.ts` went 0 → 2, new in 0.71.0 via
-`0cbbaf3` (MCP OAuth, LLM-25012) — so the ADAPTER now calls it where it previously
-did not. Both sites were read at `v0.73.0 src/acp-agent.ts:1618` and `:1711`: each is
-gated behind `supportsMcpOAuth(query)`, and the polling one waits only on a server
-that already reported `needs-auth`, never on every declared server before
-`newSession` returns. That is an auth handshake, not a readiness fence, so the
-boundary below is unchanged. The other reachable-surface findings also re-measured:
+(Re-measured at the 0.73.0 → 0.75.1 bump, not inherited from the previous one — and the
+0.70.0 → 0.73.0 argument is not reused either. `mcpServerStatus` call sites in
+`src/acp-agent.ts` are **2 at both v0.73.0 and v0.75.1** `[측정 2026-09-06, git grep -c]`;
+they first appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it
+where it once did not. Both were re-read at `v0.75.1 src/acp-agent.ts:1736` and `:1829`
+(the 0.73.0 coordinates were `:1618` and `:1711`): the first sits inside
+`authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
+`needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
+Neither waits on every declared server before `newSession` returns. That is an auth
+handshake, not a readiness fence, so the boundary below is unchanged. The other reachable-surface findings also re-measured:
 AIR typed failures and the AIR file-change report stay capability-gated and
 unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
 unconditionally and uncalled; native subagents, async tasks, session forks, session
@@ -338,6 +350,28 @@ a cut that changes or ships the Cortex rail must run and read its dedicated smok
 Per-cut counts, digests, versions, and host observations belong in BASELINE/CHANGELOG,
 not this standing contract.
 
+## 11-8. Compaction is a tool lifecycle (0.75.0 onward)
+
+The one change in the `0.73.0 → 0.75.1` bump that REACHES the common loop. Upstream #991
+(`f74a517`) replaced compaction's assistant text with a synthetic ACP tool call: `kind:
+"think"`, title `Compact conversation`, `_meta.contextCompaction` schema v1.
+
+`[측정 2026-09-06, oracle, adapter 0.75.1, claude-sonnet-5]` one live `/compact` turn emitted
+exactly two notifications (`tool_call` in-progress → `tool_call_update`), and those verbatim
+objects replayed through the production `applyAcpSessionUpdate` produced a
+`[tool:start] Compact conversation` / `[tool:…] Compact conversation` notice pair. No new
+mapper branch is needed — `renderToolUpdate` routes every tool call regardless of `kind` —
+and `_meta.contextCompaction` is dropped by the mapper, so no accounting path sees it.
+
+What changed is therefore what an OPERATOR sees in a compacting turn, not what entwurf
+computes. The post-compaction occupancy refresh is NOT new: `v0.73.0 src/acp-agent.ts:3460`
+already emitted a `usage_update` at `compact_boundary` and 0.75.1 still does
+(`dist/acp-agent.js:2740-2752`, now reading `compact_metadata.post_tokens` instead of a
+`getContextUsage` control request), so the shrinking-`used_end` case that
+`backend.ts:1286-1288` names as #96's weak floor gains no new trigger here.
+
+Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-measure/README.md`.
+
 ## Open work
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;