@junghanacs/entwurf 0.18.0 → 0.18.1

package/AGENTS.md

@@ -139,7 +139,7 @@ LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live   # o
 LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 ```
 
-- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. Neither tier includes `check-gate-qualification`, which is scheduled separately (below).
+- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. The full tier carries `check-gate-manifests` (the qualification HEAD, through `check:hermetic`); the everyday core does not, and neither tier carries the mutant-executing `check-gate-qualification`, which is scheduled separately (below).
 - **Kill-proof discipline (gate qualification).** A gate is a test only if re-planting a closed defect turns it red for the claimed reason. `check-gate-qualification` proves that automatically: committed mutants in `scripts/mutants/` must be KILLED at their `[QK:<claim>]` signature inside an isolated snapshot repo (control→mutant→restore→control; the real checkout is never written). Gates a release touches carry such manifests; assertion counts are never evidence — claim IDs + killed mutant IDs are. `check-agy-permission-matrix` holds the enumerated permission contract space; matrix cells change by axis/rule edits, never by appending cases.
 - **When changing a contract/gate:** name the production subject and an oracle independent of it; give the failing assertion a stable `[QK:<claim>]` label and add/update the exact-once mutant in `scripts/mutants/*.json`; if the contract is combinatorial, update the literal matrix axes/cells/exclusions together with their declared counts; then verify the focused gate, and let qualification and the full floor follow the scheduling contract below — once on the frozen candidate, not once per amendment. `MUTANT-STALE`/`SURVIVED`/`WRONG-REASON`/`CONTROL-RED`/`HANG`/`IMPURE` are red — never substitute an assertion count for a kill.
 - Run LIVE gates with `PWD` in scratch so session artifacts do not land in the repo. Strip `CLAUDE_CONFIG_DIR`, `PI_SESSION_ID`, and `PI_AGENT_ID` from the gate process — a live pi/ACP session exports them into children, where they strip Claude hooks or capture a fresh-call callback.
@@ -157,7 +157,7 @@ implement → affected focused gates → independent review → one amendment bu
 
 - **Inner loop:** run only the gates whose subject changed. Do not open the full floor to learn what a focused gate already answers.
 - **Review before floor:** independent review and its corrections close as one bundle before the full floor runs.
-- **Qualification is scheduled, not ambient.** `check-gate-qualification` is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every push, and release-gate carries it as a MUST step.
+- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every branch push, and release-gate carries it as a MUST step. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all; the same SHA's branch run already carries every job, and that branch run is the exact-SHA evidence a release quotes.
 - **Full floor once** (`pnpm run check:full`), on the frozen commit candidate. While it runs, nothing edits the worktree or index — including the NEXT boot sectors; a moved candidate voids the run's evidence.
 - **pre-commit is not the floor.** `.husky/pre-commit` carries only fast static checks (whitespace, lint, typecheck); the full floor is owned by this protocol, not by the hook. Do not grow the hook back, and do not build receipt/cache machinery to prove the protocol was followed.
 - **Release/LIVE acceptance is untouched.** VERIFY.md floors keep full strength; a shorter inner loop never lowers release evidence.
@@ -185,8 +185,8 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.4 <0.85` with devDep exact `0.84.4`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
-- ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
+- pi runtime range is `>=0.85.1 <0.86` with devDep exact `0.85.1`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- ACP pins are recorded in `package.json` and owned by `check-acp-sdk-surface`, which is the vitest contract `test/acp-sdk-surface.contract.test.ts` (`./run.sh check-acp-sdk-surface` is a transition shim into it, not a `scripts/` gate). `check-dep-versions` is the **pi** pin's oracle and reads no ACP pin — do not cite it for one. Do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style
 

package/CHANGELOG.md

@@ -4,6 +4,178 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.18.1 - 2026-09-06
+
+Two lanes, both landing on `main` after `v0.18.0`: the CI evidence-budget stage 1 (#102, from
+research #99) and the dependency bump (#104 — pi, claude-agent-acp, and the OMP adoption rule
+GLG decided to carry with them). They are not one cause; they are one release.
+
+### Upgrade note — this one asks something of the operator
+
+**The pi floor moved, and entwurf does not install harnesses.** The supported range is now
+`>=0.85.1 <0.86`, so a host still carrying pi 0.84.x is BELOW it. `entwurf setup` says so by
+name — `pi FAIL — detected pi <version> is outside the supported range >=0.85.1 <0.86 — Pi
+wiring not written` — and writes no pi wiring rather than wiring a runtime it cannot vouch
+for. That refusal is the design (Hard Rule 17), not a bug to work around.
+
+The order matters:
+
+1. **Upgrade pi yourself first.** `pi update`, or `pnpm add -g @earendil-works/pi-coding-agent@0.85.1`
+   for a pnpm-global install. entwurf never does this for you.
+2. **Then `entwurf setup`** — one command, as always. This release changes no deployment
+   writer (`pi-extensions/lib/meta-session.ts`, the four `install-*` paths and the packaged
+   plugins are byte-identical to 0.18.0), so unlike the 0.17.2 and 0.18.0 upgrades there is no
+   stale-writer trap here. What setup does need to redo is the pi wiring it refused to write
+   while the runtime was below floor.
+3. **Restart any pi session you had open.** A running pi process keeps the binary it started
+   with, and this release's changed extension surfaces (`entwurf-control.ts` and four ACP
+   modules) are loaded at session start. A live 0.84.4 session stays a 0.84.4 session.
+
+Hosts without pi are unaffected: absence is still an explicit setup SKIP, not a failure.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.263, node 24.18.1, pi 0.85.1,
+omp 18.0.0).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.1.PtUm0r --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0.
+  2026-09-06 18:30:51 → 19:23:40 KST (52m49s). Log preserved at
+  `<scratch>/release-gate.log`.
+  - `check-gate-qualification` as its MUST step: **369/369 KILLED**.
+  - `smoke-acp-raw-turn-live` — the Dep-bump track's designated lock for an ACP adapter
+    move — PASS on 0.75.1: launch source `package:@agentclientprotocol/claude-agent-acp`
+    (not a PATH fallback), model `claude-sonnet-5`, `protocolVersion=1`,
+    `stopReason=end_turn`, 65,780 bytes of NDJSON captured.
+  - Both #91 drift sentinels green: `smoke-omp-receive-live`, and `smoke-omp-fresh-live`
+    with 21 assertions (step 9 clause 7) — on omp **18.0.0**, below the documented weak
+    floor of 18.1.10, which is exactly what "the floor records what was proven, not what is
+    permitted" means.
+- `pnpm run check:full` on the prepared tree: exit 0, 480s.
+- Pre-push landing run for the implementation HEAD `c247594`: CI run `34018205091`,
+  `check` + `install-surface` + `artifact-consumer` all `success` (`check` 34m14s,
+  `check:full` 328s, qualification 369/369).
+
+**The first `--cut` was BLOCKED, and the reason was not this release.** MUST PASS=20 FAIL=3
+SKIP=0: `smoke-entwurf-chain-live`, `smoke-mux-lifecycle-live` and `smoke-omp-fresh-live`
+each failed waiting on a sibling that never took its turn, and all three drive their sibling
+on `openai-codex/*` while every Claude-rail step passed. Measured at the time: the codex
+weekly window was at **100%**. The chain's own timeout instrumentation is what made this
+readable rather than mysterious — it printed `terminus fixture at timeout: ownerPid=… alive=true
+ownerAlive=true watchArmed=true`, so the mailbox was provably healthy and the chain had simply
+stalled upstream. After the quota reset the same gate went green with no code change. Recorded
+because an exhausted subscription rail looks exactly like a broken product until someone
+measures it.
+
+### Changed
+
+- **The qualification HEAD runs in the everyday floor; the mutant BODY stays scheduled (#102).**
+  Across 549 CI runs the qualification step went red five times and **none of the five came from
+  mutant execution** — three died in the head in four or five seconds, two were a gate already red
+  on a clean tree (#99 B-3). So the head stops waiting behind the ~28-minute body.
+  `check-gate-qualification` gains a `--manifests-only` entrypoint, shipped as
+  `run.sh check-gate-manifests` and placed in `check:hermetic` (~8s): runner self-test, manifest-set
+  validation against the origin index, and the declared lane inventory — **zero mutants executed and
+  no snapshot of this repo**. The body runs the same head first; its contract, output and
+  mutant-execution semantics are unchanged.
+- **CI push is filtered to branch refs (#102).** All 66 semver-tag runs in this repo's history
+  rebuilt a SHA a branch push had already built, and not one reported a fact its branch run had not
+  (the single non-green tag run failed at the same step as its main run, two seconds later). The
+  exact-SHA evidence a release quotes is the branch run, which is what the release skill's oracle
+  already selects.
+- **`check-omp-birth-hook` joins `check:hermetic` (#102).** It was the one gate a committed mutant
+  named that ran nowhere else, so the control-pre of a 28-minute run was the only thing in the repo
+  that could notice it going red. `check-release-gate-outcomes` cell 9 now owns that as a contract:
+  every mutant-named gate is inside `check:full` **or** states its exclusion in prose an operator
+  reads (`scripts/check-setup-qualification.sh` takes the second arm, as its own header declared).
+- **pi runtime 0.84.4 → 0.85.1** (#104): devDep exact ×3, peer range `>=0.85.1 <0.86` ×3, the
+  `run.sh` pack-install pins, `pnpm-workspace.yaml`, the lockfile, and the five baseline docs
+  `check-dep-versions` binds. **0.85.0 is deliberately skipped**: its published `exports` advertised
+  `./client` and `./experimental/plugin` at `dist/*` paths the tarball does not contain, which
+  upstream named and fixed in 0.85.1 ("SDK import failures caused by unintentionally publishing
+  internal experimental code and dependencies in 0.85.0") by making both subpaths source-only.
+  entwurf imports neither, so it never reached us — but the landing coordinate is 0.85.1.
+- **`@agentclientprotocol/claude-agent-acp` 0.73.0 → 0.75.1** (#104). The other two ACP pins do
+  **not** move: all four tags v0.73.0–v0.75.1 declare the same `@agentclientprotocol/sdk 1.4.0`,
+  `@anthropic-ai/claude-agent-sdk 0.3.257`, `zod ^4.0.0` and `engines.node >=22`, so
+  `@anthropic-ai/sdk` stays pinned at `0.100.1` against an unchanged `>=0.93.0` peer floor.
+- **Compaction now reaches operators as a tool lifecycle, not assistant text** (upstream #991, in
+  0.75.0). A compacting turn shows a `[tool:start] Compact conversation` / `[tool:…]` notice pair
+  where 0.73.0 wrote `Compacting completed.` into the assistant's own text. No mapper change was
+  needed and no accounting path is touched; the measurement, the join through the production event
+  mapper, and the limits are in `scripts/raw-acp-compaction-measure/README.md` and
+  `docs/acp-backend-rail.md` §11-8.
+- **OMP gets a documented *weak* floor instead of a version gate (#91).** entwurf still detects omp
+  by presence alone — no `entwurf.ompFloor`, no coherence gate, no exact pin — because a floor is
+  the answer to a vendor that fails SILENTLY, which OMP has never been observed to do, and its
+  contact surface is guarded by two release-gate MUST smokes that go loudly red. What is recorded
+  instead is the last version with a LIVE receipt (**18.1.10**, 2026-09-04 thinkpad), the rule that
+  the number moves only when a new receipt exists, and the two sentinels
+  (`smoke-omp-fresh-live`, `smoke-omp-receive-live`). Code change: none.
+  `docs/setup-clean-host.md` §4b.
+
+### Fixed
+
+- **An undeclared pi 0.85.x break, caught by our own typecheck (#104).** `pi-tui`'s `Container`
+  gained a `private mouseLayout?` in the 0.85.0 mouse work (0.84.4's `Container` had no private
+  member at all) while `Box` declares a separate private field of the same name, so TypeScript's
+  private-member identity rule broke the `Box → Container` structural assignment that had held
+  through 0.84.4 (`TS2322` at `entwurf-control.ts`). Upstream's Breaking section names only
+  `createGatewayBindingFetch`. The repair narrows the annotation to what the vendor contract
+  actually asks for — `MessageRenderer` returns `Component | undefined` — which is what the helper
+  always needed.
+- **The pack-install pin-leak matcher was blind to a new closure member (#104).** pi 0.85.0 added
+  `@earendil-works/chord` as a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and
+  pi-protocol — inside the runtime closure, with a name carrying no `pi-` prefix. Measured on a real
+  0.85.1 install tree, `@earendil-works+chord@0.85.1` sits beside the seven pi entries and the
+  `^@earendil-works+pi-` filter did not see it, so an unpinned caret would have floated while
+  `check-pack-install` printed a verified pin — the same class as the 2026-07-21 `pi-agent-core`
+  incident, and it made the "covers every other pi package" comment false. The matcher now filters on
+  the org prefix, chord is pinned explicitly, and the self-test splits into two cells so each
+  property fails under its own name. New claim `[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]` with
+  its exact-once replant; inventory **368 → 369 mutants across 40 lanes**.
+- **`check-pack-install`'s "every harness absent" row was not actually absent of OMP.** The row
+  pins harness probes away with explicit `*_BIN` seams, and `OMP_BIN` was never added when 0.16.0
+  admitted OMP — the two sibling fixtures (`smoke-setup-verdict.sh`,
+  `check-setup-qualification.sh`) both got it. On a host that HAS `omp` on PATH the row's premise
+  was therefore false: setup detected omp, and the omp config/receiver installers refused —
+  correctly — because the row also exports `PI_CODING_AGENT_DIR`, which omp reads too, leaving the
+  target directory ambiguous. The product was right and the fixture was wrong. It stayed invisible
+  because CI runners carry no omp **and** `release_gate()` does not run this gate (it is
+  `prepublishOnly` plus the CI install-surface job), so no green floor ever covered it. Measured
+  here with a control: a clean clone of the pre-bump HEAD fails at the same row for the same
+  reason. The seam is added to both setup rows, and the zero-state probe now requires **five**
+  SKIPs so a sixth harness cannot be admitted while this seam is left behind again.
+- **`VERIFY.md` still advertised a pi range two bumps stale, and now nothing can leave it there.**
+  It sat outside `check-dep-versions`' `BASELINE_DOCS`, so nothing read it; it has joined that
+  list (six docs). Its declaration is a plain range, so the existing range scan binds it — no new
+  prose pattern was added for it.
+- **`AGENTS.md` claimed `check-dep-versions` checks the ACP pins.** It does not — it is the **pi**
+  pin's oracle and reads no ACP pin (`run.sh:1820-1919`). The ACP pins are owned by
+  `check-acp-sdk-surface`, which is the vitest contract `test/acp-sdk-surface.contract.test.ts`;
+  the `run.sh` name is a transition shim into it.
+
+### Added
+
+- **`scripts/raw-acp-compaction-measure/`** — a raw measurement probe (not a gate, in no check
+  tier) that drives one live `/compact` turn on the pinned adapter and replays the captured
+  notifications through the production event mapper, so the vendor wire and our rendered notice sit
+  in one receipt.
+- Four new qualification claims from #102, each with its exact-once replant:
+  `MANIFEST-SET-INTEGRITY-REFUSED` and `LANE-INVENTORY-DECLARED` (new `gate-qualification` lane,
+  replanting the 08-20 / 08-21 / 08-28 catches), `MUTANT-GATES-INSIDE-FULL-FLOOR` and
+  `CI-TAG-PUSH-NOT-REBUILT` (`release-gate` lane).
+
+### Notes
+
+- **`allowBuilds: esbuild: false`.** chord's only dependency is esbuild, and its arrival made
+  `pnpm install` stop on `ERR_PNPM_IGNORED_BUILDS` until the key carried a decision. Denied like the
+  other two entries: nothing here executes esbuild.
+- **`bridge-command-boot`'s three agy gates moved to the `run.sh` argv the other manifests use**,
+  merging a duplicate group (#102). Group count is unchanged at 52 — the merge removes one and the
+  new head gate adds one — so the saving is a 66s control pair traded for a 16s one, not fewer
+  groups.
+
 ## 0.18.0 - 2026-09-04
 
 ### Fixed

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — all but the separately scheduled `check-gate-qualification`, which CI runs on every push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on every branch push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -157,7 +157,7 @@ cd ~/repos/gh/entwurf
 
 The full source setup requires Node 24, pnpm, and Python 3 on PATH. Harnesses are
 optional-by-presence: `setup` runs the frozen dependency install, then composes what the operator
-already installed — a compatible `pi` (`>=0.84.4 <0.85`), Claude Code, agy, and the Copilot CLI
+already installed — a compatible `pi` (`>=0.85.1 <0.86`), Claude Code, agy, and the Copilot CLI
 each get their wiring completed when detected, an absent harness is an explicit zero-state SKIP,
 and a detected harness that cannot be completed (including a below-floor `pi`) is a named FAIL
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
@@ -188,7 +188,7 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.84.4 <0.85`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.85.1 <0.86`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -433,6 +433,7 @@ pnpm run check:full                     # full deterministic floor (adds the her
 # source-maintainer only — qualification snapshots the git work surface, and both
 # commands are source-contract gates rather than installed operator checks:
 ./run.sh check-agy-permission-matrix    # AGY permission contract space as a literal table (declared cells + stated exclusions)
+./run.sh check-gate-manifests           # the qualification HEAD alone: self-test + manifest-set validation + declared lane inventory, zero mutants run (in check:hermetic)
 ./run.sh check-gate-qualification       # kill-proof: committed defect mutants must turn their gates red for the claimed reason
 
 # agy LIVE acceptance — requires an already-running conversation:
@@ -450,9 +451,12 @@ LIVE=1 ./run.sh release-gate /tmp/scratch --cut # the single cut gate (MUST + BE
 LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live  # Cortex is on-demand: the aggregate does not re-certify it
 ```
 
-`pnpm run check:full` includes the AGY permission contract matrix; the committed-mutant
-gate qualification is scheduled separately (`./run.sh check-gate-qualification` — the CI
-`check` job runs it on every push, and release-gate carries it as a MUST step). A gate a
+`pnpm run check:full` includes the AGY permission contract matrix and the qualification
+HEAD (`check-gate-manifests` — runner self-test, manifest-set validation, declared lane
+inventory, zero mutants executed); the committed-mutant EXECUTION is scheduled separately
+(`./run.sh check-gate-qualification` — the CI `check` job runs it on every branch push,
+and release-gate carries it as a MUST step; a tag push runs no CI, since the same SHA's
+branch run already carries every job). A gate a
 release touches must kill its known defect for the claimed `[QK:<claim>]` reason —
 the descriptions above name what each smoke covers, and no check count is quality
 evidence on its own. Gate qualification needs the git work surface, while the matrix

package/VERIFY.md

@@ -40,8 +40,8 @@ Verification here is not a benchmark. In production we exchange short turns and
 
 ### The canonical floor — two entry points
 
-- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
+- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every branch push, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, because the same SHA's branch run already carries every job and is the exact-SHA evidence a release quotes) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
@@ -137,7 +137,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.84.3 <0.85`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.85.1 <0.86`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -139,7 +139,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.84.4)
+- `pi` on PATH (current floor 0.85.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -93,9 +93,9 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
-| pi runtime | devDep exact `0.84.4`, peer `>=0.84.4 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.4; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.73.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.75.1` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
@@ -144,9 +144,19 @@ different reasons, and collapsing them would hide a real risk**:
 - **Advertised but never called.** Some surfaces carry no capability prerequisite at all — the
   `providers/list` / `providers/set` / `providers/disable` trio added in 0.70.0 is advertised
   unconditionally, and 0.71.0–0.73.0 add native subagents, async tasks, message-specific session
-  forks, AI-generated session titles and permission-mode kinds on the same footing. They are
+  forks, AI-generated session titles and permission-mode kinds on the same footing. 0.74.0–0.75.1
+  extend the same list: the `authStatus` extension (0.75.0, #1080), Markdown-rendered usage
+  statistics (0.75.0, #1085) and restored session forks (0.75.1, #1089). The `--hide-claude-auth`
+  subscription refusal (0.74.0, #1079) is unreachable for a second reason — `[측정 2026-09-06]`
+  entwurf passes that flag nowhere (repo grep, 0 hits). They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+- **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
+  synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
+  `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
+  assistant text. Our mapper routes every `tool_call`/`tool_call_update` through
+  `renderToolUpdate` (`event-mapper.ts`), so this is not a type break; what changes is what an
+  operator SEES in a compacting turn. See §11-8 for the measurement.
 
 Adopting either class requires a separate observed need plus a complete rendering/lifecycle/evidence
 contract. An optional upstream feature is not a core-value gap.
@@ -257,17 +267,19 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.73.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.75.1 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.70.0 → 0.73.0 bump, not inherited from the previous one.
-`mcpServerStatus` call sites in `src/acp-agent.ts` went 0 → 2, new in 0.71.0 via
-`0cbbaf3` (MCP OAuth, LLM-25012) — so the ADAPTER now calls it where it previously
-did not. Both sites were read at `v0.73.0 src/acp-agent.ts:1618` and `:1711`: each is
-gated behind `supportsMcpOAuth(query)`, and the polling one waits only on a server
-that already reported `needs-auth`, never on every declared server before
-`newSession` returns. That is an auth handshake, not a readiness fence, so the
-boundary below is unchanged. The other reachable-surface findings also re-measured:
+(Re-measured at the 0.73.0 → 0.75.1 bump, not inherited from the previous one — and the
+0.70.0 → 0.73.0 argument is not reused either. `mcpServerStatus` call sites in
+`src/acp-agent.ts` are **2 at both v0.73.0 and v0.75.1** `[측정 2026-09-06, git grep -c]`;
+they first appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it
+where it once did not. Both were re-read at `v0.75.1 src/acp-agent.ts:1736` and `:1829`
+(the 0.73.0 coordinates were `:1618` and `:1711`): the first sits inside
+`authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
+`needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
+Neither waits on every declared server before `newSession` returns. That is an auth
+handshake, not a readiness fence, so the boundary below is unchanged. The other reachable-surface findings also re-measured:
 AIR typed failures and the AIR file-change report stay capability-gated and
 unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
 unconditionally and uncalled; native subagents, async tasks, session forks, session
@@ -338,6 +350,28 @@ a cut that changes or ships the Cortex rail must run and read its dedicated smok
 Per-cut counts, digests, versions, and host observations belong in BASELINE/CHANGELOG,
 not this standing contract.
 
+## 11-8. Compaction is a tool lifecycle (0.75.0 onward)
+
+The one change in the `0.73.0 → 0.75.1` bump that REACHES the common loop. Upstream #991
+(`f74a517`) replaced compaction's assistant text with a synthetic ACP tool call: `kind:
+"think"`, title `Compact conversation`, `_meta.contextCompaction` schema v1.
+
+`[측정 2026-09-06, oracle, adapter 0.75.1, claude-sonnet-5]` one live `/compact` turn emitted
+exactly two notifications (`tool_call` in-progress → `tool_call_update`), and those verbatim
+objects replayed through the production `applyAcpSessionUpdate` produced a
+`[tool:start] Compact conversation` / `[tool:…] Compact conversation` notice pair. No new
+mapper branch is needed — `renderToolUpdate` routes every tool call regardless of `kind` —
+and `_meta.contextCompaction` is dropped by the mapper, so no accounting path sees it.
+
+What changed is therefore what an OPERATOR sees in a compacting turn, not what entwurf
+computes. The post-compaction occupancy refresh is NOT new: `v0.73.0 src/acp-agent.ts:3460`
+already emitted a `usage_update` at `compact_boundary` and 0.75.1 still does
+(`dist/acp-agent.js:2740-2752`, now reading `compact_metadata.post_tokens` instead of a
+`getContextUsage` control request), so the shrinking-`used_end` case that
+`backend.ts:1286-1288` names as #96's weak floor gains no new trigger here.
+
+Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-measure/README.md`.
+
 ## Open work
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;

package/docs/setup-clean-host.md

@@ -12,7 +12,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=0.84.4 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=0.85.1 <0.86` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -110,7 +110,7 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.4
+npm install -g @earendil-works/pi-coding-agent@0.85.1
 pi --version
 
 cd ~/entwurf-smoke
@@ -118,7 +118,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.4 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.85.1 <0.86`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -239,6 +239,38 @@ announces a tool the MCP hand provides. Install it without them and it will log
 `arm-deferred`, give up after ~20s, and `doctor-omp-receive` will name the missing sibling
 as a note rather than a fault.
 
+### The OMP version rule — a weak floor, deliberately (#91)
+
+**entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
+presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=0.85.1 <0.86`) and Claude Code
+(`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
+decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
+earned one because an older binary validates the exec manifest, drops `args` at runtime, and
+reports success. OMP has never been observed to fail that way, it publishes at close to a
+daily cadence, and when its contact surface breaks the two LIVE smokes go loudly red.
+
+What stands instead is a **weak floor: the last version with a LIVE receipt.**
+
+> **OMP minimum: `18.1.10`** — `[측정 2026-09-04, thinkpad, Linux x86-64, omp/18.1.10]`
+> `smoke-omp-receive-live` 11 assertions ok (garden `20260904T224103-d36fed`) and
+> `smoke-omp-fresh-live` 21 assertions ok (garden `20260904T224132-351877`, model
+> `openai-codex/gpt-5.6-sol`), with `doctor-omp-receive` PASS and `doctor-omp-mcp` ok. That
+> update skipped one minor and ten patches from 18.0.0 and broke nothing.
+>
+> **This number moves only when a NEW LIVE receipt exists** — never on a release cadence, a
+> changelog read, or a static gate. Run newer OMP freely; the floor records what was proven,
+> not what is permitted.
+>
+> **The drift sentinels are `smoke-omp-fresh-live` and `smoke-omp-receive-live`**, both
+> release-gate MUST steps. Green after an update means keep going. Red means open a NEW issue
+> carrying the first vendor contact point that broke and its reproduction receipt — do not
+> reopen the closed adoption question. If a SILENT failure is ever observed (green smokes over
+> a dead contact point), that is the evidence a real floor needs, and it earns its own issue
+> for the same reason Claude Code's floor exists.
+
+The evidence and the reasoning are in **#91**; this paragraph is its durable form.
+
 **The receiver arms per session, and only for the visible TUI host.** Opening omp arms it;
 `/new` re-arms it for the replacement citizen and retires the previous one; closing omp
 retires it. A task subagent arms nothing. While nothing is armed, dispatch to that garden

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -123,8 +123,8 @@ export const claudeAdapter = {
     },
     // MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
     // session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-    // and a context-occupancy scalar (`used`; both read at 0.73.0
-    // `dist/acp-agent.js:2918-2924`). Both are measured, so backend.ts seals them.
+    // and a context-occupancy scalar (`used`; both read at 0.75.1
+    // `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
     // The token partition is NOT declared here: ACP's only token carrier is a
     // per-turn round-trip aggregate, which is not what pi's four fields mean.
     sealsTurnAccounting: true,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.18.0",
+	"version": "0.18.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -82,23 +82,23 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.73.0",
+		"@agentclientprotocol/claude-agent-acp": "0.75.1",
 		"@agentclientprotocol/sdk": "1.4.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.84.4 <0.85",
-		"@earendil-works/pi-coding-agent": ">=0.84.4 <0.85",
-		"@earendil-works/pi-tui": ">=0.84.4 <0.85",
+		"@earendil-works/pi-ai": ">=0.85.1 <0.86",
+		"@earendil-works/pi-coding-agent": ">=0.85.1 <0.86",
+		"@earendil-works/pi-tui": ">=0.85.1 <0.86",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.84.4",
-		"@earendil-works/pi-coding-agent": "0.84.4",
-		"@earendil-works/pi-tui": "0.84.4",
+		"@earendil-works/pi-ai": "0.85.1",
+		"@earendil-works/pi-coding-agent": "0.85.1",
+		"@earendil-works/pi-tui": "0.85.1",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
@@ -166,7 +166,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi-extensions/entwurf-control.ts

@@ -79,7 +79,7 @@ import type {
 	MessageRenderer,
 } from "@earendil-works/pi-coding-agent";
 import { getMarkdownTheme, type Theme } from "@earendil-works/pi-coding-agent";
-import { Box, type Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
+import { Box, type Component, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { ENTWURF_SENT_MESSAGE_TYPE } from "../protocol.js";
 import { CONTROL_SOCKET_SUFFIX, controlSocketPathIn, defaultControlSocketDir } from "./lib/control-socket-path.js";
 import {
@@ -548,7 +548,17 @@ interface SentBoxData {
 // `expanded` truncates the body the same way as renderSessionMessage so a
 // large send shows the same preview shape as a large receive. operators
 // reading the transcript should not need different mental models.
-const buildSentMessageBox = (data: SentBoxData, expanded: boolean, theme: Theme): Container => {
+// Return type is `Component`, the interface `MessageRenderer` actually asks for
+// (`Component | undefined`, read at pi-coding-agent
+// `dist/core/extensions/types.d.ts:889`) — NOT the concrete `Container`.
+// `[측정 2026-09-06]` pi 0.85.0's mouse work gave `Container` a `private mouseLayout?`
+// (`pi-tui dist/tui.d.ts:198`; 0.84.4's `Container` had no private member at all), and
+// `Box` declares a SEPARATE private `mouseLayout` of its own. TypeScript only accepts a
+// private member from the same declaration, so the structural assignment `Box -> Container`
+// that held through 0.84.4 became TS2322 at 0.85.x. This was an UNDECLARED break — the
+// upstream Breaking section names only `createGatewayBindingFetch`. Annotating the shared
+// interface is the honest fix: nothing here ever needed Container's own surface.
+const buildSentMessageBox = (data: SentBoxData, expanded: boolean, theme: Theme): Component => {
 	let body = data.body || "(no content)";
 	if (!expanded) {
 		const lines = body.split("\n");

package/pi-extensions/lib/acp/acp-client.ts

@@ -46,8 +46,8 @@ import type { AcpTextBlock } from "./context.js";
  * shape) and never onto those four. A field rename upstream fails the typecheck
  * here rather than silently zeroing the operator's cache-effect badge.
  */
-/** One `_meta.quota.token_count` row (claude-agent-acp 0.73.0
- *  `dist/acp-agent.js:5750-5765`). `cachedInputTokens` is cache READS — the name
+/** One `_meta.quota.token_count` row (claude-agent-acp 0.75.1
+ *  `dist/acp-agent.js:6493-6502`). `cachedInputTokens` is cache READS — the name
  *  differs from `usage.cachedReadTokens` because the shape is shared with
  *  codex-acp; `cachedWriteTokens` is Claude's extra sibling. */
 export type AcpQuotaTokenCount = {
@@ -64,7 +64,7 @@ export type AcpPromptResponse = {
 	/** Vendor-private, version-pinned. `_meta` is a standard ACP extension slot
 	 *  whose values a client may not assume, and `quota` is NOT in
 	 *  claude-agent-acp's exported types — it is produced by the private
-	 *  `turnQuotaMeta()` (read at 0.73.0 `dist/acp-agent.js:5738-5748`). Read
+	 *  `turnQuotaMeta()` (read at 0.75.1 `dist/acp-agent.js:6476-6485`). Read
 	 *  defensively, never structurally required, and re-measure on a pin move. */
 	_meta?: {
 		quota?: {