@junghanacs/entwurf 0.18.0 → 0.18.1

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -150,7 +150,7 @@ export interface AcpAdapterSettingsParams {
  *
  * During stream handling the vendor keeps a per-message snapshot in
  * `lastAssistantUsage`, but its `usage_update` publishes only the scalar `used`
- * value (read at claude-agent-acp 0.73.0 `dist/acp-agent.js:3273-3297`). Until
+ * value (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`). Until
  * that partition is carried on the wire, NOTHING honest can go in pi's four
  * fields, so entwurf writes none of them.
  */
@@ -342,8 +342,8 @@ export const claudeAdapter: AcpBackendAdapter = {
 
 	// MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
 	// session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-	// and a context-occupancy scalar (`used`; both read at 0.73.0
-	// `dist/acp-agent.js:2918-2924`). Both are measured, so backend.ts seals them.
+	// and a context-occupancy scalar (`used`; both read at 0.75.1
+	// `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
 	// The token partition is NOT declared here: ACP's only token carrier is a
 	// per-turn round-trip aggregate, which is not what pi's four fields mean.
 	sealsTurnAccounting: true,

package/pi-extensions/lib/acp/backend.ts

@@ -137,7 +137,7 @@ function finiteOrZero(value: unknown): number {
  * "the accounting-grade figure per the SDK" — it also counts Task subagents,
  * sidechains, and INTERNAL CALLS SUCH AS COMPACTION, so its rows "can total more
  * than `token_count`" and are "the fuller picture, not a decomposition of it"
- * (read at claude-agent-acp 0.73.0 `dist/acp-agent.js:5728-5748`). The narrower
+ * (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6465-6485`). The narrower
  * `PromptResponse.usage` (== `quota.token_count`) is the MAIN AGENT LOOP only.
  *
  * The wider one is the right numerator because the denominator already has that
@@ -1237,7 +1237,7 @@ export function streamAcpTurn(
 		// Writing zeros is not a placeholder for a better number we could compute:
 		// the per-request partition is genuinely absent from the wire. The vendor
 		// builds it in `lastAssistantUsage` and sends only its scalar sum (read at
-		// claude-agent-acp 0.73.0 `dist/acp-agent.js:3273-3297`) — #96.
+		// claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`) — #96.
 		//
 		// But silence is NOT the resting state. A cache miss the operator never sees
 		// is a false reading, not a modest one: a session can run for hours believing
@@ -1356,7 +1356,7 @@ export function streamAcpTurn(
 				// between them is exactly why the notice below names a MECHANISM and
 				// never a cause: claude-agent-acp's `conversation_reset` handler only
 				// switches the SDK to a fresh conversation and touches no cost at all
-				// (read at 0.73.0 `dist/acp-agent.js:3675-3682`), while claude-agent-sdk
+				// (read at 0.75.1 `dist/acp-agent.js:4282-4289`), while claude-agent-sdk
 				// separately documents that "a mid-session /clear resets the running
 				// total" (read at 0.3.257 `sdk.d.ts:4884`). A reset therefore PLAUSIBLY
 				// explains a backwards total, but nothing here has MEASURED that it did,

package/pi-extensions/lib/acp/event-mapper.ts

@@ -60,8 +60,8 @@ export type AcpPiStreamState = {
 	 *
 	 * Last write wins, never a sum: both are latest session-level observations, and
 	 * one turn can legitimately see several (claude emits one per `result` message,
-	 * including a sub-agent's own — read at claude-agent-acp 0.73.0
-	 * `dist/acp-agent.js:2918-2933`), each carrying that result's current values.
+	 * including a sub-agent's own — read at claude-agent-acp 0.75.1
+	 * `dist/acp-agent.js:3467-3482`), each carrying that result's current values.
 	 */
 	observedSessionCostUsd?: number;
 	observedContextOccupancyTokens?: number;
@@ -346,9 +346,9 @@ export function applyAcpSessionUpdate(
 		case "usage_update": {
 			// `used` is OCCUPANCY-shaped — the backend's post-turn context size, not
 			// the prompt response's turn aggregate. Claude sends `lastAssistantTotalUsage`
-			// as `used` (read at claude-agent-acp 0.73.0
-			// `dist/acp-agent.js:3290-3297`), after constructing that scalar from the
-			// latest assistant snapshot (`:3273-3289`). pi reads `usage.totalTokens` as
+			// as `used` (read at claude-agent-acp 0.75.1
+			// `dist/acp-agent.js:3867-3878`), after constructing that scalar from the
+			// latest assistant snapshot (`:3853-3866`). pi reads `usage.totalTokens` as
 			// exactly that occupancy (`calculateContextTokens(usage) = usage.totalTokens
 			// || input + output + cacheRead + cacheWrite`, read at pi-coding-agent
 			// `dist/core/compaction/compaction.js:86-88`). The assignment below is the

package/run.sh

@@ -192,6 +192,7 @@ Usage:
   ./run.sh smoke-omp-receive-live      # #87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
+  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO mutants and never snapshots this repo (~8s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
@@ -253,7 +254,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.40 must leak, @0.84.4 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -1845,13 +1846,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.85+ at the current 0.84.4 pin) whose
+// pi (past the declared ceiling — 0.86+ at the current 0.85.1 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.84.4` an existing 0.84.3 host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.4 <0.85`).
+// install resolves: at `>=0.85.1` an existing 0.85.0 host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.85.1 <0.86`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -1878,7 +1879,11 @@ assert.equal(peerDepTui, expectedPeer,
 // Scope is deliberately narrow: only sentences that DECLARE the pi pin. History
 // (CHANGELOG/NEXT) keeps its old versions, and a pi mention without a version
 // (an uninstall line, a type import) is not a declaration.
-const BASELINE_DOCS = ['AGENTS.md', 'README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md'];
+// VERIFY.md joined on 2026-09-06: it declared the pi range in prose that no gate
+// read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
+// because it was outside this list. Its declaration is a plain range, so the
+// range scan below binds it — no new PROSE_DECL is needed for it.
+const BASELINE_DOCS = ['AGENTS.md', 'README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
   const text = readFileSync(file, 'utf8');
@@ -3114,35 +3119,65 @@ check_pack() {
 }
 
 # The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
-# self-test below. The version BOUNDARY is load-bearing: a pnpm .pnpm entry is
-# `<name>@<version>` followed by either `_<peer-hash>` or end-of-name (measured pnpm 11.20.0
-# on this tree), so an unbounded substring match would bless a lookalike such as `@0.84.40`
-# while announcing the pinned floor — a false-green oracle (found by independent review,
-# 2026-08-25).
+# self-test below. TWO properties are load-bearing and each has its own cell below.
+#
+# (1) The version BOUNDARY. A pnpm .pnpm entry is `<name>@<version>` followed by either
+#     `_<peer-hash>` or end-of-name (measured pnpm 11.20.0 on this tree), so an unbounded
+#     substring match would bless a lookalike such as `@0.85.10` while announcing the pinned
+#     floor — a false-green oracle (found by independent review, 2026-08-25).
+# (2) The name PREFIX covers the whole @earendil-works closure, not the `pi-` families alone.
+#     0.85.0 added `@earendil-works/chord`, declared as a runtime `dependencies` entry by
+#     pi-coding-agent, pi-agent-core, pi-client and pi-protocol — inside the closure, with a
+#     name that carries no `pi-` prefix. `[측정 2026-09-06]` a real 0.85.1 install tree lists
+#     `@earendil-works+chord@0.85.1` next to the seven pi entries, and the old
+#     `^@earendil-works+pi-` filter did not see it: chord would have floated silently while
+#     this gate printed a verified pin. The prefix is the closure's org, not one family in it.
+#     (The measured peer-hash suffix moved too — `_ws@8.21.3` at 0.85.1 where 0.84.4 carried
+#     `_@modelcontextprotocol+sdk@…` — which is exactly what property (1)'s `(_|$)` absorbs;
+#     both shapes are fixtures below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+pi-' | grep -Ev '@0\.84\.4(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@0\.85\.1(_|$)' || true
 }
 
-# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise the
-# false-green shape (it contains no 0.84.40), so the oracle is proven against a fixture
-# listing. Expected: the two lookalikes leak, the pinned version passes bare and with a
-# peer-hash suffix. Exposed as its own snapshot-safe subcommand because the heavy
-# check-pack-install cannot run inside the qualification snapshot (no install environment),
-# and a kill-proof needs a control-green gate there; check-pack-install still runs this
-# first so the heavy gate cannot proceed on a broken oracle.
+# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
+# false-green shape (it contains no 0.85.10 and no off-pin chord), so the oracle is proven
+# against fixture listings. One cell per property of pack_install_leaked_pi, so a regression
+# in either is named by its own signature rather than folded into a single verdict. Exposed
+# as its own snapshot-safe subcommand because the heavy check-pack-install cannot run inside
+# the qualification snapshot (no install environment), and a kill-proof needs a control-green
+# gate there; check-pack-install still runs this first so the heavy gate cannot proceed on a
+# broken oracle.
 check_pack_pin_matcher() {
   local matcher_probe
+
+  # Cell 1 — the version boundary. Both measured peer-hash shapes are fixtures: the
+  # 0.84.4-era `_@modelcontextprotocol+sdk@…` and the `_ws@8.21.3` observed on a real
+  # 0.85.1 tree. Neither may leak; the two lookalikes must.
+  matcher_probe=$(printf '%s\n' \
+    '@earendil-works+pi-ai@0.85.1' \
+    '@earendil-works+pi-ai@0.85.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.85.1_ws@8.21.3' \
+    '@earendil-works+pi-ai@0.85.10' \
+    '@earendil-works+pi-agent-core@0.85.0' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.85.10
+@earendil-works+pi-agent-core@0.85.0' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.85.10/0.85.0 lookalikes and pass 0.85.1 bare or with either measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    return 1
+  fi
+
+  # Cell 2 — the closure prefix. chord is a non-`pi-` member of the same runtime closure
+  # (0.85.0 onward). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
+  # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.84.4' \
-    '@earendil-works+pi-ai@0.84.4_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.84.40' \
-    '@earendil-works+pi-agent-core@0.84.3' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.84.40
-@earendil-works+pi-agent-core@0.84.3' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.84.40/0.84.3 lookalikes and pass 0.84.4 bare or with a peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+chord@0.85.1' \
+    '@earendil-works+chord@0.85.0' \
+    '@earendil-works+pi-ai@0.85.1' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+chord@0.85.0' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol at 0.85.x) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
-  echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with a peer-hash)"
+
+  echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with either measured peer-hash) and covers the whole @earendil-works closure (chord included)"
 }
 
 _check_pack_install_impl() {
@@ -3369,7 +3404,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.84.x`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.85.x`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3387,21 +3422,30 @@ _check_pack_install_impl() {
   # `^0.84.x` carets on it), and upstream's 0.84.4 patch publish (2026-08-28
   # 22:04Z) floated that caret in this lockfile-less temp install, turning CI
   # red through the leak assertion below. That explicit pin is what held the
-  # line until the bump lane ran; the verified floor is 0.84.4 as of
-  # 2026-09-01, and the pin moved WITH it rather than being retired. The leak
-  # assertion below still covers every other pi package, including any package
-  # a future pi bump adds to the closure.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.84.x peers + typebox)"
+  # line until the bump lane ran; the pin moved WITH each verified floor rather
+  # than being retired.
+  #
+  # At 0.85.1 the constellation GREW AGAIN, and this time outside the `pi-`
+  # naming: `@earendil-works/chord` is new in 0.85.0 and is a runtime
+  # `dependencies` entry of pi-coding-agent, pi-agent-core, pi-client and
+  # pi-protocol (`[측정 2026-09-06]` `npm view <pkg>@0.85.1 dependencies`), so an
+  # unpinned `^0.85.x` caret on it floats exactly like pi-agent-core did in 2026-07-21.
+  # It is pinned here for the first time. The leak assertion below covers every
+  # other @earendil-works package too — but only because the matcher's prefix was
+  # widened from `pi-` to the org in the same change; before that it was blind to
+  # precisely this class of new member. The verified floor is 0.85.1 as of 2026-09-06.
+  echo "[check-pack-install] pnpm add into $tmp (with 0.85.x peers + chord + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.84.4" \
-    "@earendil-works/pi-coding-agent@0.84.4" \
-    "@earendil-works/pi-tui@0.84.4" \
-    "@earendil-works/pi-agent-core@0.84.4" \
-    "@earendil-works/pi-client@0.84.4" \
-    "@earendil-works/pi-protocol@0.84.4" \
-    "@earendil-works/pi-telemetry@0.84.4" \
+    "@earendil-works/pi-ai@0.85.1" \
+    "@earendil-works/pi-coding-agent@0.85.1" \
+    "@earendil-works/pi-tui@0.85.1" \
+    "@earendil-works/pi-agent-core@0.85.1" \
+    "@earendil-works/pi-client@0.85.1" \
+    "@earendil-works/pi-protocol@0.85.1" \
+    "@earendil-works/pi-telemetry@0.85.1" \
+    "@earendil-works/chord@0.85.1" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3410,18 +3454,18 @@ _check_pack_install_impl() {
   }
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
-  # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.84.4. Anything else means an unpinned caret floated and the
-  # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.84.4". Fail loud instead of proving the wrong floor.
+  # @earendil-works package present — direct or transitive, top level or nested,
+  # chord included — must be the pinned 0.85.1. Anything else means an unpinned caret
+  # floated and the rest of this gate would be exercising a runtime nobody verified,
+  # while still printing "pinned pi 0.85.1". Fail loud instead of proving the wrong floor.
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.4):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.85.1):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.4"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.85.1 (chord included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -3719,10 +3763,23 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   # SAME installed candidate, on a FRESH sandbox home with every harness absent.
   # This is the first living consumer of package-installed `entwurf setup`:
   # mode=installed decided by name before anything else, NO pnpm bootstrap inside
-  # node_modules, pi/claude/agy explicit zero-state SKIPs, stable bins PASS as
-  # npm-provided, core bridge boundary PASS, computed green, zero harness/auth
-  # writes. Harness probes are pinned absent via the PI_BIN/CLAUDE_BIN/AGY_BIN/
-  # COPILOT_BIN seams so the gate host's real harnesses never leak in.
+  # node_modules, pi/claude/agy/copilot/omp explicit zero-state SKIPs, stable bins
+  # PASS as npm-provided, core bridge boundary PASS, computed green, zero
+  # harness/auth writes. Harness probes are pinned absent via the FIVE
+  # PI_BIN/CLAUDE_BIN/AGY_BIN/COPILOT_BIN/OMP_BIN seams so the gate host's real
+  # harnesses never leak in.
+  #
+  # OMP_BIN was MISSING here from the 0.16.0 OMP admission until 2026-09-06, while
+  # the two sibling fixtures (`smoke-setup-verdict.sh:70`,
+  # `check-setup-qualification.sh:76`) both carried it. On a host that HAS omp on
+  # PATH the row's own premise was false: setup detected omp, and the omp config /
+  # receiver installers then refused — correctly — because this row also exports
+  # `PI_CODING_AGENT_DIR`, which omp reads too, so the target directory is
+  # ambiguous. Nothing was wrong with the product; the fixture was. It stayed
+  # invisible because CI runners carry no omp AND `release_gate()` does not run
+  # this gate (it is prepublishOnly + the CI install-surface job). The skip probe
+  # below now requires FIVE zero-states, so a sixth harness cannot be admitted
+  # while this seam is quietly left behind again.
   local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
   mkdir -p "$setup_home/.pi/agent" "$setup_proj"
   setup_auth="$setup_home/.pi/agent/auth.json"
@@ -3733,7 +3790,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
     XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
-    COPILOT_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" OMP_BIN="$npm_tmp/definitely-absent" \
     "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
   setup_rc=$?
   set -e
@@ -3753,7 +3810,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     return 1
   fi
   local skip_probe
-  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP"; do
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP" "omp: SKIP"; do
     if ! grep -q "$skip_probe" <<<"$setup_out"; then
       fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
       echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
@@ -3778,7 +3835,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
     return 1
   fi
-  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 4x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 5x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
 
   # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
   # bin on a fresh sandbox home, with the shared fake vendor
@@ -3804,6 +3861,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
     XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    OMP_BIN="$npm_tmp/definitely-absent" \
     COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
     "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
   setup_rc=$?
@@ -5458,10 +5516,11 @@ release_gate() {
     results+=("FAIL  static (pnpm run check:full)"); failc=$((failc + 1))
   fi
 
-  # 1b. Discriminating power of that floor. check-gate-qualification left the
-  # default check chains (operator inner-loop cost), so release acceptance
-  # carries it explicitly as its own MUST step: a cut must re-prove the gates
-  # still kill what they claim to kill.
+  # 1b. Discriminating power of that floor. The mutant-EXECUTING body left the
+  # default check chains (operator inner-loop cost) — only its head rides along,
+  # as check-gate-manifests inside check:hermetic — so release acceptance carries
+  # the body explicitly as its own MUST step: a cut must re-prove the gates still
+  # kill what they claim to kill.
   section "release-gate step: check-gate-qualification"
   if (cd "$REPO_DIR" && bash "$self" check-gate-qualification); then
     ok "check-gate-qualification: PASS"
@@ -6036,6 +6095,16 @@ case "$cmd" in
     # per cell; offline + deterministic (deps: python3).
     (cd "$REPO_DIR" && python3 scripts/check-agy-permission-matrix.py)
     ;;
+  check-gate-manifests)
+    # The HEAD of check-gate-qualification, exposed on its own so the deterministic
+    # floor can pay for it: the runner self-test (classifier truth table + synthetic
+    # negatives) plus the REAL manifests — schema, global claim uniqueness, subjects
+    # tracked and lstat-regular in the origin index, claim tokens exactly once in their
+    # gate sources — plus the declared lane inventory. It executes ZERO mutants and
+    # makes NO snapshot of this repo; the body (check-gate-qualification) owns that and
+    # is unchanged. Cheap enough for check:hermetic (~8s).
+    run_ts scripts/check-gate-qualification.ts --manifests-only
+    ;;
   check-gate-qualification)
     # Kill-proof qualification — the gate-of-gates. Proves the committed defect mutants
     # (scripts/mutants/*.json) make their gates fail BOUNDED and FOR THE CLAIMED REASON

package/scripts/check-acp-usage-accounting.ts

@@ -72,7 +72,7 @@ interface WireUsage {
  * One `_meta.quota.token_count` row. The field NAMES deliberately differ from
  * `PromptResponse.usage`: cache reads are `cachedInputTokens` here because the
  * shape is shared with codex-acp, and `cachedWriteTokens` is Claude's extra
- * sibling (read at claude-agent-acp 0.73.0 `dist/acp-agent.js:5750-5765`).
+ * sibling (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6493-6502`).
  * Reading a quota row with the `usage` field names silently yields zeros, so the
  * fixture below spells the vendor's names out rather than reusing `WireUsage`.
  */
@@ -137,7 +137,7 @@ function makeFakeChild() {
  *
  * Each `prompt` call consumes the next TurnScript: it first pushes that turn's
  * `usage_update` notification (the wire the running cost total actually arrives
- * on — read at claude-agent-acp 0.73.0 `dist/acp-agent.js:2918-2933`), then answers the
+ * on — read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), then answers the
  * prompt with that turn's `PromptResponse.usage` (the wire the turn aggregate
  * arrives on). Both orderings are the real one: the notification precedes the
  * response, because the SDK emits it from the `result` message that ENDS the turn.
@@ -393,8 +393,8 @@ try {
 	// AGENT LOOP only. `_meta.quota.model_usage` comes from `result.modelUsage` and
 	// also counts Task subagents, sidechains and INTERNAL CALLS SUCH AS COMPACTION;
 	// the vendor states its rows "can total more than `token_count`" and are "the
-	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.73.0
-	// `dist/acp-agent.js:5732-5738`).
+	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.75.1
+	// `dist/acp-agent.js:6468-6474`).
 	//
 	// The wide one is required, not merely nicer, because the DENOMINATOR already
 	// has that scope: turn cost is the adjacent diff of the backend's running total,
@@ -608,8 +608,8 @@ try {
 	// identity that produces the bound is a property of the MAIN AGENT LOOP's
 	// cache breakpoints. `_meta.quota.model_usage` is a WIDER scope: the vendor
 	// states those rows also count Task subagents, sidechains, and INTERNAL
-	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.73.0
-	// `dist/acp-agent.js:5728-5748`). Mixing the two scopes inflates the bound
+	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.75.1
+	// `dist/acp-agent.js:6465-6485`). Mixing the two scopes inflates the bound
 	// through both remaining terms that mention cacheWrite:
 	//   max(0, occupancy − cacheWrite) shrinks as wide cacheWrite grows, so
 	//   less is subtracted; min(rawBound, cacheWrite) rises with it.
@@ -749,9 +749,9 @@ try {
 	// CELL 3 — a turn with NO cost notification holds the baseline.
 	//
 	// Measured upstream: the result-path `usage_update` carries cost (read at
-	// claude-agent-acp 0.73.0 `dist/acp-agent.js:2913-2924`), while other
+	// claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), while other
 	// `usage_update` paths can carry `used` without cost (for example the
-	// rate-limit path at `:3661-3671`). A live thinkpad ledger shows such turns
+	// rate-limit path at `:4269-4277`). A live thinkpad ledger shows such turns
 	// really occur. The honest handling is to HOLD the baseline so the amount lands
 	// in the NEXT diff: misattributed by turn, exact by session. Rebaselining to 0
 	// there would double-count the whole prefix.
@@ -831,7 +831,7 @@ try {
 	// CELL 4 — a DECREASING session total is never silently absorbed.
 	//
 	// `conversation_reset` switches the session to a fresh transcript (read at
-	// claude-agent-acp 0.73.0 `dist/acp-agent.js:3675-3682`), but whether that
+	// claude-agent-acp 0.75.1 `dist/acp-agent.js:4282-4289`), but whether that
 	// changes `total_cost_usd` is an SDK-internal value we cannot observe here.
 	// A diff can therefore go negative in a session we are still holding.
 	// Absorbing it quietly would both misreport the turn and destroy the only

package/scripts/check-gate-qualification.ts

@@ -1,6 +1,18 @@
 /**
  * check-gate-qualification — kill-proof qualification of the shipped gates.
  *
+ * TWO ENTRYPOINTS, ONE FILE. `--manifests-only` (shipped as `run.sh
+ * check-gate-manifests`) stops after the HEAD — the runner self-test plus the real
+ * manifests' validation and lane inventory — having executed ZERO mutants from
+ * `scripts/mutants/` and having made NO snapshot of this repo. The default
+ * entrypoint is unchanged: it runs the same head first and then the body. The head
+ * is separable because of what it has actually caught: across 549 CI runs the
+ * qualification step went red five times, and three of those died in the head in
+ * 4-5 seconds, before a single mutant gate was invoked (#99 B-3). The head costs
+ * ~8s, so it belongs in the deterministic floor every push already pays for; the
+ * body's contract — which mutants run, how they are classified, what it prints —
+ * is untouched by the split.
+ *
  * Two phases, in a fixed order:
  *
  *   1. RUNNER SELF-TEST. The runner is itself a SUT: a qualification harness that
@@ -58,6 +70,10 @@ import {
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const MUTANTS_DIR = path.join(REPO_DIR, "scripts", "mutants");
 
+/** Head-only mode: validate, count, and stop — no mutant is executed, no repo snapshot is made. */
+const MANIFESTS_ONLY = process.argv.includes("--manifests-only");
+const SURFACE = MANIFESTS_ONLY ? "check-gate-manifests" : "gate-qualification";
+
 let passed = 0;
 function ok(label: string, cond: boolean): void {
 	assert.ok(cond, label);
@@ -775,10 +791,16 @@ const quiet = (): void => {};
 	}
 }
 
-console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
+console.log(`\n[${SURFACE}] self-test: ${passed} checks passed`);
 
-// ═══ Phase 2 — the real manifests against a snapshot of THIS repo ═══════════
+// ═══ Phase 1d — the real manifests, VALIDATED but not yet run ═══════════════
+//
+// The HEAD ends here. Everything above and in this block is pure reading and
+// checking: no mutant from `scripts/mutants/` is executed and no snapshot of THIS
+// repo exists yet. `--manifests-only` returns from exactly this point.
 
+let selected: MutantSpec[];
+let manifestCount: number;
 {
 	const manifests: MutantManifest[] = fs
 		.readdirSync(MUTANTS_DIR)
@@ -813,6 +835,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"copilot-launch": 14,
 		"copilot-receive": 18,
 		"fresh-cut": 1,
+		"gate-qualification": 2,
 		"meta-facts": 4,
 		"meta-hook-session-switch": 17,
 		"meta-identity": 4,
@@ -821,14 +844,14 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"mux-fresh-call": 37,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
-		"pack-install": 1,
+		"pack-install": 2,
 		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
 		"omp-birth": 11,
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 12,
+		"release-gate": 14,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
@@ -839,17 +862,44 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 	};
 	const laneTally: Record<string, number> = {};
 	for (const man of manifests) laneTally[man.lane] = (laneTally[man.lane] ?? 0) + man.mutants.length;
-	assert.deepEqual(
-		laneTally,
-		EXPECTED_LANE_MUTANTS,
-		"mutant lane inventory drifted from the declared contract — extend EXPECTED_LANE_MUTANTS and the manifests together, never silently",
-	);
-	const allMutants = validateManifestSet(manifests, makeOriginChecks(REPO_DIR));
-	const selected = allMutants;
+	try {
+		assert.deepEqual(laneTally, EXPECTED_LANE_MUTANTS);
+	} catch {
+		assert.fail(
+			"[QK:LANE-INVENTORY-DECLARED] the mutant lane inventory drifted from the declared contract — extend " +
+				"EXPECTED_LANE_MUTANTS and the manifests together, never silently. A lane that lost its manifest in a " +
+				"merge, or gained mutants nobody declared, would otherwise pass as `n/n killed` over whatever set " +
+				`happened to be on disk. declared=${JSON.stringify(EXPECTED_LANE_MUTANTS)} onDisk=${JSON.stringify(laneTally)}`,
+		);
+	}
+	try {
+		selected = validateManifestSet(manifests, makeOriginChecks(REPO_DIR));
+	} catch (err) {
+		assert.fail(
+			"[QK:MANIFEST-SET-INTEGRITY-REFUSED] the committed manifest set broke its cross-manifest contract (global " +
+				"claim uniqueness, subject tracked + lstat-regular in the ORIGIN index, signatureSource on the origin work " +
+				"surface, claim token present exactly once in its gate source). Every one of those is what makes a KILLED " +
+				"verdict mean something, so the set is refused rather than run. Refusal: " +
+				(err instanceof Error ? err.message : String(err)),
+		);
+	}
+	manifestCount = manifests.length;
+	console.log(`[${SURFACE}] ${selected.length} mutants across ${manifestCount} lanes (no tiers — full set every run)`);
+}
+
+if (MANIFESTS_ONLY) {
 	console.log(
-		`[gate-qualification] ${selected.length} mutants across ${manifests.length} lanes (no tiers — full set every run)`,
+		`[check-gate-manifests] ok — runner self-test green, ${selected.length} committed mutants across ` +
+			`${manifestCount} lanes validated against the origin index, and the lane inventory matches its declared ` +
+			"contract. ZERO mutants were executed and this repo was never snapshotted: the body " +
+			"(check-gate-qualification) owns that, unchanged.",
 	);
+	process.exit(0);
+}
+
+// ═══ Phase 2 — the real manifests against a snapshot of THIS repo ═══════════
 
+{
 	const headBefore = originHead(REPO_DIR);
 	const workSurfaceBefore = originWorkSurfaceSha(REPO_DIR);