@junghanacs/entwurf 0.18.0 → 0.18.2

package/AGENTS.md

@@ -139,7 +139,7 @@ LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live   # o
 LIVE=1 AGY_CONVERSATION_ID=<id> ./run.sh smoke-agy-native-push-live
 ```
 
-- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. Neither tier includes `check-gate-qualification`, which is scheduled separately (below).
+- The deterministic floor is tiered (#70). `pnpm check` is the everyday core — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the full deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT); a gate changes tier by semantic-class decision, never because it happened to get faster or slower. The full tier carries `check-gate-manifests` (the qualification HEAD, through `check:hermetic`); the everyday core does not, and neither tier carries the mutant-executing `check-gate-qualification`, which is scheduled separately (below).
 - **Kill-proof discipline (gate qualification).** A gate is a test only if re-planting a closed defect turns it red for the claimed reason. `check-gate-qualification` proves that automatically: committed mutants in `scripts/mutants/` must be KILLED at their `[QK:<claim>]` signature inside an isolated snapshot repo (control→mutant→restore→control; the real checkout is never written). Gates a release touches carry such manifests; assertion counts are never evidence — claim IDs + killed mutant IDs are. `check-agy-permission-matrix` holds the enumerated permission contract space; matrix cells change by axis/rule edits, never by appending cases.
 - **When changing a contract/gate:** name the production subject and an oracle independent of it; give the failing assertion a stable `[QK:<claim>]` label and add/update the exact-once mutant in `scripts/mutants/*.json`; if the contract is combinatorial, update the literal matrix axes/cells/exclusions together with their declared counts; then verify the focused gate, and let qualification and the full floor follow the scheduling contract below — once on the frozen candidate, not once per amendment. `MUTANT-STALE`/`SURVIVED`/`WRONG-REASON`/`CONTROL-RED`/`HANG`/`IMPURE` are red — never substitute an assertion count for a kill.
 - Run LIVE gates with `PWD` in scratch so session artifacts do not land in the repo. Strip `CLAUDE_CONFIG_DIR`, `PI_SESSION_ID`, and `PI_AGENT_ID` from the gate process — a live pi/ACP session exports them into children, where they strip Claude hooks or capture a fresh-call callback.
@@ -157,7 +157,7 @@ implement → affected focused gates → independent review → one amendment bu
 
 - **Inner loop:** run only the gates whose subject changed. Do not open the full floor to learn what a focused gate already answers.
 - **Review before floor:** independent review and its corrections close as one bundle before the full floor runs.
-- **Qualification is scheduled, not ambient.** `check-gate-qualification` is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every push, and release-gate carries it as a MUST step.
+- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on a branch push whose two-dot range touched the qualification surface (`scripts/ci-qualify-decide.sh` derives that path set from the manifests themselves), unconditionally on `workflow_dispatch -f qualify=true` and a weekly schedule, and release-gate carries it as a MUST step. The exact-SHA release oracle refuses a SHA whose body step did not conclude success, so a filtered-out release commit is a named failure with a documented dispatch recovery, never a quiet pass. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit carries the body concluding success — the branch run when the push moved the qualification surface, else the dispatch run the release skill's recovery creates.
 - **Full floor once** (`pnpm run check:full`), on the frozen commit candidate. While it runs, nothing edits the worktree or index — including the NEXT boot sectors; a moved candidate voids the run's evidence.
 - **pre-commit is not the floor.** `.husky/pre-commit` carries only fast static checks (whitespace, lint, typecheck); the full floor is owned by this protocol, not by the hook. Do not grow the hook back, and do not build receipt/cache machinery to prove the protocol was followed.
 - **Release/LIVE acceptance is untouched.** VERIFY.md floors keep full strength; a shorter inner loop never lowers release evidence.
@@ -185,8 +185,8 @@ implement → affected focused gates → independent review → one amendment bu
 - Every `.ts` file belongs to one typecheck fence: root emit-capable config, MCP strip-types config, or scripts strip-types config. Do not hide files with `exclude`.
 - Root pi extensions import TypeBox through `@earendil-works/pi-ai`; do not mix direct `@sinclair/typebox` types.
 - MCP/scripts use explicit `.ts` imports where Node strip-types requires them. Installed operator surfaces route to compiled JS.
-- pi runtime range is `>=0.84.4 <0.85` with devDep exact `0.84.4`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
-- ACP pins are recorded in `package.json` and checked by `check-dep-versions`/`check-acp-sdk-surface`; do not describe a dependency bump as a behavioral fix without evidence.
+- pi runtime range is `>=0.85.1 <0.86` with devDep exact `0.85.1`; re-evaluate loader aliases and `/compat` at every minor ceiling. The ceiling moves on measurement, never on assumption, and a previous bump's argument is never reused: at 0.83.0→0.84.0 `compat.ts` was still byte-identical but `loader.ts` was NOT, so the diff itself had to be read and judged reachable-or-not. Per-bump hashes, diff judgments, and reachability findings live in the ROADMAP **Dep bump(별도 트랙)** ledger — keep them there, not here.
+- ACP pins are recorded in `package.json` and owned by `check-acp-sdk-surface`, which is the vitest contract `test/acp-sdk-surface.contract.test.ts` (`./run.sh check-acp-sdk-surface` is a transition shim into it, not a `scripts/` gate). `check-dep-versions` is the **pi** pin's oracle and reads no ACP pin — do not cite it for one. Do not describe a dependency bump as a behavioral fix without evidence.
 
 ## Working Style
 

package/CHANGELOG.md

@@ -4,6 +4,247 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.18.2 - 2026-09-07
+
+One lane: #103, the second stage of the CI evidence budget (#99). The mutant body — 373 replants,
+~30 minutes — stops running on every branch push, and the release oracle stops accepting a run that
+did not carry it. Nothing in the runtime surface moves.
+
+### Changed
+
+- **The exact-SHA release oracle requires the qualification BODY, not three green job names (#103
+  piece 1).** `verify-exact-ci.sh` reads a fourth axis over one guard: the `check` job's
+  `Run ./run.sh check-gate-qualification` step must conclude `success`, with absent, skipped and
+  failed each named separately in the refusal. It also stops filtering to `--event push`, so a
+  `workflow_dispatch` run at the same SHA is admissible evidence — which is exactly when the
+  always-present `headSha` check starts carrying load, because `gh workflow run --ref` takes a
+  branch and never a SHA. A skipped body is not evidence: the oracle refuses that SHA and prints the
+  dispatch command that fixes it. This landed BEFORE the skip could exist.
+- **The body runs only on a branch push that moved the qualification surface (#103 piece 2).**
+  `scripts/ci-qualify-decide.sh` diffs the two-dot push range GitHub itself compares and intersects
+  it with a path set **derived from `scripts/mutants/*.json` at runtime** — no copy in YAML, so a new
+  mutant subject cannot land outside the filter. Five numbered fail-opens, each naming itself in the
+  log: an all-zero base, a forced push (whose base GitHub does not document), a dispatch without
+  `qualify=true` or a schedule, an unreadable range, and `pull_request`. `workflow_dispatch -f
+  qualify=true` and a weekly schedule run the body unconditionally; `fetch-depth: 0` on the check job
+  is what keeps the base readable, and it measured free (2s checkout, the same as depth 1).
+- **Measured on real runs, not argued.** A code push ran the body and took 36m24s
+  ([34047559085](https://github.com/junghan0611/entwurf/actions/runs/34047559085)); a docs-only push
+  skipped it and took 6m13s
+  ([34065841309](https://github.com/junghan0611/entwurf/actions/runs/34065841309)); the four-axis
+  oracle **refused** that second SHA while all three of its jobs were green, and the documented
+  dispatch recovery turned the refusal back into a pass
+  ([34066181211](https://github.com/junghan0611/entwurf/actions/runs/34066181211)). The historical
+  justification is replayed rather than remembered: all five qualification reds this repo's CI has
+  ever produced still run the body under the filter.
+
+### Added
+
+- Three kill-qualified claims and their exact-once replants, inventory 370 → 373:
+  `RELEASE-SHA-QUALIFIED-IN-CI` (the fourth axis), `QUALIFY-FILTER-COVERS-SUBJECTS` (every manifest
+  subject and signatureSource decides `run_body=true`, asserted behaviourally against the shipped
+  script), and `QUALIFY-FILTER-READS-PUSH-RANGE` (a hermetic throwaway repo with a docs-only tip over
+  a commit that touched a subject — the two-dot reading, proven without repo history).
+  `QUALIFY-FILTER-REPLAYS-PAST-CATCHES` replays the five reds from recorded file lists.
+- `scripts/fixtures/qualify-replay.json` — the five historical reds as the push ranges GitHub
+  compared, measured once here because history is not readable everywhere the gate runs.
+
+### Verification
+
+All on oracle (Linux, node 24.18.1, pi 0.85.1, omp 18.1.12 — updated from 18.0.0 during this lane).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.2.JlEU88 --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0, 3305s (55m05s).
+  `check-gate-qualification` as its MUST step: **373/373 KILLED**.
+- `pnpm run check:full` on the prepared tree: exit 0, 504s.
+- Pre-version landing run for `0f6667d`: CI run
+  [34070192960](https://github.com/junghan0611/entwurf/actions/runs/34070192960), all three jobs
+  success — and this is the first release landing judged by the fourth axis the same release adds:
+  the oracle read that run's qualification step, not just its job names.
+
+### Notes
+
+- **A gate that reads repo history cannot live in the qualification snapshot.** The replay cell first
+  read live git objects and went CONTROL-RED inside the snapshot's fresh baseline, costing the whole
+  release-gate lane its 17 kills. That is why the fixture carries file lists and the range semantics
+  are proven hermetically instead.
+- **Key order in `ci.yml` is a contract.** The body step keeps `run:` as its leading key: cell 8a
+  counts that sequence-item form exactly once, and the oracle matches GitHub's rendered
+  `Run <command>` step name, so an `if:` placed first — or any `name:` — would break both. Confirmed
+  on a real run after the filter landed.
+
+## 0.18.1 - 2026-09-06
+
+Two lanes, both landing on `main` after `v0.18.0`: the CI evidence-budget stage 1 (#102, from
+research #99) and the dependency bump (#104 — pi, claude-agent-acp, and the OMP adoption rule
+GLG decided to carry with them). They are not one cause; they are one release.
+
+### Upgrade note — this one asks something of the operator
+
+**The pi floor moved, and entwurf does not install harnesses.** The supported range is now
+`>=0.85.1 <0.86`, so a host still carrying pi 0.84.x is BELOW it. `entwurf setup` says so by
+name — `pi FAIL — detected pi <version> is outside the supported range >=0.85.1 <0.86 — Pi
+wiring not written` — and writes no pi wiring rather than wiring a runtime it cannot vouch
+for. That refusal is the design (Hard Rule 17), not a bug to work around.
+
+The order matters:
+
+1. **Upgrade pi yourself first.** `pi update`, or `pnpm add -g @earendil-works/pi-coding-agent@0.85.1`
+   for a pnpm-global install. entwurf never does this for you.
+2. **Then `entwurf setup`** — one command, as always. This release changes no deployment
+   writer (`pi-extensions/lib/meta-session.ts`, the four `install-*` paths and the packaged
+   plugins are byte-identical to 0.18.0), so unlike the 0.17.2 and 0.18.0 upgrades there is no
+   stale-writer trap here. What setup does need to redo is the pi wiring it refused to write
+   while the runtime was below floor.
+3. **Restart any pi session you had open.** A running pi process keeps the binary it started
+   with, and this release's changed extension surfaces (`entwurf-control.ts` and four ACP
+   modules) are loaded at session start. A live 0.84.4 session stays a 0.84.4 session.
+
+Hosts without pi are unaffected: absence is still an explicit setup SKIP, not a failure.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.263, node 24.18.1, pi 0.85.1,
+omp 18.0.0).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.1.PtUm0r --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0.
+  2026-09-06 18:30:51 → 19:23:40 KST (52m49s). Log preserved at
+  `<scratch>/release-gate.log`.
+  - `check-gate-qualification` as its MUST step: **369/369 KILLED**.
+  - `smoke-acp-raw-turn-live` — the Dep-bump track's designated lock for an ACP adapter
+    move — PASS on 0.75.1: launch source `package:@agentclientprotocol/claude-agent-acp`
+    (not a PATH fallback), model `claude-sonnet-5`, `protocolVersion=1`,
+    `stopReason=end_turn`, 65,780 bytes of NDJSON captured.
+  - Both #91 drift sentinels green: `smoke-omp-receive-live`, and `smoke-omp-fresh-live`
+    with 21 assertions (step 9 clause 7) — on omp **18.0.0**, below the documented weak
+    floor of 18.1.10, which is exactly what "the floor records what was proven, not what is
+    permitted" means.
+- `pnpm run check:full` on the prepared tree: exit 0, 480s.
+- Pre-push landing run for the implementation HEAD `c247594`: CI run `34018205091`,
+  `check` + `install-surface` + `artifact-consumer` all `success` (`check` 34m14s,
+  `check:full` 328s, qualification 369/369).
+
+**The first `--cut` was BLOCKED, and the reason was not this release.** MUST PASS=20 FAIL=3
+SKIP=0: `smoke-entwurf-chain-live`, `smoke-mux-lifecycle-live` and `smoke-omp-fresh-live`
+each failed waiting on a sibling that never took its turn, and all three drive their sibling
+on `openai-codex/*` while every Claude-rail step passed. Measured at the time: the codex
+weekly window was at **100%**. The chain's own timeout instrumentation is what made this
+readable rather than mysterious — it printed `terminus fixture at timeout: ownerPid=… alive=true
+ownerAlive=true watchArmed=true`, so the mailbox was provably healthy and the chain had simply
+stalled upstream. After the quota reset the same gate went green with no code change. Recorded
+because an exhausted subscription rail looks exactly like a broken product until someone
+measures it.
+
+### Changed
+
+- **The qualification HEAD runs in the everyday floor; the mutant BODY stays scheduled (#102).**
+  Across 549 CI runs the qualification step went red five times and **none of the five came from
+  mutant execution** — three died in the head in four or five seconds, two were a gate already red
+  on a clean tree (#99 B-3). So the head stops waiting behind the ~28-minute body.
+  `check-gate-qualification` gains a `--manifests-only` entrypoint, shipped as
+  `run.sh check-gate-manifests` and placed in `check:hermetic` (~8s): runner self-test, manifest-set
+  validation against the origin index, and the declared lane inventory — **zero mutants executed and
+  no snapshot of this repo**. The body runs the same head first; its contract, output and
+  mutant-execution semantics are unchanged.
+- **CI push is filtered to branch refs (#102).** All 66 semver-tag runs in this repo's history
+  rebuilt a SHA a branch push had already built, and not one reported a fact its branch run had not
+  (the single non-green tag run failed at the same step as its main run, two seconds later). The
+  exact-SHA evidence a release quotes is the branch run, which is what the release skill's oracle
+  already selects.
+- **`check-omp-birth-hook` joins `check:hermetic` (#102).** It was the one gate a committed mutant
+  named that ran nowhere else, so the control-pre of a 28-minute run was the only thing in the repo
+  that could notice it going red. `check-release-gate-outcomes` cell 9 now owns that as a contract:
+  every mutant-named gate is inside `check:full` **or** states its exclusion in prose an operator
+  reads (`scripts/check-setup-qualification.sh` takes the second arm, as its own header declared).
+- **pi runtime 0.84.4 → 0.85.1** (#104): devDep exact ×3, peer range `>=0.85.1 <0.86` ×3, the
+  `run.sh` pack-install pins, `pnpm-workspace.yaml`, the lockfile, and the five baseline docs
+  `check-dep-versions` binds. **0.85.0 is deliberately skipped**: its published `exports` advertised
+  `./client` and `./experimental/plugin` at `dist/*` paths the tarball does not contain, which
+  upstream named and fixed in 0.85.1 ("SDK import failures caused by unintentionally publishing
+  internal experimental code and dependencies in 0.85.0") by making both subpaths source-only.
+  entwurf imports neither, so it never reached us — but the landing coordinate is 0.85.1.
+- **`@agentclientprotocol/claude-agent-acp` 0.73.0 → 0.75.1** (#104). The other two ACP pins do
+  **not** move: all four tags v0.73.0–v0.75.1 declare the same `@agentclientprotocol/sdk 1.4.0`,
+  `@anthropic-ai/claude-agent-sdk 0.3.257`, `zod ^4.0.0` and `engines.node >=22`, so
+  `@anthropic-ai/sdk` stays pinned at `0.100.1` against an unchanged `>=0.93.0` peer floor.
+- **Compaction now reaches operators as a tool lifecycle, not assistant text** (upstream #991, in
+  0.75.0). A compacting turn shows a `[tool:start] Compact conversation` / `[tool:…]` notice pair
+  where 0.73.0 wrote `Compacting completed.` into the assistant's own text. No mapper change was
+  needed and no accounting path is touched; the measurement, the join through the production event
+  mapper, and the limits are in `scripts/raw-acp-compaction-measure/README.md` and
+  `docs/acp-backend-rail.md` §11-8.
+- **OMP gets a documented *weak* floor instead of a version gate (#91).** entwurf still detects omp
+  by presence alone — no `entwurf.ompFloor`, no coherence gate, no exact pin — because a floor is
+  the answer to a vendor that fails SILENTLY, which OMP has never been observed to do, and its
+  contact surface is guarded by two release-gate MUST smokes that go loudly red. What is recorded
+  instead is the last version with a LIVE receipt (**18.1.10**, 2026-09-04 thinkpad), the rule that
+  the number moves only when a new receipt exists, and the two sentinels
+  (`smoke-omp-fresh-live`, `smoke-omp-receive-live`). Code change: none.
+  `docs/setup-clean-host.md` §4b.
+
+### Fixed
+
+- **An undeclared pi 0.85.x break, caught by our own typecheck (#104).** `pi-tui`'s `Container`
+  gained a `private mouseLayout?` in the 0.85.0 mouse work (0.84.4's `Container` had no private
+  member at all) while `Box` declares a separate private field of the same name, so TypeScript's
+  private-member identity rule broke the `Box → Container` structural assignment that had held
+  through 0.84.4 (`TS2322` at `entwurf-control.ts`). Upstream's Breaking section names only
+  `createGatewayBindingFetch`. The repair narrows the annotation to what the vendor contract
+  actually asks for — `MessageRenderer` returns `Component | undefined` — which is what the helper
+  always needed.
+- **The pack-install pin-leak matcher was blind to a new closure member (#104).** pi 0.85.0 added
+  `@earendil-works/chord` as a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and
+  pi-protocol — inside the runtime closure, with a name carrying no `pi-` prefix. Measured on a real
+  0.85.1 install tree, `@earendil-works+chord@0.85.1` sits beside the seven pi entries and the
+  `^@earendil-works+pi-` filter did not see it, so an unpinned caret would have floated while
+  `check-pack-install` printed a verified pin — the same class as the 2026-07-21 `pi-agent-core`
+  incident, and it made the "covers every other pi package" comment false. The matcher now filters on
+  the org prefix, chord is pinned explicitly, and the self-test splits into two cells so each
+  property fails under its own name. New claim `[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]` with
+  its exact-once replant; inventory **368 → 369 mutants across 40 lanes**.
+- **`check-pack-install`'s "every harness absent" row was not actually absent of OMP.** The row
+  pins harness probes away with explicit `*_BIN` seams, and `OMP_BIN` was never added when 0.16.0
+  admitted OMP — the two sibling fixtures (`smoke-setup-verdict.sh`,
+  `check-setup-qualification.sh`) both got it. On a host that HAS `omp` on PATH the row's premise
+  was therefore false: setup detected omp, and the omp config/receiver installers refused —
+  correctly — because the row also exports `PI_CODING_AGENT_DIR`, which omp reads too, leaving the
+  target directory ambiguous. The product was right and the fixture was wrong. It stayed invisible
+  because CI runners carry no omp **and** `release_gate()` does not run this gate (it is
+  `prepublishOnly` plus the CI install-surface job), so no green floor ever covered it. Measured
+  here with a control: a clean clone of the pre-bump HEAD fails at the same row for the same
+  reason. The seam is added to both setup rows, and the zero-state probe now requires **five**
+  SKIPs so a sixth harness cannot be admitted while this seam is left behind again.
+- **`VERIFY.md` still advertised a pi range two bumps stale, and now nothing can leave it there.**
+  It sat outside `check-dep-versions`' `BASELINE_DOCS`, so nothing read it; it has joined that
+  list (six docs). Its declaration is a plain range, so the existing range scan binds it — no new
+  prose pattern was added for it.
+- **`AGENTS.md` claimed `check-dep-versions` checks the ACP pins.** It does not — it is the **pi**
+  pin's oracle and reads no ACP pin (`run.sh:1820-1919`). The ACP pins are owned by
+  `check-acp-sdk-surface`, which is the vitest contract `test/acp-sdk-surface.contract.test.ts`;
+  the `run.sh` name is a transition shim into it.
+
+### Added
+
+- **`scripts/raw-acp-compaction-measure/`** — a raw measurement probe (not a gate, in no check
+  tier) that drives one live `/compact` turn on the pinned adapter and replays the captured
+  notifications through the production event mapper, so the vendor wire and our rendered notice sit
+  in one receipt.
+- Four new qualification claims from #102, each with its exact-once replant:
+  `MANIFEST-SET-INTEGRITY-REFUSED` and `LANE-INVENTORY-DECLARED` (new `gate-qualification` lane,
+  replanting the 08-20 / 08-21 / 08-28 catches), `MUTANT-GATES-INSIDE-FULL-FLOOR` and
+  `CI-TAG-PUSH-NOT-REBUILT` (`release-gate` lane).
+
+### Notes
+
+- **`allowBuilds: esbuild: false`.** chord's only dependency is esbuild, and its arrival made
+  `pnpm install` stop on `ERR_PNPM_IGNORED_BUILDS` until the key carried a decision. Denied like the
+  other two entries: nothing here executes esbuild.
+- **`bridge-command-boot`'s three agy gates moved to the `run.sh` argv the other manifests use**,
+  merging a duplicate group (#102). Group count is unchanged at 52 — the merge removes one and the
+  new head gate adds one — so the saving is a 66s control pair traded for a 16s one, not fewer
+  groups.
+
 ## 0.18.0 - 2026-09-04
 
 ### Fixed

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — all but the separately scheduled `check-gate-qualification`, which CI runs on every push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -157,7 +157,7 @@ cd ~/repos/gh/entwurf
 
 The full source setup requires Node 24, pnpm, and Python 3 on PATH. Harnesses are
 optional-by-presence: `setup` runs the frozen dependency install, then composes what the operator
-already installed — a compatible `pi` (`>=0.84.4 <0.85`), Claude Code, agy, and the Copilot CLI
+already installed — a compatible `pi` (`>=0.85.1 <0.86`), Claude Code, agy, and the Copilot CLI
 each get their wiring completed when detected, an absent harness is an explicit zero-state SKIP,
 and a detected harness that cannot be completed (including a below-floor `pi`) is a named FAIL
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
@@ -188,7 +188,7 @@ gitignored and may be absent or stale immediately after a checkout or pull.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.84.4 <0.85`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.85.1 <0.86`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -433,6 +433,7 @@ pnpm run check:full                     # full deterministic floor (adds the her
 # source-maintainer only — qualification snapshots the git work surface, and both
 # commands are source-contract gates rather than installed operator checks:
 ./run.sh check-agy-permission-matrix    # AGY permission contract space as a literal table (declared cells + stated exclusions)
+./run.sh check-gate-manifests           # the qualification HEAD alone: self-test + manifest-set validation + declared lane inventory, zero mutants run (in check:hermetic)
 ./run.sh check-gate-qualification       # kill-proof: committed defect mutants must turn their gates red for the claimed reason
 
 # agy LIVE acceptance — requires an already-running conversation:
@@ -450,9 +451,14 @@ LIVE=1 ./run.sh release-gate /tmp/scratch --cut # the single cut gate (MUST + BE
 LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live  # Cortex is on-demand: the aggregate does not re-certify it
 ```
 
-`pnpm run check:full` includes the AGY permission contract matrix; the committed-mutant
-gate qualification is scheduled separately (`./run.sh check-gate-qualification` — the CI
-`check` job runs it on every push, and release-gate carries it as a MUST step). A gate a
+`pnpm run check:full` includes the AGY permission contract matrix and the qualification
+HEAD (`check-gate-manifests` — runner self-test, manifest-set validation, declared lane
+inventory, zero mutants executed); the committed-mutant EXECUTION is scheduled separately
+(`./run.sh check-gate-qualification` — the CI `check` job runs it on a branch push that touched the qualification surface,
+unconditionally on `workflow_dispatch -f qualify=true` and a weekly schedule, and release-gate
+carries it as a MUST step; a tag push runs no CI at all). A branch run whose body was filtered out
+is not release evidence: the exact-SHA oracle requires the run it reads to carry that step
+concluding success. A gate a
 release touches must kill its known defect for the claimed `[QK:<claim>]` reason —
 the descriptions above name what each smoke covers, and no check count is quality
 evidence on its own. Gate qualification needs the git work surface, while the matrix

package/VERIFY.md

@@ -40,8 +40,8 @@ Verification here is not a benchmark. In production we exchange short turns and
 
 ### The canonical floor — two entry points
 
-- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. Both tiers exclude the separately scheduled `check-gate-qualification`.
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every push, and as a release-gate MUST step — no longer inside the default check chains) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT).
+- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
@@ -76,7 +76,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
-| Exact release commit | all required CI jobs green at the exact SHA | A different green SHA is not transferable evidence. |
+| Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
@@ -137,7 +137,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.84.3 <0.85`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.85.1 <0.86`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -139,7 +139,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.84.4)
+- `pi` on PATH (current floor 0.85.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -93,9 +93,9 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
-| pi runtime | devDep exact `0.84.4`, peer `>=0.84.4 <0.85` | **exact** oracle + **closed range** | built and certified against 0.84.4; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.73.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.75.1` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
@@ -144,9 +144,19 @@ different reasons, and collapsing them would hide a real risk**:
 - **Advertised but never called.** Some surfaces carry no capability prerequisite at all — the
   `providers/list` / `providers/set` / `providers/disable` trio added in 0.70.0 is advertised
   unconditionally, and 0.71.0–0.73.0 add native subagents, async tasks, message-specific session
-  forks, AI-generated session titles and permission-mode kinds on the same footing. They are
+  forks, AI-generated session titles and permission-mode kinds on the same footing. 0.74.0–0.75.1
+  extend the same list: the `authStatus` extension (0.75.0, #1080), Markdown-rendered usage
+  statistics (0.75.0, #1085) and restored session forks (0.75.1, #1089). The `--hide-claude-auth`
+  subscription refusal (0.74.0, #1079) is unreachable for a second reason — `[측정 2026-09-06]`
+  entwurf passes that flag nowhere (repo grep, 0 hits). They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+- **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
+  synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
+  `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
+  assistant text. Our mapper routes every `tool_call`/`tool_call_update` through
+  `renderToolUpdate` (`event-mapper.ts`), so this is not a type break; what changes is what an
+  operator SEES in a compacting turn. See §11-8 for the measurement.
 
 Adopting either class requires a separate observed need plus a complete rendering/lifecycle/evidence
 contract. An optional upstream feature is not a core-value gap.
@@ -257,17 +267,19 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.73.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.75.1 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.70.0 → 0.73.0 bump, not inherited from the previous one.
-`mcpServerStatus` call sites in `src/acp-agent.ts` went 0 → 2, new in 0.71.0 via
-`0cbbaf3` (MCP OAuth, LLM-25012) — so the ADAPTER now calls it where it previously
-did not. Both sites were read at `v0.73.0 src/acp-agent.ts:1618` and `:1711`: each is
-gated behind `supportsMcpOAuth(query)`, and the polling one waits only on a server
-that already reported `needs-auth`, never on every declared server before
-`newSession` returns. That is an auth handshake, not a readiness fence, so the
-boundary below is unchanged. The other reachable-surface findings also re-measured:
+(Re-measured at the 0.73.0 → 0.75.1 bump, not inherited from the previous one — and the
+0.70.0 → 0.73.0 argument is not reused either. `mcpServerStatus` call sites in
+`src/acp-agent.ts` are **2 at both v0.73.0 and v0.75.1** `[측정 2026-09-06, git grep -c]`;
+they first appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it
+where it once did not. Both were re-read at `v0.75.1 src/acp-agent.ts:1736` and `:1829`
+(the 0.73.0 coordinates were `:1618` and `:1711`): the first sits inside
+`authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
+`needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
+Neither waits on every declared server before `newSession` returns. That is an auth
+handshake, not a readiness fence, so the boundary below is unchanged. The other reachable-surface findings also re-measured:
 AIR typed failures and the AIR file-change report stay capability-gated and
 unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
 unconditionally and uncalled; native subagents, async tasks, session forks, session
@@ -338,6 +350,28 @@ a cut that changes or ships the Cortex rail must run and read its dedicated smok
 Per-cut counts, digests, versions, and host observations belong in BASELINE/CHANGELOG,
 not this standing contract.
 
+## 11-8. Compaction is a tool lifecycle (0.75.0 onward)
+
+The one change in the `0.73.0 → 0.75.1` bump that REACHES the common loop. Upstream #991
+(`f74a517`) replaced compaction's assistant text with a synthetic ACP tool call: `kind:
+"think"`, title `Compact conversation`, `_meta.contextCompaction` schema v1.
+
+`[측정 2026-09-06, oracle, adapter 0.75.1, claude-sonnet-5]` one live `/compact` turn emitted
+exactly two notifications (`tool_call` in-progress → `tool_call_update`), and those verbatim
+objects replayed through the production `applyAcpSessionUpdate` produced a
+`[tool:start] Compact conversation` / `[tool:…] Compact conversation` notice pair. No new
+mapper branch is needed — `renderToolUpdate` routes every tool call regardless of `kind` —
+and `_meta.contextCompaction` is dropped by the mapper, so no accounting path sees it.
+
+What changed is therefore what an OPERATOR sees in a compacting turn, not what entwurf
+computes. The post-compaction occupancy refresh is NOT new: `v0.73.0 src/acp-agent.ts:3460`
+already emitted a `usage_update` at `compact_boundary` and 0.75.1 still does
+(`dist/acp-agent.js:2740-2752`, now reading `compact_metadata.post_tokens` instead of a
+`getContextUsage` control request), so the shrinking-`used_end` case that
+`backend.ts:1286-1288` names as #96's weak floor gains no new trigger here.
+
+Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-measure/README.md`.
+
 ## Open work
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;

package/docs/setup-clean-host.md

@@ -12,7 +12,7 @@ only on Linux because its strict live-owner join uses `/proc`.
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=0.84.4 <0.85` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=0.85.1 <0.86` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -110,7 +110,7 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.84.4
+npm install -g @earendil-works/pi-coding-agent@0.85.1
 pi --version
 
 cd ~/entwurf-smoke
@@ -118,7 +118,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.84.4 <0.85`. It is a hard minimum: installing this
+The supported range is `>=0.85.1 <0.86`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -239,6 +239,38 @@ announces a tool the MCP hand provides. Install it without them and it will log
 `arm-deferred`, give up after ~20s, and `doctor-omp-receive` will name the missing sibling
 as a note rather than a fault.
 
+### The OMP version rule — a weak floor, deliberately (#91)
+
+**entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
+presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=0.85.1 <0.86`) and Claude Code
+(`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
+decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
+earned one because an older binary validates the exec manifest, drops `args` at runtime, and
+reports success. OMP has never been observed to fail that way, it publishes at close to a
+daily cadence, and when its contact surface breaks the two LIVE smokes go loudly red.
+
+What stands instead is a **weak floor: the last version with a LIVE receipt.**
+
+> **OMP minimum: `18.1.10`** — `[측정 2026-09-04, thinkpad, Linux x86-64, omp/18.1.10]`
+> `smoke-omp-receive-live` 11 assertions ok (garden `20260904T224103-d36fed`) and
+> `smoke-omp-fresh-live` 21 assertions ok (garden `20260904T224132-351877`, model
+> `openai-codex/gpt-5.6-sol`), with `doctor-omp-receive` PASS and `doctor-omp-mcp` ok. That
+> update skipped one minor and ten patches from 18.0.0 and broke nothing.
+>
+> **This number moves only when a NEW LIVE receipt exists** — never on a release cadence, a
+> changelog read, or a static gate. Run newer OMP freely; the floor records what was proven,
+> not what is permitted.
+>
+> **The drift sentinels are `smoke-omp-fresh-live` and `smoke-omp-receive-live`**, both
+> release-gate MUST steps. Green after an update means keep going. Red means open a NEW issue
+> carrying the first vendor contact point that broke and its reproduction receipt — do not
+> reopen the closed adoption question. If a SILENT failure is ever observed (green smokes over
+> a dead contact point), that is the evidence a real floor needs, and it earns its own issue
+> for the same reason Claude Code's floor exists.
+
+The evidence and the reasoning are in **#91**; this paragraph is its durable form.
+
 **The receiver arms per session, and only for the visible TUI host.** Opening omp arms it;
 `/new` re-arms it for the replacement citizen and retires the previous one; closing omp
 retires it. A task subagent arms nothing. While nothing is armed, dispatch to that garden

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -123,8 +123,8 @@ export const claudeAdapter = {
     },
     // MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
     // session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-    // and a context-occupancy scalar (`used`; both read at 0.73.0
-    // `dist/acp-agent.js:2918-2924`). Both are measured, so backend.ts seals them.
+    // and a context-occupancy scalar (`used`; both read at 0.75.1
+    // `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
     // The token partition is NOT declared here: ACP's only token carrier is a
     // per-turn round-trip aggregate, which is not what pi's four fields mean.
     sealsTurnAccounting: true,