@junghanacs/entwurf 0.19.0 → 0.20.1

package/docs/acp-backend-rail.md

@@ -92,10 +92,10 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.17.0` | shipped baseline | the package contract these rows belong to |
+| Entwurf package | `0.20.0` | shipped baseline | the package contract these rows belong to |
 | pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.75.1` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.76.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
@@ -151,6 +151,23 @@ different reasons, and collapsing them would hide a real risk**:
   entwurf passes that flag nowhere (repo grep, 0 hits). They are
   unreachable only because the common loop never invokes them (nor `logout`). Nothing upstream
   enforces that; it is our own call-site discipline, and it stops holding the moment we use one.
+- **Advertised but never called — 0.76.0 adds exactly one.** Upstream #1111 puts a
+  `recommendedValue` on AIR config options, and it is **opt-in**: the adapter turns it on only
+  when `initialize`'s `clientCapabilities._meta.jetbrains.air.capabilities` names
+  `recommendedValue`. entwurf sends `clientCapabilities: {}` (`backend.ts:1758`), so
+  `useRecommendedValue` is false on every branch. The label normalization, the `default` row and
+  the effort selector that ride it are unreachable for a second, independent reason as well:
+  `[측정 2026-09-10]` `git grep -c configOptions pi-extensions/lib/acp/` is **0**, and entwurf
+  has never set `EFFORT_CONFIG_ID`, which is the other gate on the SDK-side `applyFlagSettings`.
+  The rest of 0.76.0 is one refactor: `resolveModelPreference` moved into a new
+  `dist/session-model.*` (diff is comments and formatting), `dist/session-effort.*` is new, and
+  `setSessionConfigOption` — our only model-forcing wire call — is byte-identical across
+  `v0.75.1..v0.76.0`.
+- **One 0.76.0 change has a reachable SHAPE and is still inert for us.** When
+  `configuredSettings` is a STRING PATH, its `readFile` + `JSON.parse` moved out of
+  `resolvedProvider` and up onto the unconditional `session/new` path. entwurf passes `settings`
+  as an OBJECT (`tool-surface.ts:153`), so the branch is never taken. That makes "entwurf never
+  hands `settings` as a path" a contract rather than an accident; it is stated at that call site.
 - **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
   synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
   `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
@@ -197,7 +214,7 @@ operator's repair named.
 
 | Seam | Claude | Cortex Code |
 |---|---|---|
-| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
+| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
 | Launch | bundled `claude-agent-acp`; `CLAUDE_AGENT_ACP_COMMAND` override | `cortex acp serve`; optional connection; `CORTEX_ACP_COMMAND` override; never a launch-time `-m` |
 | Model authority | per-turn ACP set-model | per-turn ACP set-model; an unavailable curated id fails before prompt |
 | Carrier | engraving in `_meta.systemPrompt` | no system-prompt carrier; engraving rides the first-user augment |
@@ -256,6 +273,14 @@ Cortex containment was measured against the live CLI rather than copied from Cla
   exact-writes an overlay-private `cortex/mcp.json`. Non-stdio declarations fail before
   spawn. Only the `entwurf-bridge` entry receives the real operator HOME required to
   see the garden store.
+- **`realHome` absoluteness:** the D10 guard judges the captured `realHome` in BOTH
+  path flavors (POSIX and win32), so the refusal rule states the contract rather than
+  the host it happens to run on. This claims no native-Windows support — native
+  Windows is UNSUPPORTED. The certified ACP axis remains Linux
+  desktop/workstation; macOS ACP turns are NOT CERTIFIED — pending physical
+  host. The flavor-explicit form only stops a POSIX host from reading a
+  drive/UNC path as relative, which is what made the defect unkillable on
+  Linux (PR #77).
 - **Carrier:** Cortex has no `_meta.systemPrompt` contract. The engraving is placed at
   the head of the first-user augment; claiming a system-prompt engraving is false.
 
@@ -267,23 +292,23 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.75.1 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.76.0 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.73.0 → 0.75.1 bump, not inherited from the previous one — and the
-0.70.0 → 0.73.0 argument is not reused either. `mcpServerStatus` call sites in
-`src/acp-agent.ts` are **2 at both v0.73.0 and v0.75.1** `[측정 2026-09-06, git grep -c]`;
-they first appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it
-where it once did not. Both were re-read at `v0.75.1 src/acp-agent.ts:1736` and `:1829`
-(the 0.73.0 coordinates were `:1618` and `:1711`): the first sits inside
+(Re-measured at the 0.75.1 → 0.76.0 bump, not inherited — the previous bump's argument is
+not reused, the way the 0.73.0 → 0.75.1 entry did not reuse 0.70.0 → 0.73.0's.
+`mcpServerStatus` call sites in `src/acp-agent.ts` are **2 at v0.75.1 and 2 at v0.76.0**
+`[측정 2026-09-10, upstream v0.76.0/src/acp-agent.ts read directly, grep -n]`; they first
+appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it where it
+once did not. Both were re-read at `v0.76.0 src/acp-agent.ts:1762` and `:1855`
+(v0.75.1: `:1736` / `:1829`; v0.73.0: `:1618` / `:1711`): the first sits inside
 `authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
 `needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
 Neither waits on every declared server before `newSession` returns. That is an auth
-handshake, not a readiness fence, so the boundary below is unchanged. The other reachable-surface findings also re-measured:
-AIR typed failures and the AIR file-change report stay capability-gated and
-unadvertised by entwurf; `providers/set` / `providers/disable` stay advertised
-unconditionally and uncalled; native subagents, async tasks, session forks, session
-titles, permission-mode kinds and clear-context planning are all new-but-uncalled.
+handshake, not a readiness fence, so the boundary below is unchanged. The surrounding 200
+lines are byte-identical and the region moved +26; the whole 0.76.0 delta is one refactor
+plus one opt-in AIR extension that `clientCapabilities: {}` never enables, so the other
+reachable-surface findings stand as re-measured at the previous bump.
 This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement
@@ -376,5 +401,5 @@ Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-meas
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;
 - broader installed-host and cross-machine Cortex evidence;
-- any future Codex managed native-citizen lane—separate from ACP; 0.14.0 does not ship one;
+- any future Codex managed native-citizen lane—separate from ACP; the lane is open as #95 and no release ships one;
 - persisted ACP resume/load, which is not implemented by today's in-memory reuse.

package/docs/external-mcp-host.md

@@ -52,9 +52,12 @@ Prerequisites on the host running the external MCP client:
 > carrier reader trims and tests truthiness, so empty and absent are the same answer by
 > construction. Pinned by `[QK:FRESHCALL-IDENTITY-SCRUB]` in the `check-mux-fresh-call` vitest lane,
 > inside `check:full`. The DETECT half is unchanged and still load-bearing, because a seam covers
-> only the launches that pass through it: `doctor-omp-bridge` reads `/proc/<pid>/environ` for every
-> live `omp` process and goes RED on its own axis when one carries either carrier. An omp the
-> operator started from a pi citizen's bash never touched the seam and is still unsupported, exactly
+> only the launches that pass through it: `doctor-omp-bridge` reads each live `omp`
+> process's environment (on Linux, `/proc/<pid>/environ`) and goes RED on its own
+> axis when one carries either carrier. The remaining uncertified Darwin axis is
+> per-process environment DISCOVERY, not `/proc` absence; macOS rails are
+> NOT CERTIFIED — pending physical host. An omp the operator started
+> from a pi citizen's bash never touched the seam and is still unsupported, exactly
 > as this boundary says.
 
 Example env file:
@@ -166,6 +169,7 @@ Use the managed install surface rather than editing omp's files by hand:
 ```bash
 entwurf install-omp-bridge     # the BIRTH extension (a garden id per visible TUI session)
 entwurf install-omp-mcp        # the MCP hand (this section)
+entwurf install-omp-config     # the operator setting (tools.xdev: false)
 entwurf install-omp-receive    # the RECEIVER extension (mailbox watch + announce-only doorbell)
 
 entwurf doctor-omp-bridge
@@ -173,7 +177,7 @@ entwurf doctor-omp-mcp
 entwurf doctor-omp-receive
 ```
 
-Three units, not two. The receiver is what makes the citizen answerable at all — without it omp
+Four units, not two. The receiver is what makes the citizen answerable at all — without it omp
 sends under its own garden id and every reply is refused as `mailbox-undeliverable` — and it is
 also a prerequisite of visible fresh: the fresh preflight refuses this host before touching tmux
 when the receive unit is missing, rather than opening a window that can never be reached.
@@ -241,7 +245,8 @@ bridge registered, **11 devices**: omp's own `ast_edit`, `debug`, `lsp`, `browse
 seven `entwurf_*`. So the default does not merely wrap entwurf — it wraps omp's own LSP and
 debugger too.
 
-**Set this on any omp host that is meant to work as a citizen:**
+**`entwurf setup` writes this for a detected omp host, and `entwurf install-omp-config` is
+the repair leaf. The value they own:**
 
 ```yaml
 # ~/.omp/agent/config.yml

package/docs/fresh-cut-policy.md

@@ -22,7 +22,8 @@ the new generation.
 ## What certification checks
 
 `certifyActiveStore` is shared by the doctor and all identity writers: pi birth,
-Claude's `SessionStart`, agy's imprint, and `entwurf_register_native`. Every active
+Claude's `SessionStart`, Copilot's first-prompt birth hook, OMP's birth extension,
+agy's imprint, and `entwurf_register_native`. Every active
 record must be:
 
 - a regular, non-symlink `.meta.json` file;
@@ -43,7 +44,7 @@ are opened without following symlinks; implementation and race proofs live besid
 
 ## Running a cut
 
-First close every pi, Claude Code, and agy session that could own a citizen or
+First close every pi, Claude Code, Copilot, OMP, and agy session that could own a citizen or
 transport artifact. Then run:
 
 ```bash

package/docs/setup-clean-host.md

@@ -1,8 +1,18 @@
 # Clean-host setup
 
-Current operator recipe for a fresh Linux desktop/workstation. The neutral npm
-package can install elsewhere, but Claude's garden-native meta-bridge is certified
-only on Linux because its strict live-owner join uses `/proc`.
+Operator recipe for a POSIX host. **Linux is the certified axis** — §2–§6 are
+written for it and their receipts are Linux receipts. What follows is the macOS
+evidence split, and its three states must not collapse into "macOS is supported":
+
+- **CERTIFIED (CI)** — the Entwurf-only install surface on macOS
+  (`macos-install-surface`). Weaker than a physical-host doctor green. §1 is
+  this surface.
+- **NOT CERTIFIED — pending physical host** — **on macOS**, every garden-native
+  harness rail in §2–§6 (pi, Claude, Copilot, OMP, agy), marker join, ACP turn,
+  mux. Wiring may be written; that is not a rail receipt. The remaining
+  unmeasured Darwin doctor reason is per-process environment DISCOVERY
+  (start-key is portable).
+- **UNSUPPORTED** — native Windows only. macOS is never this.
 
 ## Requirements
 
@@ -22,8 +32,35 @@ only on Linux because its strict live-owner join uses `/proc`.
 Claude Code >=2.1.217 is required for the managed exec-hook lifecycle. The package
 never supplies or proxies backend credentials.
 
+On a physical Darwin host, `python3` may be the CommandLineTools stub (a
+dialog instead of an interpreter) — unmeasured. That is a probe cell
+(`scripts/raw-macos-measure/probe.sh` M3), not a certification path.
+
 ## 1. Install Node and entwurf
 
+This section is the Entwurf-only install surface. On macOS it is
+**CERTIFIED (CI)** (`macos-install-surface`): npm pack → clean consumer
+install → bins → `--help` → `check-bridge` → harness-absent `setup`. That
+is not a harness-rail receipt.
+
+On Darwin, `entwurf setup` is intentionally non-green when it detects a
+harness. The wiring is written; the row is FAIL:
+
+> the wiring WAS written and nothing failed to install, but this harness
+> rail is NOT CERTIFIED — pending physical host on Darwin. setup runs no
+> doctor; the rail axis is owned by '<doctor>', which refuses on this
+> platform. Tracking: #78.
+
+That FAIL is honest: setup runs no doctor, and no physical-host rail
+receipt exists — it is not an install failure. An Entwurf-only host (no
+harness on PATH) stays green (five SKIP, `bins: PASS`, `core: PASS`,
+`result: green`), which is what CERTIFIED (CI) observed.
+
+A physical Mac can send host facts without installing entwurf or logging
+into a harness: `scripts/raw-macos-measure/probe.sh` (`/bin/sh`, ~3.5s,
+cells M1–M9, writes nothing). Measurement, not certification — it does
+not move CERTIFIED (CI) or close a rail.
+
 Use the host's normal Node 24 installation. With nvm:
 
 ```bash
@@ -107,6 +144,12 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 
 ## 2. Optional pi adapter / ACP plugin
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. Control sockets, mux, and ACP plugin hosting have no
+physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
+on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
+`setup` names the pi row FAIL with the §1 Darwin wording.
+
 Install the exact release floor, then wire the project:
 
 ```bash
@@ -134,6 +177,9 @@ The V3 record births the garden id; do not inject a pi session id manually.
 
 ## 3. Optional Claude Code native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending physical
+host (see the end of this section).
+
 First register the MCP bridge if the stable bin is not already present:
 
 ```bash
@@ -159,12 +205,21 @@ validation, or hand-inspected marker cannot replace a new real session. If the l
 form is unsupported, reinstall; if ownership is correct but the live join is absent,
 restart the affected session.
 
-New macOS wiring is refused because the live join is not instrumented there. Darwin
-uninstall remains available for cleaning an older managed install; this is an evidence
-boundary, not a permanent impossibility claim.
+The Darwin install fence is open (`Linux | Darwin`); python3 is the
+refusal, not the platform name. A completed Darwin install is still not
+a rail receipt: this rail is NOT CERTIFIED — pending physical host. The
+remaining unmeasured doctor reason is per-process environment DISCOVERY
+of live bridge children (start-key is portable). A CI runner cannot
+supply a Claude login. Uninstall is open on Darwin too. That is an
+evidence boundary, not UNSUPPORTED.
 
 ## 4. Optional GitHub Copilot CLI native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. The Darwin install fence for `install-copilot-bridge` is
+open (`Linux | Darwin`); a completed install is not a rail receipt. That
+is an evidence boundary, not UNSUPPORTED.
+
 Copilot has four independently owned surfaces. `setup` composes all four when `copilot` is on
 PATH (#86 C3b); the commands below are the per-unit repair, doctor, and inverse surfaces. All
 four must be green for supported visible fresh; a manual citizen may omit the footer, but fresh
@@ -187,7 +242,12 @@ scanning for that process, checks the receiver, removes inherited pi identity ca
 the model/permission defaults. Birth occurs on the first prompt. `entwurf_fresh_call` uses this
 same managed invocation and requires the birth, MCP, receiver, and visible-identity preflight.
 
-## 4b. Optional OMP (`omp`) native citizen — accepted on one host
+## 4b. Optional OMP (`omp`) native citizen — accepted on one Linux host (thinkpad)
+
+This rail is CERTIFIED on Linux (one host, named in the version rule
+below); on macOS it is NOT CERTIFIED — pending physical host. The Darwin
+install fences for `install-omp-bridge` and `install-omp-receive` are
+open (`Linux | Darwin`); a completed install is not a rail receipt.
 
 Three independently owned surfaces, and a boundary that is part of the instructions rather
 than a footnote. Birth, visible identity, who-sent, the MCP hand and RECEIVE are landed, and
@@ -338,6 +398,10 @@ why `disabledServers` is never the way to hide an import.
 
 ## 5. Optional Antigravity native citizen
 
+This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
+physical host. The installers may write on Darwin; a green install is
+not a native-push receipt.
+
 Install the three independently owned surfaces:
 
 ```bash
@@ -363,6 +427,10 @@ LIVE=1 AGY_CONVERSATION_ID=<id> entwurf smoke-agy-native-push-live
 
 ## 6. Optional ACP backend turns
 
+ACP turns are CERTIFIED on Linux; on macOS they are NOT CERTIFIED —
+pending physical host. Mux (visible fresh / resume) is the same state.
+A CI runner has no Claude or Cortex login.
+
 Claude uses the operator's existing local Claude authentication:
 
 ```bash
@@ -386,6 +454,15 @@ After upgrading the package, rerun the managed installers for every native harne
 in use and restart their existing processes. Native plugin caches are not live-reload
 safe across launch-contract changes.
 
+On Darwin the four previously closed install fences
+(`install-meta-bridge`, `install-copilot-bridge`, `install-omp-bridge`,
+`install-omp-receive`) now accept `Linux | Darwin` and refuse on the
+real toolchain (python3 / node / harness presence), not the platform
+name. Re-running them writes wiring. `setup` still names every detected
+harness unit FAIL with the §1 Darwin wording — upgrade does not mint a
+rail receipt. Doctors refuse on Darwin until a physical-host receipt
+exists.
+
 If install or doctor reports an unreadable/old active citizen generation, do not edit
 records by hand. Close pi, Claude, Copilot, and agy sessions first, run
 `entwurf meta-bridge-fresh-cut`, and read its exit status before any install. Then choose the
@@ -414,6 +491,10 @@ PASS/SKIP/FAIL summary. The complete quiescence, archive, and exit-code contract
   core / full candidate floor); maintainer checkout only.
 - `check-install-container`: checkout-invisible Linux package-consumer shape using
   fixtures; not a native lifecycle proof.
+- `macos-install-surface`: macOS Entwurf-only package-consumer shape, CERTIFIED (CI)
+  (`macos-latest` runner, run 34303884286 @ `70eda03`); not a native lifecycle proof.
+- `scripts/raw-macos-measure/probe.sh`: physical-Darwin host facts (~3.5s,
+  no install, no login). Measurement, not a certification path.
 - `doctor-meta-bridge`: one installed real Claude host, only with a new live session.
 - `LIVE=1 entwurf release-gate /path/to/scratch --cut`: aggregate runtime acceptance (`--cut` makes any MUST SKIP red; without it the run is a diagnostic pass).
 
@@ -422,6 +503,11 @@ host verdicts are [BASELINE.md](../BASELINE.md).
 
 ## Uninstall
 
+Darwin uninstall is open for the same surfaces the installers write
+(the Claude uninstall fence was already open; the four install fences
+now match). Running an inverse on Darwin is cleanup, not a rail
+certification.
+
 Run only the surfaces this host owns:
 
 ```bash

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -123,8 +123,8 @@ export const claudeAdapter = {
     },
     // MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
     // session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-    // and a context-occupancy scalar (`used`; both read at 0.75.1
-    // `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
+    // and a context-occupancy scalar (`used`; both read at 0.76.0
+    // `dist/acp-agent.js:3471-3486`). Both are measured, so backend.ts seals them.
     // The token partition is NOT declared here: ACP's only token carrier is a
     // per-turn round-trip aggregate, which is not what pi's four fields mean.
     sealsTurnAccounting: true,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -49,11 +49,11 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"];
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"];
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
-// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/overlay.js

@@ -35,7 +35,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 /** Operator's real Claude config dir — the symlink-passthrough SOURCE. */
 export const CLAUDE_REAL_CONFIG_DIR = join(homedir(), ".claude");
 /** pi-owned overlay dir — the CLAUDE_CONFIG_DIR target for ACP child spawns. */
@@ -356,7 +356,11 @@ function cortexLinkIfExists(realPath, overlayPath) {
  * Returns the isolated HOME/SNOWFLAKE_HOME the spawn env must carry.
  */
 export function ensureCortexDualHomeOverlay(params) {
-    if (!params.realHome || !params.realHome.startsWith("/")) {
+    // Absoluteness is judged in BOTH path flavors so the guard states the contract
+    // ("the parent captured an absolute HOME") instead of the host it happens to run
+    // on. This asserts nothing about native-Windows support; it only stops a POSIX
+    // host from silently accepting a drive/UNC path as "relative".
+    if (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {
         throw new Error(`entwurf: cortex dual-HOME overlay requires an absolute realHome captured by the parent (got ${JSON.stringify(params.realHome)})`);
     }
     const overlaysRoot = params.overlaysRoot ?? CORTEX_OVERLAYS_ROOT;

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/tool-surface.js

@@ -120,6 +120,12 @@ export function buildClaudeSessionMeta(params, normalizedSystemPrompt) {
         ...(params.modelId ? { model: params.modelId } : {}),
         tools: [...params.tools],
         settingSources: [...params.settingSources],
+        // `settings` is an OBJECT here, and that is a contract, not a convenience.
+        // claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
+        // JSON.parse for that form moved out of `resolvedProvider` up onto the
+        // unconditional `session/new` path — a shape that WOULD reach us, and does not,
+        // only because we never hand it a path. Keep it inline: a path would put file
+        // IO, and its failure modes, inside every session creation.
         settings: {
             permissions: {
                 allow: [...params.permissionAllow],

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.19.0",
-	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
+	"version": "0.20.1",
+	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, and Antigravity; Claude and Snowflake Cortex Code ACP backends. Codex has verified delivery-probe evidence, not a managed native-citizen lane.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",
@@ -82,7 +82,7 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.75.1",
+		"@agentclientprotocol/claude-agent-acp": "0.76.0",
 		"@agentclientprotocol/sdk": "1.4.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",

package/pi-extensions/acp-provider.ts

@@ -14,7 +14,7 @@
 // registry (backend-adapter.ts), NOT a per-backend list spelled here. Adding a
 // backend therefore never edits this file. check-acp-provider-surface pins that
 // the compiled entry really registers the EXACT union
-// ([QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]).
+// ([QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE]).
 //
 // Fence: this entry rides the emit-capable root tsconfig (it is not in the root
 // `exclude` list); its lib modules are imported with `.js` suffixes (the root

package/pi-extensions/lib/acp/acp-client.ts

@@ -46,8 +46,8 @@ import type { AcpTextBlock } from "./context.js";
  * shape) and never onto those four. A field rename upstream fails the typecheck
  * here rather than silently zeroing the operator's cache-effect badge.
  */
-/** One `_meta.quota.token_count` row (claude-agent-acp 0.75.1
- *  `dist/acp-agent.js:6493-6502`). `cachedInputTokens` is cache READS — the name
+/** One `_meta.quota.token_count` row (claude-agent-acp 0.76.0
+ *  `dist/acp-agent.js:6566-6575`). `cachedInputTokens` is cache READS — the name
  *  differs from `usage.cachedReadTokens` because the shape is shared with
  *  codex-acp; `cachedWriteTokens` is Claude's extra sibling. */
 export type AcpQuotaTokenCount = {
@@ -64,7 +64,7 @@ export type AcpPromptResponse = {
 	/** Vendor-private, version-pinned. `_meta` is a standard ACP extension slot
 	 *  whose values a client may not assume, and `quota` is NOT in
 	 *  claude-agent-acp's exported types — it is produced by the private
-	 *  `turnQuotaMeta()` (read at 0.75.1 `dist/acp-agent.js:6476-6485`). Read
+	 *  `turnQuotaMeta()` (read at 0.76.0 `dist/acp-agent.js:6549-6558`). Read
 	 *  defensively, never structurally required, and re-measure on a pin move. */
 	_meta?: {
 		quota?: {

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -150,7 +150,7 @@ export interface AcpAdapterSettingsParams {
  *
  * During stream handling the vendor keeps a per-message snapshot in
  * `lastAssistantUsage`, but its `usage_update` publishes only the scalar `used`
- * value (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`). Until
+ * value (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:3857-3882`). Until
  * that partition is carried on the wire, NOTHING honest can go in pi's four
  * fields, so entwurf writes none of them.
  */
@@ -342,8 +342,8 @@ export const claudeAdapter: AcpBackendAdapter = {
 
 	// MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
 	// session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-	// and a context-occupancy scalar (`used`; both read at 0.75.1
-	// `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
+	// and a context-occupancy scalar (`used`; both read at 0.76.0
+	// `dist/acp-agent.js:3471-3486`). Both are measured, so backend.ts seals them.
 	// The token partition is NOT declared here: ACP's only token carrier is a
 	// per-turn round-trip aggregate, which is not what pi's four fields mean.
 	sealsTurnAccounting: true,

package/pi-extensions/lib/acp/backend.ts

@@ -137,7 +137,7 @@ function finiteOrZero(value: unknown): number {
  * "the accounting-grade figure per the SDK" — it also counts Task subagents,
  * sidechains, and INTERNAL CALLS SUCH AS COMPACTION, so its rows "can total more
  * than `token_count`" and are "the fuller picture, not a decomposition of it"
- * (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6465-6485`). The narrower
+ * (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:6538-6558`). The narrower
  * `PromptResponse.usage` (== `quota.token_count`) is the MAIN AGENT LOOP only.
  *
  * The wider one is the right numerator because the denominator already has that
@@ -1237,7 +1237,7 @@ export function streamAcpTurn(
 		// Writing zeros is not a placeholder for a better number we could compute:
 		// the per-request partition is genuinely absent from the wire. The vendor
 		// builds it in `lastAssistantUsage` and sends only its scalar sum (read at
-		// claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`) — #96.
+		// claude-agent-acp 0.76.0 `dist/acp-agent.js:3857-3882`) — #96.
 		//
 		// But silence is NOT the resting state. A cache miss the operator never sees
 		// is a false reading, not a modest one: a session can run for hours believing
@@ -1356,7 +1356,7 @@ export function streamAcpTurn(
 				// between them is exactly why the notice below names a MECHANISM and
 				// never a cause: claude-agent-acp's `conversation_reset` handler only
 				// switches the SDK to a fresh conversation and touches no cost at all
-				// (read at 0.75.1 `dist/acp-agent.js:4282-4289`), while claude-agent-sdk
+				// (read at 0.76.0 `dist/acp-agent.js:4286-4293`), while claude-agent-sdk
 				// separately documents that "a mid-session /clear resets the running
 				// total" (read at 0.3.257 `sdk.d.ts:4884`). A reset therefore PLAUSIBLY
 				// explains a backwards total, but nothing here has MEASURED that it did,

package/pi-extensions/lib/acp/event-mapper.ts

@@ -60,8 +60,8 @@ export type AcpPiStreamState = {
 	 *
 	 * Last write wins, never a sum: both are latest session-level observations, and
 	 * one turn can legitimately see several (claude emits one per `result` message,
-	 * including a sub-agent's own — read at claude-agent-acp 0.75.1
-	 * `dist/acp-agent.js:3467-3482`), each carrying that result's current values.
+	 * including a sub-agent's own — read at claude-agent-acp 0.76.0
+	 * `dist/acp-agent.js:3471-3486`), each carrying that result's current values.
 	 */
 	observedSessionCostUsd?: number;
 	observedContextOccupancyTokens?: number;
@@ -346,8 +346,8 @@ export function applyAcpSessionUpdate(
 		case "usage_update": {
 			// `used` is OCCUPANCY-shaped — the backend's post-turn context size, not
 			// the prompt response's turn aggregate. Claude sends `lastAssistantTotalUsage`
-			// as `used` (read at claude-agent-acp 0.75.1
-			// `dist/acp-agent.js:3867-3878`), after constructing that scalar from the
+			// as `used` (read at claude-agent-acp 0.76.0
+			// `dist/acp-agent.js:3871-3882`), after constructing that scalar from the
 			// latest assistant snapshot (`:3853-3866`). pi reads `usage.totalTokens` as
 			// exactly that occupancy (`calculateContextTokens(usage) = usage.totalTokens
 			// || input + output + cacheRead + cacheWrite`, read at pi-coding-agent

package/pi-extensions/lib/acp/models.ts

@@ -53,13 +53,13 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"] as const;
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"] as const;
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
 
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
-// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/pi-extensions/lib/acp/overlay.ts

@@ -46,7 +46,7 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 
 import type { AcpMcpServer } from "./config.js";
 
@@ -416,7 +416,11 @@ function cortexLinkIfExists(realPath: string, overlayPath: string): void {
  * Returns the isolated HOME/SNOWFLAKE_HOME the spawn env must carry.
  */
 export function ensureCortexDualHomeOverlay(params: CortexOverlayParams): CortexOverlayResult {
-	if (!params.realHome || !params.realHome.startsWith("/")) {
+	// Absoluteness is judged in BOTH path flavors so the guard states the contract
+	// ("the parent captured an absolute HOME") instead of the host it happens to run
+	// on. This asserts nothing about native-Windows support; it only stops a POSIX
+	// host from silently accepting a drive/UNC path as "relative".
+	if (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {
 		throw new Error(
 			`entwurf: cortex dual-HOME overlay requires an absolute realHome captured by the parent (got ${JSON.stringify(params.realHome)})`,
 		);

package/pi-extensions/lib/acp/tool-surface.ts

@@ -150,6 +150,12 @@ export function buildClaudeSessionMeta(
 		...(params.modelId ? { model: params.modelId } : {}),
 		tools: [...params.tools],
 		settingSources: [...params.settingSources],
+		// `settings` is an OBJECT here, and that is a contract, not a convenience.
+		// claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
+		// JSON.parse for that form moved out of `resolvedProvider` up onto the
+		// unconditional `session/new` path — a shape that WOULD reach us, and does not,
+		// only because we never hand it a path. Keep it inline: a path would put file
+		// IO, and its failure modes, inside every session creation.
 		settings: {
 			permissions: {
 				allow: [...params.permissionAllow],

package/pi-extensions/lib/meta-session.ts

@@ -1622,6 +1622,31 @@ export type MarkerOwnerVerdict = "live" | "dead" | "uncertain";
  * comparable to each other: `linux:<starttime ticks since boot>` and `ps:<lstart
  * wall-clock text>` describe the same process with different numbers, so a
  * mismatch ACROSS schemes says nothing about whether the process changed.
+ *
+ * They are also NOT equally resolved. `linux:` carries `/proc` clock ticks at
+ * 10 ms granularity; `ps:` carries `lstart` wall-clock text at ONE-SECOND
+ * granularity [measured, oracle 2026-09-09: two children spawned 50 ms apart
+ * returned identical `lstart` strings, and widening to `lstart=,command=`
+ * still collided when argv was identical]. Darwin has no `/proc`, so it ALWAYS
+ * takes the `ps:` branch — there the pid-reuse defense window is 100x wider
+ * than on Linux. 0.20.0 ships no key change anyway, and the numbers are why.
+ * A same-second pid reuse on Darwin requires pid N to die, the whole
+ * sequential pid space (PID_MAX 99999, wrapping after ~99,899 spawns and
+ * skipping live pids) to wrap back around to N, and the replacement to start
+ * in the SAME wall-clock second — a sustained ~99,900 spawns/second for a full
+ * second. Measured on the reference host: 19.9 forks/second average under real
+ * load, ~14,873 forks/second pathological synthetic peak (6.7x short even at
+ * the synthetic peak), with Darwin's default `kern.maxproc` (~2,500) capping
+ * churn in flight besides. The error direction is one-sided: a coarser clock
+ * can only make more keys compare EQUAL, and {@link classifyMarkerOwner} grants
+ * `live` on equal keys — coarsening can mint a false `live` (identity grant
+ * fails OPEN) and can never mint a false `dead` (the generation cut stays
+ * fail-CLOSED). The migration axis is empty by measurement, not argument: a
+ * read-only scan of this host's real marker store found 1,248 marker files —
+ * all `linux:`, zero `ps:` keys — because on Linux `/proc` always wins, so no
+ * Linux install ever minted a `ps:` key; only a Darwin install can. A
+ * Darwin-side hardening decision, if one is ever wanted, belongs with the
+ * physical-Mac receipts (#78), not ahead of them.
  */
 export type StartKeyScheme = "linux" | "ps";