@junghanacs/entwurf 0.23.0 → 0.24.0

package/scripts/check-acp-backend-preflight.ts

@@ -16,23 +16,42 @@
 
 import { strict as assert } from "node:assert";
 import { execFileSync } from "node:child_process";
-import { readFileSync, rmSync } from "node:fs";
-import { resolve } from "node:path";
+import { readdirSync, readFileSync, rmSync } from "node:fs";
+import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Model, TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 
 const model = { id: "claude-sonnet-5" } as unknown as Model<Api>;
 
 // Declared tools exclude `read`, but the Claude child always exposes Read →
 // declared != actual → the preflight must reject before spawning.
-const context: Context = {
+//
+// Built through `normalizeContext` — NOT as a `Context` literal. Since pi 0.86
+// a custom provider is handed a TranscriptContext (model-runtime.ts calls
+// `normalizeContext(context)` before `provider.streamSimple`), so `context.tools`
+// is ALWAYS undefined on the provider path and the declared surface lives in the
+// leading system message's `toolsAdded`. Feeding a 0.85-shaped literal straight
+// into streamShellAcp would bypass the fold and let this gate stay green over a
+// preflight that can no longer see any tools at all.
+const context: TranscriptContext = normalizeContext({
 	messages: [{ role: "user", content: "hi", timestamp: 0 }],
 	tools: [
 		{ name: "bash", description: "", parameters: {} as never },
 		{ name: "edit", description: "", parameters: {} as never },
 		{ name: "write", description: "", parameters: {} as never },
 	],
-};
+});
+
+// Premise guard: the fixture must really carry its tools as transcript state. If
+// a future pi stops folding, this fails loudly instead of leaving the exclude-
+// tools assertion below testing an empty surface for the wrong reason.
+assert.equal(context.messages[0].role, "system", "normalizeContext folded the tools into a leading system message");
+assert.deepEqual(
+	(context.messages[0] as { toolsAdded?: { name: string }[] }).toolsAdded?.map((t) => t.name),
+	["bash", "edit", "write"],
+	"the declared surface rides the system message's toolsAdded",
+);
 
 const TMP_EMIT = ".tmp-verify/acp-backend-preflight";
 rmSync(TMP_EMIT, { recursive: true, force: true });
@@ -44,7 +63,7 @@ try {
 	const mod = (await import(backendUrl)) as {
 		streamShellAcp: (
 			m: Model<Api>,
-			c: Context,
+			c: TranscriptContext,
 		) => AsyncIterable<AssistantMessageEvent> & {
 			result: () => Promise<{ stopReason: string; errorMessage?: string }>;
 		};
@@ -101,8 +120,25 @@ try {
 	for await (const ev of stream) events.push(ev);
 
 	const types = events.map((e) => e.type);
-	assert.ok(!types.includes("done"), `a tool-surface lie must NOT complete as done (got ${types.join(",")})`);
 	const errorEvent = events.find((e): e is Extract<AssistantMessageEvent, { type: "error" }> => e.type === "error");
+
+	// The whole claim in ONE assertion, placed BEFORE the diagnostic breakdown so
+	// a mutant always dies here and carries the signature. The breakdown below
+	// still runs on a green tree and says WHICH half broke.
+	const preflightFired =
+		!types.includes("done") &&
+		/cannot honor --exclude-tools \(read\)/.test(String(errorEvent?.error.errorMessage ?? ""));
+	assert.ok(
+		preflightFired,
+		"[QK:ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS] the runtime tool-surface preflight must read the active tools by " +
+			"REPLAYING the transcript's system messages (`getCurrentTools(context.messages)`), which is where pi 0.86 puts " +
+			"the declared surface. Reading a `context.tools` field instead yields undefined on every 0.86 provider call; " +
+			"with a fallback to the full builtin set that makes assertExcludeToolsHonored unfireable — the turn reaches a " +
+			"spawn and the operator is told a tool is excluded while the backend can still run it. " +
+			`Got events [${types.join(",")}], error=${JSON.stringify(errorEvent?.error.errorMessage ?? null)}`,
+	);
+
+	assert.ok(!types.includes("done"), `a tool-surface lie must NOT complete as done (got ${types.join(",")})`);
 	assert.ok(errorEvent, `expected an error event (got ${types.join(",")})`);
 	assert.equal(errorEvent.reason, "error", "tool-surface divergence is a hard error, not aborted");
 	assert.equal(errorEvent.error.stopReason, "error", "final message stopReason must be error");
@@ -123,8 +159,80 @@ try {
 	rmSync(TMP_EMIT, { recursive: true, force: true });
 }
 
+// ---------------------------------------------------------------------------
+// Provider-path fixture sweep — the cast that got past typecheck twice
+// ---------------------------------------------------------------------------
+// The behavioral cells above prove ONE gate feeds the 0.86 shape. This proves the
+// others cannot quietly stop doing so. When the pi 0.86 pin landed, the branded
+// `TranscriptContext` named every gate that built a provider-path fixture as a
+// `Context` LITERAL — and named none of the four that wrote `as Context`, because a
+// cast is exactly the operation that silences the brand. Those four then failed in
+// the full floor with `'error' !== 'done'`, a message that says nothing about the
+// cause. A fixture cast to `Context` declares no tools, `getCurrentTools` replays
+// none, and every turn seals as an exclude-tools rejection before the prompt is
+// sent — which reads like broken streaming and is actually a stale fixture.
+//
+// So: no provider-path source may cast to `Context` at all. Static by nature —
+// there is no production subject here and nothing to drive, the claim IS the
+// absence of a token in a file set — so this carries no mutant. Its kill-proof is
+// the sweep itself: delete the assertion and nothing else changes, which is true of
+// any absence check and is why it lives beside the capability it protects rather
+// than in a lane of its own.
+{
+	// The SMOKES are in scope, not only the deterministic gates. Leaving them out is how this
+	// guard missed `smoke-acp-session-reuse-live.ts` in the 0.23.2 release gate: the gates it
+	// did sweep were all green, and the one provider-path fixture it could not see failed an
+	// hour into a LIVE run instead.
+	const swept = [
+		...readdirSync(resolve("scripts"))
+			.filter((f) => (f.startsWith("check-acp-") || f.startsWith("smoke-")) && f.endsWith(".ts"))
+			.map((f) => join("scripts", f)),
+		...readdirSync(resolve("pi-extensions", "lib"), { recursive: true, encoding: "utf8" })
+			.filter((f) => f.endsWith(".test.ts"))
+			.map((f) => join("pi-extensions", "lib", f)),
+	];
+	// Guard the sweep: a glob that matches nothing passes vacuously and says so to nobody.
+	assert.ok(swept.length >= 10, `provider-path sweep matched only ${swept.length} files — the globs stopped resolving`);
+
+	// BOTH spellings, because the hazard is the TYPE, not one syntax for reaching it. The four
+	// gates found in the full floor wrote `as Context`; the live smoke found in the release gate
+	// wrote `const turn1: Context = {…}`. A guard that names one spelling only teaches the next
+	// author which spelling to use.
+	//
+	// `Context[...]` and `Context<...>` are NOT the hazard and are excluded by the trailing
+	// lookahead: `messages: Context["messages"]` is the legitimate INPUT to `normalizeContext`,
+	// which takes a real Context by contract. Flagging it would push authors to re-type pi's own
+	// message array by hand, which is a worse fixture than the one this rule exists to prevent.
+	const RAW_CONTEXT = /(?:\bas\s+Context|:\s*Context)\b(?![[<])/;
+	const offenders: string[] = [];
+	for (const file of swept) {
+		readFileSync(file, "utf8")
+			.split("\n")
+			.forEach((line, i) => {
+				// Prose about the rule is not a violation of it.
+				if (line.trimStart().startsWith("//") || line.trimStart().startsWith("*")) return;
+				if (RAW_CONTEXT.test(line)) offenders.push(`${file}:${i + 1}: ${line.trim()}`);
+			});
+	}
+	assert.deepEqual(
+		offenders,
+		[],
+		"[QK:ACP-FIXTURE-NO-CONTEXT-CAST] a provider-path fixture may not be typed as the raw `Context` — neither by " +
+			"annotation nor by cast. Since pi 0.86 a custom provider receives a branded TranscriptContext, and the brand is " +
+			"the only thing that names a stale fixture at typecheck time; either spelling silences it, so the fixture " +
+			"declares no tools, the exclude-tools preflight rejects every turn before the prompt is sent, and the failure " +
+			"surfaces as `'error' !== 'done'` with nothing pointing at the cause. Build it with " +
+			"`normalizeContext({ tools, messages })` instead. Found:\n" +
+			offenders.join("\n"),
+	);
+}
+
 console.log(
-	"[check-acp-backend-preflight] ok — streamShellAcp runs assertExcludeToolsHonored before spawn; a declared-vs-actual " +
+	"[check-acp-backend-preflight] ok — streamShellAcp replays the 0.86 transcript's system messages for the active tool " +
+		"surface and runs assertExcludeToolsHonored before spawn; a declared-vs-actual " +
 		"tool-surface lie fails fast into the stream as an error event (no backend launched, no done); " +
-		"actionableAcpBackendHint (A-c) classifies a context-window 400 into an actionable hint without misclassifying unrelated failures",
+		"actionableAcpBackendHint (A-c) classifies a context-window 400 into an actionable hint without misclassifying " +
+		"unrelated failures; and no provider-path fixture in the acp gates, the smokes or the lib tests is typed as the raw " +
+		"`Context` (annotation or cast), so the " +
+		"TranscriptContext brand still names a stale one at typecheck time",
 );

package/scripts/check-acp-carrier-augment.ts

@@ -19,7 +19,7 @@ import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import type { Context } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 import {
 	buildPiContextAugment,
 	prependNewPromptAugment,
@@ -163,8 +163,10 @@ const BRIDGE_MARK = "operating through entwurf";
 // ===========================================================================
 // helper: a context whose first user message is `firstUser`
 // ===========================================================================
-function ctxWith(firstUser: string): Context {
-	return {
+// Built through `normalizeContext` (pi 0.86 provider-path shape): a custom
+// provider receives a TranscriptContext, never a raw Context.
+function ctxWith(firstUser: string) {
+	return normalizeContext({
 		messages: [
 			{ role: "user", content: firstUser, timestamp: 0 },
 			{
@@ -186,7 +188,7 @@ function ctxWith(firstUser: string): Context {
 			},
 			{ role: "user", content: "latest turn", timestamp: 0 },
 		],
-	};
+	});
 }
 
 // ===========================================================================

package/scripts/check-acp-event-mapper.ts

@@ -11,8 +11,8 @@
 // Pure/deterministic — IN pnpm check.
 
 import { strict as assert } from "node:assert";
-import type { AssistantMessageEvent, Context } from "@earendil-works/pi-ai";
-import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+import type { AssistantMessageEvent } from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream, normalizeContext } from "@earendil-works/pi-ai";
 import { contextToAcpPrompt, contextTranscript } from "../pi-extensions/lib/acp/context.ts";
 import {
 	type AcpPiStreamState,
@@ -183,7 +183,14 @@ const deltas = (events: AssistantMessageEvent[]): string[] =>
 // 6) context conversion — transcript passthrough, no systemPrompt, single block
 // ---------------------------------------------------------------------------
 {
-	const context: Context = {
+	// `normalizeContext` is the 0.86 provider-path shape: the systemPrompt and the
+	// declared tools are FOLDED INTO a leading `role:"system"` message rather than
+	// staying on their own Context fields. That is exactly why the no-leak
+	// assertion below matters now — the secret is INSIDE `messages`, so the only
+	// thing keeping it out of the ACP child's transcript is renderMessage's
+	// explicit `case "system"` drop. A hand-built Context literal here would have
+	// proved nothing: the transcript loop never saw those fields to begin with.
+	const context = normalizeContext({
 		systemPrompt: "SECRET-SYSTEM-PROMPT-DO-NOT-LEAK",
 		tools: [{ name: "x", description: "d", parameters: {} as never }],
 		messages: [
@@ -226,9 +233,13 @@ const deltas = (events: AssistantMessageEvent[]): string[] =>
 				timestamp: 0,
 			},
 		],
-	};
+	});
+	// The fixture really does carry the prompt as a transcript message — assert the
+	// premise so a future pi that stops folding cannot turn the no-leak assertion
+	// into a vacuous one.
+	assert.equal(context.messages[0].role, "system", "normalizeContext put the systemPrompt in a leading system message");
 	const transcript = contextTranscript(context);
-	assert.ok(!transcript.includes("SECRET-SYSTEM-PROMPT"), "transcript must NOT leak context.systemPrompt");
+	assert.ok(!transcript.includes("SECRET-SYSTEM-PROMPT"), "transcript must NOT leak the folded system prompt");
 	assert.ok(!transcript.includes("private reasoning"), "transcript must NOT include assistant thinking");
 	assert.match(transcript, /User: first question/, "includes prior user turn");
 	assert.match(transcript, /Assistant: an answer/, "includes assistant text");
@@ -243,7 +254,7 @@ const deltas = (events: AssistantMessageEvent[]): string[] =>
 	assert.equal(prompt[0].type, "text", "prompt block is text");
 	assert.equal(prompt[0].text, transcript, "prompt text equals the transcript");
 
-	assert.deepEqual(contextToAcpPrompt({ messages: [] }), [], "empty history → empty prompt array");
+	assert.deepEqual(contextToAcpPrompt(normalizeContext({ messages: [] })), [], "empty history → empty prompt array");
 }
 
 console.log(

package/scripts/check-acp-prompt-builder.ts

@@ -16,7 +16,8 @@
 // pure scope lock over it. Pure/deterministic — IN pnpm check.
 
 import { strict as assert } from "node:assert";
-import type { Context } from "@earendil-works/pi-ai";
+import type { TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 import {
 	type AcpBootstrapPath,
 	buildAcpPrompt,
@@ -28,8 +29,15 @@ const REUSE_PATHS: AcpBootstrapPath[] = ["reuse", "resume", "load"];
 
 // A multi-turn context: a prior turn, an assistant answer, the real latest user
 // turn (with an image), and a SessionStart hook user-message appended AFTER it.
-function multiTurn(): Context {
-	return {
+//
+// Built through `normalizeContext` (pi-ai) because that is what pi 0.86 hands a
+// custom provider: `systemPrompt`/`tools` are folded into a LEADING
+// `role:"system"` message, never their own fields. A hand-built `Context`
+// literal here would test a shape production no longer receives — the
+// systemPrompt-leak assertions below only mean something when the prompt is
+// actually inside `messages`.
+function multiTurn(): TranscriptContext {
+	return normalizeContext({
 		systemPrompt: "SECRET-SYSTEM-PROMPT",
 		tools: [{ name: "x", description: "d", parameters: {} as never }],
 		messages: [
@@ -63,7 +71,7 @@ function multiTurn(): Context {
 			// must NOT pick this as the latest user delta.
 			{ role: "user", content: "device=thinkpad time_kst=20260618T160000", timestamp: 0 },
 		],
-	};
+	});
 }
 
 // ---------------------------------------------------------------------------
@@ -120,12 +128,12 @@ for (const path of REUSE_PATHS) {
 // 4) no assistant yet → first user of the whole context is the delta
 // ---------------------------------------------------------------------------
 {
-	const ctx: Context = {
+	const ctx = normalizeContext({
 		messages: [
 			{ role: "user", content: "only question", timestamp: 0 },
 			{ role: "user", content: "device=thinkpad time_kst=x", timestamp: 0 },
 		],
-	};
+	});
 	const delta = latestUserDelta(ctx);
 	assert.equal(delta.length, 1, "delta exists when there is a user turn");
 	assert.equal(delta[0].text, "only question", "first user wins (hook message skipped) even with no assistant");
@@ -135,7 +143,7 @@ for (const path of REUSE_PATHS) {
 // 5) trailing message is assistant (no user after it) → empty delta
 // ---------------------------------------------------------------------------
 {
-	const ctx: Context = {
+	const ctx = normalizeContext({
 		messages: [
 			{ role: "user", content: "q", timestamp: 0 },
 			{
@@ -156,7 +164,7 @@ for (const path of REUSE_PATHS) {
 				timestamp: 0,
 			},
 		],
-	};
+	});
 	assert.deepEqual(latestUserDelta(ctx), [], "no user after the last assistant → empty delta");
 }
 
@@ -164,7 +172,7 @@ for (const path of REUSE_PATHS) {
 // 6) empty context → empty for every path
 // ---------------------------------------------------------------------------
 {
-	const empty: Context = { messages: [] };
+	const empty = normalizeContext({ messages: [] });
 	assert.deepEqual(buildAcpPrompt(empty, "new"), [], "empty context → empty new prompt");
 	for (const path of REUSE_PATHS) {
 		assert.deepEqual(buildAcpPrompt(empty, path), [], `empty context → empty ${path} prompt`);

package/scripts/check-acp-prompt-lifecycle.ts

@@ -36,7 +36,8 @@ import { copyFileSync, mkdirSync, mkdtempSync, rmdirSync, rmSync } from "node:fs
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Message, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 import { isRetryableAssistantError } from "@earendil-works/pi-ai/compat";
 
 const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
@@ -215,7 +216,7 @@ function makeHarness(recordDir: string) {
 /** Start a turn and collect its events in the background. */
 function startTurn(
 	backend: any,
-	context: Context,
+	context: TranscriptContext,
 	options: Record<string, unknown>,
 	deps: unknown,
 ): { events: AssistantMessageEvent[]; done: Promise<void> } {
@@ -230,11 +231,27 @@ function startTurn(
 const sealed = (events: AssistantMessageEvent[]) =>
 	events.filter((e) => e.type === "done" || e.type === "error") as any[];
 
-const userCtx = (text: string): Context => ({ messages: [{ role: "user", content: text, timestamp: 0 }] }) as Context;
+// The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
+// every turn, and since 0.86 that declaration reaches a provider as the leading system
+// message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools
+// truthfulness preflight. A fixture that declares NO tools is therefore not "a turn with the
+// defaults" — it is a turn where the operator excluded everything, and the preflight rejects it
+// before the prompt is ever sent. So every provider-path context here is built through
+// `normalizeContext`, never cast `as Context`: the cast is exactly what hid this shape from
+// typecheck when the 0.86 pin landed.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
+
+const userCtx = (text: string): TranscriptContext =>
+	normalizeContext({ tools: PI_DECLARED_TOOLS, messages: [{ role: "user", content: text, timestamp: 0 }] });
 
 /** A reuse-shaped context: prior user, assistant, new user. */
-function reuseCtx(prior: string, latest: string): Context {
-	return {
+function reuseCtx(prior: string, latest: string): TranscriptContext {
+	return normalizeContext({
+		tools: PI_DECLARED_TOOLS,
 		messages: [
 			{ role: "user", content: prior, timestamp: 0 },
 			{
@@ -256,7 +273,7 @@ function reuseCtx(prior: string, latest: string): Context {
 			} as unknown as Message,
 			{ role: "user", content: latest, timestamp: 0 },
 		],
-	} as Context;
+	});
 }
 
 const TMP_EMIT = ".tmp-verify/acp-prompt-lifecycle";

package/scripts/check-acp-session-reuse.ts

@@ -30,7 +30,26 @@ import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmdirSync, rmSync,
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Message, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Context, Message, Model, TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
+
+// The pi built-ins the Claude child also exposes natively. pi declares its tool
+// surface on every turn; since 0.86 that declaration reaches a provider as the
+// leading system message's `toolsAdded` (normalizeContext), and backend.ts
+// replays it for the exclude-tools truthfulness preflight. A fixture that
+// declares NO tools is therefore not "a turn with the defaults" — it is a turn
+// where the operator excluded everything, and the preflight rejects it before
+// any spawn. So every provider-path context in this gate is built through `tctx`.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
+
+/** A provider-path context in the 0.86 shape: tools folded into a leading system message. */
+function tctx(messages: Context["messages"]): TranscriptContext {
+	return normalizeContext({ tools: PI_DECLARED_TOOLS, messages });
+}
 
 const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
 const opus = { id: "claude-opus-5" } as unknown as Model<Api>;
@@ -222,30 +241,28 @@ function mkAssistant(content: Array<{ type: "text"; text: string; textSignature?
 }
 
 // A multi-turn (reuse-shaped) context: a prior user, an assistant, a new user.
-function reuseCtx(prior: string, latest: string): Context {
-	return {
-		messages: [
-			{ role: "user", content: prior, timestamp: 0 },
-			{
-				role: "assistant",
-				content: [{ type: "text", text: "ok" }],
-				api: "x",
-				provider: "x",
-				model: "x",
-				usage: {
-					input: 0,
-					output: 0,
-					cacheRead: 0,
-					cacheWrite: 0,
-					totalTokens: 0,
-					cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
-				},
-				stopReason: "stop",
-				timestamp: 0,
+function reuseCtx(prior: string, latest: string): TranscriptContext {
+	return tctx([
+		{ role: "user", content: prior, timestamp: 0 },
+		{
+			role: "assistant",
+			content: [{ type: "text", text: "ok" }],
+			api: "x",
+			provider: "x",
+			model: "x",
+			usage: {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0,
+				totalTokens: 0,
+				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
 			},
-			{ role: "user", content: latest, timestamp: 0 },
-		],
-	};
+			stopReason: "stop",
+			timestamp: 0,
+		},
+		{ role: "user", content: latest, timestamp: 0 },
+	]);
 }
 
 const TMP_EMIT = ".tmp-verify/acp-session-reuse";
@@ -282,7 +299,7 @@ try {
 
 		// Pre-write a COMPATIBLE persisted record at a DIFFERENT acp id — if the
 		// backend (wrongly) resumed it, turn 1 would prompt "OLD-RESUME-ID".
-		const turn1Ctx: Context = { messages: [{ role: "user", content: "remember NONCE-AAA", timestamp: 0 }] };
+		const turn1Ctx = tctx([{ role: "user", content: "remember NONCE-AAA", timestamp: 0 }]);
 		store.writeSessionRecord(
 			store.buildSessionRecord(
 				{
@@ -350,7 +367,7 @@ try {
 		await collect(
 			backend.streamAcpTurn(
 				sonnet,
-				{ messages: [{ role: "user", content: "first", timestamp: 0 }] },
+				tctx([{ role: "user", content: "first", timestamp: 0 }]),
 				{ sessionId: "gate-B" },
 				h.deps,
 			) as Stream,
@@ -384,7 +401,7 @@ try {
 		const h = makeHarness(recordDir);
 		let release!: () => void;
 		h.setBlock(new Promise<void>((r) => (release = r)));
-		const ctx: Context = { messages: [{ role: "user", content: "only", timestamp: 0 }] };
+		const ctx = tctx([{ role: "user", content: "only", timestamp: 0 }]);
 		// turn A: first turn, blocks in prompt (still in flight, not yet retained).
 		const aDone = collect(backend.streamAcpTurn(sonnet, ctx, { sessionId: "gate-D" }, h.deps) as Stream);
 		await new Promise((r) => setTimeout(r, 20)); // let turn A claim the key + spawn
@@ -410,7 +427,7 @@ try {
 		await collect(
 			backend.streamAcpTurn(
 				sonnet,
-				{ messages: [{ role: "user", content: "x", timestamp: 0 }] },
+				tctx([{ role: "user", content: "x", timestamp: 0 }]),
 				{ sessionId: "gate-E1", cwd: "/w1" },
 				h.deps,
 			) as Stream,
@@ -421,7 +438,7 @@ try {
 		await collect(
 			backend.streamAcpTurn(
 				sonnet,
-				{ messages: [{ role: "user", content: "y", timestamp: 0 }] },
+				tctx([{ role: "user", content: "y", timestamp: 0 }]),
 				{ sessionId: "gate-E1", cwd: "/w2" },
 				h.deps,
 			) as Stream,
@@ -434,7 +451,7 @@ try {
 		await collect(
 			backend.streamAcpTurn(
 				sonnet,
-				{ messages: [{ role: "user", content: "x", timestamp: 0 }] },
+				tctx([{ role: "user", content: "x", timestamp: 0 }]),
 				{ sessionId: "gate-E2" },
 				h2.deps,
 			) as Stream,
@@ -481,7 +498,7 @@ try {
 		const t1 = await collect(
 			backend.streamAcpTurn(
 				sonnet,
-				{ messages: [{ role: "user", content: "hi NONCE-F", timestamp: 0 }] },
+				tctx([{ role: "user", content: "hi NONCE-F", timestamp: 0 }]),
 				{ sessionId: "gate-F" },
 				h.deps,
 			) as Stream,
@@ -513,15 +530,13 @@ try {
 
 		// F4: a `new` full-transcript rebuild DROPS a lifecycle-marked assistant block
 		// (context.ts filter) while keeping the real transcript text.
-		const ctxWithNotice: Context = {
-			messages: [
-				{ role: "user", content: "real user line", timestamp: 0 },
-				mkAssistant([
-					{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5]\n", textSignature: MARKER },
-					{ type: "text", text: "real assistant line" },
-				]),
-			],
-		};
+		const ctxWithNotice = tctx([
+			{ role: "user", content: "real user line", timestamp: 0 },
+			mkAssistant([
+				{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5]\n", textSignature: MARKER },
+				{ type: "text", text: "real assistant line" },
+			]),
+		]);
 		const built = ctxMod
 			.buildAcpPrompt(ctxWithNotice, "new")
 			.map((b: { text: string }) => b.text)
@@ -534,12 +549,10 @@ try {
 
 		// F5: a lifecycle-marked block does NOT change the reuse-compat signature —
 		// the per-message signature is identical with and without the notice.
-		const ctxNoNotice: Context = {
-			messages: [
-				{ role: "user", content: "real user line", timestamp: 0 },
-				mkAssistant([{ type: "text", text: "real assistant line" }]),
-			],
-		};
+		const ctxNoNotice = tctx([
+			{ role: "user", content: "real user line", timestamp: 0 },
+			mkAssistant([{ type: "text", text: "real assistant line" }]),
+		]);
 		assert.deepEqual(
 			store.contextMessageSignatures(ctxWithNotice),
 			store.contextMessageSignatures(ctxNoNotice),
@@ -639,7 +652,7 @@ try {
 			await collect(
 				backend.streamAcpTurn(
 					sonnet,
-					{ messages: [{ role: "user", content: "hi NONCE-G", timestamp: 0 }] },
+					tctx([{ role: "user", content: "hi NONCE-G", timestamp: 0 }]),
 					{ sessionId: "gate-G" },
 					h.deps,
 				) as Stream,
@@ -704,7 +717,7 @@ try {
 			await collect(
 				backend.streamAcpTurn(
 					sonnet,
-					{ messages: [{ role: "user", content: "hi NONCE-H", timestamp: 0 }] },
+					tctx([{ role: "user", content: "hi NONCE-H", timestamp: 0 }]),
 					{ sessionId: "gate-H-off" },
 					hOff.deps,
 				) as Stream,
@@ -720,7 +733,7 @@ try {
 			await collect(
 				backend.streamAcpTurn(
 					sonnet,
-					{ messages: [{ role: "user", content: "hi NONCE-H2", timestamp: 0 }] },
+					tctx([{ role: "user", content: "hi NONCE-H2", timestamp: 0 }]),
 					{ sessionId: "gate-H-on" },
 					hOn.deps,
 				) as Stream,
@@ -761,7 +774,7 @@ try {
 			await collect(
 				backend.streamAcpTurn(
 					sonnet,
-					{ messages: [{ role: "user", content: "hi NONCE-I1", timestamp: 0 }] },
+					tctx([{ role: "user", content: "hi NONCE-I1", timestamp: 0 }]),
 					{ sessionId: "gate-I-one" },
 					h.deps,
 				) as Stream,
@@ -769,7 +782,7 @@ try {
 			await collect(
 				backend.streamAcpTurn(
 					sonnet,
-					{ messages: [{ role: "user", content: "hi NONCE-I2", timestamp: 0 }] },
+					tctx([{ role: "user", content: "hi NONCE-I2", timestamp: 0 }]),
 					{ sessionId: "gate-I-two" },
 					h.deps,
 				) as Stream,