@junghanacs/entwurf 0.23.1 → 0.25.0

package/scripts/mutants/mux-fresh-call.json

@@ -18,7 +18,7 @@
 			"title": "claude-code goes back to the variadic space form, which swallows the prompt as an option value",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`, `--model=${model}`];"
+				"\t\t\treturn [\n\t\t\t\tcomposition.prompt,\n\t\t\t\t`--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]},${FRESH_CALL_DELIVERY_TOOL[\"claude-code\"]}`,\n\t\t\t\t`--model=${model}`,\n\t\t\t];"
 			],
 			"replace": [
 				"\t\t\treturn [composition.prompt, \"--allowedTools\", FRESH_CALL_CALLBACK_TOOL[\"claude-code\"], `--model=${model}`];"
@@ -55,9 +55,11 @@
 			"title": "Claude Code drops the explicit model token and silently resolves its ambient Opus default again",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`, `--model=${model}`];"
+				"\t\t\treturn [\n\t\t\t\tcomposition.prompt,\n\t\t\t\t`--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]},${FRESH_CALL_DELIVERY_TOOL[\"claude-code\"]}`,\n\t\t\t\t`--model=${model}`,\n\t\t\t];"
+			],
+			"replace": [
+				"\t\t\treturn [\n\t\t\t\tcomposition.prompt,\n\t\t\t\t`--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]},${FRESH_CALL_DELIVERY_TOOL[\"claude-code\"]}`,\n\t\t\t];"
 			],
-			"replace": ["\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CLAUDE-MODEL-ARGV]",
@@ -67,8 +69,8 @@
 			"claim": "FRESHCALL-CALLBACK-PRECEDES-TASK",
 			"title": "the task is framed before the callback instruction, so a sibling that stalls in the task never names itself",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\t\t`FIRST ACTION, before reading files or anything else: call ${tool} with ` +"],
-			"replace": ["\t\t`FINAL ACTION, after completing the task: call ${tool} with ` +"],
+			"find": ["\t\t\t\t\t`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`"],
+			"replace": ["\t\t\t\t\t`FINAL ACTION, after completing the task: call ${birthTool} with no arguments.`"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CALLBACK-PRECEDES-TASK]",
@@ -275,7 +277,7 @@
 			"claim": "FRESHCALL-COPILOT-CALLBACK-TOOL",
 			"title": "the Copilot callback names Claude Code's `mcp__server__tool` spelling — a dialect copied instead of measured, and the whole first turn is spent looking for a tool that is not there",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\tcopilot: \"entwurf-bridge-entwurf_v2\","],
+			"find": ["\tcopilot: \"entwurf-bridge-entwurf_callback\","],
 			"replace": ["\tcopilot: \"mcp__entwurf-bridge__entwurf_v2\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
@@ -669,7 +671,7 @@
 			"title": "the first turn stops naming where the result goes, so a sibling finishes its task, prints the answer in its own window, and the caller never learns it is done",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\t`When the task reaches its requested final result, send that result to the same target with ${tool}.`,"
+				"\t\t`When the task reaches its requested final result, send that result to the same target with ${deliveryTool}.`,"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -682,13 +684,24 @@
 			"title": "the Claude child loses the one sentence that tells it how to load a deferred callback tool — the framing goes back to naming a tool the child cannot call on its first turn, which is the measured silence: 0/5 directly callable, 5 of 14 production launches dead",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\"claude-code\": [\n\t\t\"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its\",\n\t\t'tools are deferred: load them first with ToolSearch(\"select:${callbackTool},${peersTool}\") —',\n\t\t\"it waits for the server — then call ${callbackTool}.\",\n\t],"
+				"\t\"claude-code\": [\n\t\t\"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its\",\n\t\t'tools are deferred: load them first with ToolSearch(\"select:${callbackTool},${deliveryTool},${peersTool}\") —',\n\t\t\"it waits for the server — then call ${callbackTool}.\",\n\t],"
 			],
 			"replace": ["\t\"claude-code\": [],"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:FRESHCOMP-TOOL-LOAD-HINT-CLAUDE-ONLY]",
 			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CALLBACK-ENV",
+			"title": "the launcher-computed callback pair is dropped from tmux -e, so the sibling's first action has to retype a garden id out of prose — Hard Rule 2",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t...callbackEnvAssignments(callback).flatMap((assignment) => [\"-e\", assignment]),"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CALLBACK-ENV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
 		}
 	]
 }

package/scripts/mutants/omp-fresh.json

@@ -45,7 +45,7 @@
 			"claim": "FRESHCALL-OMP-CALLBACK-TOOL-DIALECT",
 			"title": "the callback tool name spelled the way a reader expects instead of the way omp mints it — `entwurf_v2` keeps its digit, which omp's sanitizer charset [a-z_] eats. The sibling is told to call a tool that does not exist in its session, so the whole first turn is spent and no address ever comes back. A launch receipt still prints",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\tomp: \"mcp__entwurf_bridge_entwurf_v\","],
+			"find": ["\tomp: \"mcp__entwurf_bridge_entwurf_callback\","],
 			"replace": ["\tomp: \"mcp__entwurf_bridge_entwurf_v2\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
@@ -167,10 +167,8 @@
 			"claim": "OMP-BOOTSTRAP-CALLBACK-ONLY",
 			"title": "the task folded back into the stage-one prompt, so the sibling is asked to call back AND to work in one message. This is the prompt the failed LIVE actually ran, minus the missing tool: a competing goal beside the callback is what the two-stage split exists to remove, and nothing about argv or readiness would notice it coming back",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt({ target: payload.target, nonce: payload.nonce }));"],
-			"replace": [
-				"\t\t\tsend(`${buildOmpCallbackOnlyPrompt({ target: payload.target, nonce: payload.nonce })}\\n\\n${payload.task}`);"
-			],
+			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt());"],
+			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt()}\\n\\n${payload.task}`);"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-CALLBACK-ONLY]",
@@ -204,11 +202,9 @@
 			"claim": "OMP-BOOTSTRAP-RESULT-ARMS-ONLY",
 			"title": "the task sent from inside the tool_result handler again, instead of at the turn_end boundary. `[LIVE 2026-08-30]` this is the exact shape that failed: the hook log showed armed/ready/callback-observed/released, the release predicate was provably correct, and the task still never appeared in the session — because that handler runs while the callback turn is streaming. Every static contract about correlation and readiness stays green while the product delivers nothing",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": [
-				"\t\t\tlog(\"INFO\", `bootstrap-released nonce=${payload.nonce} toolCallId=${callId}: task armed for the next turn_end`);"
-			],
+			"find": ["\t\t\tlog(\"INFO\", `bootstrap-released toolCallId=${callId}: task armed for the next turn_end`);"],
 			"replace": [
-				"\t\t\tlog(\"INFO\", `bootstrap-released nonce=${payload.nonce} toolCallId=${callId}: task armed for the next turn_end`);\n\t\t\tphase = \"task-sent\";\n\t\t\tsend(payload.task);"
+				"\t\t\tlog(\"INFO\", `bootstrap-released toolCallId=${callId}: task armed for the next turn_end`);\n\t\t\tphase = \"task-sent\";\n\t\t\tsend(payload.task);"
 			],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,

package/scripts/mutants/pack-install.json

@@ -6,8 +6,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.85\\.1' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.87\\.1(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.0' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED]",
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.87\\.1(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.87\\.1(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",

package/scripts/mutants/pi-floor.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-floor",
+	"mutants": [
+		{
+			"claim": "PI-FLOOR-SINGLE-SOURCE",
+			"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
+			"subject": "pnpm-workspace.yaml",
+			"find": ["  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1'"],
+			"replace": ["  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0'"],
+			"gate": ["bash", "run.sh", "check-dep-versions"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-FLOOR-SINGLE-SOURCE]",
+			"signatureSource": "run.sh"
+		}
+	]
+}

package/scripts/mutants/release-gate.json

@@ -227,6 +227,54 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:CODEX-FIRST-ADMISSION-IS-RELEASE-MUST]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CODEX-OPERATOR-PREREQ-ABSENT-SKIPS",
+			"title": "a constant-false guard leaves the decline arm as dead code, so every absent operator input falls through to the assertions and exits FAIL again — the shape that made this MUST step red inside every cut and would require a per-cut exception",
+			"subject": "scripts/smoke-codex-fresh-live.ts",
+			"find": [
+				"\tconst absentInputs = OPERATOR_INPUTS.filter(([name]) => (process.env[name]?.trim() ?? \"\") === \"\");",
+				"\tif (absentInputs.length > 0) {"
+			],
+			"replace": [
+				"\tconst absentInputs = OPERATOR_INPUTS.filter(([name]) => (process.env[name]?.trim() ?? \"\") === \"\");",
+				"\tif (absentInputs.length > 0 && process.env.ENTWURF_NEVER_SET === \"1\") {"
+			],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-OPERATOR-PREREQ-ABSENT-SKIPS]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CODEX-OPERATOR-PREREQ-WRONG-FAILS",
+			"title": "turning the pid grammar into a decline means a malformed, dead or non-Codex app-server pid the operator DID supply reports as a missing prerequisite, so a broken answer buys silence where a cut reads silence as an unmet precondition rather than a defect",
+			"subject": "scripts/smoke-codex-fresh-live.ts",
+			"find": [
+				"\tok(",
+				"\t\t\"ENTWURF_CODEX_APP_SERVER_PID explicitly names the existing operator-owned app-server\",",
+				"\t\t/^[1-9]\\d*$/.test(pidText),"
+			],
+			"replace": [
+				"\tif (!/^[1-9]\\d*$/.test(pidText)) skipLive(LABEL, \"no usable app-server pid was supplied\");",
+				"\tok(",
+				"\t\t\"an app-server pid was supplied\",",
+				"\t\ttrue,"
+			],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-OPERATOR-PREREQ-WRONG-FAILS]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED",
+			"title": "deriving the app-server pid by process search in the release instructions teaches the exact inference the MUST step refuses, and on a host running several app-servers it hands the gate an arbitrary process to verify as the operator's answer",
+			"subject": ".claude/skills/entwurf-release/SKILL.md",
+			"find": [": \"${CODEX_APP_SERVER_PID:?state the app-server pid you started; never search for it}\""],
+			"replace": ["CODEX_APP_SERVER_PID=$(pgrep -f 'codex.*app-server' | head -1)"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		}
 	]
 }

package/scripts/mutants/retired-sent-surface.json

@@ -0,0 +1,32 @@
+{
+	"schemaVersion": 1,
+	"lane": "retired-sent-surface",
+	"mutants": [
+		{
+			"claim": "NO-RENDERER-WITHOUT-PRODUCER",
+			"title": "a renderer is registered for a customType nothing in this extension emits — a producer-less orphan box no operator can ever reach, the same shape that shipped for two releases behind comments naming producers that did not exist",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\tpi.registerMessageRenderer(SESSION_MESSAGE_TYPE, renderSessionMessage);"],
+			"replace": [
+				"\tpi.registerMessageRenderer(SESSION_MESSAGE_TYPE, renderSessionMessage);\n\tpi.registerMessageRenderer(\"entwurf-orphan\", renderSessionMessage);"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:NO-RENDERER-WITHOUT-PRODUCER]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "RETIRED-SENT-SURFACE-ABSENT",
+			"title": "the retired sender-side echo constant comes back as a public export of a SHIPPED file — a name an npm consumer can import and nothing in the repo can ever produce, which is the promise #120 P3 removed rather than renamed",
+			"subject": "protocol.js",
+			"find": ["export const ENTWURF_PROJECT_CONTEXT_OPEN_TAG = \"<project-context\";"],
+			"replace": [
+				"export const ENTWURF_PROJECT_CONTEXT_OPEN_TAG = \"<project-context\";\nexport const ENTWURF_SENT_MESSAGE_TYPE = \"entwurf-sent\";"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:RETIRED-SENT-SURFACE-ABSENT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -29,10 +29,10 @@
 		},
 		{
 			"claim": "V2PROD-INBAND-ERROR-WIRED",
-			"title": "the production sendOverSocket closure stops copying response.error onto the RpcSendResult, so a receiver's named in-band refusal is stranded one hop before driveSend and the caller sees a reasonless rejected",
+			"title": "the production sendOverSocket closure stops copying response.error onto the RpcSendResult, so a receiver's named in-band refusal is stranded one hop before driveSend and the caller sees a reasonless rejected (#120 P2: the wire seam now also classifies the acceptance boundary, so the same line carries one more field — the mutation still drops the receiver's own error)",
 			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
-			"find": ["\t\t\treturn { success: response.success, error: response.error };"],
-			"replace": ["\t\t\treturn { success: response.success };"],
+			"find": ["\t\t\treturn { success: response.success, error: response.error, boundary };"],
+			"replace": ["\t\t\treturn { success: response.success, boundary };"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-production"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2PROD-INBAND-ERROR-WIRED]",
@@ -40,15 +40,15 @@
 		},
 		{
 			"claim": "V2SURF-PI-MODE-SCOPE",
-			"title": "pi-native mode param reverts to \"Delivery mode for a live send\" (false for native-push)",
+			"title": "pi-native mode param reverts to \"Delivery mode for a live send\" (false for native-push) (#120 P2: the description was rewritten to stop claiming an interrupt, so the mutation now strips the rail scope from the corrected sentence)",
 			"subject": "pi-extensions/entwurf-control.ts",
 			"find": [
-				"\t\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (immediate) or follow_up (after task). \" +",
+				"\t\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. \" +",
 				"\t\t\t\t\t\"The mailbox and native-push plans carry no mode, so it has no effect on those rails.\","
 			],
 			"replace": [
-				"\t\t\t\t\t\"Delivery mode for a live send: steer (immediate, interrupt the current turn) or follow_up \" +",
-				"\t\t\t\t\t\"(queued after the current task finishes running to completion).\","
+				"\t\t\t\t\t\"Delivery mode for a live send: steer (ask the steering queue) or follow_up (ask the follow-up queue). \" +",
+				"\t\t\t\t\t\"Both queues are volatile process memory.\","
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,

package/scripts/probe-bridge-command.ts

@@ -67,6 +67,7 @@ export const EXPECTED_TOOLS = [
 	"entwurf_register_native",
 	"entwurf_fresh_call",
 	"entwurf_resume_call",
+	"entwurf_callback",
 ] as const;
 const DEFAULT_TIMEOUT_MS = 10_000;
 /** How long a probed child gets to die politely before it is killed outright. */

package/scripts/smoke-acp-session-reuse-live.ts

@@ -24,11 +24,26 @@ import { copyFileSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Model, TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+// The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
+// every turn, and since 0.86 that declaration reaches a provider as the leading system
+// message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools
+// truthfulness preflight. A fixture that declares NO tools is therefore not "a turn with the
+// defaults" — it is a turn where the operator excluded everything, and the preflight rejects it
+// before the prompt is ever sent. So every provider-path context here is built through
+// `normalizeContext`, never typed as a raw `Context`: that annotation is exactly what hid this
+// shape from typecheck when the 0.86 pin landed.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
+
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 
 function fail(msg: string): never {
@@ -101,7 +116,8 @@ async function main(): Promise<void> {
 	console.error(`[smoke-acp-session-reuse-live] codeword: ${codeword}`);
 
 	// --- turn 1 (new): introduce the codeword, full transcript ---
-	const turn1: Context = {
+	const turn1: TranscriptContext = normalizeContext({
+		tools: PI_DECLARED_TOOLS,
 		messages: [
 			{
 				role: "user",
@@ -109,7 +125,7 @@ async function main(): Promise<void> {
 				timestamp: 0,
 			},
 		],
-	};
+	});
 	const r1 = await withTimeout(
 		"turn 1",
 		consume(backend.streamShellAcp(model, turn1, options) as Stream),
@@ -121,7 +137,9 @@ async function main(): Promise<void> {
 	console.error("[smoke-acp-session-reuse-live] starting turn 2 reuse prompt");
 
 	// --- turn 2 (reuse): ask for the codeword, DELTA ONLY ---
-	const turn2: Context = {
+	// turn1.messages already carries the folded system message, so spreading it keeps the
+	// declared surface on the reuse turn too; normalizeContext does not double it.
+	const turn2: TranscriptContext = normalizeContext({
 		messages: [
 			...turn1.messages,
 			{
@@ -147,7 +165,7 @@ async function main(): Promise<void> {
 				timestamp: 0,
 			},
 		],
-	};
+	});
 	const r2 = await withTimeout(
 		"turn 2",
 		consume(backend.streamShellAcp(model, turn2, options) as Stream),

package/scripts/smoke-agy-install-state.sh

@@ -67,7 +67,7 @@ write_mcp_fake() {   # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE
@@ -89,7 +89,7 @@ if [ "${REVIEW_ENV:-}" = "fail" ]; then echo configured-env-failure >&2; exit 24
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-codex-fresh-live.ts

@@ -669,12 +669,75 @@ async function run(): Promise<void> {
 			"set LIVE=1 plus ENTWURF_CODEX_APP_SERVER_PID, ENTWURF_CODEX_FRESH_MODEL, and ENTWURF_CODEX_FRESH_PI_MODEL to run; this opens real Codex and Pi windows and spends model turns.",
 		);
 	}
+
+	// ── THE OPERATOR-SUPPLIED PREREQUISITE TRIPLE, AND WHY ITS ABSENCE IS A SKIP ──
+	//
+	// Entwurf does not own the Codex app-server (VERIFY: "The A cell takes no inferred
+	// server or models"), so these three values can only come from the operator. That
+	// stays true. What was wrong is the CLASSIFICATION of their absence.
+	//
+	// `[측정 2026-09-23]` the skip line directly above promised four prerequisites in one
+	// breath — LIVE=1 *plus* the three env names — but only the first could ever produce a
+	// SKIP. The other three were `ok()` assertions, and `ok()` throws, so a missing
+	// operator input exited as FAIL. `release_gate()` supplies none of them, so this MUST
+	// step declined as a FAILURE inside every aggregate on every host: 0.25.0's own
+	// candidate receipt reads `MUST PASS=23 FAIL=1`, and the release record had to carry a
+	// prose classification explaining that the one red was "the shape of that step", and the
+	// cut stayed BLOCKED. A contract that manufactures a red every cut and then needs a human
+	// to excuse it is not a floor.
+	//
+	// `scripts/lib/step-outcome.sh` already wrote the rule this violated: "a step that RAN
+	// AND BROKE and a step that NEVER RAN are different facts, and a release record that
+	// blurs them is worthless: the first is a defect to fix, the second is a prerequisite to
+	// supply." An absent operator input is the second.
+	//
+	// So the axis is split, and the split is the whole repair:
+	//   ABSENT  (unset/empty) -> skipLive: nothing ran, the missing names are printed, and
+	//                            `--cut` still refuses it as BLOCKED (MUST SKIP). Nothing is
+	//                            excused — a cut without this receipt remains impossible.
+	//   PRESENT BUT WRONG     -> FAIL, unchanged: a malformed or dead PID, a process whose
+	//                            argv is not a Codex app-server, a foreign uid, A == S. The
+	//                            operator answered, and the answer is a defect.
+	// Nothing is inferred either way, and no default is invented for a value the operator
+	// did not give. The reproducible green is the invocation VERIFY and the release skill's
+	// P5 both now spell out, and `release_gate` needs no plumbing for it: measured on this
+	// source, that function exports no scrub and unsets nothing, so an exported triple
+	// already reaches this step.
+	//
+	// DELIBERATELY NOT MOVED: the installed-config preflights below (`codexFreshPreflight`,
+	// `codexCallerFreshPreflight`, `codexLaunchCwdFreshPreflight`). Those are host state
+	// `setup` establishes and the Codex doctors cover, and the file header's contract
+	// already decided them — "missing system birth, user MCP/status/terminal-title config,
+	// app-server, models, runtime, bridge, or tmux seat is a FAIL". A one-time answered
+	// launch directory is host setup, not a per-invocation input, and reclassifying it would
+	// be a second contract change riding this one.
+	const OPERATOR_INPUTS = [
+		["ENTWURF_CODEX_APP_SERVER_PID", "the pid of the app-server YOU started (never inferred)"],
+		["ENTWURF_CODEX_FRESH_MODEL", "the Codex-side model this cell may spend a turn on"],
+		["ENTWURF_CODEX_FRESH_PI_MODEL", "the pi-side model of the callback sibling"],
+	] as const;
+	const absentInputs = OPERATOR_INPUTS.filter(([name]) => (process.env[name]?.trim() ?? "") === "");
+	if (absentInputs.length > 0) {
+		skipLive(
+			LABEL,
+			`this cell takes no inferred server or models, and ${absentInputs.length} operator-supplied ` +
+				`prerequisite(s) are absent: ${absentInputs.map(([name, why]) => `${name} (${why})`).join("; ")}. ` +
+				"Supply them on the invocation — LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<pid> " +
+				"ENTWURF_CODEX_FRESH_MODEL=<codex-model> ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> — either for the " +
+				"standalone run or for `./run.sh release-gate <scratch> --cut`, which inherits them. " +
+				"A cut is still blocked without this receipt: --cut reads a MUST SKIP as red.",
+		);
+	}
+
 	ok("the measured/certified host axis is Linux", process.platform === "linux", `host=${process.platform}`);
 
+	// Present, so a malformed value is the operator's answer being wrong — a FAIL, not a
+	// declined prerequisite. The absence arm above already left.
 	const pidText = process.env.ENTWURF_CODEX_APP_SERVER_PID?.trim() ?? "";
 	ok(
 		"ENTWURF_CODEX_APP_SERVER_PID explicitly names the existing operator-owned app-server",
 		/^[1-9]\d*$/.test(pidText),
+		`ENTWURF_CODEX_APP_SERVER_PID=${JSON.stringify(pidText)} is not a positive decimal pid`,
 	);
 	const appServerPid = Number(pidText);
 	const procDir = `/proc/${appServerPid}`;
@@ -749,10 +812,13 @@ async function run(): Promise<void> {
 		`fixture-session=${fixtureCoordinate.sessionId}\nfixture-name=${fixtureSessionName}\n` +
 		`fixture-window=${fixtureCoordinate.windowId}`;
 
+	// Both are non-empty: the prerequisite arm at the top of `run` left otherwise. Asserting
+	// `.length > 0` again here would be a tautology dressed as a check, so the pair is
+	// RECORDED instead — the tier a live receipt is read on is a fact the evidence needs, and
+	// 0.25.0 already had to explain in prose that its pi leg ran on terra rather than luna.
 	const codexModel = process.env.ENTWURF_CODEX_FRESH_MODEL?.trim() ?? "";
 	const piModel = process.env.ENTWURF_CODEX_FRESH_PI_MODEL?.trim() ?? "";
-	ok("ENTWURF_CODEX_FRESH_MODEL explicitly names the Codex runtime model", codexModel.length > 0);
-	ok("ENTWURF_CODEX_FRESH_PI_MODEL explicitly names the Pi callback sibling model", piModel.length > 0);
+	receipts["1b-operator-supplied-models"] = `codex=${codexModel}\npi=${piModel}`;
 	const codexRuntime = resolveExecutable("codex", appServerEnv);
 	ok("the Codex runtime resolves on the app-server PATH", codexRuntime !== null);
 	const bridgeRuntime = resolveExecutable("entwurf-bridge", appServerEnv);
@@ -1016,11 +1082,19 @@ async function run(): Promise<void> {
 		message: initialPiInstruction,
 	});
 	receipts["5-fixture-to-initial-pi-v2"] = instructInitialPi.text;
+	// #120 P2: the control-socket rail answers with the ACCEPTANCE BOUNDARY the receiver observed,
+	// and every member of that closed set is a success. The initial Pi is mid-turn while the fixture
+	// addresses it, so `queued-follow-up` is an ORDINARY answer here — measured 2026-09-23, this
+	// exact step. The old `sent|delivered` pin passed only when the caller happened to be idle, and
+	// before P2 it passed on the busy path too because the rail said `sent` either way; `delivered`
+	// was never a member of the set at all. The sibling LIVE smokes took this widening in 6d90d73
+	// (`smoke-herdr-fresh-call-live.ts`, `smoke-mux-lifecycle-live.ts`); this step was missed.
 	ok(
 		"the fixture addressed the real initial Pi caller through an actual control-socket entwurf_v2 receipt",
 		!instructInitialPi.isError &&
-			/control-socket/i.test(instructInitialPi.text) &&
-			/(?:sent|delivered)/i.test(instructInitialPi.text),
+			/entwurf_v2 control-socket → (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/.test(
+				instructInitialPi.text,
+			),
 		instructInitialPi.text,
 	);
 
@@ -1325,15 +1399,22 @@ async function run(): Promise<void> {
 	assertExactSourceToolCalls(
 		piSourceToolReceipts(readInitialPiEntries()),
 		[
-			{
-				toolName: "entwurf_v2",
-				arguments: {
-					target: callerGid,
-					intent: "fire-and-forget",
-					message: initialPiNonce,
-					wants_reply: false,
-				},
-			},
+			// 0.24.0 moved a pi sibling's first action to the ZERO-ARGUMENT eighth verb, and this
+			// smoke's own launch receipt says so in the same run: "its first action is the
+			// zero-argument callback verb (codex is the one arm that still sends the nonce as
+			// arguments)". The Codex audit below therefore keeps its `entwurf_v2` shape, and only
+			// this one moves. `{}` is matched by deep-strict equality, so it pins the verb's actual
+			// contract — a target or message typed here would be a second address axis and the verb
+			// refuses it by name.
+			//
+			// Nothing is weakened by dropping the nonce from THIS expectation: the correlation is
+			// proven earlier and from the delivered body, which is where a nonce can actually be
+			// corrupted — `the initial Pi callback carries the exact launch nonce` (:970-973) reads
+			// the fixture's own mailbox, requires exactly one exact match and refuses duplicates,
+			// and the two cells beside it bind that callback's sender envelope to a real pi V3
+			// citizen. This audit's job is the different one its name says: exactly these calls,
+			// once each, and nothing else.
+			{ toolName: "entwurf_callback", arguments: {} },
 			{
 				toolName: "entwurf_fresh_call",
 				arguments: {

package/scripts/smoke-copilot-mcp-state.sh

@@ -26,7 +26,7 @@ write_mcp_fake() {
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE