@junghanacs/entwurf 0.23.1 → 0.25.0

package/scripts/smoke-herdr-fresh-call-live.ts

@@ -83,6 +83,16 @@ import { joinKeyOf, parseHerdrPaneList } from "../pi-extensions/lib/herdr-placem
 import { assessLauncherCleanup, snapshotClaudeLauncher, verifyClaudeLauncher } from "./lib/claude-launcher-fence.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
+/**
+ * #120 P2: the control-socket rail answers with the ACCEPTANCE BOUNDARY the receiver observed, and
+ * every member of that set is a success. The caller here is mid-turn while its child calls back,
+ * so `queued-steer` is the ORDINARY answer — the old literal `→ sent` pin would have gone red on
+ * the common case and passed only when the caller happened to be idle. What must still be absent
+ * is a REFUSAL, which the negative beside it now names directly (`rejected` / `failed`) instead of
+ * as "anything that is not the word sent".
+ */
+const CONTROL_ACCEPTED = /entwurf_v2 control-socket → (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/;
+
 const LABEL = "smoke-herdr-fresh-call-live";
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const REAL_HOME = process.env.HOME ?? os.homedir();
@@ -186,17 +196,38 @@ function transcriptRecords(file: string): string[] {
 }
 
 /**
- * The id of the `entwurf_v2` toolCall in this record that IS the callback, or null. Pi writes a call
- * and its result as two records; this is one half of the join that replaces a same-record read.
+ * The BARE verb names, as the two surfaces this smoke reads actually spell them — NOT the
+ * model-facing dialect. `[측정 2026-09-20, this smoke's own red fixture]` the claude MCP activity
+ * log carries `Calling MCP tool: entwurf_callback` / `Tool 'entwurf_callback' completed`, and pi
+ * writes `"type":"toolCall","name":"entwurf_callback"`; neither records
+ * `mcp__entwurf-bridge__entwurf_callback`. The per-host dialect is owned by
+ * `FRESH_CALL_CALLBACK_TOOL` / `FRESH_CALL_DELIVERY_TOOL` in `fresh-call-composition.ts` and is
+ * what the FRAMING says; these two are what an OBSERVER sees, and conflating them is what this
+ * pair of constants exists to stop.
+ */
+const CALLBACK_VERB = "entwurf_callback";
+const DELIVERY_VERB = "entwurf_v2";
+
+/**
+ * The id of the CALLBACK toolCall in this record, or null. Pi writes a call and its result as two
+ * records; this is one half of the join that replaces a same-record read.
+ *
+ * WHAT MAKES IT THE CALLBACK `[ff09522]`. It used to be the ARGUMENTS: message === nonce, target
+ * === the caller, intent === fire-and-forget. That predicate is gone because the thing it read is
+ * gone — the birth verb takes ZERO arguments and reads the caller and the nonce out of its own
+ * process env, so there is nothing in the call for a model to get wrong and nothing here to
+ * compare. What identifies the callback now is the verb plus the ABSENCE of an address: a call
+ * carrying a target or a message is a model supplying an address, which is the second address axis
+ * Hard Rule 2 refuses, and it is not this act.
  *
- * WHAT MAKES IT THE CALLBACK, READ STRUCTURALLY `[sol 재검 2026-09-18]`. An earlier version only
- * asked whether the serialised arguments CONTAINED the nonce, which a call carrying `prefix+nonce`,
- * or the right nonce to the wrong target, satisfies just as well — and then the later, correct call
- * is the one that produces the artifact, so the predicate could join a wrong call to a right
- * delivery. The arguments are an object, so they are read as one: the message must BE the nonce,
- * the target must be the caller that minted it, and the intent must be the one the framing names.
+ * The nonce↔sender correlation the old predicate carried did not disappear with it — it moved to
+ * the DELIVERED ARTIFACT, which this smoke checks independently and earlier ("the child's callback
+ * ARRIVED … its body is a production nonce and its sender is the child the direct witness resolved
+ * to"). Two records, one event, same as before; only the half that names the call has changed.
  */
 function entwurfCallIdFor(record: string, nonce: string, callerGid: string): string | null {
+	void nonce;
+	void callerGid;
 	let parsed: unknown;
 	try {
 		parsed = JSON.parse(record);
@@ -207,16 +238,14 @@ function entwurfCallIdFor(record: string, nonce: string, callerGid: string): str
 	if (!Array.isArray(content)) return null;
 	for (const part of content) {
 		const call = part as { type?: unknown; name?: unknown; id?: unknown; arguments?: unknown };
-		if (call.type !== "toolCall" || call.name !== "entwurf_v2") continue;
-		const args = call.arguments as
-			| { message?: unknown; target?: unknown; intent?: unknown; wants_reply?: unknown }
-			| undefined;
-		if (typeof args !== "object" || args === null) continue;
-		if (args.message !== nonce) continue;
-		if (args.target !== callerGid) continue;
-		if (args.intent !== "fire-and-forget") continue;
-		// The framing asks for no reply; a call that asked for one is a different act.
-		if (args.wants_reply === true) continue;
+		if (call.type !== "toolCall" || call.name !== CALLBACK_VERB) continue;
+		// Zero-argument verb: absent, null and `{}` are all the shape it is called with. A supplied
+		// target or message is a model naming an address the env already owns — not this act.
+		const args = call.arguments as { message?: unknown; target?: unknown } | undefined | null;
+		if (args !== undefined && args !== null) {
+			if (typeof args !== "object" || Array.isArray(args)) continue;
+			if (args.target !== undefined || args.message !== undefined) continue;
+		}
 		return typeof call.id === "string" ? call.id : null;
 	}
 	return null;
@@ -830,10 +859,7 @@ async function main(): Promise<void> {
 					callId === null
 						? -1
 						: childRecords.findIndex(
-								(record, i) =>
-									i > callAt &&
-									record.includes("entwurf_v2 control-socket → sent") &&
-									toolResultIdOf(record) === callId,
+								(record, i) => i > callAt && CONTROL_ACCEPTED.test(record) && toolResultIdOf(record) === callId,
 							);
 				// The LAST mention of the task token, so the birth prompt — which carries it, first —
 				// cannot be what satisfies "the work came after".
@@ -845,14 +871,14 @@ async function main(): Promise<void> {
 					}
 				}
 				ok(
-					`${cell.label}: the child decoded the one-line birth argv and ran the task only AFTER its callback — the \`sent\` outcome belongs, by toolCallId, to the very call that carried the delivered nonce, and the task token appears in a record after it`,
+					`${cell.label}: the child decoded the one-line birth argv and ran the task only AFTER its callback — the ACCEPTED outcome belongs, by toolCallId, to the very call that carried the delivered nonce, and the task token appears in a record after it`,
 					nonce.length > 0 && callAt >= 0 && sentAt > callAt && workedAt > sentAt,
 				);
 				ok(
-					`${cell.label}: the child's OWN tool result says the callback was DELIVERED on the rail its caller answers on — \`entwurf_v2 control-socket → sent\` — not a timeout, not a reject, not a dirty lock`,
-					childText.includes("entwurf_v2 control-socket → sent") &&
+					`${cell.label}: the child's OWN tool result says the callback was ACCEPTED on the rail its caller answers on — one of \`sent|queued-steer|queued-follow-up|accepted-unknown-boundary\` — not a timeout, not a reject, not a dirty lock`,
+					CONTROL_ACCEPTED.test(childText) &&
 						!/entwurf_v2 [a-z-]+ (?:execution failed:|DELIVERED \()/.test(childText) &&
-						!/entwurf_v2 control-socket → (?!sent)[a-z-]+/.test(childText),
+						!/entwurf_v2 control-socket → (?:rejected|failed)/.test(childText),
 				);
 			} else {
 				const childActivity = mcpActivityBySession(root).get(childNative) ?? [];
@@ -864,23 +890,27 @@ async function main(): Promise<void> {
 				// OFFERS exactly that corroboration ("you can corroborate the caller first if you
 				// want to"), so the old oracle contradicted our own prompt and would have forbidden
 				// the behaviour we asked for. What still must hold is everything the claim was
-				// actually about — the callback lands before any work, it completes, and no
-				// entwurf_v2 in the log failed or timed out.
+				// actually about — the callback lands before any work, it completes, and neither the
+				// callback verb nor the delivery verb failed or timed out anywhere in the log.
+				// `[ff09522]` the verb this joins on MOVED: the birth callback is `entwurf_callback`
+				// and `entwurf_v2` is now only the DELIVERY the closing line asks for. Joining on the
+				// old name does not merely miss — it mis-attributes, finding the result-delivery call
+				// and then reporting the real callback as forbidden work before it.
 				// ONLY what the framing actually offers. `entwurf_self` used to sit in this set and
 				// nothing ever proposed it to the child — an allowance for a tool we do not mention
 				// widens the oracle without widening the contract (sol D1, 2026-09-18).
 				const READ_ONLY_FIRST = new Set(["entwurf_peers"]);
-				const beforeCallback = order.slice(0, Math.max(order.indexOf("entwurf_v2"), 0));
+				const beforeCallback = order.slice(0, Math.max(order.indexOf(CALLBACK_VERB), 0));
 				// THE JOIN THIS AXIS CAN ACTUALLY MAKE. The claude MCP log records WHICH tool was
 				// called and whether it completed — never its arguments or its result body — so
-				// "the first entwurf_v2 completed" alone would also be true of a call that delivered
+				// "the first callback completed" alone would also be true of a call that delivered
 				// somebody else's nonce or came back as a semantic reject over a successful
 				// transport. The second artifact closes it: the caller's own delivered message
 				// carries the EXACT nonce and the child as its sender, and its enqueue timestamp has
 				// to fall inside the window of that first call. Two independent records, one event.
-				const callAt = indexOfEntry(childActivity, (e) => (e.debug ?? "") === "Calling MCP tool: entwurf_v2");
+				const callAt = indexOfEntry(childActivity, (e) => (e.debug ?? "") === `Calling MCP tool: ${CALLBACK_VERB}`);
 				const doneAt = indexOfEntry(childActivity, (e) =>
-					(e.debug ?? "").startsWith("Tool 'entwurf_v2' completed successfully"),
+					(e.debug ?? "").startsWith(`Tool '${CALLBACK_VERB}' completed successfully`),
 				);
 				const callbackStamp = deliveredMessages(String(fenced.ENTWURF_META_MAILBOX_DIR), callerGid)[0]?.file ?? "";
 				const stampedAt = Date.parse(
@@ -902,14 +932,19 @@ async function main(): Promise<void> {
 					// here, and a claim about "any work" is wider than the oracle. What IS observed, and
 					// is the thing the framing actually asks for, is the ORDER OF TOOLS: the first
 					// non-read-only tool this child called was the callback.
-					`${cell.label}: the child's FIRST non-read-only tool call was the callback — the FIRST entwurf_v2 completed successfully and the delivered callback carrying this exact nonce was enqueued inside that call's own window, preceded only by the read-only corroboration the framing offers, with no failed or timed-out entwurf_v2 anywhere in its log (this cell reads tool activity only; assistant text is not observable on this rail)`,
+					`${cell.label}: the child's FIRST non-read-only tool call was the zero-argument ${CALLBACK_VERB} — it completed successfully and the delivered callback carrying this exact nonce was enqueued inside that call's own window, preceded only by the read-only corroboration the framing offers, with neither ${CALLBACK_VERB} nor ${DELIVERY_VERB} failing or timing out anywhere in its log (this cell reads tool activity only; assistant text is not observable on this rail)`,
 					childActivity.length > 0 &&
-						order.includes("entwurf_v2") &&
+						order.includes(CALLBACK_VERB) &&
 						beforeCallback.every((name) => READ_ONLY_FIRST.has(name)) &&
 						within &&
 						callbackArrived &&
-						!childActivity.some(
-							(e) => (e.debug ?? "").startsWith("Tool 'entwurf_v2' failed") || (e.error ?? "").includes("entwurf_v2"),
+						// BOTH verbs, because the child uses both: the birth callback and, after the
+						// work, the delivery verb the framing's closing line names. A failed delivery
+						// is as fatal to this rail as a failed callback.
+						![CALLBACK_VERB, DELIVERY_VERB].some((verb) =>
+							childActivity.some(
+								(e) => (e.debug ?? "").startsWith(`Tool '${verb}' failed`) || (e.error ?? "").includes(verb),
+							),
 						),
 				);
 			}

package/scripts/smoke-herdr-raw-install-live.sh

@@ -490,7 +490,7 @@ for (const name of ["entwurf", "entwurf-bridge", "entwurf-statusline"]) {
 }
 
 // The REAL subcommand, from the installed bin, under node_modules — which is the branch of
-// start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (run.sh:5187), so a
+// start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (`EXPECT_TOOLS` in run.sh check-bridge), so a
 // zero exit here is the artifact listing all seven garden verbs and no eighth.
 const run = spawnSync(path.join(binDir, "entwurf"), ["check-bridge"], { encoding: "utf8" });
 const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
@@ -507,6 +507,7 @@ const verbs = (said.match(/entwurf_[a-z0-9_]+/g) ?? []).filter((v, i, a) => a.in
 // one; the two disagreeing is the signal, and a verb genuinely added upstream reddens this
 // smoke until somebody says so here too.
 const EXPECTED_VERBS = [
+  "entwurf_callback",
   "entwurf_fresh_call",
   "entwurf_inbox_read",
   "entwurf_peers",
@@ -519,7 +520,7 @@ console.log(`  VERBS ${verbs.join(",") || "<none>"}`);
 if (run.status === 0) ok(`entwurf check-bridge exit 0 from the installed bin (${verbs.length} verbs listed)`);
 else no(`entwurf check-bridge exit ${run.status}: ${said.trim().slice(0, 400)}`);
 JSON.stringify(verbs) === JSON.stringify(EXPECTED_VERBS)
-  ? ok(`the receipt names EXACTLY the seven garden verbs (${EXPECTED_VERBS.length}), parsed from what the installed bin answered`)
+  ? ok(`the receipt names EXACTLY the eight garden verbs (${EXPECTED_VERBS.length}), parsed from what the installed bin answered`)
   : no(`verb set mismatch — want ${JSON.stringify(EXPECTED_VERBS)} got ${JSON.stringify(verbs)}`);
 process.exit(bad);
 ' "$ACTIVE" "$REGISTRY" "$PLUGIN_ID" || fail=1
@@ -553,13 +554,19 @@ const HOME = process.env.HOME;
 const SOCKET_DIR = path.join(HOME, ".pi", "entwurf-control");
 const META_DIR = path.join(HOME, ".pi", "agent", "meta-sessions");
 const ENTWURF_BIN = process.argv[2];
+// The ENTRY POINT is an argument, because there are two of them and they are different
+// claims. `pi --entwurf-control` proves the WIRING; `entwurf pi` proves the LAUNCHER a user
+// received from npm. One program, so neither claim drifts away from the other.
+const LABEL = process.argv[3];
+const [COMMAND, ...COMMAND_ARGS] = process.argv.slice(4);
 
 let bad = 0;
 const ok = (m) => console.log("  ok    " + m);
 const no = (m) => { console.log("  FAIL  " + m); bad = 1; };
 const ls = (dir) => { try { return fs.readdirSync(dir); } catch { return []; } };
 
-const child = spawn("pi", ["--entwurf-control", "--mode", "rpc"], { stdio: ["pipe", "pipe", "pipe"] });
+console.log(`  ENTRY  ${LABEL}: ${COMMAND} ${COMMAND_ARGS.join(" ")}`);
+const child = spawn(COMMAND, COMMAND_ARGS, { stdio: ["pipe", "pipe", "pipe"] });
 let stderr = "";
 child.stderr.on("data", (d) => { stderr += d.toString(); });
 
@@ -655,14 +662,14 @@ child.stdout.on("data", (d) => {
 child.on("error", (err) => { no(`pi failed to spawn: ${err.message}`); done(1); });
 child.on("exit", (code) => {
 	if (settled) return;
-	no(`pi exited ${code} before answering get_state — stderr: ${stderr.trim().slice(0, 600)}`);
+	no(`${LABEL}: the session exited ${code} before answering get_state — stderr: ${stderr.trim().slice(0, 600)}`);
 	done(1);
 });
 
 setTimeout(() => { child.stdin.write(`${JSON.stringify({ type: "get_state", id: "g1" })}\n`); }, 500);
 setTimeout(() => { if (!settled) { no("pi did not answer get_state within 60s"); done(1); } }, 60_000);
 DRIVER_EOF
-node /tmp/use-path-drive.mjs "$ACTIVE/node_modules/.bin/entwurf" || fail=1
+node /tmp/use-path-drive.mjs "$ACTIVE/node_modules/.bin/entwurf" "the plugin wiring" pi --entwurf-control --mode rpc || fail=1
 
 # ── 8. the status fan, driven by the REAL binaries this install produced ─────
 # `check-herdr-plugin` already drives `lib/status.mjs` against stub `entwurf` and `herdr`
@@ -734,8 +741,86 @@ if printf '%s' "$fan_with_server" | grep -qx '1 citizen(s) not shown: nobody cou
 else
   bad "the fan drew no '1 citizen(s) not shown ... (unobserved)' accounting for the citizen born in [7]"
 fi
+
+# ── 8b. the SAME fan with the ENTWURF_BIN crutch REMOVED (#116 A-D3=C) ──────
+# The two runs above hand the pane `ENTWURF_BIN`, which is exactly the operator crutch D3=C exists
+# to delete: with it, this cell stays green whether or not the ledger fallback exists, so it can
+# certify nothing about the first screen a real user sees. `plugins/herdr/README.md` says the plugin
+# puts NOTHING on PATH, so pathless is the state a correct install actually leaves behind.
+# The herdr server from [8] is still up — the fan's second read needs it, and [9] stops it below.
+PATHLESS="$(printf '%s' "$PATH" | tr ':' '\n' | while IFS= read -r d; do [ -n "$d" ] && [ -x "$d/entwurf" ] || printf '%s\n' "$d"; done | paste -sd:)"
+run_fan_pathless() {
+  env -u ENTWURF_BIN PATH="$PATHLESS" HERDR_BIN_PATH="$(command -v herdr)" node "$FAN" </dev/null 2>&1
+}
+if command -v entwurf >/dev/null 2>&1 && PATH="$PATHLESS" command -v entwurf >/dev/null 2>&1; then
+  bad "the pathless PATH still resolves an entwurf — this cell would prove nothing"
+else
+  ok "the pathless PATH resolves no entwurf (the crutch is really gone, not merely unset)"
+fi
+
+fan_pathless="$(run_fan_pathless)"; fan_pathless_rc=$?
+echo "$fan_pathless" | sed 's/^/    /'
+echo "    → exit $fan_pathless_rc"
+# The IDENTICAL literal the crutched run asserts at the cell above, so the two runs are comparable
+# rather than two different claims.
+if [ "$fan_pathless_rc" -eq 0 ] && printf '%s' "$fan_pathless" | grep -qx '1 citizen(s) not shown: nobody could observe placement for them (unobserved)\.'; then
+  ok "[QK:HRIL-FAN-LEDGER-FALLBACK] with NO ENTWURF_BIN and no entwurf on PATH, the certified activation ledger supplies the runtime and the citizen read completes — the same accounting sentence, from a binary nobody put on PATH"
+else
+  bad "the ledger-fallback claim failed: pathless fan rc=$fan_pathless_rc did not reproduce the crutched run's citizen accounting"
+fi
+if printf '%s' "$fan_pathless" | grep -q 'via activation-ledger'; then
+  ok "the pathless run says WHICH source supplied the binary, so the fallback cannot be mistaken for a PATH hit"
+else
+  bad "the pathless run did not name activation-ledger as the binary's source"
+fi
+
+# ── 8c. pathless AND no ledger: the CITIZEN axis alone skips, and it is not red ──
+# The other half of the same contract. A host that never activated must not read as broken, and the
+# three blocks that need no entwurf binary must still answer.
+# XDG_STATE_HOME is redirected TOO, and that is the whole isolation: the ledger lives under XDG
+# **state** ($LEDGER above) while the runtime lives under XDG **data**. Moving only the second would
+# leave this cell reading the real host's ledger, and "no ledger here" would be unfalsifiable.
+HOMELESS="$(mktemp -d)"
+fan_no_ledger="$(env -u ENTWURF_BIN PATH="$PATHLESS" HOME="$HOMELESS" XDG_DATA_HOME="$HOMELESS/.local/share" \
+  XDG_STATE_HOME="$HOMELESS/.local/state" \
+  HERDR_BIN_PATH="$(command -v herdr)" node "$FAN" </dev/null 2>&1)"; fan_no_ledger_rc=$?
+echo "$fan_no_ledger" | sed 's/^/    /'
+echo "    → exit $fan_no_ledger_rc"
+if [ "$fan_no_ledger_rc" -eq 0 ] &&
+   printf '%s' "$fan_no_ledger" | grep -q 'entwurf-not-found' &&
+   printf '%s' "$fan_no_ledger" | grep -q '\[1\] HERDR INTEGRATION' &&
+   printf '%s' "$fan_no_ledger" | grep -q '\[2\] ENTWURF ACTIVATION' &&
+   printf '%s' "$fan_no_ledger" | grep -q '\[3\] RAILS'; then
+  ok "[QK:HRIL-FAN-NO-LEDGER-SKIPS-CITIZENS-ONLY] with no ledger and no runtime the CITIZEN block alone skips by name at exit 0, and blocks 1-3 still render — never activating is a state, not a defect, and this is what stops D3=C drifting into 'install it from the pane'"
+else
+  bad "the no-ledger citizen-skip claim failed: fan rc=$fan_no_ledger_rc did not render blocks 1-3 with a citizen-only skip"
+fi
+rm -rf "$HOMELESS"
+
 herdr server stop >/dev/null 2>&1 || true
 
+# ── 8a. the SHIPPED LAUNCHER, from the bin the user actually received ───────
+# [7] proves the wiring by running `pi` off PATH. That is not the same claim as the one #118
+# hop 2 makes, and astra named the gap: a user who installed this plugin does not have this
+# checkout, so the only launcher that means anything to them is the one inside the npm
+# artifact the lock names. Measured on the published tarball before this cell existed, the
+# `pi)` case IS in `run.sh` at 0.23.1 — so the claim is now testable, and this cell is what
+# tests it: the same 0-token birth, driven through `<active>/node_modules/.bin/entwurf pi`.
+#
+# The proof that it EXEC'd pi is the birth itself. A launcher that silently did nothing, or
+# resolved to something else, cannot produce a V3 record and a gardenId-keyed socket.
+#
+# IT SITS AFTER [8] ON PURPOSE: the fan cell asserts the unobserved count as an exact
+# literal, and a second citizen born before it would change that number. Order here is the
+# cheaper of the two ways to keep that oracle exact.
+echo; echo "[8a] entwurf pi — the launcher inside the npm artifact, same 0-token birth"
+ENTWURF_INSTALLED_BIN="$ACTIVE/node_modules/.bin/entwurf"
+if [ -x "$ENTWURF_INSTALLED_BIN" ]; then
+  node /tmp/use-path-drive.mjs "$ENTWURF_INSTALLED_BIN" "the shipped launcher" "$ENTWURF_INSTALLED_BIN" pi --mode rpc || fail=1
+else
+  bad "no installed entwurf bin at $ENTWURF_INSTALLED_BIN — the launcher claim cannot be measured"
+fi
+
 # ── 9. deactivate: the roundtrip, on the npm source (#118 H1-5) ──────────────
 # `check-herdr-activation` cell 16 proves this against fixtures: [QK:HAC-DEACTIVATE-ROUNDTRIP]
 # asserts the pi settings return to their ORIGINAL MEANING (JSON equality, not bytes — the

package/scripts/smoke-meta-install-state.sh

@@ -380,6 +380,74 @@ cell(
     "#94 compaction keys relinquish across nested/string axes: restore, delete, operator-changed, fresh, type-strict",
     compaction_cells,
 )
+
+TURN_DURATION = "showTurnDuration"
+
+def turn_duration_cells():
+    # GLG's ruling: showTurnDuration reports how long a turn took. That is
+    # operator INFORMATION, not a single-driver policy surface, so entwurf must
+    # neither own it nor force it to false.
+    #
+    # The claim is measured against the two constants and the real leaf, never
+    # quoted from a comment: a drift that puts the key back under management has
+    # to redden HERE and not only at the drive level, because the drive level
+    # runs one install shape while the constant governs every host.
+    managed = m.managed_keys()["settings"]["scalar"]
+    assert TURN_DURATION not in managed, managed
+    assert TURN_DURATION not in m._managed_scalar_names
+    assert TURN_DURATION in m._retired_scalar_names
+    retired = {name: last for name, _path, last in m.RETIRED_SETTINGS_SCALARS}
+    # The last managed value is the comparison relinquishment turns on. A wrong
+    # one here would either skip a value we really wrote or overwrite one we
+    # never did, so it is pinned by type as well as equality.
+    assert retired[TURN_DURATION] is False, retired[TURN_DURATION]
+
+    path = [TURN_DURATION]
+
+    def call(current=MISSING, old=MISSING):
+        settings = {} if current is MISSING else {TURN_DURATION: current}
+        keys = {} if old is MISSING else {TURN_DURATION: copy.deepcopy(old)}
+        state = {"files": {"settings": {"keys": keys}}}
+        m.relinquish_retired_scalar(state, settings, TURN_DURATION, path, False)
+        return state, settings
+
+    def led(existed, value):
+        return {"kind": "scalar", "path": path, "original": {"existed": existed, "value": value}}
+
+    # THE MEASURED HOST SHAPE (2026-09-23): ledger says we wrote false over a
+    # pre-install false, and the operator has since set true. Their true must
+    # survive, and the entry must be consumed so uninstall cannot reach back.
+    state, settings = call(True, led(True, False))
+    assert settings[TURN_DURATION] is True, settings
+    assert TURN_DURATION not in state["files"]["settings"]["keys"]
+    # Consumption is the inverse: restore_entry is the only writer uninstall has,
+    # and with the row gone there is no entry left to hand it.
+    before = copy.deepcopy((state, settings))
+    m.relinquish_retired_scalar(state, settings, TURN_DURATION, path, False)
+    assert (state, settings) == before
+
+    # Still carrying OUR false, with provenance -> undo our own write honestly.
+    state, settings = call(False, led(True, False))
+    assert settings[TURN_DURATION] is False, settings
+    state, settings = call(False, led(False, None))
+    assert TURN_DURATION not in settings, settings
+
+    # No provenance at all -> the value is the operator's whatever it says.
+    for current in [True, False, MISSING]:
+        state, settings = call(current)
+        assert settings == ({} if current is MISSING else {TURN_DURATION: current})
+
+    # Type strictness on the bool axis: `0 == False` while `type(0) is not bool`,
+    # so an untyped comparison would rewrite a value that was never ours.
+    state, settings = call(0, led(True, False))
+    assert settings[TURN_DURATION] == 0 and type(settings[TURN_DURATION]) is int
+
+cell(
+    "[QK:META-RETIRE-TURN-DURATION-OPERATOR-OWNED]",
+    "showTurnDuration is operator-owned: unmanaged in the SSOT, retired at false, "
+    "and relinquishment preserves the measured live true while consuming the ledger entry",
+    turn_duration_cells,
+)
 sys.exit(failed)
 PY
 then ok "#71 retirement leaf: provenance, bool strictness, malformed refusal, one-shot convergence"
@@ -409,6 +477,10 @@ assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['va
 assert 'autoCompactEnabled' not in s['files']['settings']['keys']
 assert 'env.DISABLE_AUTOCOMPACT' not in s['files']['settings']['keys']
 assert 'skipDangerousModePermissionPrompt' not in s['files']['settings']['keys']
+# Same for showTurnDuration: a fresh install takes no ownership evidence for it,
+# so on a host entwurf meets for the first time there is nothing to relinquish
+# and nothing uninstall could ever restore.
+assert 'showTurnDuration' not in s['files']['settings']['keys']
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
 PY
 then ok "state captures original scalar/map values, excludes the retired scalar, and is mode 0600"; else bad "state did not capture original values / retirement / mode 0600"; fi
@@ -440,6 +512,18 @@ state['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']={
   'kind':'scalar', 'path':['env','DISABLE_AUTOCOMPACT'],
   'original':{'existed':True, 'value':'0'}
 }
+# showTurnDuration: the upgrade shape MEASURED on the source host 2026-09-23,
+# planted verbatim so apply() is judged against the state a real prior version
+# left behind. The ledger proves entwurf wrote `false` over a pre-install
+# `false`; the live value is the `true` the operator set afterwards. This is the
+# only branch where relinquishment could plausibly damage an operator choice —
+# restoring the snapshot here would hand `false` back to somebody who had since
+# turned the display on — so it is the branch the drive level must carry.
+settings['showTurnDuration']=True
+state['files']['settings']['keys']['showTurnDuration']={
+  'kind':'scalar', 'path':['showTurnDuration'],
+  'original':{'existed':True, 'value':False}
+}
 json.dump(settings, open(sp,'w'), indent=2); open(sp,'a').write('\n')
 json.dump(state, open(stp,'w'), indent=2); open(stp,'a').write('\n')
 PY
@@ -459,9 +543,16 @@ assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
 assert 'autoCompactEnabled' not in settings
 assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
-for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
+for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert settings[key] is False, key
 assert settings['skipDangerousModePermissionPrompt'] is False
+# showTurnDuration retirement, drive level. Two facts that must not be read off
+# one assertion: the operator's PRE-install `true` (fixture) is still `true`
+# AFTER apply, and it is still `true` because apply never wrote the key rather
+# than because it happened to write the same value. The upgrade shape planted
+# above supplies the second half — a ledger entry proving entwurf wrote `false`
+# here, over a live `true` the operator set afterwards.
+assert settings['showTurnDuration'] is True
 # #94 drive-level relinquishment, both branches:
 #   nested path  -> the operator's pre-entwurf '0' is back, and the env map that
 #                   carries it survives with the neighbour key untouched.
@@ -473,6 +564,9 @@ state=json.load(open(cfg + '/entwurf.install-state.json'))
 assert 'skipDangerousModePermissionPrompt' not in state['files']['settings']['keys']
 assert 'autoCompactEnabled' not in state['files']['settings']['keys']
 assert 'env.DISABLE_AUTOCOMPACT' not in state['files']['settings']['keys']
+# The consumed entry is the whole inverse: with no ledger row left, uninstall()
+# has no authority over this key and can never write our `false` back.
+assert 'showTurnDuration' not in state['files']['settings']['keys']
 for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
     assert item in settings['permissions']['allow'], item
 assert settings['permissions']['allow'].count('Read') == 1
@@ -493,6 +587,13 @@ then ok "apply installs managed keyset without clobbering unrelated keys"; else
 if py check >/dev/null 2>&1; then ok "survival check passes after relinquishing the retired scalar"; else bad "survival check failed right after retirement apply"; fi
 MANAGED_JSON="$(py managed-keys)"
 if printf '%s' "$MANAGED_JSON" | grep -q 'skipDangerousModePermissionPrompt'; then bad "managed-keys still claims the retired operator key"; else ok "managed-keys returns skipDangerousModePermissionPrompt to the operator"; fi
+# managed-keys is the CROSS-REPO contract: check-keyset-overlap and the
+# agent-config fragment read it to stay disjoint. Measured 2026-09-23 —
+# `check-keyset-overlap agent-config/claude/settings.fragment.json` failed on
+# exactly one key, showTurnDuration, because both sides claimed it. Dropping our
+# claim is what resolves that collision, so the SSOT output is asserted here and
+# not only in the Python constants.
+if printf '%s' "$MANAGED_JSON" | grep -q 'showTurnDuration'; then bad "managed-keys still claims showTurnDuration — a consumer fragment setting the operator's own value would keep colliding"; else ok "managed-keys returns showTurnDuration to the operator (cross-repo collision resolved at the SSOT)"; fi
 # A provenance-less true cannot be changed safely, but doctor/check must make it visible.
 python3 - <<'PY'
 import json, os
@@ -577,6 +678,11 @@ assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == '/old/user/statusline.sh'
 assert settings['promptSuggestionEnabled'] is True
 assert settings['skipDangerousModePermissionPrompt'] is False
+# showTurnDuration survives uninstall at the operator's value. The install above
+# ran against a ledger row saying entwurf had written `false` here; relinquish
+# consumed that row, so uninstall reaches this key with no authority at all and
+# the `true` the operator set is still `true`. The key must also be ABSENT from
+# the removal list below — a retired key is neither restored nor deleted.
 assert settings['showTurnDuration'] is True
 # One list, one meaning: these are the keys UNINSTALL removed. `autoCompactEnabled`
 # is not among them post-#94 — that entwurf never introduced it is a different

package/scripts/smoke-mux-lifecycle-live.ts

@@ -786,9 +786,16 @@ async function main(): Promise<void> {
 				mode: "follow_up",
 				message: `Scene 2 (${liveNeedle}): you were told a color. Reply with that color only, then stop.`,
 			});
+			// #120 P2: the rail answers with the ACCEPTANCE BOUNDARY, and this send names `follow_up`
+			// against a citizen that may well be mid-turn — `queued-follow-up` is a correct, normal
+			// answer here. Pinning the word `sent` would have demanded an idle receiver the scene
+			// never promises. What is asserted is the rail plus an accepted boundary; a refusal
+			// still fails through `isError`.
 			ok(
-				`${cell}: tools/call entwurf_v2 fire-and-forget delivered on the CONTROL-SOCKET rail to the fresh citizen`,
-				!send.isError && send.text.includes("control-socket") && send.text.includes("sent"),
+				`${cell}: tools/call entwurf_v2 fire-and-forget was ACCEPTED on the CONTROL-SOCKET rail by the fresh citizen`,
+				!send.isError &&
+					send.text.includes("control-socket") &&
+					/→ (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/.test(send.text),
 				`--- response ---\n${send.text}\n--- bridge stderr ---\n${bridge.stderrTail()}`,
 			);
 			receipts[`${cell}/3-live-send`] = send.text;

package/scripts/smoke-omp-fresh-live.ts

@@ -434,7 +434,9 @@ ok(
 // callback-only prompt is delivered first, and the task is released only by the exact
 // successful callback result. The transcript is where both are visible, in order, in one
 // native session.
-const bootstrapLine = buildOmpCallbackOnlyPrompt({ target: callerGid, nonce: nonce as string })
+// Since the callback moved out of band (ENTWURF_CALLBACK_TARGET/NONCE in the sibling env), the
+// callback-only prompt carries no address; the receipt is the no-arg first action itself.
+const bootstrapLine = buildOmpCallbackOnlyPrompt()
 	.split("\n")
 	.find((l) => l.includes("FIRST AND ONLY ACTION")) as string;
 const transcript = fs.readFileSync(transcriptPath as string, "utf8");
@@ -442,7 +444,7 @@ const callbackAt = transcript.indexOf(bootstrapLine);
 const taskAt = transcript.indexOf(sceneFact);
 receipts["5-two-stage-order"] = `callback-only prompt @${callbackAt}, task scene fact @${taskAt}`;
 ok(
-	"stage one is in the sibling's own transcript: the extension delivered the callback-ONLY prompt, carrying this call's target and nonce",
+	"stage one is in the sibling's own transcript: the extension delivered the callback-ONLY prompt (no-arg first action; the address rides the sibling env, never this prompt)",
 	callbackAt >= 0,
 	`        expected line: ${bootstrapLine}`,
 );

package/scripts/smoke-omp-mcp-state.sh

@@ -53,7 +53,7 @@ cat > "$SB/bin/entwurf-bridge" <<'FAKE'
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE