@junghanacs/entwurf 0.24.0 → 0.25.1

package/mcp/entwurf-bridge/dist/scripts/doctor-pi-provider.js

@@ -143,11 +143,24 @@ log(`  project      ${projectPath}: ${projScopeDesc}`);
 log(`  EFFECTIVE (${effectiveScope}): ${effectiveDesc}`);
 // install-state ownership (user scope). absent state on a configured effective is either a
 // pre-Task-2 install or a user-override we deliberately did not own.
+//
+// `command` is read beside it because it — not the bare name — is the CANONICAL managed command
+// (#116 M3-b2). `register-pi-provider.py` writes the same string into the settings entry and into
+// this record (:332-342, :368-369), and in plugin mode that string is an absolute bridge under the
+// certified stable runtime, because a Herdr-plugin host has nothing entwurf on PATH. Reading it
+// here is what lets this doctor judge drift without re-deriving the stable runtime root: the root
+// is the writer's business, and a second derivation in this file would be a second address axis.
+//
+// `ownership` is the PREIMAGE classification — what stood at the key BEFORE that install — so
+// `absent` means "we created it", not "nobody owns it". Treating it as an ownership verdict is what
+// made every plugin-mode host red while its bridge booted and served all eight verbs.
 let ownership;
+let stateCommand;
 if (existsSync(statePath)) {
     try {
         const st = JSON.parse(readFileSync(statePath, "utf8"));
         ownership = typeof st.ownership === "string" ? st.ownership : undefined;
+        stateCommand = typeof st.command === "string" ? st.command : undefined;
         log(`  state: install-state present (ownership=${ownership}).`);
     }
     catch {
@@ -200,9 +213,33 @@ else {
             hardFail = 1;
         }
     }
-    if (!isBare) {
-        // Ownership classification never rounds a broken runtime up to green. It only says who may
-        // repair the non-canonical entry after the independent boot verdict above.
+    // Ownership classification never rounds a broken runtime up to green. It only says who may
+    // repair the entry after the independent boot verdict above.
+    //
+    // A MANAGED record is the pair (known preimage ownership, recorded command). For that pair the
+    // recorded command is canonical and the comparison runs REGARDLESS of whether the effective
+    // command happens to be the bare name. Keeping this decision inside a `!isBare` branch is how
+    // real drift escaped: a record naming the absolute plugin bridge, with the settings repointed to
+    // the bare `entwurf-bridge`, is drift — and a bare bridge that boots would otherwise carry it to
+    // green. "The effective command is spellable as our old default" is not evidence that it is the
+    // command this install wrote.
+    //
+    // Everything else — a record that names no command, or one whose ownership is a word this
+    // doctor does not know — falls through to the ORIGINAL logic below, unchanged. Repairing this
+    // defect is not a licence to migrate the state schema, to grant an amnesty to records written
+    // before `command` existed, or to let an unknown ownership word buy a managed green because a
+    // string happened to match. The state is rewritten by `./run.sh setup`, not by its reader.
+    const knownManagedOwnership = ownership === "absent" || ownership === "managed-current" || ownership === "managed-legacy";
+    if (knownManagedOwnership && stateCommand !== undefined) {
+        if (cmd !== stateCommand) {
+            log(`  FAIL: state records '${stateCommand}' as the managed command (ownership=${ownership}), but the effective command is '${cmd}' — the key drifted to something entwurf never wrote.`);
+            hardFail = 1;
+        }
+        else {
+            log(`  ok: effective command is the managed command this install recorded ('${stateCommand}', preimage ownership=${ownership}).`);
+        }
+    }
+    else if (!isBare) {
         if (ownership && ownership !== "user-override") {
             log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);
             hardFail = 1;

package/mcp/entwurf-bridge/dist/scripts/herdr-rails.mjs

@@ -0,0 +1,72 @@
+/**
+ * herdr-rails — the ONE place the herdr rail's backend set and its per-backend model SYNTAX
+ * example are written down (#116 A7).
+ *
+ * WHY THIS FILE EXISTS. Three surfaces were about to say the same two things in three
+ * dialects: `herdr-fresh-call.ts` owned the closed backend tuple, `build.mjs` narrated one
+ * model id per harness at install time, and the status pane was about to print a RAILS block.
+ * Three copies of one fact is how a rail quietly grows a fourth backend in prose that no
+ * dispatch honours. So the fact lives here and the three read it.
+ *
+ * WHY `.mjs` AND NOT `.ts`. It is read by two runtimes that cannot agree on anything else:
+ * the Herdr plugin runs `node lib/status.mjs` with no loader flags at all, and the pi
+ * extension is typechecked by `tsc`. A `.ts` leaf would be unloadable by the first; a second
+ * copy would defeat the point. `protocol.js` set this precedent for exactly the same reason
+ * (root tsconfig.json `allowJs`), and this file keeps its shape: dependency-free, no imports,
+ * no environment, no IO, so importing it can never be a side effect.
+ *
+ * WHAT THIS FILE IS NOT, and each absence is load-bearing:
+ *   - NOT a model catalogue. One example per backend, chosen to show the SHAPE of the string
+ *     (`provider/model` vs a bare vendor id). Adding a second example starts a list, a list
+ *     invites completeness, and completeness is a catalogue Entwurf would then be expected to
+ *     keep current for every vendor. `entwurf_fresh_call` takes a model string with no default
+ *     and validates nothing; that is the contract, and an example must not imply otherwise.
+ *   - NOT a supported-model set, a recommendation, or a validator. Nothing reads MODEL_SYNTAX_EXAMPLE
+ *     to decide anything — it is display text on three surfaces.
+ *   - NOT a provider, billing or quota statement. No rail here names a provider, a subscription
+ *     or a cost. `#76` is about which rail a sibling may be launched on, and a syntax example
+ *     that mentioned a provider would read as an answer to it. It does not answer it.
+ *   - NOT a launcher, and not a claim that any binary exists. `HERDR_AGENT_KIND` (the herdr
+ *     `--kind` token) stays with the rail that spends it; this leaf carries no argv.
+ */
+/**
+ * The closed pilot set for the herdr launch rail. Herdr's own `--kind` enum is much larger and
+ * that is not evidence of support: every other backend is a named pre-mutation reject.
+ *
+ * The JSDoc cast is what keeps the TYPE half of this single source honest. Without it TypeScript
+ * infers `readonly string[]` from a `.mjs` file and `HerdrFreshCallBackend` silently widens to
+ * `string` — the tuple would still be one source at runtime while the compiler had stopped
+ * checking anything. A gate pins both halves.
+ *
+ * @type {readonly ["pi", "claude-code"]}
+ */
+export const HERDR_FRESH_CALL_BACKENDS = Object.freeze(["pi", "claude-code"]);
+/**
+ * ONE model string per backend, and it is an example of SYNTAX, never of choice.
+ *
+ * `[관측: GLG, 날것 PC, 2026-09-17]` "일단 정확한 모델명을 모른다" — after a green install the first
+ * thing missing is a call that works, and the two runtimes spell a model differently enough that
+ * guessing fails: pi wants a provider-qualified path, Claude Code wants the vendor id alone.
+ * That difference is the whole content of this map.
+ *
+ * @type {Readonly<Record<"pi" | "claude-code", string>>}
+ */
+export const MODEL_SYNTAX_EXAMPLE = Object.freeze({
+    pi: "openai-codex/gpt-5.6-terra",
+    "claude-code": "claude-sonnet-5",
+});
+/**
+ * How a citizen on each backend is REACHED once it exists, in the operator's words. This is the
+ * rail fact the status pane's RAILS block renders and the install narration states — the same
+ * sentence, so a host cannot be told two different things about one backend.
+ *
+ * `[관측: GLG, 날것 PC, 2026-09-17]` from the operator's chair a plain `pi` looks identical to a
+ * citizen pi: the install says green, `pi` starts, and nothing is there. Citizenship is argv-gated
+ * on purpose, and that gate is invisible unless something says it out loud.
+ *
+ * @type {Readonly<Record<"pi" | "claude-code", string>>}
+ */
+export const RAIL_ENTRY_NOTE = Object.freeze({
+    pi: "start it as `pi --entwurf-control` to be a garden citizen — a plain `pi` loads the extension but has no garden id, no control socket and no entwurf tools",
+    "claude-code": "nothing to add — an ordinary `claude` picks up the entwurf tools through MCP",
+});

package/mcp/entwurf-bridge/src/index.ts

@@ -431,7 +431,9 @@ server.tool(
 		"alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport " +
 		"from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge " +
 		"mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE " +
-		"outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
+		"outcome, named per rail: a control receiver's acceptance boundary (`sent` / `queued-steer` / " +
+		"`queued-follow-up` / `accepted-unknown-boundary` — those four only), a mailbox ENQUEUE receipt, a " +
+		"native-push INJECTION, a rejection, or lock-dirty. EXISTING targets only; discover with " +
 		"entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
 		"citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
 		'"no control-socket probe." The decider resolves the actual rail at dispatch time: a self-fetch ' +
@@ -472,9 +474,8 @@ server.tool(
 			.enum(["steer", "follow_up"])
 			.optional()
 			.describe(
-				"Injection style for a CONTROL-SOCKET send only: steer (interrupt the current turn) or " +
-					"follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
-					"effect on those rails.",
+				"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. " +
+					"The mailbox and native-push plans carry no mode, so it has no effect on those rails.",
 			),
 		wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
 	},

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.24.0",
+	"version": "0.25.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
@@ -92,16 +92,17 @@
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.86.0 <0.87",
-		"@earendil-works/pi-coding-agent": ">=0.86.0 <0.87",
-		"@earendil-works/pi-tui": ">=0.86.0 <0.87",
+		"@earendil-works/pi-ai": ">=0.87.1 <0.88",
+		"@earendil-works/pi-coding-agent": ">=0.87.1 <0.88",
+		"@earendil-works/pi-tui": ">=0.87.1 <0.88",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.86.0",
-		"@earendil-works/pi-coding-agent": "0.86.0",
-		"@earendil-works/pi-tui": "0.86.0",
+		"@earendil-works/pi-agent-core": "0.87.1",
+		"@earendil-works/pi-ai": "0.87.1",
+		"@earendil-works/pi-coding-agent": "0.87.1",
+		"@earendil-works/pi-tui": "0.87.1",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
@@ -175,8 +176,8 @@
 		"check:full": "bash scripts/check-elapsed.sh check:full check:core check:hermetic check:package",
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
-		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior",
-		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push",
+		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior",
+		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},

package/pi-extensions/entwurf-control.ts

@@ -78,9 +78,8 @@ import type {
 	ExtensionContext,
 	MessageRenderer,
 } from "@earendil-works/pi-coding-agent";
-import { getMarkdownTheme, type Theme } from "@earendil-works/pi-coding-agent";
-import { Box, type Component, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
-import { ENTWURF_SENT_MESSAGE_TYPE } from "../protocol.js";
+import { getMarkdownTheme } from "@earendil-works/pi-coding-agent";
+import { Box, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { readCallbackEnv } from "./lib/callback-env.js";
 import {
 	type CompactionGuard,
@@ -89,6 +88,7 @@ import {
 	noteCompactionBefore,
 	noteCompactionTerminal,
 } from "./lib/compaction-send-guard.js";
+import { sendReceiptBoundary } from "./lib/control-send-receipt.js";
 import { CONTROL_SOCKET_SUFFIX, controlSocketPathIn, defaultControlSocketDir } from "./lib/control-socket-path.js";
 import {
 	attachAcceptedSocketDisconnectPolicy,
@@ -112,15 +112,6 @@ const EMACS_AGENT_SOCKET_FLAG = "emacs-agent-socket";
 // comes from the `.js` leaf both runtime lanes can import.
 const ENTWURF_DIR = defaultControlSocketDir(os.homedir());
 const SESSION_MESSAGE_TYPE = "entwurf-message";
-// Sender-side UI marker. Layer B (ACP path) emits a CustomMessage with this
-// customType so the operator sees a first-class [entwurf sent →] box paired
-// with the receive-side [entwurf received ⟵] box. The provider-level context
-// filter in index.ts drops this customType before the LLM sees it — colocated
-// with the emitter so sessions without --entwurf-control are still protected.
-// There is no second emitter: the v1 native send path ("Layer A") that also drew
-// this box through renderSentMessage() was removed in the 0.12 cutover, and
-// renderSentMessage is now registered for exactly one customType (see
-// registerMessageRenderer below). Do not describe a native sender-side box.
 const SENDER_INFO_PATTERN = /<sender_info>[\s\S]*?<\/sender_info>/g;
 
 // ============================================================================
@@ -478,10 +469,12 @@ const renderSessionMessage: MessageRenderer = (message, { expanded }, theme) =>
 	//
 	// The label is "[entwurf received ⟵]" with a left-pointing arrow so the
 	// receiving operator immediately sees the directionality (this is an
-	// incoming message). The corresponding sender-side surface in
-	// mcp/entwurf-bridge/entwurf_v2 renders "[entwurf sent →]" — same
-	// transport, opposite arrows, no confusion about who-said-what when the
-	// transcript is read end-to-end.
+	// incoming message). There is no matching box on the sending side: the one
+	// that used to be described here had zero producers and was removed (#120 P3).
+	// A sender sees a TEXT receipt naming the acceptance boundary
+	// (`entwurf-v2-surface.ts`), which is the honest thing to show — a box would
+	// claim the message was rendered into someone's transcript, and only the
+	// receiver can say that.
 	//
 	// wants_reply defaults to false (etiquette marker, not protocol contract).
 	// We show the badge only when the sender explicitly set it true; an
@@ -523,124 +516,6 @@ const renderSessionMessage: MessageRenderer = (message, { expanded }, theme) =>
 	return box;
 };
 
-// Sender-side payload — what renderSentMessage needs to draw the [entwurf sent →]
-// box. Carried by the ACP path's CustomMessage `details` — the ONLY carrier since
-// the v1 native renderResult path was removed (0.12 cutover). All four envelope fields are intentionally
-// echoed in the box even though the sender is "this same session" — operators
-// reading a busy multi-session transcript should be able to verify at a glance
-// which 담당자 is on the wire (cwd) and which model identity (agentId) actually
-// signed the message, without scrolling up to find the session header.
-//
-// timestamp is captured at execute() / send-emit time, not at render time, so
-// re-renders (resize, expand toggle) keep showing the moment the message was
-// actually delivered rather than drifting forward to "now".
-//
-// wants_reply mirrors the receive-side etiquette badge. It stays optional because
-// the box is drawn from a CustomMessage whose `details` may predate the field; the
-// v1 `registerSessionTool` / `entwurfSendParameters` schema this note used to point
-// at is gone (0.12 cutover), so there is no native call site left to grow.
-interface SentBoxData {
-	to: string; // target sessionId
-	from?: string; // sender agentId, e.g. "entwurf/claude-opus-5"
-	cwd?: string; // sender cwd (raw, abbreviateHome applied at render)
-	timestamp?: string; // ISO 8601 UTC; rendered in KST
-	mode?: string; // "steer" | "follow_up" | string passed through
-	wants_reply?: boolean;
-	deliveredAs?: string; // RPC echo — surfaces when receiver remapped (e.g. queued as followUp)
-	body: string; // message text the operator sent
-}
-
-// Visual mirror of renderSessionMessage. Same Box / Markdown / theme tokens —
-// the two boxes must share the customMessageBg / customMessageLabel /
-// customMessageText surface so they are pixel-equivalent in any theme. The
-// only deliberate visual differences are:
-//   - label: [entwurf sent →]   vs  [entwurf received ⟵]
-//   - "to:" leads, "from:" follows  vs  "from:" only
-//   - mode: line                  (no equivalent on receive side — receiver
-//                                   doesn't see how the sender queued it)
-//
-// `expanded` truncates the body the same way as renderSessionMessage so a
-// large send shows the same preview shape as a large receive. operators
-// reading the transcript should not need different mental models.
-// Return type is `Component`, the interface `MessageRenderer` actually asks for
-// (`Component | undefined`, read at pi-coding-agent
-// `dist/core/extensions/types.d.ts:889`) — NOT the concrete `Container`.
-// `[측정 2026-09-06]` pi 0.85.0's mouse work gave `Container` a `private mouseLayout?`
-// (`pi-tui dist/tui.d.ts:198`; 0.84.4's `Container` had no private member at all), and
-// `Box` declares a SEPARATE private `mouseLayout` of its own. TypeScript only accepts a
-// private member from the same declaration, so the structural assignment `Box -> Container`
-// that held through 0.84.4 became TS2322 at 0.85.x. This was an UNDECLARED break — the
-// upstream Breaking section names only `createGatewayBindingFetch`. Annotating the shared
-// interface is the honest fix: nothing here ever needed Container's own surface.
-const buildSentMessageBox = (data: SentBoxData, expanded: boolean, theme: Theme): Component => {
-	let body = data.body || "(no content)";
-	if (!expanded) {
-		const lines = body.split("\n");
-		if (lines.length > 5) {
-			body = `${lines.slice(0, 5).join("\n")}\n...`;
-		}
-	}
-
-	const box = new Box(1, 1, (t) => theme.bg("customMessageBg", t));
-	const labelBase = theme.fg("customMessageLabel", `\x1b[1m[entwurf sent →]\x1b[22m`);
-
-	// Header line: label + KST + optional (wants reply) badge — matches the
-	// receive-side header layout 1:1.
-	const kst = formatTimestampKst(data.timestamp) ?? "(unknown time)";
-	const replyBadge = data.wants_reply === true ? "  (wants reply)" : "";
-	const headerLine = `${labelBase} ${theme.fg("dim", `${kst}${replyBadge}`)}`;
-	box.addChild(new Text(headerLine, 0, 0));
-
-	// to: <sessionId>  — target peer
-	box.addChild(new Text(theme.fg("dim", `to:   ${data.to || "(unknown sessionId)"}`), 0, 0));
-
-	// from: <agentId> @ <cwd>  — self identity. Shown even though it's "us"
-	// because in a multi-session human-greeted topology the operator is
-	// switching between several pi sessions and needs to confirm which one
-	// signed this send.
-	const fromAgent = data.from ?? "(unknown agent)";
-	const fromCwd = data.cwd ? abbreviateHome(data.cwd) : "(unknown cwd)";
-	box.addChild(new Text(theme.fg("dim", `from: ${fromAgent} @ ${fromCwd}`), 0, 0));
-
-	// mode: <mode>[ → deliveredAs]  — show RPC remap when it differs from
-	// what the caller asked for (e.g. caller said "steer" but receiver was
-	// idle so it became a direct prompt). Silent when they agree.
-	if (data.mode) {
-		const remap = data.deliveredAs && data.deliveredAs !== data.mode ? theme.fg("muted", ` → ${data.deliveredAs}`) : "";
-		box.addChild(new Text(theme.fg("dim", `mode: ${data.mode}${remap}`), 0, 0));
-	}
-
-	box.addChild(new Spacer(1));
-	box.addChild(
-		new Markdown(body, 0, 0, getMarkdownTheme(), {
-			color: (value: string) => theme.fg("customMessageText", value),
-		}),
-	);
-	return box;
-};
-
-// CustomMessageRenderer adapter for Layer B (ACP path). The CustomMessage
-// carries the SentBoxData under `details` (set by index.ts streamShellAcp
-// when a completed mcp__entwurf-bridge__entwurf_v2 is observed). `content`
-// holds the raw message body too, but we prefer details.body because the
-// content channel may have been routed through string-only persistence and
-// trimmed.
-const renderSentMessage: MessageRenderer = (message, { expanded }, theme) => {
-	const details = (message.details ?? {}) as Partial<SentBoxData>;
-	const fallbackBody = extractTextContent(message.content);
-	const data: SentBoxData = {
-		to: details.to ?? "(unknown sessionId)",
-		from: details.from,
-		cwd: details.cwd,
-		timestamp: details.timestamp,
-		mode: details.mode,
-		wants_reply: details.wants_reply,
-		deliveredAs: details.deliveredAs,
-		body: details.body ?? fallbackBody,
-	};
-	return buildSentMessageBox(data, expanded, theme);
-};
-
 // ============================================================================
 // Command Handlers
 // ============================================================================
@@ -824,9 +699,17 @@ async function handleCommand(
 			return;
 		}
 
+		// #120 P2: the receiver reports the BOUNDARY it actually observed — `sent` for an idle
+		// direct trigger, `queued-steer` / `queued-follow-up` for the two in-process queues — and
+		// nothing else. The bare `delivered:true` that used to lead this payload is GONE rather
+		// than kept for compatibility: it was equally true of all three states and therefore said
+		// nothing, which is the bare `delivered` DELIVERY.md refuses by name. The `deliveredAs`
+		// beside it had no consumer at all. Skew is safe in both directions without a translator —
+		// an old sender keys on `response.success` and never reads `data`, and a new sender reads
+		// an old receiver's payload as `accepted-unknown-boundary`, the honest name for an
+		// acceptance it cannot classify.
 		respond(true, "send", {
-			delivered: true,
-			deliveredAs: isIdle ? "direct" : mode === "follow_up" ? "followUp" : "steer",
+			boundary: sendReceiptBoundary({ idle: isIdle, mode }),
 			wants_reply: wantsReply,
 		});
 		return;
@@ -1104,17 +987,6 @@ export default function (pi: ExtensionAPI) {
 	};
 
 	pi.registerMessageRenderer(SESSION_MESSAGE_TYPE, renderSessionMessage);
-	// Layer B (ACP path) sender-side UI box. Registered unconditionally because
-	// renderer registration happens at extension load, BEFORE we know whether
-	// this session ends up with a routable identity: `updateSessionEnv` only
-	// publishes PI_SESSION_ID once a garden id exists, and clears it otherwise.
-	// A session without `--entwurf-control` therefore does NOT send — a bundled
-	// `entwurf_v2` sender call there fails loud on the missing envelope (the
-	// documented provider-vs-citizen boundary), and this renderer simply never
-	// fires. Registering it up front keeps one registration path instead of a
-	// conditional seam, and guarantees the [entwurf sent →] box exists for every
-	// session that DOES send.
-	pi.registerMessageRenderer(ENTWURF_SENT_MESSAGE_TYPE, renderSentMessage);
 
 	if (shouldRegisterControlTools(pi)) {
 		registerListSessionsTool(pi);
@@ -1387,7 +1259,7 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 		mode: Type.Optional(
 			StringEnum(["steer", "follow_up"] as const, {
 				description:
-					"Injection style for a CONTROL-SOCKET send only: steer (immediate) or follow_up (after task). " +
+					"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. " +
 					"The mailbox and native-push plans carry no mode, so it has no effect on those rails.",
 			}),
 		),
@@ -1415,9 +1287,11 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 		description: `CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id alone
 does not say which rail that citizen answers on. Give target + intent; the decider picks transport from
 liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox;
-probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome
-(delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers.
-A peer entwurf_peers shows as liveness=alive → fire-and-forget. A citizen with NO socket liveness
+probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome, per rail: a control
+receiver's acceptance boundary ("sent" / "queued-steer" / "queued-follow-up" /
+"accepted-unknown-boundary" — those four only), a mailbox ENQUEUE receipt, a native-push INJECTION,
+a rejection, or lock-dirty. EXISTING targets only (see entwurf_peers).
+A peer shown as liveness=alive → fire-and-forget. A citizen with NO socket liveness
 (liveness=unsupported) is ALSO fire-and-forget — unsupported means only "no control-socket probe" — and the
 decider picks its own rail: a self-fetch backend (e.g. Claude Code) gets the mailbox, a native-push backend
 (e.g. Antigravity) gets direct injection and has NO mailbox at all. THERE IS A THIRD RESULT: the mailbox
@@ -1426,9 +1300,8 @@ rather than queued for an inbox nobody drains. The native-push probe is 3-valued
 alive → injected; dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate
 (unestablished ≠ gone). DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets
 dormant-fire-forget-unsupported — same receiver rule as the mailbox, no active drainer means no
-delivery. The intent that used to answer there, owned-outcome, resumed it by
-launching a hidden background child; it was withdrawn under the visible-first rule, so re-open the session
-yourself and dispatch again. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push
+delivery. The intent that used to answer there, owned-outcome, was withdrawn
+under the visible-first rule — re-open the session yourself and dispatch again. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push
 rails are lock-free — deliverability and the adapter probe guard them. mode applies to a CONTROL-SOCKET
 send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000 chars; send an
 artifact path + digest for more.`,

package/pi-extensions/lib/compaction-send-guard.ts

@@ -1,9 +1,11 @@
 /**
  * compaction-send-guard — whether a control-socket `send` may call `pi.sendMessage`.
  *
- * Pi 0.86.0 has no public `ExtensionContext.isCompacting()` (`[측정 2026-09-20]` the
- * installed `dist/core/extensions/types.d.ts` declares `isIdle(): boolean` at :233 and
- * `signal` at :237, and carries no `isCompacting` member at all; the identifier exists
+ * Pi has no public `ExtensionContext.isCompacting()`. `[측정 2026-09-20, pi 0.86.0]` and
+ * re-measured `[측정 2026-09-22, pi 0.87.0]` and `[측정 2026-09-23, pi 0.87.1]`: the installed
+ * `dist/core/extensions/types.d.ts` declares `isIdle(): boolean` at :233 and `signal` at :237 —
+ * the SAME coordinates at all three floors — and carries no `isCompacting` member at all (grep
+ * count 0, re-counted on 0.87.1); the identifier exists
  * only inside the interactive/rpc modes' own bundles). Compaction is non-idle
  * (`AgentSession.isIdle` = no agent run AND not compacting) but `sendCustomMessage`
  * does not refuse it. A non-streaming `triggerTurn:true` send starts `_runAgentPrompt`

package/pi-extensions/lib/control-send-receipt.ts

@@ -0,0 +1,108 @@
+/**
+ * control-send-receipt — the ONE place the control-socket's acceptance boundary is named,
+ * on both ends of the wire (#120 P2).
+ *
+ * WHY A BOUNDARY AXIS AT ALL, AND WHY IT IS NOT THE ROUTE AXIS.
+ * `SendFinalOutcome` (`entwurf-v2-send.ts`) answers WHICH LEG delivered — first socket,
+ * re-resolved socket, mailbox — and it is what the release reducer keys on. It is an INTERNAL
+ * route/release algebra and it is NOT the sender-visible delivery boundary: `sent` and
+ * `fallback-sent` say a receiver accepted the bytes, and nothing whatever about what the receiver
+ * then did with them. Answering "what happened to my message" with a route word is how
+ * `control-socket → sent` came to mean four different things, one of which was
+ * "queued behind ten steers and dropped when the operator hit ESC".
+ *
+ * `[측정 2026-09-22, pi-agent-core 0.87.0; 재측정 2026-09-23, 0.87.1 — 좌표 동일]` the receiver's two queues are independent and each is
+ * `one-at-a-time` (`dist/agent.js:60-71,96-97,137-138`); steering is drained after every turn
+ * (`dist/agent-loop.js:85,186`) while follow-ups are drained ONLY when the inner loop has ended
+ * (`:191-197`). There is no global FIFO across them. So `steer` and `follow_up` are not two
+ * spellings of one queue — they are two different promises about when, and a receipt that cannot
+ * tell them apart cannot be used to reason about either.
+ *
+ * WHAT EACH BOUNDARY CLAIMS, EXACTLY:
+ *   sent                        the receiver was idle and the message was accepted as a DIRECT
+ *                               turn trigger. It is an accepted REQUEST, not proof that the model
+ *                               saw it and not proof the turn completed.
+ *   queued-steer                accepted into the receiver's in-process steering queue. Volatile
+ *                               process memory: no durability, no ordering against the other
+ *                               queue, and an abort clears it.
+ *   queued-follow-up            accepted into the receiver's in-process follow-up queue. Same
+ *                               volatility, and it waits for the inner loop to end — a steer that
+ *                               arrives later still goes first.
+ *   accepted-unknown-boundary   the receiver ACCEPTED (its RPC answered success) but did not name
+ *                               a boundary this build understands. Version skew, not failure: the
+ *                               message is gone from our hands either way, so this must never be
+ *                               rendered as a failure to retry — and never as `sent`, which would
+ *                               put back the exact false claim this axis exists to remove.
+ *
+ * NO LEGACY MAPPER LIVES HERE. The previous wire carried `delivered:true` plus a `deliveredAs`
+ * producer nothing consumed; both are gone rather than translated. A new receiver answers an old
+ * sender fine (it keys on `response.success` and ignores `data`), and an old receiver answers a
+ * new sender as `accepted-unknown-boundary` — which is the honest name for it. A dual route would
+ * be a second address for one fact.
+ */
+
+/** The closed boundary set, in the order a reader should learn them. */
+export const ACCEPTANCE_BOUNDARIES = ["sent", "queued-steer", "queued-follow-up", "accepted-unknown-boundary"] as const;
+
+export type AcceptanceBoundary = (typeof ACCEPTANCE_BOUNDARIES)[number];
+
+/** What a receiver can actually observe about itself. `accepted-unknown-boundary` is a READER's
+ * verdict about an answer it could not classify, so a receiver may never produce it. */
+export type ObservedBoundary = Exclude<AcceptanceBoundary, "accepted-unknown-boundary">;
+
+/**
+ * RECEIVER SIDE. The whole classification, from the two facts the receiver already has at the
+ * moment it accepts: was it idle, and which queue did the caller ask for. Pure — it reads no
+ * clock, no socket and no session, so the same inputs always name the same boundary.
+ *
+ * `idle` wins over `mode`: an idle receiver takes the message as a direct trigger and neither
+ * queue is involved, which is why `mode` is meaningless there (`entwurf-control.ts` passes no
+ * `deliverAs` on that branch).
+ */
+export function sendReceiptBoundary(input: { idle: boolean; mode: "steer" | "follow_up" }): ObservedBoundary {
+	if (input.idle) return "sent";
+	return input.mode === "follow_up" ? "queued-follow-up" : "queued-steer";
+}
+
+/** Is this an acceptance a receiver could have observed about itself? */
+export function isObservedBoundary(value: unknown): value is ObservedBoundary {
+	return value === "sent" || value === "queued-steer" || value === "queued-follow-up";
+}
+
+/**
+ * SENDER SIDE. Read the receiver's typed boundary off an RPC `data` payload.
+ *
+ * Anything this build does not recognise — a missing field, an older receiver's shape, a value
+ * outside the set — is `accepted-unknown-boundary` and NOT an error: by the time `data` exists the
+ * RPC has already answered success, so the message has been accepted. Inventing a failure here
+ * would invite a retry that double-delivers, and answering `sent` would claim a direct injection
+ * nobody reported.
+ */
+export function parseAcceptanceBoundary(data: unknown): AcceptanceBoundary {
+	if (typeof data !== "object" || data === null) return "accepted-unknown-boundary";
+	const value = (data as { boundary?: unknown }).boundary;
+	return isObservedBoundary(value) ? value : "accepted-unknown-boundary";
+}
+
+/** How much of an unrecognised answer may be repeated back. A receiver's payload is untrusted
+ * input from another process; a full object on a status line is an injection surface and an
+ * unbounded one at that. */
+const UNKNOWN_DIAGNOSTIC_MAX = 80;
+
+/**
+ * A BOUNDED, single-line description of an answer we could not classify — for the operator who has
+ * to decide whether this is version skew or a broken peer. Returns `undefined` when there is
+ * nothing worth saying, so a caller renders the bare boundary rather than an empty parenthesis.
+ *
+ * It describes the SHAPE and never trusts the content: the raw value is stringified, stripped of
+ * newlines and truncated. Never the whole object.
+ */
+export function describeUnknownBoundary(data: unknown): string | undefined {
+	if (typeof data !== "object" || data === null) return data === undefined ? undefined : `data: ${typeof data}`;
+	const value = (data as { boundary?: unknown }).boundary;
+	if (value === undefined) return "no boundary field";
+	const raw = typeof value === "string" ? value : typeof value;
+	const flat = raw.replace(/\s+/g, " ").trim();
+	if (flat === "") return "empty boundary";
+	return flat.length > UNKNOWN_DIAGNOSTIC_MAX ? `${flat.slice(0, UNKNOWN_DIAGNOSTIC_MAX)}…` : flat;
+}

package/pi-extensions/lib/entwurf-v2-contract-schema.ts

@@ -51,7 +51,7 @@ export const EntwurfV2InputSchema = Type.Object(
 		mode: Type.Optional(
 			StringEnum(ENTWURF_V2_MODES, {
 				description:
-					"delivery mode (steer = interrupt current turn, follow_up = queue) — NOT the ownership axis (F1) nor liveness routing. MEANINGLESS on the meta-mailbox transport (F-mailbox): a mailbox ack is enqueue+doorbell, not a turn injection, so steer/follow_up does not apply when the verdict transport is meta-mailbox.",
+					"delivery mode — NOT the ownership axis (F1) nor liveness routing. steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. MEANINGLESS on the meta-mailbox transport (F-mailbox): a mailbox ack is enqueue+doorbell, not a turn injection, so steer/follow_up does not apply when the verdict transport is meta-mailbox.",
 			}),
 		),
 		wantsReply: Type.Optional(

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -265,8 +265,12 @@ export type EntwurfV2Transport = (typeof ENTWURF_V2_TRANSPORTS)[number];
 // and a future visible-resume verb would speak them again.
 export const ENTWURF_V2_ACTIONS = ["send"] as const;
 export const ENTWURF_V2_OWNERSHIPS = ["ack-only"] as const;
-// Delivery mode of the message to the target (how it is injected) — steer =
-// interrupt the current turn, follow_up = queue after it. A SEPARATE axis from
+// Delivery mode of the message to the target: WHICH QUEUE a busy receiver is asked for.
+// `[측정 2026-09-22, pi-agent-core 0.87.0; 재측정 2026-09-23, 0.87.1 — 좌표 동일]` neither is an interrupt — `dist/agent-loop.js:186`
+// drains steering after each turn and `:191-197` drains follow-ups only once the inner loop has
+// ended, and the two queues (`dist/agent.js:96-97,137-138`) have no FIFO between them, so a later
+// steer overtakes every earlier follow_up. Both are volatile process memory and an abort drops
+// them. A SEPARATE axis from
 // both the intent/ownership axis (F1) and the liveness-routing axis. The removed
 // v1 `entwurf_send` carried the same steer|follow_up surface, so this axis is
 // inherited vocabulary, not a second live delivery verb.