@junghanacs/entwurf 0.35.0 → 0.35.1

package/CHANGELOG.md

@@ -4,6 +4,135 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.35.1 - 2026-10-13
+
+### ACP
+
+- **Claude rows move to Opus/Sonnet 5.5 (#128).** The curated `entwurf` Claude ids are
+  now `claude-opus-5-5`, `claude-sonnet-5-5` and `claude-fable-5-1`; the Cortex rows keep
+  their native 5 ids. Driver `claude-agent-acp` stays 0.85.1, whose SDK already lists the
+  5.5 ids. Curation and launch checks alone do not certify a live 5.5 turn; the narrow
+  LIVE evidence is recorded under the release boundary below. The retired
+  `claude-opus-5` / `claude-sonnet-5` are not aliased: an Entwurf-built pi launch
+  (`entwurf_fresh_call` `entwurf/<id>`, or `entwurf_resume_call` of a session recorded on
+  one) refuses them as `acp-model-not-curated` before a pane opens, because Pi's substring
+  resolver would otherwise open them on the Cortex rows. Records and transcripts are not
+  rewritten.
+- **Claude set-model answers are read back before the prompt (#128).** The driver answers
+  `claude-sonnet-5-5` and `claude-opus-5-5` with its alias rows `sonnet` / `opus`, named
+  `Sonnet 5.5` / `Opus 5.5`, and `claude-fable-5-1` with its own row (measured against
+  0.85.1 without a prompt). The claude adapter now accepts only that answer: a missing
+  model option, another row, or any row other than that exact value/name pair refuses the
+  turn before the prompt instead of letting a different model answer under the requested
+  id. Cortex answers are not read back; they are unmeasured.
+
+### Developer checkout
+
+- **A source-only menu returns a host to its checkout.** `./run.sh menu` offers a read-only
+  readiness check, or switches to the developer board: after that same check and the exact
+  confirmation `DEV`, it runs the existing `plugins/herdr/use-dev-checkout.sh --apply`, which
+  deactivates the currently owned installation and then links Pi / Claude Code wiring and
+  Herdr's local plugin to this checkout. It needs an interactive terminal, runs only from a
+  source checkout, and adds no installer, npm acquisition, retry or recovery. Its prompts
+  and messages are English.
+
+### pi-durable
+
+- **A read withdraws the inbox notices it made stale (#140).** A doorbell queues one native
+  follow-up per arriving message, while `entwurf_inbox_read` drains them all, so each
+  leftover notice started a run that read an empty inbox. After a read attempt, the
+  pi-durable host aborts (`Submission.abort`) its own queued notices whose announced mail is
+  no longer unread. Reads and rings share one gate. A failed inspection of the mailbox
+  retains the tracked notices; a failed abort releases its tracked handle without retry.
+  Both are named on stderr and leave the read's outcome unchanged. This does not claim the
+  native queued notice was removed after a failed abort, nor crash-safe receive.
+
+### Release boundary and verification
+
+- **Driver unchanged by operator instruction.** `claude-agent-acp` stays 0.85.1. The 0.89.1
+  line (ACP SDK 1.6 → 1.8, agent SDK 0.3.293) is a separate lane and is not read as
+  compatible here.
+- **Local evidence is focused, not a whole pass.** Each slice ran its affected focused gates
+  and its affected qualification groups once as PARTIAL receipts, each with a green
+  control: the #128 launch cut killed 99/99 claims in 12 groups, the set-model readback
+  75/75 in 12 groups, and the menu 6/6 in one group. The set now holds 956 claims across
+  72 lanes. By operator instruction the FULL floor and the whole qualification BODY were
+  not repeated locally during development; both ran in the first prepared SHA's exact CI.
+  Push run 38258514409 at `b93bb37` first failed `check` at `check-herdr-sandbox`
+  `[QK:HS-NO-RESIDUE]`: a sandbox process still held the private HOME after
+  `herdr server stop` and the gate's fixed 2 s wait. A rerun of the failed job on the same
+  SHA passed that assertion, and the run concluded with all four required jobs green and
+  the qualification body at 956/956 claims killed. The first red stays on record as a
+  teardown-timing observation; it is not read as a pass.
+- **LIVE release gate, native Codex excluded for this cut.** As in 0.35.0, the operator
+  excluded native Codex: its MUST step stays wired and declined for lack of the
+  operator-supplied app-server pid and model tiers, so no Codex app-server, sibling or
+  turn started. That SKIP is an unmeasured per-cut exception, not a PASS or a standing
+  waiver. The gate ran from fresh scratch at `b93bb37`, with HEAD, index and tracked tree
+  identical before and after: `/tmp/entwurf-release-gate-0.35.1.aXzo1A/release-gate.log`,
+  MUST PASS=23 FAIL=0 SKIP=1 (only native Codex), BEHAVIOR PASS=1 FAIL=0 SKIP=0, standard
+  `--cut` exit 1 / BLOCKED (MUST SKIP). An earlier attempt failed only its static step,
+  because the checkout's bridge `dist` was older than the source mtimes
+  (`check-bridge-delivery` staleness); the bridge was rebuilt and the whole gate re-run,
+  and only the re-run is the receipt.
+- **What the 5.5 evidence covers.** The ACP steps drove `claude-sonnet-5-5` prompt turns,
+  the provider-path ones through the set-model readback above. `claude-opus-5-5` ran only
+  as a turn-free socket citizen whose record and `get_info` report
+  `entwurf/claude-opus-5-5`; neither it nor Fable 5.1 has prompt-turn evidence. Before the
+  gate, one no-prompt wire measurement against 0.85.1 recorded the set-model answers for
+  all three ids, and one operator-started ACP turn on `claude-sonnet-5-5` reported its own
+  exact model id; that is a model's self-report, not a gate.
+- **Unpublished candidate carrier.** As in 0.35.0, `plugins/herdr/runtime-lock.json`
+  temporarily names the closed `herdr-checkout` source: an npm-source lock must agree with
+  the checkout's core version, and 0.35.1 has no published integrity yet. The Herdr
+  manifest stays 0.35.0. After the operator publishes core 0.35.1, a separate Herdr
+  snapshot re-pins the measured registry bytes.
+- **Publication boundary.** This record amendment carries no source change and takes its
+  own exact CI, qualification body included, before the make artifact, core tag and GitHub
+  Release. npm publication belongs to the operator; the Herdr re-pin follows it.
+
+## v2026.10.12-herdr.0.35.0 — Herdr Entwurf plugin 0.35.0
+
+A separate Herdr plugin snapshot, not another core release: core package0.35.0 and
+its `v0.35.0` tag remain unchanged. The operator has published the core to npm.
+
+### Herdr plugin
+
+- **Re-pin the published core0.35.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns to production npm source
+  `@junghanacs/entwurf@0.35.0` with the registry's measured sha512
+  (`sha512-ENivJbtr…umf2zA==`). The plugin manifest moves0.34.2→0.35.0;
+  admission remains Herdr>=0.9.0 and the one-build/one-pane/Linux shape is unchanged.
+- **The same core capability through Herdr.** This snapshot follows the renewed demo
+  and source-tooling restoration, plus #137's conservative TOML-only qualification
+  refinement. It records no new demo or model turn and changes no rail, gate or mutant.
+- **Upgrade by acquisition source, not just version.** A settled npm-source0.34.2
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed the intervening `herdr-checkout` candidate must explicitly deactivate by
+  its own absolute runtime path before reinstalling the npm-source snapshot.
+  No operator installation or active session is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports version/latest0.35.0, repair0.12.8-repair.1. The downloaded
+  tarball is11083782 bytes, SHA256
+  `82ae9ab99b799c987fe0dac4bb76fc406afe42088a128a131af4d69a97592e71`, equal to the preserved
+  core release candidate. Independently computed sha512 equals `dist.integrity`;
+  the registry-shipped runtime helper is byte-equal to this checkout's.
+- Required exact-registry-tarball Docker consumer passed without repacking. Real-npm
+  0.34.2→0.35.0 swap and harness-seeded torn-swap recovery passed: the product restored
+  the last-good tree before reacquisition, certified the new registry digest, then
+  performed an exact-request no-op and owned-fixture removal. Seven focused
+  Herdr/manifests gates passed; HEAD/index/work surface stayed unchanged during that run.
+- At preparation time, public-ref install/use/deactivate/reinstall and the exact pushed
+  plugin SHA's ordinary four-job CI/#137 next-plugin BODY-SKIP observation are still
+  pending. Their actual outcomes must be recorded in the release checkpoint and #137
+  before tagging/closing; this paragraph is not their acceptance. Earlier npm or
+  checkout-carrier receipts cannot certify these source-specific axes.
+- Core0.35.0's whole940 qualification and native Codex LIVE remain explicit per-cut
+  unmeasured exceptions, never PASS or standing waivers. This plugin-only metadata
+  change does not run the approximately95-minute BODY or another core release aggregate.
+
 ## 0.35.0 - 2026-10-12
 
 ### Collaboration and qualification

package/VERIFY.md

@@ -116,7 +116,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 >
 > A cut that touches the prompt-lifecycle contract (no wall clock on a running turn) owes one long-turn acceptance the aggregate floor is too short to carry: `LIVE=1 ./run.sh smoke-acp-long-turn-live` drives a real turn whose tool work outlasts the retired 600s cutoff and requires exactly one cold ACP bootstrap in the transcript. It takes >12 minutes by construction and is on-demand, not part of `release-gate`.
 >
-> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-6-luna` and recorded-ACP `entwurf/claude-sonnet-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
+> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-6-luna` and recorded-ACP `entwurf/claude-sonnet-5-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
 >
 > One cell cannot be fully fenced, and that is recorded rather than glossed: the recorded-ACP pi cell runs under the operator's REAL home, because its provider spawns `claude` as a child that authenticates from there — measured, a fenced HOME kills that turn with `Authentication required` before the model is ever reached, and `CLAUDE_CONFIG_DIR` alone does not fix it. That is the same trade `smoke-acp-bundled-mcp-live` already makes. While that cell runs, its citizen's control socket and per-gid lock exist under the operator's own `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks`; its meta store stays fixture, so no garden record is minted outside the fixture, and the run ends by proving all six real roots hold the entry sets they started with, with no fixture garden id and no leftover lock.
 >
@@ -278,7 +278,7 @@ consumer image outside this standing protocol.
 ### Verifying the two capabilities a gate cannot fully judge
 
 - **Garden-id delivery:** discover a target with `entwurf_peers`, then `entwurf_v2 fire-and-forget` — the intent axis is single-valued since the visible-first cut. It reaches a live pi target over its control socket, a deliverable self-fetch citizen through the mailbox, and a probe-alive native-push conversation by direct injection. A DORMANT in-domain citizen rejects as `dormant-fire-forget-unsupported` — delivery never wakes it; reopen it with the separate lifecycle verb `entwurf_resume_call {target}`, then dispatch again. A wrong target state is rejected, never auto-fixed and never launched into.
-- **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
+- **ACP continuity:** a direct `pi --provider entwurf --model claude-sonnet-5-5` turn, or the `smoke-acp-session-reuse-live` gate (process-scoped reuse + recall). Multi-turn reuse is proven by that gate, not by any v1 resume tool.
 - **agy citizenship:** in a fresh agy conversation, the first `PreInvocation` must yield a garden id, `entwurf_self` must report `agentId=meta-session/antigravity` and `replyable:true` only while the native probe is alive, and a reply to that same garden id must direct-inject into the same conversation. No mailbox/receiver-marker evidence counts on this rail.
 
 ### What NOT to do — bypassing the operational path
@@ -393,7 +393,7 @@ strips Claude hooks (`hooks: {}` overlay). Strip those carriers:
 cd /path/to/scratch
 env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID \
   LIVE=1 /path/to/entwurf/run.sh release-gate /path/to/scratch --cut
-pi --provider entwurf --model claude-sonnet-5 -p "reply with ok only"   # one-turn smoke
+pi --provider entwurf --model claude-sonnet-5-5 -p "reply with ok only"   # one-turn smoke
 ```
 
 The one-turn smoke is a **provider**-surface check (auth + model routing + a real
@@ -421,7 +421,7 @@ frozen here.
 
 ## 1A. Main Agent Evaluation — Is `entwurf` Claude strong enough?
 
-Separate from continuity gates. Gates prove "sessions continue"; this questionnaire examines tool self-awareness / native tool usability / MCP-boundary awareness / long-turn focus / quality vs direct Claude Code. Run it against `entwurf/claude-sonnet-5` via a direct `pi --provider entwurf` turn (or a live ACP session); accumulate turns by re-prompting the same target.
+Separate from continuity gates. Gates prove "sessions continue"; this questionnaire examines tool self-awareness / native tool usability / MCP-boundary awareness / long-turn focus / quality vs direct Claude Code. Run it against `entwurf/claude-sonnet-5-5` via a direct `pi --provider entwurf` turn (or a live ACP session); accumulate turns by re-prompting the same target.
 
 ### 1A.0 Two carrier surfaces — engraving vs pi-context-augment (load-bearing)
 
@@ -459,6 +459,7 @@ The single-turn / multi-turn / cross-process / persistence-boundary / shutdown i
 | Tool-call / event mapping | `check-acp-event-mapper`, `smoke-acp-provider-live` |
 | Prompt lifecycle — no wall-clock cutoff on a running turn; abort ends it by ACP `session/cancel` with bounded cleanup; a child death is reported with exit status + stderr on new AND reuse turns; our prompt-phase error text is not classified transient by pi | `check-acp-prompt-lifecycle`, `check-probe-ordering` |
 | Claude typed `incomplete_tool_call` prompt failure — real pi retry/overflow classifiers reject the fixed verdict, raw evidence stays in existing diagnostics, exactly one seal and drop on new/reuse; other failures retain the legacy stderr path, cancel stays separate. A deterministic receipt does not certify the target vendor runtime. No LIVE gate induces this rejection; the raw-turn and reuse smokes certify only their own rows above. | `check-acp-vendor-rejection` (four mutants) |
+| Claude set-model answer read back before the prompt — an exact row, or the one alias row (value and name) measured for the requested id; a missing model option, another row or any other value/name pair refuses with non-transient text. Deterministic only: the measured 0.85.1 answer shapes are fixture literals, not a runtime certificate. | `check-acp-set-model-readback` (two mutants), `check-probe-ordering` |
 | Operator mcpServers / skills reach the live session | `smoke-acp-mcp-live`, `smoke-acp-skill-live`, `check-acp-config` |
 | Overlay isolation + memory containment | `check-acp-overlay`, `smoke-acp-memory-containment-live`, `check-acp-tool-surface` |
 

package/docs/acp-backend-rail.md

@@ -379,9 +379,9 @@ operator's repair named.
 
 | Seam | Claude | Cortex Code |
 |---|---|---|
-| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
+| Model ids | unprefixed `claude-sonnet-5-5`, `claude-opus-5-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
 | Launch | bundled `claude-agent-acp`; `CLAUDE_AGENT_ACP_COMMAND` override | `cortex acp serve`; optional connection; `CORTEX_ACP_COMMAND` override; never a launch-time `-m` |
-| Model authority | per-turn ACP set-model | per-turn ACP set-model; an unavailable curated id fails before prompt |
+| Model authority | per-turn ACP set-model, its answer read back before the prompt | per-turn ACP set-model; an unavailable curated id fails before prompt; the answer is not read back |
 | Carrier | engraving in `_meta.systemPrompt` | no system-prompt carrier; engraving rides the first-user augment |
 | Overlay | `CLAUDE_CONFIG_DIR` whitelist, configured-empty hooks, native memory hidden | session-scoped isolated HOME + `SNOWFLAKE_HOME`, private `cortex/mcp.json`, measured-minimum auth passthrough |
 | MCP | explicit wire `mcpServers` | explicit declarations projected to private `mcp.json` because Cortex ignores the wire field |
@@ -390,6 +390,32 @@ operator's repair named.
 
 ### Claude
 
+The unprefixed Claude curation uses exact Opus/Sonnet 5.5 ids; the ACP adapter does
+not route the retired exact ids `claude-opus-5` or `claude-sonnet-5`, alias them to
+a newer model, or rewrite existing session records. Cortex retains its separate
+native 5 ids. Pi owns fuzzy CLI model selection before the adapter: with this
+seven-row set, its 1.1.0 resolver matches the old bare 5 patterns to the Cortex rows
+instead of refusing them (measured with the pure upstream resolver and synthetic rows,
+not a vendor turn). So the launches Entwurf builds admit only an EXACT curated id
+(`pi-extensions/lib/acp/model-ids.js`): `entwurf_fresh_call` with backend `pi` and an
+`entwurf/<id>` model, and `entwurf_resume_call` of a session whose emitted provider is
+`entwurf`, refuse anything else as `acp-model-not-curated` before a pane opens. A human
+typing `pi --model …` keeps the upstream fuzzy behaviour, so use the full 5.5 ids there.
+
+The adapter reads its set-model answer back before the prompt. The driver resolves the
+requested id onto one of the rows it offers and answers with that row's `value` as the
+model option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). Measured on
+2026-10-12 against 0.85.1 with no prompt sent: `claude-fable-5-1` answers its own row,
+while `claude-sonnet-5-5` and `claude-opus-5-5` answer the alias rows `sonnet` and
+`opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row resolves to is not on the
+ACP wire, so `CLAUDE_SET_MODEL_ALIAS_ROWS` (`backend-adapter.ts`) declares, for each
+alias-answered id, the one measured row it is accepted as, value and name together. A
+missing model option, another row, or any other value/name pair refuses the turn before
+the prompt, with text pi does not classify as transient. A curated id added later needs
+its own measured answer before it ships. `check-acp-set-model-readback` holds the
+contract offline; it does not certify the installed driver's runtime, and no 5.5 prompt
+turn is claimed by this measurement.
+
 The bundled adapter resolves before any PATH fallback. Its overlay retains only the
 auth/runtime state required by the Claude Agent SDK and hides operator memory, hooks,
 agents, history, and local settings. Rich project/operator context rides the first-user

package/docs/setup-clean-host.md

@@ -913,7 +913,7 @@ operator-installed Claude runtime. Resolution order:
 2. `require.resolve(...)` against the bundled `@agentclientprotocol/claude-agent-acp`.
 3. `PATH:claude-agent-acp` fallback if package resolution fails.
 
-The curated Claude ids are `claude-opus-5`, `claude-sonnet-5`, and
+The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`, and
 `claude-fable-5-1`. Cortex exposes `cortex-auto`, `cortex-claude-opus-5`,
 `cortex-claude-sonnet-5`, and `cortex-openai-gpt-5.4`.
 `entwurfProvider.cortexConnection` or `ENTWURF_ACP_CORTEX_CONNECTION` selects

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -110,6 +110,44 @@ function resolveClaudeLaunch() {
  * ambient value cannot turn it off. Cortex declares nothing of the kind.
  */
 export const CLAUDE_FOREGROUND_ONLY_ENV = { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" };
+/**
+ * The set-model answer is read back before the prompt (#128). claude-agent-acp resolves the
+ * requested id onto one of the rows it offers and answers with that row's `value` as the model
+ * option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). `[측정 2026-10-12]` 0.85.1, no
+ * prompt: `claude-fable-5-1` answers its own row, while `claude-sonnet-5-5` and `claude-opus-5-5`
+ * answer the alias rows `sonnet` and `opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row
+ * resolves to (`ModelInfo.resolvedModel`) is not on the ACP wire, so an alias answer is accepted
+ * only as the exact measured row, value AND name, declared here for the requested id. No other
+ * spelling is matched.
+ */
+export const CLAUDE_SET_MODEL_ALIAS_ROWS = Object.freeze({
+    "claude-sonnet-5-5": Object.freeze({ value: "sonnet", name: "Sonnet 5.5" }),
+    "claude-opus-5-5": Object.freeze({ value: "opus", name: "Opus 5.5" }),
+});
+/** Refuse unless the set-model answer names the requested model. A missing model option, another
+ *  row, or a row that is not the measured alias row would let a different model answer under this id. */
+export function confirmClaudeSetModelAnswer(response, nativeModelId) {
+    const configOptions = response?.configOptions;
+    const modelOption = Array.isArray(configOptions)
+        ? configOptions.find((option) => option?.id === "model")
+        : undefined;
+    const currentValue = modelOption?.currentValue;
+    if (typeof currentValue === "string" && currentValue === nativeModelId)
+        return;
+    const rows = Array.isArray(modelOption?.options)
+        ? modelOption.options.flatMap((row) => Array.isArray(row?.options) ? row.options : [row])
+        : [];
+    const selected = typeof currentValue === "string" ? rows.find((row) => row?.value === currentValue) : undefined;
+    const alias = CLAUDE_SET_MODEL_ALIAS_ROWS[nativeModelId];
+    if (alias !== undefined && currentValue === alias.value && selected?.name === alias.name)
+        return;
+    const answered = modelOption === undefined
+        ? "no model option"
+        : `model ${jsonText(currentValue)} named ${jsonText(selected?.name ?? null)}`;
+    throw new Error(`entwurf: claude-agent-acp answered set-model ${JSON.stringify(nativeModelId)} with ${answered}, which does not ` +
+        `name the requested model. Refusing before the prompt so a different model cannot answer under this id; ` +
+        `the installed driver and the curated id disagree, and repeating the turn cannot change that.`);
+}
 export const claudeAdapter = {
     backend: "claude",
     // Claude owns its UNPREFIXED curated ids only (rail “Adapter contract”). The native id
@@ -161,7 +199,12 @@ export const claudeAdapter = {
         if (typeof setConfig !== "function") {
             throw new Error(`setSessionConfigOption unsupported — cannot enforce model ${modelId}`);
         }
-        await setConfig.call(connection, { sessionId: acpSessionId, configId: "model", value: nativeModelId });
+        const answer = await setConfig.call(connection, {
+            sessionId: acpSessionId,
+            configId: "model",
+            value: nativeModelId,
+        });
+        confirmClaudeSetModelAnswer(answer, nativeModelId);
     },
     configSignatureFields(_adapterSettings) {
         // Claude folds no extra backend-specific fields beyond backend + nativeModelId
@@ -302,7 +345,8 @@ export const cortexAdapter = {
     // serves fails loud BEFORE the prompt (`Unsupported model: …`). PR #40's
     // launch-time `-m` pin was retired for this: set-model is the single model
     // authority (resolveLaunch never passes `-m`), and "auto" is set explicitly
-    // rather than treated as an unspoken default.
+    // rather than treated as an unspoken default. NO answer readback, unlike claude: nobody has
+    // measured what cortex's set_config_option response carries, so a check would be a guess.
     async enforceModel({ connection, acpSessionId, nativeModelId, modelId }) {
         const setConfig = connection.setSessionConfigOption;
         if (typeof setConfig !== "function") {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/model-ids.js

@@ -0,0 +1,67 @@
+// ACP plugin — the curated model IDs, and nothing else (#128).
+//
+// This leaf imports NOTHING. `models.ts` builds the registry rows from the pi-ai
+// catalog; the launch seams (`fresh-call-dispatch.ts`, `resume-launch-identity.ts`)
+// only need to know which IDs exist, and they ride the pi-free bridge closure, so
+// they read the IDs here rather than load a vendor catalog to learn them.
+//
+// WHY `.js`: the same reason as `protocol.js`. Both the emit-capable root program
+// (allowJs) and Node --experimental-strip-types resolve an explicit `.js` import
+// literally to this file, so `models.ts` (root fence, `.js` specifiers) and the
+// strip-types gates that load `models.ts` directly reach one SSOT. A `.ts` leaf
+// would need a `.ts` specifier the root config cannot allow.
+//
+// WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
+// case-insensitive substring match among the provider's rows and prefers the
+// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
+// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
+// silently open on the Snowflake Cortex rail instead of the Claude subscription.
+// An exact match against this list is the only admission; nothing is aliased,
+// substituted or rewritten.
+/** The single ACP provider id under which every curated row is registered. */
+export const PROVIDER_ID = "entwurf";
+// The curated Claude ids. Adding one here is a commitment to verify it across
+// both axes (protocol smoke + agent interview) — do not extend casually.
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
+    "claude-sonnet-5-5",
+    "claude-opus-5-5",
+    "claude-fable-5-1",
+]);
+/** The anchor model whose absence is a hard registry regression, not a soft skip. */
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
+// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
+// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+export const CORTEX_MODEL_PREFIX = "cortex-";
+export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+    "cortex-auto",
+    "cortex-claude-opus-5",
+    "cortex-claude-sonnet-5",
+    "cortex-openai-gpt-5.4",
+]);
+/** @type {ReadonlySet<string>} */
+const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+/**
+ * Exact membership only — no trim, no case folding, no prefix.
+ * @param {string} model
+ * @returns {boolean}
+ */
+export function isCuratedAcpModelId(model) {
+    return CURATED_ACP_MODEL_IDS.has(model);
+}
+/** The named refusal both launch seams answer with. */
+export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curated");
+export const ACP_MODEL_NOT_CURATED_HINT = `an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
+    "Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
+    "so nothing was opened, and nothing is aliased or rewritten";
+/** Carries `reason` so callers match a FIELD, never the wording. */
+export class AcpModelNotCuratedError extends Error {
+    /** @param {string} model */
+    constructor(model) {
+        super(`${ACP_MODEL_NOT_CURATED}: ${JSON.stringify(model)} is not an exact curated ${PROVIDER_ID} model id`);
+        this.name = "AcpModelNotCuratedError";
+        /** @readonly */
+        this.reason = ACP_MODEL_NOT_CURATED;
+        /** @readonly */
+        this.model = model;
+    }
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -32,8 +32,11 @@
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
 import { getModels } from "@earendil-works/pi-ai/compat";
-/** Provider id — current pre-rename surface; S1 renames this load-bearing id to `entwurf`. */
-export const PROVIDER_ID = "entwurf";
+import { CURATED_ANCHOR_MODEL_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./model-ids.js";
+// The provider id and the curated ID lists live in the dependency-free
+// `model-ids.js` leaf, shared with the launch seams (#128); this file is the only
+// one that loads the upstream catalog to turn them into registry rows.
+export { CORTEX_MODEL_PREFIX, CURATED_ANCHOR_MODEL_ID, PROVIDER_ID, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./model-ids.js";
 // #26 auth-boundary sentinel. `pi.registerProvider` requires an apiKey when a
 // provider defines custom models, but the ACP plugin consumes NO key: backend
 // auth belongs to the operator's own Claude CLI child process (AGENTS
@@ -45,15 +48,8 @@ export const PROVIDER_ID = "entwurf";
 // — that silences the warning but keeps the wrong auth-boundary shape. The
 // check-auth-boundary gate pins this.
 export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
-// The curated Claude ids. Adding one here is a commitment to verify it across
-// both axes (protocol smoke + agent interview) — do not extend casually.
-// Exported so the claude backend adapter (backend-adapter.ts) can answer
-// `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"];
-/** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
-// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5.5, Opus 5.5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window was the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.
@@ -82,7 +78,7 @@ function claudeContextWindow(model) {
 // carries the reserved `cortex-` prefix: the prefix is the SINGLE routing
 // authority (backend-adapter.ts `routeModel`) and keeps the ids off the Claude
 // native ids Cortex routes to (`cortex-claude-sonnet-5` vs the unprefixed
-// `claude-sonnet-5` the claude adapter owns). `routeModel` strips the prefix to
+// `claude-sonnet-5-5` the claude adapter owns). `routeModel` strips the prefix to
 // recover the native id, which is enforced per-turn via
 // session/set_config_option — never a launch `-m` pin (CP0-M).
 //
@@ -91,14 +87,7 @@ function claudeContextWindow(model) {
 // the running cortex no longer serves fails LOUD at set-model, before the
 // prompt (measured: `Unsupported model: …` names the live set). Adding an id
 // here is the same verify-both-axes commitment as the Claude set — do not
-// extend casually.
-export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = [
-    "cortex-auto",
-    "cortex-claude-opus-5",
-    "cortex-claude-sonnet-5",
-    "cortex-openai-gpt-5.4",
-];
+// extend casually. The prefix and the four ids are declared in model-ids.js.
 // Hand-set conservative context window. Cortex reports the LIVE window via its
 // own ACP session config, not this curated metadata — this is a floor for the
 // registry surface, deliberately not inflated to the Claude 1M.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-visible-resume.js

@@ -46,6 +46,7 @@
  * a resume runs no turn (measured — the transcript stayed byte-identical), so there is no turn
  * outcome for this module to claim.
  */
+import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
 import { ResumeBackendUnsupportedError, resolveResumeLaunchIdentity, } from "./resume-launch-identity.js";
@@ -129,6 +130,15 @@ export async function visibleResume(targetGardenId, deps) {
             identity = deps.resolveIdentity(targetGardenId);
         }
         catch (err) {
+            // #128: the recorded model is not an exact curated ACP id, so Pi would pick another row
+            // by substring. Same shape as `target-not-pi`: a named refusal matched on its FIELD.
+            if (err instanceof AcpModelNotCuratedError) {
+                return {
+                    ok: false,
+                    reason: err.reason,
+                    detail: `${targetGardenId} would launch model ${JSON.stringify(err.model)} under the entwurf provider (the resolved launch pair, which may differ from the recorded provider)`,
+                };
+            }
             if (err instanceof ResumeBackendUnsupportedError) {
                 return {
                     ok: false,
@@ -210,6 +220,7 @@ export async function observeSameGidSocket(targetGardenId, socketPath, deps, tim
 const REJECT_HINT = {
     "target-invalid": "no citizen has that id; discover targets with entwurf_peers",
     "target-not-pi": "that citizen's backend has no same-id resume — reach it with entwurf_v2, or open a fresh sibling",
+    "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "target-locked": "another resume or dispatch holds this citizen's lock right now",
     "target-live": "that citizen is already running — this verb only reopens dormant ones",
     "target-indeterminate": "the socket probe could not prove the citizen is dormant, so nothing was started",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-dispatch.js

@@ -24,8 +24,9 @@
  * the one address path, on both rails.
  */
 import { spawn as spawnChildProcess } from "node:child_process";
+import { ACP_MODEL_NOT_CURATED, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-preflight.js";
-import { mintNonce } from "./fresh-call-composition.js";
+import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.js";
 import { createHerdrRunner, herdrFreshCall, renderHerdrFreshCall, resolveHerdrContext, } from "./herdr-fresh-call.js";
 import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 /** herdr's own marker, read for its EXACT value. `[측정 2026-09-14]` herdr exports `HERDR_ENV=1`
@@ -33,6 +34,25 @@ import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 export function selectFreshCallRail(env) {
     return env.HERDR_ENV === "1" ? "herdr" : "tmux";
 }
+/**
+ * #128: a pi sibling asked for under the `entwurf` provider must name an EXACT curated ACP id. Pi
+ * resolves `--model` by substring among that provider's rows, so a retired `entwurf/claude-sonnet-5`
+ * would open on `cortex-claude-sonnet-5` — another vendor and billing rail — with a receipt that
+ * still names the requested id. Asked here, at the one root both rails share, so neither rail can
+ * forget it. It reads the model the way the rails will (trimmed), and only a model that already
+ * passes their grammar: a malformed one keeps its own `model-invalid` answer from the rail.
+ */
+export function isUncuratedEntwurfPiModel(backend, model) {
+    if (backend !== "pi")
+        return false;
+    const trimmed = model.trim();
+    if (!isSafeFreshCallModel(trimmed))
+        return false;
+    const slash = trimmed.indexOf("/");
+    if (slash < 0 || trimmed.slice(0, slash) !== PROVIDER_ID)
+        return false;
+    return !isCuratedAcpModelId(trimmed.slice(slash + 1));
+}
 /**
  * Open a sibling on whichever rail this process is actually standing in.
  *
@@ -49,6 +69,12 @@ export function selectFreshCallRail(env) {
  * them rather than inheriting a rule from a topology it does not share.
  */
 export async function dispatchFreshCall(request, env = process.env, spawn, nonce = mintNonce()) {
+    // Before either rail is asked anything: both would open a pane on the wrong row.
+    if (isUncuratedEntwurfPiModel(request.backend, request.model)) {
+        return selectFreshCallRail(env) === "herdr"
+            ? { rail: "herdr", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } }
+            : { rail: "tmux", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } };
+    }
     if (selectFreshCallRail(env) === "herdr") {
         const context = resolveHerdrContext(env);
         if (!context.ok) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -789,6 +789,9 @@ const HERDR_REJECT_HINT = {
     "caller-identity-unavailable": "this surface has no record-backed identity, so a sibling would have nowhere to call home",
     "model-empty": "pass the model you want the sibling opened with — it is never inherited from this process",
     "model-invalid": "the model is not in the accepted grammar (no whitespace, no leading dash)",
+    // #128: decided at the dispatch root (`fresh-call-dispatch.ts`), worded here because this rail's
+    // import fence admits no ACP module. The curated list itself lives in `acp/model-ids.js`.
+    "acp-model-not-curated": "an entwurf model must be one exact curated ACP id — Pi would otherwise pick another row by substring (a retired claude-sonnet-5 lands on cortex-claude-sonnet-5), so nothing was opened and nothing was aliased",
     "task-empty": "a sibling opened with nothing to do is a window nobody asked for",
     "task-too-long": `the task is over the ${TASK_MAX_CHARS}-character interface bound this verb shares with entwurf_v2`,
     "herdr-context-missing": "HERDR_ENV/HERDR_BIN_PATH are absent, so this process is not inside herdr and this rail does not exist here",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -85,6 +85,7 @@
  *     the session the window is actually in. It still reports no `pane_current_path`, and
  *     there is no "session created" field because nothing here creates one.
  */
+import { ACP_MODEL_NOT_CURATED_HINT } from "./acp/model-ids.js";
 import { callbackEnvAssignments } from "./callback-env.js";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
@@ -490,6 +491,7 @@ const REJECT_HINT = {
     "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
+    "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "task-empty": "task is empty after trimming",
     "task-too-long": `task exceeds ${TASK_MAX_CHARS} characters`,
     "runtime-unresolved": "the backend's runtime is not installed on PATH",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/resume-launch-identity.js

@@ -19,11 +19,12 @@
  */
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { AcpModelNotCuratedError, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { getEntwurfExplicitExtensions, readSessionIdentity } from "./entwurf-core.js";
 import { readAddressableMetaIdentity } from "./meta-session.js";
 /**
- * The ONE expected refusal on this leaf: the target is a citizen of a backend that has no
- * same-id resume at all.
+ * One of the TWO expected refusals on this leaf: the target is a citizen of a backend that has no
+ * same-id resume at all. The other is `AcpModelNotCuratedError` (#128, `acp/model-ids.js`).
  *
  * Everything else this function throws is a defect in the record, the transcript or the
  * environment — a stale path, a foreign session file, an unrecorded model, an unresolvable
@@ -126,11 +127,19 @@ export function resolveResumeLaunchIdentity(gardenId) {
     if (!identity.cwd) {
         throw new Error(`resume-launch-identity: ${gardenId} header has no cwd (the cold-resume authority, #9).`);
     }
+    // #128: the pair checked is the one the launch will EMIT, not the recorded provider alone —
+    // `getEntwurfExplicitExtensions` also routes a bare Claude model id to `entwurf`. Under that
+    // provider Pi resolves `--model` by substring, so a retired `claude-sonnet-5` would reopen on
+    // `cortex-claude-sonnet-5`. The record and transcript stay as they are; the resume is refused.
+    const provider = explicitExtensions.provider ?? identity.provider;
+    const model = explicitExtensions.modelOverride ?? resumeModel;
+    if (provider === PROVIDER_ID && !isCuratedAcpModelId(model))
+        throw new AcpModelNotCuratedError(model);
     return {
         sessionFile,
         cwd: identity.cwd,
         explicitExtensionArgs: explicitExtensions.args,
-        provider: explicitExtensions.provider ?? identity.provider,
-        model: explicitExtensions.modelOverride ?? resumeModel,
+        provider,
+        model,
     };
 }