@junghanacs/entwurf 0.35.0 → 0.36.0

package/run.sh

@@ -2,10 +2,10 @@
 #
 # Model id convention (see AGENTS.md Hard Rule #1):
 #   - User-facing examples use the qualified form `entwurf/<backend-model>`
-#     (e.g. `entwurf/claude-sonnet-5`); the prefix routes to this provider
+#     (e.g. `entwurf/claude-sonnet-5-5`); the prefix routes to this provider
 #     so `--provider` is redundant and is dropped in docs.
 #   - Smoke helpers that feed `ensureBridgeSession({modelId})` directly (cancel,
-#     model-switch) pass BARE backend ids (`claude-sonnet-5`, `gpt-5.4`)
+#     model-switch) pass BARE backend ids (`claude-sonnet-5-5`, `gpt-5.4`)
 #     because the bridge library contract is bare. Smoke helpers that invoke pi
 #     via the CLI still pin `--provider entwurf` and can accept either
 #     bare or qualified model, but we keep bare here to match the bridge-level
@@ -32,7 +32,7 @@ TARGET_PROJECT_DIR=${2:-$PROJECT_DIR_DEFAULT}
 # and install path against the same scope for traceability.
 PACKAGE_NAME="@junghanacs/entwurf"
 # Runtime provider id — DO NOT change. Embedded in model strings
-# (`entwurf/claude-sonnet-5`), settings keys (`entwurfProvider`),
+# (`entwurf/claude-sonnet-5-5`), settings keys (`entwurfProvider`),
 # log prefixes (`[entwurf:bootstrap]`), and the `--provider entwurf`
 # CLI surface. Renaming this would break every consumer transcript and every
 # saved session anchor.
@@ -116,9 +116,55 @@ run_vitest() {
   (cd "$REPO_DIR" && "$bin" run "$@")
 }
 
+# A source-only UI over the existing owned developer-return procedure. No second
+# installer, npm acquisition, automatic mode switch or ownership writer lives here.
+developer_menu() {
+  [ "$#" -eq 0 ] || { echo 'usage: ./run.sh menu' >&2; return 2; }
+  if [ ! -d "$REPO_DIR/.git" ] || [ ! -f "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" ]; then
+    echo '[menu] developer-checkout-source-only — run ./run.sh menu from the prepared source checkout, not the npm installation.' >&2
+    return 1
+  fi
+  if [ ! -t 0 ]; then
+    echo '[menu] menu-tty-required — interactive stdin is required; nothing was changed.' >&2
+    return 2
+  fi
+  local choice confirm
+  printf '\nHerdr — npm installation check → developer board (local checkout)\n'
+  printf 'Checkout: %s\n' "$REPO_DIR"
+  printf '  1) Readiness check — read-only (not a full certificate of installation prerequisites)\n'
+  printf '  2) Switch to the developer board — Pi / Claude Code / Herdr local link\n'
+  printf '  0) Quit — nothing is changed\n'
+  if ! IFS= read -r -p 'Choose [0/1/2]: ' choice; then
+    echo '[menu] menu-input-closed — nothing was changed.' >&2
+    return 2
+  fi
+  case "$choice" in
+    0) return 0 ;;
+    1) bash "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" --check ;;
+    2)
+      # Show the real owner's readiness first. Busy sessions or bad ownership
+      # stop here; confirmation grants no authority to bypass those guards.
+      bash "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" --check || return $?
+      printf '\nClose the affected sessions yourself, and start no new session while switching.\n'
+      printf 'The currently owned installation is deactivated, then this checkout is linked. There is no automatic recovery or retry.\n'
+      if ! IFS= read -r -p 'Type DEV to switch (anything else cancels): ' confirm; then
+        echo '[menu] menu-input-closed — apply was not called.' >&2
+        return 2
+      fi
+      if [ "$confirm" != DEV ]; then
+        echo '[menu] menu-cancelled — installation wiring is unchanged.'
+        return 0
+      fi
+      bash "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" --apply
+      ;;
+    *) echo '[menu] invalid-menu-choice — choose 0, 1 or 2; nothing was changed.' >&2; return 2 ;;
+  esac
+}
+
 usage() {
   cat <<'EOF'
 Usage:
+  ./run.sh menu                       # source-only Herdr developer board: read-only readiness check or explicitly confirmed return to checkout wiring; never closes sessions or acquires npm artifacts
   ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
@@ -135,7 +181,7 @@ Usage:
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
   ./run.sh check-demo-reproducibility # source-checkout-only: discover offline demo Node tests; no LIVE, model, render or publication
-  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter/task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
+  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver, owned-source emission and typecheck fence, task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
@@ -223,11 +269,11 @@ Usage:
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
   ./run.sh smoke-claude-native-resume-live # LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path
 
-  ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
+  ./run.sh install-meta-bridge        # INTERNAL wiring leaf: setup, the source-only developer menu and doctor recovery compose it; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is NOT CERTIFIED and stays nonzero, on ONE narrowed reason — start-key and ppid are portable there (`ps` fallback, same string the TS core mints), so what holds the lane closed is per-process environment DISCOVERY alone, pending physical-host evidence. Detection power is held by check-meta-doctor-oracle
   ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
-  ./run.sh pi-durable [args...]       # #129/#130: the MANAGED durable launch. Verifies this package's pi-durable CARRIER (pi/pi-durable/carrier/, the pinned upstream app emitted by the maintainer) and the pi SDK set it resolves — every declared member/direct edge at exactly the pinned version — refusing by name (package-incomplete / carrier-drift / sdk-absent / sdk-mismatch, exit 3), then exec()s node under the carrier resolver with the packaged bootstrap (pi/pi-durable/bootstrap.mjs) in this terminal. A new session needs --provider <p> --model <exact catalog id> --width task-wide [--entwurf-bootstrap <{v:2,task}>]; --continue takes none of them. Nothing outside the package is located, installed or repaired
+  ./run.sh pi-durable [args...]       # #129/#130: the MANAGED durable launch. Verifies this package's pi-durable CARRIER (pi/pi-durable/carrier/, emitted deterministically from Entwurf's owned source pi/pi-durable/src) and the pi SDK set it resolves — every declared member/direct edge at exactly the pinned version — refusing by name (package-incomplete / carrier-drift / sdk-absent / sdk-mismatch, exit 3), then exec()s node under the carrier resolver with the packaged bootstrap (pi/pi-durable/bootstrap.mjs) in this terminal. A new session needs --provider <p> --model <exact catalog id> --width task-wide [--entwurf-bootstrap <{v:2,task}>]; --continue takes none of them. Nothing outside the package is located, installed or repaired
   ./run.sh install-copilot-bridge     # #82: GLOBAL install of the Copilot BIRTH plugin (own marketplace root; node+entry baked into the no-argv exec string). MCP wiring and the RECEIVER extension are separate install surfaces (install-copilot-mcp, install-copilot-receive). Also retires the stale Claude unit (--keep-stale-claude-unit opts out)
   ./run.sh uninstall-copilot-bridge   # #86 C3a: honest inverse of install-copilot-bridge from the package-owned install-state (exact qualified id + exact marketplace name/path + recorded assembly only; state deleted LAST; a failing vendor list is UNKNOWN and refuses; never --force, never the stale Claude unit)
   ./run.sh doctor-copilot-bridge      # #82/#86: fail-loud surface for that unit — runtime axis (red = a hook that RAN and failed, or a broken/unbaked artifact; "installed with zero records" is NOT red and is reported as NOT-YET: a Copilot session is born on its FIRST PROMPT, not when the window opens, measured) + ownership axis (install-state shape/binding, marketplace path drift, UNKNOWN vendor lists; legacy no-state install = named non-green, repair = install-copilot-bridge adoption). Either axis red = red
@@ -291,7 +337,7 @@ Usage:
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi SDK (pins derived from the package.json exact production dependency; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for) + the INSTALLED #129 durable bootstrap (pi/pi-durable/bootstrap.mjs) imported from node_modules: main/openDurableCitizen exported and PACKAGED_BRIDGE_ENTRY = the installed package's own dist entry — import only, no runtime/TUI/birth/bridge started + the #130 pi-durable CARRIER on actual npm consumers (Entwurf-only / aligned host / isolated global): the installed verifier, a consumer-contained resolution oracle with a same-sandbox neighbour control, every physical SDK edge at the pin, a mixed tree refused as pi-durable-sdk-mismatch though it still imports, and the public `entwurf pi-durable` reaching the app's own explicit-model refusal before any birth, also with one explicit `--native-module` (the synthetic fixture, initialized first; a reserved extension name refused before anything opens) (offline, sandbox HOME)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
-  ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
+  ./run.sh install [project-dir]      # INTERNAL wiring leaf: setup/npm-consumer entry and the source-only developer menu compose it; prefer those owning procedures
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
   ./run.sh install-user-scope [--plugin-runtime <root>]  # #116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope
   ./run.sh herdr-plugin-activate <backend...>  # #116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status
@@ -1395,6 +1441,14 @@ check_acp_foreground_only() {
   run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
 }
 
+check_acp_set_model_readback() {
+  # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
+  # MUTANT EXECUTION COORDINATE for scripts/mutants/acp-set-model-readback.json (#128): the claude
+  # adapter refuses a set-model answer that does not name the requested model, before the prompt.
+  section "claude ACP set-model readback (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
+}
+
 check_acp_vendor_rejection() {
   # Behaviour-adjacent tests are discovered by the glob lane. This narrow case is the
   # mutant execution coordinate: include the adapter admission and real turn pipeline,
@@ -1552,7 +1606,7 @@ check_pi_durable_beside() {
   # from re-running every beside test. The six files are one contact: the adapter and its packaged
   # bootstrap, the installed carrier/SDK-set verifier (which also reads the three checkout gates as
   # SOURCE), the fresh preflight, the owner join that admits the durable host, the carrier's
-  # relocation grammar, resolver and maintainer emitter (#130) with the carrier's task footer (#134),
+  # relocation grammar, resolver, owned-source emitter (#130, #141) and source fence with the carrier's task footer (#134),
   # and the bootstrap's explicit --native-module ingress (#130 P2) and its --native-module-dir (#134).
   run_vitest pi-extensions/meta-bridge-pi-durable.test.ts pi-extensions/lib/pi-durable-runtime.test.ts pi-extensions/lib/pi-durable-fresh-preflight.test.ts pi-extensions/lib/entwurf-deliverability.owner-join.test.ts pi-extensions/lib/pi-durable-carrier.test.ts pi-extensions/lib/pi-durable-native-module.test.ts
 }
@@ -1603,12 +1657,12 @@ check_mux_launch_tmux() {
 smoke_acp_socket_citizen_live() {
   # S1 acceptance smoke (ACP plugin on v2) — OUT of pnpm check, needs LIVE=1.
   # Spawns a REAL `pi --entwurf-control` resident on an ACP model
-  # (entwurf/claude-opus-5) and proves it is a first-class socket-citizen:
+  # (entwurf/claude-opus-5-5) and proves it is a first-class socket-citizen:
   # the control socket stands up, get_info answers with the ACP model (model-lock
   # did NOT revert — QM1), idle/cwd are reported, and the fail-loud streamSimple
   # stub never fires (turn-free launch — QM2). No prompt is sent: S1 proves
   # citizenship, never a backend turn (that is S2). Honest skip when LIVE!=1.
-  # Model override: ENTWURF_S1_MODEL (default claude-opus-5).
+  # Model override: ENTWURF_S1_MODEL (default claude-opus-5-5).
   #   LIVE=1 ./run.sh smoke-acp-socket-citizen-live
   run_ts scripts/smoke-acp-socket-citizen-live.ts
 }
@@ -1622,7 +1676,7 @@ smoke_acp_raw_turn_live() {
   # plus captured raw NDJSON bytes. NO provider/overlay/streamSimple/_meta — the
   # raw backend pipe only. Launch source must be the package bin (PATH fallback
   # fails acceptance unless ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK=1, debug).
-  # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-raw-turn-live
   run_ts scripts/smoke-acp-raw-turn-live.ts
 }
@@ -1640,7 +1694,7 @@ smoke_acp_overlay_live() {
   # meta-store for mailbox absence (flaky — concurrent sessions); the honest
   # claim is overlay-supplies-hooks:{}. Launch must be the package bin (PATH
   # fallback fails acceptance unless ENTWURF_ACP_OVERLAY_ALLOW_PATH_FALLBACK=1).
-  # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-overlay-live
   run_ts scripts/smoke-acp-overlay-live.ts
 }
@@ -1655,7 +1709,7 @@ smoke_acp_memory_containment_live() {
   # can stop a memory write is the lever — not us. Fails loud if engraving.md is
   # empty (carrier OFF = no containment). Launch must be the package bin (PATH
   # fallback fails acceptance unless ENTWURF_ACP_MEMORY_ALLOW_PATH_FALLBACK=1).
-  # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-memory-containment-live
   run_ts scripts/smoke-acp-memory-containment-live.ts
 }
@@ -1682,7 +1736,7 @@ smoke_acp_provider_live() {
   # assistant reply (live model proof) + the removed S0 stub error never appears
   # (provider path actually opened) + pi exits 0. Tool-free prompt; the
   # event-mapper gate owns the tool→notice contract.
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-provider-live
   run_ts scripts/smoke-acp-provider-live.ts
 }
@@ -1696,7 +1750,7 @@ smoke_acp_session_reuse_live() {
   # is the verdict; codeword recall is supporting only (a rebuilt full transcript
   # could recall it too). The one-shot exit0 half is owned by
   # smoke-acp-provider-live.
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-session-reuse-live
   run_ts scripts/smoke-acp-session-reuse-live.ts
 }
@@ -1708,7 +1762,7 @@ smoke_acp_carrier_augment_live() {
   # secret (the augment rode the wire to the model) and the EMPTY default carrier
   # must bill clean (exit 0, no HTTP-400 canary — 핀1 live). Optional tiny carrier
   # check via SMOKE_ACP_CARRIER_PRESENT=1 (non-blocking).
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-carrier-augment-live
   run_ts scripts/smoke-acp-carrier-augment-live.ts
 }
@@ -1794,9 +1848,9 @@ smoke_acp_rgg_live() {
   # birth, record-keyed socket, attach-on-reopen, no pi-session-id socket) holds
   # under the ACP provider too — the logic is provider-agnostic. The POSITIVE cell
   # (one real turn completing transcriptPath/model) is the only model-in-loop part.
-  # Target override: ENTWURF_RGG_TARGET (default entwurf/claude-sonnet-5).
+  # Target override: ENTWURF_RGG_TARGET (default entwurf/claude-sonnet-5-5).
   #   ./run.sh smoke-acp-rgg-live
-  local target="${ENTWURF_RGG_TARGET:-entwurf/claude-sonnet-5}"
+  local target="${ENTWURF_RGG_TARGET:-entwurf/claude-sonnet-5-5}"
   (cd "$REPO_DIR" && ENTWURF_LIVE_TARGET="$target" SMOKE_RGG_POSITIVE=0 bash scripts/smoke-resident-garden-guard.sh)
 }
 
@@ -2381,8 +2435,8 @@ const nextFloorRange = `>=${piAi} <${piMaj}.${piMin + 1}`;
 const floorGaps = [];
 const PI_CONSTELLATION = [
   '@earendil-works/pi-ai', '@earendil-works/pi-coding-agent', '@earendil-works/pi-tui',
-  '@earendil-works/pi-agent-core', '@earendil-works/pi-client', '@earendil-works/pi-protocol',
-  '@earendil-works/pi-telemetry', '@earendil-works/chord',
+  '@earendil-works/pi-agent-core', '@earendil-works/pi-telemetry', '@earendil-works/chord',
+  // `[측정 2026-10-13]` 1.2.0: pi-client and pi-protocol left — upstream removed both, E404 at 1.2.0.
   // `[측정 2026-09-30]` 0.99.1: pi-coding-agent's runtime deps gained the built-in extensions' packages.
   '@earendil-works/pi-codemode', '@earendil-works/pi-mcp',
   // #130: the durable library the pi-durable carrier imports — a production dependency since 0.32.
@@ -2523,6 +2577,65 @@ for (const [file, re, min, label] of SITES) {
   bound += hits.length;
 }
 
+// #141: the pi-durable carrier's emitter identity, the one place CI runs an EXACT Node. The check job
+// runs the Node the pin records as the carrier's emitter (CI-BOUND), and its check:full floor step runs
+// with ENTWURF_REQUIRE_EMITTER_NODE=1 (CI-REQUIRED), so that floor proves the emission under that
+// identity; every other job floats the major so the newest release of the lane stays covered. Both are
+// read from ACTIVE workflow lines only — the step's own `with:` / `env:` mapping, comments stripped —
+// so commented-out text or the same key on another step can never stand in for them.
+const EMITTER_BOUND_QK = '[QK:PI-DURABLE-EMITTER-NODE-CI-BOUND]';
+const EMITTER_REQUIRED_QK = '[QK:PI-DURABLE-EMITTER-NODE-CI-REQUIRED]';
+const emitterNode = JSON.parse(readFileSync('pi/pi-durable/overlay/upstream-pin.json', 'utf8')).carrier?.emitter?.node;
+assert.match(String(emitterNode), /^v\d+\.\d+\.\d+$/,
+  `${EMITTER_BOUND_QK} pi/pi-durable/overlay/upstream-pin.json carrier.emitter.node must be an exact vX.Y.Z (got ${emitterNode})`);
+// jobs → steps → active lines. A full-line comment is dropped and a trailing ` # …` is cut; job heads are
+// the two-space keys under `jobs:`, a step starts at its six-space `- ` item.
+const ciJobs = new Map();
+{
+  let inJobs = false;
+  let steps;
+  for (const raw of readFileSync('.github/workflows/ci.yml', 'utf8').split('\n')) {
+    const line = raw.replace(/\s+#.*$/, '');
+    if (/^\s*#/.test(raw) || line.trim() === '') continue;
+    if (/^\S/.test(line)) { inJobs = line === 'jobs:'; steps = undefined; continue; }
+    if (!inJobs) continue;
+    const head = /^  ([a-z][a-z0-9-]*):$/.exec(line);
+    if (head) { steps = []; ciJobs.set(head[1], steps); continue; }
+    if (steps === undefined) continue;
+    if (/^      - /.test(line)) steps.push([`        ${line.slice(8)}`]);
+    else if (steps.length > 0 && /^        /.test(line)) steps.at(-1).push(line);
+  }
+}
+// A step's own value for `key` (`with:` / `env:` child at ten spaces), or a top-level step key at eight.
+const stepKey = (step, key) => step.find((l) => l.startsWith(`        ${key}: `))?.slice(10 + key.length);
+const stepChild = (step, block, key) => {
+  const at = step.indexOf(`        ${block}:`);
+  if (at === -1) return undefined;
+  const children = [];
+  for (const l of step.slice(at + 1)) { if (!l.startsWith('          ')) break; children.push(l); }
+  return children.find((l) => l.startsWith(`          ${key}: `))?.slice(12 + key.length);
+};
+const setupNodes = (job) => (ciJobs.get(job) ?? []).filter((s) => /^actions\/setup-node@/.test(stepKey(s, 'uses') ?? ''));
+const checkSetup = setupNodes('check');
+assert.equal(checkSetup.length, 1,
+  `${EMITTER_BOUND_QK} .github/workflows/ci.yml: the check job must have exactly one actions/setup-node step (found ${checkSetup.length})`);
+const checkNode = stepChild(checkSetup[0], 'with', 'node-version');
+assert.equal(`v${checkNode}`, emitterNode,
+  `${EMITTER_BOUND_QK} .github/workflows/ci.yml: the check job's setup-node runs Node ${checkNode}, but the carrier's pinned emitter is ${emitterNode} — its floor would prove the emission under another identity`);
+const floors = (ciJobs.get('check') ?? []).filter((s) => stepKey(s, 'run') === 'pnpm run check:full');
+assert.equal(floors.length, 1,
+  `${EMITTER_REQUIRED_QK} .github/workflows/ci.yml: the check job must run \`pnpm run check:full\` in exactly one step (found ${floors.length})`);
+assert.equal(stepChild(floors[0], 'env', 'ENTWURF_REQUIRE_EMITTER_NODE'), '"1"',
+  `${EMITTER_REQUIRED_QK} .github/workflows/ci.yml: the check job's check:full step does not set ENTWURF_REQUIRE_EMITTER_NODE: "1" in its own env, so an emitter-identity mismatch on that floor would be a skip, not red`);
+for (const [job] of ciJobs) {
+  if (job === 'check') continue;
+  for (const s of setupNodes(job)) {
+    const value = stepChild(s, 'with', 'node-version');
+    assert.match(String(value), /^\d+$/,
+      `${EMITTER_BOUND_QK} .github/workflows/ci.yml: job ${job} pins node-version ${value}; only the check job is exact, the others float the major`);
+  }
+}
+
 // Sweep the tracked first-party contract TEXT surfaces, NOT just the files
 // already registered above. The first cut of this gate swept only SITES' own
 // files and therefore could not see a declaration in an UNREGISTERED file —
@@ -2573,7 +2686,7 @@ assert.ok(swept >= 6,
 // `bound` is the real declaration count; SITES.length is the number of RULES
 // (the CI rule alone matches two node-version lines). Naming the rule count a
 // declaration count would be this gate telling a small lie about its own reach.
-console.log(`[check-node-floor-coherence] ok — Node >=${MAJOR} is coherent across engines.node, ${bound} bound declarations from ${SITES.length} site rules, and ${swept} declarations swept over ${tracked.length} tracked first-party contract text surfaces (single supported axis, no legacy lane). Non-text carriers (e.g. a Dockerfile \`FROM node:*\`) are OUTSIDE this pattern and must be bound by their own gate.`);
+console.log(`[check-node-floor-coherence] ok — Node >=${MAJOR} is coherent across engines.node, ${bound} bound declarations from ${SITES.length} site rules, and ${swept} declarations swept over ${tracked.length} tracked first-party contract text surfaces (single supported axis, no legacy lane); the pi-durable emitter ${emitterNode} is the CI check job's exact Node. Non-text carriers (e.g. a Dockerfile \`FROM node:*\`) are OUTSIDE this pattern and must be bound by their own gate.`);
 EOF
   )
 }
@@ -2862,7 +2975,7 @@ check_pi_import_surface() {
   # resolve under the extension loader.
   #
   # #130 CARRIER FENCE (replaces the #129 bootstrap exception, retired with the source runtime):
-  # the pi-durable carrier (pi/pi-durable/carrier/*.js, upstream app files emitted by
+  # the pi-durable carrier (pi/pi-durable/carrier/*.js, emitted from Entwurf's owned source by
   # scripts/emit-pi-durable-carrier.ts) is the ONE place pi-coding-agent internals are reached,
   # and only through the reserved `entwurf-pi-dist:` scheme its resolver answers. The fence is
   # declared and asserted here, not inferred from the root-only scan staying quiet:
@@ -3646,7 +3759,7 @@ check_pack() {
     "package.json" "README.md" "LICENSE" "CHANGELOG.md"
     "protocol.js" "run.sh"
     "pi-extensions/acp-provider.ts"
-    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/backend.ts"
+    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/model-ids.js" "pi-extensions/lib/acp/backend.ts"
     "pi-extensions/lib/acp/overlay.ts" "pi-extensions/lib/acp/tool-surface.ts"
     "pi-extensions/lib/acp/event-mapper.ts" "pi-extensions/lib/acp/context.ts"
     "pi-extensions/entwurf-control.ts"
@@ -3704,7 +3817,6 @@ check_pack() {
     "mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-fresh-preflight.js"
     "pi/pi-durable/bootstrap.mjs"
     "pi/pi-durable/overlay/upstream-pin.json"
-    "pi/pi-durable/overlay/runtime-contacts.patch"
     "pi/pi-durable/carrier-resolver.mjs"
     "pi/pi-durable/carrier-relocation.mjs"
     "pi/pi-durable/carrier/runtime.js"
@@ -3791,6 +3903,11 @@ check_pack() {
     # Maintainer take/renderer/helper TS is source-only, including non-test implementations.
     '^demo/.*\.ts$'
   )
+  # #141: the owned pi-durable source, its typecheck fence and the retired overlay patch are maintainer
+  # input. An installed consumer runs the emitted carrier JS (and its LICENSE) only — Rule 11: compiled
+  # JS for installed entrypoints. The files array lists pi/pi-durable per FILE, so nothing admits these
+  # today; this tripwire is what fails loud the day an allowlist entry would.
+  local durable_source_pattern='^pi/pi-durable/(src/|tsconfig\.json$|overlay/runtime-contacts\.patch$)'
 
   local pass=1 f pat hit
 
@@ -3810,6 +3927,13 @@ check_pack() {
     fi
   done
 
+  hit=$(grep -E "$durable_source_pattern" <<<"$file_list" || true)
+  if [ -n "$hit" ]; then
+    fail "[check-pack] [QK:PI-DURABLE-SOURCE-NOT-SHIPPED] the owned pi-durable source rides the tarball — an installed consumer runs the carrier JS only:"
+    echo "$hit" | sed 's/^/    /' >&2
+    pass=0
+  fi
+
   local total
   total=$(printf '%s\n' "$file_list" | wc -l | tr -d ' ')
   echo "[check-pack] $total files in tarball"
@@ -3844,7 +3968,7 @@ check_pack() {
 #     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
 #     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@1\.1\.0(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@1\.2\.0(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
@@ -3864,15 +3988,15 @@ check_pack_pin_matcher() {
   # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
   # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@1.1.0' \
-    '@earendil-works+pi-ai@1.1.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@1.1.0_ws@8.21.3' \
-    '@earendil-works+pi-ai@1.1.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
-    '@earendil-works+pi-ai@1.1.0-beta.1' \
+    '@earendil-works+pi-ai@1.2.0' \
+    '@earendil-works+pi-ai@1.2.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.2.0_ws@8.21.3' \
+    '@earendil-works+pi-ai@1.2.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@1.2.0-beta.1' \
     '@earendil-works+pi-agent-core@0.87.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.1.0-beta.1
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@1.2.0-beta.1
 @earendil-works+pi-agent-core@0.87.1' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.1.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.1.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.2.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.2.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -3880,11 +4004,11 @@ check_pack_pin_matcher() {
   # (0.85.0 onward, still true at 0.99.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+chord@1.1.0' \
+    '@earendil-works+chord@1.2.0' \
     '@earendil-works+chord@0.87.1' \
-    '@earendil-works+pi-ai@1.1.0' | pack_install_leaked_pi)
+    '@earendil-works+pi-ai@1.2.0' | pack_install_leaked_pi)
   if [ "$matcher_probe" != '@earendil-works+chord@0.87.1' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0, `[측정 2026-09-23]` at 0.87.1 and `[측정 2026-09-30]` at 0.99.1, where pi-coding-agent adds pi-codemode and pi-mcp beside them) — got: ${matcher_probe:-<nothing leaked>}"
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it was a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0, `[측정 2026-09-23]` at 0.87.1 and `[측정 2026-09-30]` at 0.99.1, where pi-coding-agent adds pi-codemode and pi-mcp beside them; `[측정 2026-10-13]` at 1.2.0 pi-durable alone declares it) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -4059,8 +4183,8 @@ ORACLE
   # copied from this checkout into the sandbox — it never ships (test/ is outside the package files).
   # Its initialization appends `init` to the receipt this cell names; the same public launch must then
   # reach the same carrier model refusal, so the installed bootstrap loaded the module before the
-  # runtime and the native registry installed its extension (carrier/runtime.js 148) before that
-  # refusal (runtime.js 164). A module claiming an extension name the app installs itself is refused by
+  # runtime and the native registry installed its extension (carrier/runtime.js 159) before that
+  # refusal (runtime.js 175). A module claiming an extension name the app installs itself is refused by
   # name before anything opens: no durable session directory, no citizen, in a fresh sandbox home.
   # Native SDK file opens here are ordinary (the module runs in the native process); none is judged.
   local mod_dir="$box/pd-module" mod_home="$box/pd-module-home" mod_env=()
@@ -4115,7 +4239,7 @@ ORACLE
   # aligned host binary (the pinned version, installed above for L1) must be inside the range.
   # The previous host version is a variable, not a quoted `@pkg@x.y.z` spec: check-dep-versions reads
   # those specs as this repo's install pins, and this one is deliberately off the floor.
-  local host_home host_proj host_old="$box/pd-host-old" host_env=() host_old_ver="1.0.4"
+  local host_home host_proj host_old="$box/pd-host-old" host_env=() host_old_ver="1.1.0"
   mkdir -p "$host_old"
   for spec in "${host_specs[@]}"; do host_old_specs+=("${spec%@*}@$host_old_ver"); done
   out=$(cd "$host_old" && npm install "${host_old_specs[@]}" --no-audit --no-fund 2>&1) || {
@@ -4133,7 +4257,7 @@ ORACLE
       fail "[check-pack-install] host $cell: the native pi-durable row must stay PASS whatever the PATH host is:"; echo "$out" | tail -20 | sed 's/^/    /' >&2; return 1
     fi
     if [ "$cell" = old ]; then
-      if [ "$rc" -eq 0 ] || ! grep -q "pi: FAIL — detected pi $host_old_ver is outside the supported range >=$pin_ver <1.2" <<<"$out" || [ -e "$host_proj/.pi" ] || [ -e "$host_home/.pi/agent/settings.json" ]; then
+      if [ "$rc" -eq 0 ] || ! grep -q "pi: FAIL — detected pi $host_old_ver is outside the supported range >=$pin_ver <1.3" <<<"$out" || [ -e "$host_proj/.pi" ] || [ -e "$host_home/.pi/agent/settings.json" ]; then
         fail "[QK:PACK-INSTALL-HOST-RANGE-SEPARATE] [check-pack-install] a real pi $host_old_ver host beside the $pin_ver native set must be a named pi FAIL with zero Pi wiring and a non-green setup (rc=$rc):"
         echo "$out" | tail -20 | sed 's/^/    /' >&2
         return 1
@@ -4294,7 +4418,7 @@ _check_pack_install_impl() {
     "package.json" "README.md" "LICENSE" "CHANGELOG.md"
     "protocol.js" "run.sh"
     "pi-extensions/acp-provider.ts"
-    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/backend.ts"
+    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/model-ids.js" "pi-extensions/lib/acp/backend.ts"
     "pi-extensions/lib/acp/overlay.ts" "pi-extensions/lib/acp/tool-surface.ts"
     "pi-extensions/lib/acp/event-mapper.ts" "pi-extensions/lib/acp/context.ts"
     "pi-extensions/entwurf-control.ts"
@@ -4341,7 +4465,6 @@ _check_pack_install_impl() {
     "mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-fresh-preflight.js"
     "pi/pi-durable/bootstrap.mjs"
     "pi/pi-durable/overlay/upstream-pin.json"
-    "pi/pi-durable/overlay/runtime-contacts.patch"
     "pi/pi-durable/carrier-resolver.mjs"
     "pi/pi-durable/carrier-relocation.mjs"
     "pi/pi-durable/carrier/runtime.js"
@@ -4504,21 +4627,26 @@ _check_pack_install_impl() {
   # pi-ai, pi-codemode, pi-mcp, pi-tui}, pi-ai {pi-telemetry}, pi-agent-core {pi-ai}, pi-durable
   # {chord, pi-ai}, and `npm view` gives pi-client {chord, pi-protocol}, pi-protocol {chord}. All
   # eleven are published at 1.1.0.
-  echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.1.x SDK + chord + codemode + mcp + durable + typebox)"
+  # `[측정 2026-10-13]` at 1.2.0 the constellation SHRINKS to the nine-member SDK set: upstream
+  # removed pi-client and pi-protocol (7472cda0d), and `npm view <pkg>@1.2.0` answers E404 for both,
+  # so their pins cannot move with the floor and leave instead of staying redundant. The 1.2.0
+  # registry manifests give pi-coding-agent {pi-agent-core, pi-ai, pi-codemode, pi-mcp, pi-tui}
+  # (chord dropped), pi-ai {pi-telemetry}, pi-agent-core {pi-ai}, pi-durable {chord, pi-ai,
+  # pi-codemode}; all nine are published at 1.2.0
+  # (.tmp-verify/141-kickoff/s1a/map-receipts/01-tarballs.txt).
+  echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.2.x SDK + chord + codemode + mcp + durable + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@1.1.0" \
-    "@earendil-works/pi-coding-agent@1.1.0" \
-    "@earendil-works/pi-tui@1.1.0" \
-    "@earendil-works/pi-agent-core@1.1.0" \
-    "@earendil-works/pi-client@1.1.0" \
-    "@earendil-works/pi-protocol@1.1.0" \
-    "@earendil-works/pi-telemetry@1.1.0" \
-    "@earendil-works/chord@1.1.0" \
-    "@earendil-works/pi-codemode@1.1.0" \
-    "@earendil-works/pi-mcp@1.1.0" \
-    "@earendil-works/pi-durable@1.1.0" \
+    "@earendil-works/pi-ai@1.2.0" \
+    "@earendil-works/pi-coding-agent@1.2.0" \
+    "@earendil-works/pi-tui@1.2.0" \
+    "@earendil-works/pi-agent-core@1.2.0" \
+    "@earendil-works/pi-telemetry@1.2.0" \
+    "@earendil-works/chord@1.2.0" \
+    "@earendil-works/pi-codemode@1.2.0" \
+    "@earendil-works/pi-mcp@1.2.0" \
+    "@earendil-works/pi-durable@1.2.0" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -4534,11 +4662,11 @@ _check_pack_install_impl() {
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.1.0):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.2.0):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.1.0 (chord and pi-durable included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.2.0 (chord and pi-durable included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4720,8 +4848,8 @@ _check_pack_install_impl() {
   loader_ids=$(awk '$1 == "entwurf" { print $2 }' <<<"$loader_out" | LC_ALL=C sort)
   loader_expected=$(printf '%s\n' \
     claude-fable-5-1 \
-    claude-opus-5 \
-    claude-sonnet-5 \
+    claude-opus-5-5 \
+    claude-sonnet-5-5 \
     cortex-auto \
     cortex-claude-opus-5 \
     cortex-claude-sonnet-5 \
@@ -4830,7 +4958,7 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1
   }
-  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-5" <<<"$foreign_out"; then
+  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-5-5" <<<"$foreign_out"; then
     fail "[check-pack-install] foreign-cwd --entwurf-control did not load the entwurf extension from user scope:"
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1
@@ -7069,6 +7197,10 @@ release_gate() {
 
 cmd=${1:-}
 case "$cmd" in
+  menu)
+    shift
+    developer_menu "$@"
+    ;;
   setup)
     setup_all "$TARGET_PROJECT_DIR"
     ;;
@@ -7243,6 +7375,9 @@ case "$cmd" in
   check-acp-foreground-only)
     check_acp_foreground_only
     ;;
+  check-acp-set-model-readback)
+    check_acp_set_model_readback
+    ;;
   check-resume-launch-identity)
     check_resume_launch_identity
     ;;

package/scripts/check-acp-backend-preflight.ts

@@ -16,13 +16,13 @@
 
 import { strict as assert } from "node:assert";
 import { execFileSync } from "node:child_process";
-import { readdirSync, readFileSync, rmSync } from "node:fs";
+import { readdirSync, readFileSync, rmdirSync, rmSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Model, TranscriptContext } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 
-const model = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const model = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 // Declared tools exclude `read`, but the Claude child always exposes Read →
 // declared != actual → the preflight must reject before spawning.
@@ -157,6 +157,14 @@ try {
 	);
 } finally {
 	rmSync(TMP_EMIT, { recursive: true, force: true });
+	try {
+		// Same as check-acp-cortex: the emit created `.tmp-verify/` as TMP_EMIT's parent, and
+		// check-gate-qualification's snapshot manifest walks ignored paths, so a leftover empty
+		// parent reads as a dirty tree. Remove it when empty; a sibling's emit keeps it alive.
+		rmdirSync(".tmp-verify");
+	} catch {
+		// non-empty or already gone — fine either way
+	}
 }
 
 // ---------------------------------------------------------------------------