@junghanacs/entwurf 0.51.0 → 0.53.1

package/docs/setup-clean-host.md

@@ -23,26 +23,25 @@ evidence split, and its three states must not collapse into "macOS is supported"
 
 ## Requirements
 
-This table and the 1.4-specific install examples below describe the published `@junghanacs/entwurf@0.50.0`, which ships the Pi 1.4.0 SDK set. The #155 0.51.0 preparation at `434874ef6d6e399a0ae6813c850d01c5232eb1d9` pins SDK 1.5.0; its separate validation TGZ was installed in the approved operating window, but is not the still-unpublished final shipping artifact. npm publication requires its own authority. See the [SDK 1.5 boundary](#sdk-15-development-boundary-155) below; these 0.50 instructions do not select or prove 0.51 bytes.
-The previous package, `0.41.0`, ships the Pi 1.3.0 SDK set and requires Pi 1.3.x; the setup guide
-inside that tarball is its contract.
+The current published Entwurf 0.52.0 uses the exact Pi 1.5.2 SDK set and host Pi `>=1.5.2 <1.6`. The marked 0.51.0 / SDK 1.5.0 examples below are historical and remain bound to their own published manifest. Source validation, publication and a running host's loaded bytes are separate evidence; the earlier addon-less validation tarball installed on one operating host is not the published artifact (see the [#158 boundary](#sdk-152-candidate-boundary-158)).
+
+The validation TGZ installed in #155's operating window before the D1 display repair is an earlier, separate artifact, not the published one; see the [SDK 1.5 boundary](#sdk-15-development-boundary-155) below.
+
+The older package, `0.50.0`, ships the Pi 1.4.0 SDK set and requires a Pi 1.4.x host; the setup guide inside that tarball is its contract.
 
-<!-- entwurf:published @junghanacs/entwurf@0.50.0 pi 1.4.0 -->
 | Component | Requirement | Needed for |
 |---|---|---|
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.4.0 <1.5` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
-| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.4.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
+| pi | optional-by-presence — current 0.52.0: `>=1.5.2 <1.6`; historical 0.51.0: <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`>=1.5.0 <1.6`<!-- /entwurf:published -->. Absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus its exact pi SDK set (1.5.2 in published 0.52.0; 1.5.0 in historical 0.51.0) as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.306`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | legacy citizen; native push paused (#152) |
 | OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all four operator-owned units (birth/MCP/status-line/terminal-title) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires the operator-owned app-server, started with `entwurf codex-app-server` in a tmux session of the operator's choosing (#95 D1 retired the fixed `codex` home) | native-push and visible fresh, supported in 0.21.0 |
-| Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
-<!-- /entwurf:published -->
 
 Claude Code >=2.1.306 is required for the managed exec-hook lifecycle and same-id resume. The package
 never supplies or proxies backend credentials.
@@ -85,7 +84,7 @@ node --version
 npm --version
 ```
 
-The two npm forms below install the **published** package, `0.50.0` (Pi 1.4.x, the Pi 1.4.0 SDK
+The two npm forms below install the **published** package, `0.52.0` (Pi 1.5.x, the Pi 1.5.2 SDK
 set). The [product entry](../README.md#install)'s unpinned `npm install -g @junghanacs/entwurf`
 takes whichever version npm's `latest` dist-tag names; pin `@<version>` as below when you mean the
 exact artifact the [Requirements](#requirements) table describes.
@@ -94,7 +93,7 @@ Global install is simplest when native harnesses should find stable bins from ev
 working directory:
 
 ```bash
-npm install -g @junghanacs/entwurf@0.50.0
+npm install -g @junghanacs/entwurf@0.52.0
 entwurf --help
 entwurf setup /path/to/your-project
 entwurf check-bridge
@@ -105,7 +104,7 @@ A project-local installation is also supported:
 ```bash
 mkdir -p ~/entwurf-smoke && cd ~/entwurf-smoke
 npm init -y
-npm install --save-dev @junghanacs/entwurf@0.50.0
+npm install --save-dev @junghanacs/entwurf@0.52.0
 npx entwurf setup .
 npx entwurf check-bridge
 ```
@@ -115,10 +114,10 @@ project-local install, or `./run.sh <command>` from a source checkout. Keep that
 same scope when upgrading and checking; native process restarts are separate (§7).
 
 `check-bridge` is auth-free. It proves the installed prebuilt MCP server boots and
-lists the nine garden tools (0.50.0); it does not prove a backend model turn, native hook or retirement permission.
+lists the nine garden tools (0.52.0); it does not prove a backend model turn, native hook or retirement permission.
 
 Neither npm form installs a harness runtime. `pi`, Claude Code, Copilot CLI, Codex CLI, agy,
-Cortex, and their authentication remain operator-owned optional prerequisites for the
+and their authentication remain operator-owned optional prerequisites for the
 integrations that use them; all may be absent on an Entwurf-only host. A source checkout's
 pinned Pi development packages are for building and testing this repo, not a transitive product installation promise.
 
@@ -226,13 +225,11 @@ physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
 on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 `setup` names the pi row FAIL with the §1 Darwin wording.
 
-Install the exact release floor, then wire the project. The previous 0.41.0 instead takes the
-Pi 1.3.x its own setup guide names. A source checkout passes its checkout path to `-e` in place of
-the global package root:
+For published Entwurf 0.52.0, install its exact host Pi floor and wire the project as shown below.
+The previous 0.51.0 uses the Pi 1.5.0 floor named in its own setup guide:
 
-<!-- entwurf:published @junghanacs/entwurf@0.50.0 pi 1.4.0 -->
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.4.0
+npm install -g @earendil-works/pi-coding-agent@1.5.2
 pi --version
 
 cd ~/entwurf-smoke
@@ -240,11 +237,12 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.4.0 <1.5`. It is a hard minimum: installing this
-release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
-minor. A host using only the external MCP bridge can skip pi until it needs a
+The supported host Pi range for published Entwurf 0.52.0 is `>=1.5.2 <1.6`.
+A detected host outside that range is refused for Pi wiring; Entwurf does not upgrade it.
+Align the host explicitly, for example with the exact npm command above, before wiring Pi. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
-<!-- /entwurf:published -->
+
+Published 0.52.0 requires host Pi `>=1.5.2 <1.6`; `setup` reports a detected older host as FAIL. Prepare host Pi 1.5.2 before wiring, and use the checkout path rather than the global npm package when running a checkout directly. Range eligibility does not replace installation, validation or operating approval. Ordinary Pi 1.5.2 defaults its global `cacheWarming` setting to `idle`, which may send additional provider requests; pi-durable does not map that setting. See the [#158 durable boundary](./durable-native-support.md#sdk-152-candidate-boundary-158).
 
 For daily garden-native pi sessions:
 
@@ -263,7 +261,7 @@ A plain `pi` can load the package without becoming a citizen.
 In that session ask for `entwurf_self`, then `entwurf_peers`. Pick an existing
 live garden id and ask for `entwurf_v2` with `intent: "fire-and-forget"` and your
 message. These are harness tools, not shell subcommands; pi exposes them through
-Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The 0.50.0 bridge has nine tools;
+Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The bridge has nine tools;
 pi hides `entwurf_inbox_read` and `entwurf_register_native`, leaving seven active.
 The added `entwurf_retire_call` is only for one target/action explicitly requested by the
 human operator, never autonomous cleanup. Where a host provides or is configured with an approval
@@ -348,11 +346,12 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
 
 What the Entwurf package supplies:
 
-1. **The pi SDK set** — in the 0.51.0 prepared checkout, `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
-   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry, pi-schema}` at exactly `1.5.0`, plus
-   `proper-lockfile`, as Entwurf's own production dependencies. The authoritative current set is
-   the [SDK pin](../pi/pi-durable/overlay/upstream-pin.json) and [package manifest](../package.json);
-   for this candidate, model data rides `@earendil-works/pi-ai@1.5.0`, not a catalog copy.
+1. **The pi SDK set** — published 0.52.0 supplies `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry, pi-schema}` at exactly `1.5.2`, plus
+   `proper-lockfile`, as production dependencies. Model data rides `pi-ai@1.5.2`, not a catalog copy.
+   Historical 0.51.0 used <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`@earendil-works/pi-ai@1.5.0`<!-- /entwurf:published -->.
+   The [SDK pin](../pi/pi-durable/overlay/upstream-pin.json) and [package manifest](../package.json)
+   describe the checkout you hold, not immutable published bytes.
 2. **The native app/TUI carrier** — upstream does not publish the experimental durable
    app (`pi-coding-agent` excludes `dist/experimental`; `pi-durable` on npm is the
    library). Entwurf owns the six app files as canonical source (`pi/pi-durable/src`,
@@ -362,9 +361,9 @@ What the Entwurf package supplies:
    (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
    own `dist/` as installed — never through a source checkout.
 
-The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.5.0/packages/durable/README.md)
-and the [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
-(last published at v1.1.0) describe what the carrier is. Running the bare upstream app does not attach Entwurf's
+The upstream library guide for the published 0.51.0 pairing is [v1.5.0](https://github.com/earendil-works/pi/blob/v1.5.0/packages/durable/README.md); for the published 0.52.0 SDK APIs use [v1.5.2](https://github.com/earendil-works/pi/blob/v1.5.2/packages/durable/README.md).
+The [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
+(last published at v1.1.0) records the app's origin: Entwurf's maintained app source, not a newer upstream app, is the current composition authority. Both guides describe what the carrier is. Running the bare upstream app does not attach Entwurf's
 garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
 proxy a subscription; native execution, models, auth, queues, SQLite and recovery stay
 upstream-owned.
@@ -377,7 +376,7 @@ carrier file, the license, the resolver and its relocation grammar are present
 (`pi-durable-carrier-drift`); every declared SDK package resolves from the carrier
 (`pi-durable-sdk-absent`); and every reachable physical edge — from the carrier to each package,
 and from every package copy it reaches, at any depth, to its own `@earendil-works` dependencies —
-lands on a package of the declared name at exactly the pinned version (`pi-durable-sdk-mismatch`). The members' declarations are exact in the prepared 1.5.0 set; even so, the physical package each import binds must be checked. Sharing
+lands on a package of the declared name at exactly the pinned version (`pi-durable-sdk-mismatch`). The members' declarations are exact in the published 1.5.0 set and, measured on the registry tarballs (#158), in the 1.5.2 set; even so, the physical package each import binds must be checked. Sharing
 one copy with an aligned host install of the same version is an ordinary layout. A mixed
 tree (for example an override that binds pi-durable's `pi-ai` to an older published version) still
 *imports* — which is why the edge check exists — and is refused by name.
@@ -459,9 +458,9 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
   not a claim that every load path is harmless.
 
-The ordinary Pi CLI on PATH is a separate subject (§2, range <!-- entwurf:published @junghanacs/entwurf@0.50.0 pi 1.4.0 -->`>=1.4.0 <1.5`<!-- /entwurf:published -->): a host Pi is
+The ordinary Pi CLI on PATH is a separate subject (§2; historical 0.51.0 range <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`>=1.5.0 <1.6`<!-- /entwurf:published -->, current 0.52.0 range `>=1.5.2 <1.6`): a host Pi is
 not needed to run pi-durable, and a host inside the range need not be the same copy as the
-carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
+carrier's. The native harnesses own credentials, model settings and their respective session stores — ordinary Pi JSONL and pi-durable SQLite; keep them
 in place rather than copying credentials or migrating ordinary Pi transcripts. Native
 recovery does not prove exactly-once Entwurf dispatch or inbox read recovery. The contact
 provides garden attachment, visible identity and announce-only root-directed self-fetch.
@@ -472,12 +471,18 @@ proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
 ### SDK 1.5 development boundary (#155)
 
-The published 0.50.0 / SDK 1.4.0 instructions above and the #155 SDK 1.5 development
-candidates are distinct subjects. Synthetic migration and downgrade-refusal fixtures on `0408a66`
-did not authorize an operating first write. A separately approved 1.5 operating window and Native
-LIVE were later measured as described below; neither makes the validation TGZ the final release
-artifact. Installing an older package is not a data rollback. Follow the current evidence in
-[#155](https://github.com/junghan0611/entwurf/issues/155), not the 1.3→1.4 receipt below.
+The historical 0.51.0 instructions describe the SDK 1.5.0 set that #155 shipped; the #155 SDK
+1.5 development candidates that preceded it were distinct subjects. Synthetic migration and
+downgrade-refusal fixtures on `0408a66` did not authorize an operating first write. A separately
+approved 1.5 operating window and Native LIVE were later measured as described below; neither made
+the validation TGZ the published artifact. Installing an older package is not a data rollback. Follow the current evidence in
+[#155](https://github.com/junghan0611/entwurf/issues/155), not the 1.3→1.4 receipt below. The #158 source candidate is a separate boundary, next.
+
+### SDK 1.5.2 candidate boundary (#158)
+
+The published 0.52.0 package (#158) pins the Pi SDK at exactly 1.5.2 (ten members) and declares host Pi `>=1.5.2 <1.6`. Publication does not install it on an operating host; an operating move requires its own installation and same-identity return receipts. The #155 receipts above prove their own subject only; none is inherited by 1.5.2.
+
+What #158 measured so far and what it did not is recorded in [the durable-native boundary](./durable-native-support.md#sdk-152-candidate-boundary-158) and in the #158 thread: registry tarball integrity and member edges, an isolated six-member scheduler comparison and a native SQLite cross-version read/append check. The pre-version checkpoint's frozen FULL belongs to its own recorded worktree. The earlier validation candidate has its own floor and installation receipts; later source edits and the final carrier-bearing artifact require their own acceptance. Operating-scale and interrupted sessions are not certified by the bounded fixtures. An operating move follows the default radius below, each step with its own receipt.
 
 ### Default radius for a requested Pi SDK upgrade
 
@@ -493,17 +498,19 @@ The measured precedent is [#148's pre-cutover hold](https://github.com/junghan06
 
 Push, release/tag/npm publication and retirement of any other citizen retain their separate authorization boundaries. This decision fixes the repeatable method; it does not pre-authorize those actions.
 
+**Installation handoff: prepared is not installed.** State prominently whether the installer has actually run or is still waiting for the operator's approval. A prepared terminal, a pulled checkout or a printed resume command is not success. Keep the normal old-owner exit and consistent complete backup gates; before presenting the reopen step as ready, require the recorded installation exit 0 and coherent carrier/SDK verification. Then reopen the intended same session with its original explicit native module. Do not automatically send Enter, install or switch ownership to bridge an approval wait. The [0.51.0 ThinkPad incident](../CHANGELOG.md#install-handoff-incident-and-recovery--thinkpad-2026-11-04) records a new-source/old-dependency launch refusal and the separately authorized recovery; it is not evidence of data loss or an SDK regression.
+
 **Recurring SDK rail.** At task start, agree the exact SDK and the scope of development, review and verification once; do not repeatedly ask for the existing-auth strategy. Inspect the published SDK set and upstream changes, isolate the development checkout from operating runtimes, and implement against the coherent pinned set in private HOME, PI and writable XDG roots. Use the gate's own temporary-directory constraints: the #155 FULL's deeper scratch produced 117/109-byte socket paths and EINVAL; run3 used `TMPDIR=/tmp` with each gate creating its own private scratch and passed. Preserve both `pnpm_config_verify_deps_before_run=error` and `npm_config_verify_deps_before_run=error`, managed builds and candidate seals; do not run offline gates under ambient CI.
 
 The owned canonical app/TUI source is production responsibility; the SDK owns the execution engine. In independent upgrade review, compare old and new app-visible payload semantics against known fixtures and a separate official SDK oracle: more than 50 active entries on reopen and same-process conversation switch, head/reset and background-compaction retention, and the distinction from model memory. API names, typechecks or a QK that only fixes the new SDK's window can all be green while older display compatibility regresses. When official emission changes a generated digest, check its pin-linked mutant find literal and the existing manifest inventory together; this is not a new gate.
 
-Freeze for sequential independent review, then affected PARTIAL groups, frozen FULL and applicable scripted/native-H carrier cells. Accept the **same reviewed validation TGZ** in the Linux container and rehearse ownership refusal/takeover in isolation. Measure SDK publication age early to plan the window, then recheck it fresh before installation; never automatically exempt the global policy.
+Freeze for sequential independent review, then affected PARTIAL groups, frozen FULL and applicable scripted/native-H carrier cells. Accept the **same reviewed validation TGZ** in the Linux container and rehearse ownership refusal/takeover in isolation. Measure SDK publication age early to plan the window, then recheck it fresh before installation; never automatically exempt the global policy. Any operator-approved exception must name the exact packages and versions and be recorded with that upgrade's decision; it is not a standing patch-release exemption and not permission for an operating cutover. For #158 the operator explicitly approved the exact SDK 1.5.2 release-age exception on 2026-11-11: only those ten member/version terms are added to `minimumReleaseAgeExclude`, and the global policy and every other dependency remain subject to their own checks. That differs from #155's dated no-exception installation and authorises no operating write or publication.
 
 In the named operating window, identify owners, obtain their normal exit and prove it, then take a consistent complete session backup including WAL/SHM before the first new-SDK write. Install a coherent host and validation TGZ, verify installed global root (GR), runtime and ownership independently, and perform only the approved takeover. Reopen the same identities with their original explicitly named native modules and existing auth; observe real turns and round trips before the Native LIVE floor. Public pi-durable `entwurf_resume_call` is bridge-only: it does not save or restore operator native modules. If one is needed, use the original explicit CLI entry; do not infer a profile or kill a citizen automatically. One approval can cover the named scope, sibling roles and fixture work, but not bypass normal exit, the first-write decision, or separate push/npm authority.
 
 For each named Native fixture, record the runtime root and SDK actually selected separately from the operator installation: a private PATH can select the genuine source CLI while an ordinary Pi extension still comes from an older installed GR. Do not substitute a wrapper or rewire the operating host to make the evidence agree. A planned source-CLI Native run is not a completed receipt.
 
-**#155 measured example (2026-11-03; before the D1 display repair):** at 20:47 KST host Pi 1.5.0 and the unpublished, addon-less 0.51.0 validation TGZ (SHA-256 `199e5f41d20e5b2665125868b7e3e27740e5985f7a25ac61902126b7ed638bf5`) were installed, not the final publication artifact. Four owners exited normally; the 171-file durable backup's source-before/backup/source-after manifests matched (`5c08bed1968fd1e26baa58112f0ce5c36874e147ccc5e9b4c69ec1a0d9070a46`); two Pi transcripts were also backed up. All ten SDK members were freshly measured at 24.70–24.84 hours old, without a policy exception. The P5 Native LIVE cut recorded MUST 24/0/0 and BEHAVIOR 1/0/0 (pass/fail/skip) on its own sealed candidate, not the prepared SHA. Native-host criterion 4 separately measured a fresh Claude Code fixture's actual installed 0.51 MCP child and strict doctor; existing pre-cutover Claude sessions retained their loaded 0.50 bridge. Neither the 20:47 installation nor P5 proves that the later D1 display repair is operating: the D1-bearing artifact must first be installed, and the human must then restart the process; restarting against the earlier artifact still loads the old app. See [0.51.0 release evidence](../CHANGELOG.md#release-evidence) for scopes and receipts.
+**#155 measured example (2026-11-03; before the D1 display repair):** at 20:47 KST host Pi 1.5.0 and the unpublished, addon-less 0.51.0 validation TGZ (SHA-256 `199e5f41d20e5b2665125868b7e3e27740e5985f7a25ac61902126b7ed638bf5`) were installed, not the final publication artifact. Four owners exited normally; the 171-file durable backup's source-before/backup/source-after manifests matched (`5c08bed1968fd1e26baa58112f0ce5c36874e147ccc5e9b4c69ec1a0d9070a46`); two Pi transcripts were also backed up. All ten SDK members were freshly measured at 24.70–24.84 hours old, without a policy exception. The P5 Native LIVE cut recorded MUST 24/0/0 and BEHAVIOR 1/0/0 (pass/fail/skip) on its own sealed candidate, not the prepared SHA. Native-host criterion 4 separately measured a fresh Claude Code fixture's actual installed 0.51 MCP child and strict doctor; existing pre-cutover Claude sessions retained their loaded 0.50 bridge. Neither the 20:47 installation nor P5 proves that the later D1 display repair is operating: the D1-bearing artifact must first be installed, and the human must then restart the process; restarting against the earlier artifact still loads the old app. See [0.51.0 release evidence](../CHANGELOG.md#0510--2026-11-04) for scopes and receipts.
 
 The Windows-bearing release TGZ, its Linux acceptance, exact prepared-SHA CI, installed-host acceptance and publication/registry proof are separate later evidence. Re-measure owners, loaded bytes, version/integrity, backup and candidate evidence on every upgrade; this ordering does not guarantee success for a future SDK.
 
@@ -773,7 +780,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (<!-- entwurf:published @junghanacs/entwurf@0.50.0 pi 1.4.0 -->`>=1.4.0 <1.5`<!-- /entwurf:published --> for published 0.50.0) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (the #158 checkout's predicate, `>=1.5.2 <1.6`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and
@@ -988,7 +995,7 @@ real initial Pi outside `codex`, then omitted-placement Codex and outbound Pi in
 callbacks and addressed delivery both ways. `DELIVERY.md` owns that 57-assertion receipt, its four
 coordinates, and its digest as history. The caller-seat re-run is **accepted** — 2026-09-16, 56
 assertions for the seat topology and 65 for the caller-DIRECTORY axis, both exit 0 — and it, not the
-fixed home, is the current contract (`DELIVERY.md`, `BASELINE.md:37-38`, `VERIFY.md` release
+fixed home, is the current contract (`DELIVERY.md`, BASELINE.md's release-host table (Codex caller-seat rows), `VERIFY.md` release
 acceptance).
 
 `entwurf_fresh_call` accepts backend `codex` — supported in 0.21.0 — and requires an explicit model. Its
@@ -1068,7 +1075,7 @@ LIVE=1 AGY_CONVERSATION_ID=<id> entwurf smoke-agy-native-push-live
 
 ACP turns are CERTIFIED on Linux; on macOS they are NOT CERTIFIED —
 pending physical host. Mux (visible fresh / resume) is the same state.
-A CI runner has no Claude or Cortex login.
+A CI runner has no Claude login.
 
 Claude uses the operator's existing local Claude authentication:
 
@@ -1076,16 +1083,10 @@ Claude uses the operator's existing local Claude authentication:
 LIVE=1 entwurf smoke-acp-provider-live
 ```
 
-Cortex requires an authenticated `cortex` CLI and an explicit connection. Keep
-`CORTEX_HOME` unset; the adapter refuses its presence because it bypasses containment.
-
-```bash
-LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> \
-  entwurf smoke-acp-cortex-live
-```
-
-The aggregate release gate is Claude-backed and does not run Cortex automatically.
-Its silence is not a Cortex PASS.
+Cortex ACP is disabled. Existing Cortex configuration and credentials are not modified.
+Entwurf fresh/resume exact admission refuses retired Cortex ids; the ACP adapter also
+refuses a Cortex id that reaches it, without a Claude fallback. Pi's own direct `--model`
+fuzzy selection precedes that adapter; its result for a typed retired id is unmeasured here.
 
 ### Backend prerequisites and resolver
 
@@ -1097,12 +1098,10 @@ operator-installed Claude runtime. Resolution order:
 2. `require.resolve(...)` against the bundled `@agentclientprotocol/claude-agent-acp`.
 3. `PATH:claude-agent-acp` fallback if package resolution fails.
 
-The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`, and
-`claude-fable-5-1`. Cortex exposes `cortex-auto`, `cortex-claude-opus-5`,
-`cortex-claude-sonnet-5`, and `cortex-openai-gpt-5.4`.
-`entwurfProvider.cortexConnection` or `ENTWURF_ACP_CORTEX_CONNECTION` selects
-an authenticated connection; the env override wins. Codex and Antigravity are
-native-push citizens (§4c/§5), not ACP backends.
+The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`,
+`claude-fable-5-1`, and `claude-fable-5-2`. Cortex ACP is disabled; a legacy
+`entwurfProvider.cortexConnection` does not select a backend or block Claude.
+Codex and Antigravity are native-push citizens (§4c/§5), not ACP backends.
 
 ### Settings reference and backend-specific keys
 
@@ -1137,15 +1136,11 @@ retired bundled `session-bridge` entry. It is not a general MCP catalog.
 user augment. Large Claude `_meta.systemPrompt` carriers can route OAuth sessions
 to metered “extra usage” billing.
 
-`entwurfProvider` is one block, not a promise that every key shapes both backends.
 `tools`, `permissionAllow`, `disallowedTools`, `settingSources`, `skillPlugins`
-and `appendSystemPrompt` are Claude's declaration surface, not Cortex's native
-tool surface. They still enter the config signature (and `tools` the common
-exclude-tools preflight), so editing them forces a fresh Cortex session.
-`cortexConnection` is Cortex-only; `mcpServers` reaches both through their own
-transports. `compaction` is a **top-level pi key**, not a backend knob. Unknown
-and retired keys are ignored; a wrong-backend key can fail silently, so check
-which backend consumes it before diagnosing bridge failure.
+and `appendSystemPrompt` are Claude's declaration surface. `mcpServers` carries
+explicit servers. `compaction` is a **top-level pi key**, not a backend knob.
+The retired `cortexConnection` key is not consumed by Claude and does not enable
+Cortex ACP; unknown and retired keys are ignored.
 
 ### Backend operation and containment
 
@@ -1160,12 +1155,8 @@ Read/Bash/Edit/Write; `Skill` is added for non-empty `skillPlugins`.
 The launch env sets `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1`: vendor-managed
 background work is off, not arbitrary processes a command detaches itself.
 
-Cortex uses its native tools, session-private HOME / `SNOWFLAKE_HOME`, and private
-`cortex/mcp.json` projection because it ignores wire `mcpServers`. Only the bridge
-receives the real operator HOME needed for the garden store; `CORTEX_HOME` is
-refused, including an empty value, because it bypasses containment.
 [ACP backend rail — Shipped adapters](./acp-backend-rail.md#shipped-adapters)
-owns the exact overlay/carrier/backend mechanics and audit limits.
+owns the exact Claude overlay/carrier mechanics and audit limits.
 
 Entwurf owns no memory layer or memory DB, and no backend is another's memory
 authority. Operator semantic-memory / Denote tools remain host-native skills,
@@ -1200,7 +1191,7 @@ Non-empty `skillPlugins` auto-adds `Skill` to `tools` and `Skill(*)` to
 path or missing `.claude-plugin/plugin.json` before starting the session; the
 SDK, not the bridge, validates plugin.json contents and SKILL.md bodies.
 Start a fresh Claude session and ask it to list callable skills. The operator
-judgement is `Q-SKILL-CALLABLE` in [VERIFY](../VERIFY.md).
+judgement is asking the session which skills it can call; it is not a named row in [VERIFY](../VERIFY.md).
 This is Claude-only; Codex uses native `~/.codex/skills/` passthrough.
 [agent-config](https://github.com/junghan0611/agent-config) is a real multi-harness
 consumer, not a requirement for this setup.
@@ -1226,8 +1217,7 @@ Bridge identity, pi context, `~/AGENTS.md`, cwd AGENTS and date/cwd ride a one-s
 first-user prepend (`pi-context-augment.ts`), not the system carrier. It removes
 duplicate cwd AGENTS already in `<project-context ...>`. Its descriptions do not
 grant tools: the actual callable schema is truth (`read` / `Read` / `exec_command`,
-MCP only when schema-visible). Cortex engraving rides this augment because it
-has no system-prompt carrier; Claude uses `_meta.systemPrompt`.
+MCP only when schema-visible). Claude uses `_meta.systemPrompt` for its engraving.
 
 ### Session reuse and compaction
 
@@ -1243,7 +1233,12 @@ owns the reuse policy and distinguishes live mapping from semantic recall.
 **Entwurf does not implement compaction.** A backend's native compaction preserves
 the pi session/mapping; configure its policy through that backend's own interface,
 not a pi-side JSONL summary. The bridge exposes no backend-specific compaction
-knobs. The ACP footer uses `usage_update.used / size` (backend prompt/tools/cache/
+knobs. One fixed exception on the Claude ACP rail: its adapter's idle `/compact` (an autonomous
+turn on an idle session) is turned off inline (`settings.idleCompaction: false`), because pi would
+not see that turn; in-prompt auto-compaction stays the backend's, and a managed settings tier would
+still win over the inline value ([rail §Capability posture](./acp-backend-rail.md#capability-posture)).
+Pi's own summaries on a Claude ACP model (`/compact`, the threshold, overflow recovery, `/tree`) are not that backend compaction: each runs as a one-shot tool-less turn on a new child, and the session's retained child is closed after a compaction ([rail §11-10](./acp-backend-rail.md)).
+The ACP footer uses `usage_update.used / size` (backend prompt/tools/cache/
 session included) with `[entwurf:usage]` diagnostics. Near limit choose a visible
 action: clear, open a new session with a different model, or let the backend
 compact natively.
@@ -1266,7 +1261,7 @@ harness unit FAIL with the §1 Darwin wording — upgrade does not mint a
 rail receipt. Doctors refuse on Darwin until a physical-host receipt
 exists.
 
-If install or doctor reports an unreadable/old active citizen generation, do not edit
+If install or doctor reports an active citizen generation it cannot read, first distinguish reader-version skew from a genuinely unreadable generation. Roll a stale reader forward and preserve identities and records; only a genuinely unreadable generation, as the [fresh-cut policy](./fresh-cut-policy.md) prescribes, takes the procedure below. Do not fresh-cut merely because an SDK or checkout changed. For a genuinely unreadable generation, do not edit
 records by hand. Close pi, Claude, Copilot, OMP, agy, and Codex sessions first, run
 `entwurf meta-bridge-fresh-cut`, and read its exit status before any install. Then choose the
 installation mode you actually own:
@@ -1316,7 +1311,7 @@ An already-running process keeps the modules it loaded, whatever is on disk. So,
 
 1. Build once from the checkout (`pnpm run build-bridge`, or its body `bash scripts/with-dist-lock.sh bash scripts/build-bridge.sh` when no package lifecycle should run).
 2. Compare the whole compiled output with the accepted candidate's, as a file-set and hash manifest. A hash of the selected entry alone is not enough: the entry can stay identical while a helper it loads differs. Check the pinned SDK set separately, and that the new process started after the build.
-3. Close the visible session and reopen it with its own native same-id resume. Closing a working sibling is an operator decision for that session, not something an agent does because new bytes landed.
+3. Close the visible session and reopen it with its own native same-id resume. Closing a working sibling is an operator decision for that session, not something an agent does because new bytes landed. For a pi-durable session launched with an operator module, reopen the intended native session with its original explicit CLI and module after verifying the installation; garden-id resume does not restore modules.
 4. Confirm `entwurf_self` names the same garden id, and that the receiver/owner join points at the new process, whose bridge child started after the build.
 
 A per-component setup PASS or a `git pull` does not show which bytes a running bridge loaded. On 2026-10-20 one host of the #107 pair still selected a pre-feature dist after a pull and a green setup. The cause was not traced. A hash check caught it before the first message, and a manual build and visible resume fixed it. Entwurf adds no auto-build, reload or watcher for this.

package/mcp/entwurf-bridge/dist/ENTWURF.json

@@ -6,8 +6,14 @@
 		"editing": "Preserve decoded strings exactly unless an explicit semantic amendment is intended. Review related consumers and independent oracles atomically. Accepted payload changes advance revision; history-only edits, routine releases and unrelated code changes do not. schemaVersion tracks reader/structural compatibility. A slotted hint holds only the text around its slot: the slot value (for record-less-socket, the fresh-cut command in both invocation forms) is supplied by its code owner and never copied here. Metadata is not delivered to models."
 	},
 	"schemaVersion": 6,
-	"revision": 19,
+	"revision": 20,
 	"history": [
+		{
+			"revision": 20,
+			"source": "b9fa0d2aa43ebefc1c3bd5bc864c84965b52289a",
+			"issue": "https://github.com/junghan0611/entwurf/issues/159",
+			"change": "Align delivery descriptions with completion and reply routing while preserving receipt, rail, and lifecycle boundaries."
+		},
 		{
 			"revision": 19,
 			"source": "2734f524bfeca6eb1a0ae092494d45576af9ebef",
@@ -126,11 +132,11 @@
 	"tools": {
 		"entwurf_v2": {
 			"descriptions": {
-				"mcp": "CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome, named per rail: a control receiver's acceptance boundary (`sent` / `queued-steer` / `queued-follow-up` / `accepted-unknown-boundary` — those four, or `mailbox-enqueued` on a re-resolved mailbox leg), a mailbox ENQUEUE receipt, a native-push INJECTION, a rejection, or lock-dirty. This receipt is not the colleague's reply or evidence of reading. EXISTING targets only; discover with entwurf_peers. A live socket can receive fire-and-forget. unsupported means only \"no control-socket probe,\" not reachability. The decider resolves the actual rail at dispatch time: a self-fetch mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; native-push has NO mailbox: dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate; agy (paused, #152) → native-push-paused, no probe. A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. owned-outcome was withdrawn. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode applies to a CONTROL-SOCKET send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000 chars; send an artifact path + digest for more.",
-				"durable": "Send a message to an existing garden citizen by garden id through the entwurf-bridge (intent fire-and-forget). Returns the bridge's delivery receipt, or fails with its named rejection. This receipt is not the colleague's reply."
+				"mcp": "Send, reply or hand off to an existing garden id; the decider selects the live rail (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome, named per rail: a control receiver's acceptance boundary (`sent` / `queued-steer` / `queued-follow-up` / `accepted-unknown-boundary` — those four, or `mailbox-enqueued` on a re-resolved mailbox leg), a mailbox ENQUEUE receipt, a native-push INJECTION, a rejection, or lock-dirty. A receipt is not a reply or proof of reading. A local final is not delivery: when asked to reply, call entwurf_v2 for the requested recipient (normally the replyable sender); honor routing and no-send instructions. Discover existing targets with entwurf_peers. A live socket can receive fire-and-forget; unsupported means only \"no control-socket probe,\" not reachability. For a target without a live socket, the THIRD RESULT is rejection if neither mailbox nor native-push is available. An inactive self-fetch citizen is mailbox-undeliverable; native-push has NO mailbox: dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate; agy (paused) → native-push-paused, no probe. A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. This delivery verb never launches or resumes a process. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. A control-socket-DOMAIN dispatch takes a target lock; mailbox and native-push rails are lock-free. mode applies only to a CONTROL-SOCKET send. wants_reply requests a response without authorizing an action or requiring an automatic acknowledgment; an absent or false marker does not cancel a request in the message. message caps at 16000 chars; send an artifact path + digest for more.",
+				"durable": "Send, reply or hand off to an existing garden id through entwurf-bridge (intent fire-and-forget), returning a delivery receipt or named rejection. The receipt is not a reply or proof of reading. For a requested reply, send to the authorized recipient, normally the replyable sender; a local final is not delivery. Honor routing and no-send instructions; an absent or false wants_reply does not cancel a request, and an address alone needs no ACK."
 			},
 			"parameters": {
-				"intent": "fire-and-forget = send/reply/hand-off to an existing target after a current rail check. unsupported is not a reachability verdict; the decider picks a rail or REJECTS (self-fetch → mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate; a paused backend — agy, #152 — rejects as native-push-paused before any probe); set wants_reply to request an answer, not to wait for one. This is the ONLY intent: owned-outcome, which resumed a dormant citizen by launching a hidden background child, was withdrawn under the visible-first rule. It is not selectable, not deprecated-but-tolerated; a dormant socket citizen is currently unreachable by this verb and rejects as dormant-fire-forget-unsupported.",
+				"intent": "fire-and-forget sends, replies or hands off to an existing target after a current rail check. unsupported is not a reachability verdict: self-fetch uses a deliverable mailbox or rejects as mailbox-undeliverable; native-push injects when alive, rejects dead as native-push-target-dead and indeterminate as native-push-probe-indeterminate; paused agy rejects as native-push-paused before probing. wants_reply requests a response, not a wait. This delivery verb never launches or resumes a process; a dormant socket rejects as dormant-fire-forget-unsupported.",
 				"message": "Message / prompt to the colleague. In familiar language and natural sentences, convey what matters now and the context they need. Keep identifiers and evidence exact; trim repetition, not meaning. Hard cap 16000 chars; for larger payloads send a file/artifact path plus digest.",
 				"mode": "Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. The mailbox and native-push plans carry no mode, so it has no effect on those rails.",
 				"target": "Target garden id (use entwurf_peers to discover)",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/acp-client.js

@@ -16,7 +16,7 @@
 // This module owns the `AcpConnectionLike` seam so the backend and the live
 // smokes both drive ONE adapter — the SDK method-name mapping lives here only,
 // and the backend's orchestration + the gate fakes stay untouched.
-import { AGENT_METHODS, CLIENT_METHODS, client, } from "@agentclientprotocol/sdk";
+import { AGENT_METHODS, CLIENT_METHODS, client } from "@agentclientprotocol/sdk";
 /**
  * Production factory — wrap the SDK 1.1 fluent `client()` into the
  * `AcpConnectionLike` seam the backend (and the live smokes) drive.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -23,7 +23,7 @@ import { fileURLToPath } from "node:url";
 import { RequestError } from "@agentclientprotocol/sdk";
 import { enrichMcpServersWithEnvelope } from "./config.js";
 import { loadEngraving } from "./engraving.js";
-import { CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./models.js";
+import { CLAUDE_ACP_EFFORT_VALUES, CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, LEGACY_CORTEX_MODEL_IDS, SUPPORTED_ANTHROPIC_MODEL_IDS, } from "./models.js";
 import { claudeLaunchEnvDefaults, ensureClaudeConfigOverlay, ensureCortexDualHomeOverlay } from "./overlay.js";
 import { buildClaudeSessionMeta } from "./tool-surface.js";
 // POSIX-safe single-quote wrapper for shell arg interpolation. Byte-for-byte
@@ -114,7 +114,7 @@ export const CLAUDE_FOREGROUND_ONLY_ENV = { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS
  * The set-model answer is read back before the prompt (#128). claude-agent-acp resolves the
  * requested id onto one of the rows it offers and answers with that row's `value` as the model
  * option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). `[측정 2026-10-12]` 0.85.1, no
- * prompt: `claude-fable-5-1` answers its own row, while `claude-sonnet-5-5` and `claude-opus-5-5`
+ * prompt: `claude-fable-5-1` answers its own row (and, at 0.106.0 #142, so does `claude-fable-5-2`), while `claude-sonnet-5-5` and `claude-opus-5-5`
  * answer the alias rows `sonnet` and `opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row
  * resolves to (`ModelInfo.resolvedModel`) is not on the ACP wire, so an alias answer is accepted
  * only as the exact measured row, value AND name, declared here for the requested id. No other
@@ -148,6 +148,46 @@ export function confirmClaudeSetModelAnswer(response, nativeModelId) {
         `name the requested model. Refusing before the prompt so a different model cannot answer under this id; ` +
         `the installed driver and the curated id disagree, and repeating the turn cannot change that.`);
 }
+const CLAUDE_EFFORT_VALUE_SET = new Set(CLAUDE_ACP_EFFORT_VALUES);
+/** The named refusal for a thinking level ACP Claude cannot carry (#142). The text is fixed and
+ *  must read as NON-transient to pi's retry and overflow classifiers: replaying the turn cannot
+ *  change the level that was asked for. */
+export const ACP_THINKING_LEVEL_UNSUPPORTED = "acp-thinking-level-unsupported";
+/**
+ * Map pi's requested level to the claude-agent-acp effort value, or refuse by name (#142).
+ * The value is the registered row's `thinkingLevelMap` entry for that level — the documented pi
+ * meaning of the map — and must be one of the measured effort values. `undefined` (pi off, or no
+ * level) is refused rather than left at the vendor `default`: that would let the turn run at a
+ * depth nobody chose while the operator believes a level was applied.
+ */
+export function resolveClaudeEffort(modelId, reasoning, thinkingLevelMap) {
+    const value = reasoning === undefined ? undefined : thinkingLevelMap?.[reasoning];
+    if (typeof value === "string" && CLAUDE_EFFORT_VALUE_SET.has(value))
+        return value;
+    const asked = reasoning === undefined
+        ? "no thinking level (pi sends none for `off`, and none when no level is set; the two are indistinguishable here)"
+        : `thinking level ${JSON.stringify(reasoning)}`;
+    throw new Error(`entwurf: ${ACP_THINKING_LEVEL_UNSUPPORTED} — ${modelId} over Claude ACP carries effort ` +
+        `${CLAUDE_ACP_EFFORT_VALUES.join("/")} only, and was asked for ${asked}. Choose one of those levels; ` +
+        `the turn was not sent, and repeating it at the same level cannot change that.`);
+}
+function claudeEffortRefusal(modelId, value, what, cause) {
+    const error = new Error(`entwurf: claude-agent-acp ${what} for effort ${JSON.stringify(value)} on ${modelId}. Refusing before the prompt ` +
+        `so the turn cannot run at an effort nobody chose; repeating the turn cannot change the driver's answer.`);
+    if (cause !== undefined)
+        error.cause = cause;
+    return error;
+}
+/** Refuse unless the set-effort answer reads back the requested value. */
+export function confirmClaudeEffortAnswer(response, modelId, value) {
+    const configOptions = response?.configOptions;
+    const effort = Array.isArray(configOptions)
+        ? configOptions.find((option) => option?.id === "effort")
+        : undefined;
+    if (effort?.currentValue === value)
+        return;
+    throw claudeEffortRefusal(modelId, value, effort == null ? "answered with no effort option" : `answered effort ${jsonText(effort.currentValue)}`);
+}
 export const claudeAdapter = {
     backend: "claude",
     // Claude owns its UNPREFIXED curated ids only (rail “Adapter contract”). The native id
@@ -206,6 +246,23 @@ export const claudeAdapter = {
         });
         confirmClaudeSetModelAnswer(answer, nativeModelId);
     },
+    resolveThinking({ modelId, reasoning, thinkingLevelMap }) {
+        return resolveClaudeEffort(modelId, reasoning, thinkingLevelMap);
+    },
+    async enforceThinking({ connection, acpSessionId, modelId, value }) {
+        const setConfig = connection.setSessionConfigOption;
+        if (typeof setConfig !== "function") {
+            throw new Error(`setSessionConfigOption unsupported — cannot set effort for ${modelId}`);
+        }
+        let answer;
+        try {
+            answer = await setConfig.call(connection, { sessionId: acpSessionId, configId: "effort", value });
+        }
+        catch (err) {
+            throw claudeEffortRefusal(modelId, value, "refused the set", err);
+        }
+        confirmClaudeEffortAnswer(answer, modelId, value);
+    },
     configSignatureFields(_adapterSettings) {
         // Claude folds no extra backend-specific fields beyond backend + nativeModelId
         // (which backend.ts adds). A future backend reads its own stable id off
@@ -226,21 +283,15 @@ export const claudeAdapter = {
 // ---------------------------------------------------------------------------
 // Registry — modelId → adapter
 // ---------------------------------------------------------------------------
-/** Registered adapters. Order carries NO routing authority — routeModel decides.
- *  claude (unprefixed ids) + cortex (the `cortex-` prefix). A further backend
- *  appends here with its own reserved prefix; the fail-fast below proves no two
- *  adapters claim one id. */
-// ---------------------------------------------------------------------------
-// cortex adapter — Snowflake Cortex Code, the first non-claude backend on the
-// rail (docs/acp-backend-rail.md, “Shipped adapters”). It adds ZERO to the common layer:
-// everything cortex-specific lives here + models.ts + overlay.ts + the gates.
-// ---------------------------------------------------------------------------
-const SUPPORTED_CORTEX_IDS = new Set(SUPPORTED_CORTEX_MODEL_IDS);
+// The former Cortex implementation is retained privately for historical source
+// continuity only. The exported adapter below denies every side-effecting entry,
+// and the production registry does not contain this implementation.
+const SUPPORTED_CORTEX_IDS = new Set(LEGACY_CORTEX_MODEL_IDS);
 /** The env var an operator sets to pin a Snowflake connection per-shell without
  *  editing settings.json. Wins over `entwurfProvider.cortexConnection`. The
  *  ENTWURF_ACP_* convention (PR #40's legacy PI_SHELL_ACP* cortex-connection var renamed). */
 export const CORTEX_CONNECTION_ENV = "ENTWURF_ACP_CORTEX_CONNECTION";
-export const cortexAdapter = {
+const retiredCortexAdapter = {
     backend: "cortex",
     // Cortex owns the reserved `cortex-` prefix (rail “Adapter contract”). routeModel strips it to the
     // native id: `cortex-auto` → "auto", `cortex-claude-sonnet-5` → "claude-sonnet-5".
@@ -373,7 +424,29 @@ export const cortexAdapter = {
     // server rejects a prompt with, so every cortex failure keeps the verbatim-first
     // errorMessage. Borrowing claude's `incomplete_tool_call` reader would be a guess.
 };
-const ADAPTERS = [claudeAdapter, cortexAdapter];
+const cortexDisabled = () => {
+    throw new Error("entwurf: cortex-acp-disabled: Cortex ACP is not supported");
+};
+/** Retained exported shape refuses the retired adapter before a launch or overlay can be made. */
+export const cortexAdapter = {
+    ...retiredCortexAdapter,
+    routeModel: () => undefined,
+    curatedModels: () => [],
+    resolveAdapterSettings: cortexDisabled,
+    resolveLaunch: cortexDisabled,
+    launchEnvDefaults: cortexDisabled,
+    ensureOverlay: cortexDisabled,
+    loadCarrier: cortexDisabled,
+    buildSessionMeta: cortexDisabled,
+    enforceModel: cortexDisabled,
+    configSignatureFields: cortexDisabled,
+};
+const ADAPTERS = [claudeAdapter];
+/** A declared backend is only a guard, never a replacement routing authority. */
+export function assertSupportedDeclaredBackend(backend) {
+    if (backend?.toLowerCase() === "cortex")
+        cortexDisabled();
+}
 /**
  * Resolve the backend adapter that owns `modelId`.
  *
@@ -385,6 +458,9 @@ const ADAPTERS = [claudeAdapter, cortexAdapter];
  * so callers get `{ adapter, nativeModelId }` and never re-parse the id string.
  */
 export function resolveAcpBackendAdapter(modelId) {
+    if (modelId.toLowerCase().startsWith(CORTEX_MODEL_PREFIX)) {
+        throw new Error(`entwurf: cortex-acp-disabled: ${JSON.stringify(modelId)} is not supported`);
+    }
     const matches = [];
     for (const adapter of ADAPTERS) {
         const routed = adapter.routeModel(modelId);