@junghanacs/entwurf 0.52.0 → 0.53.1

package/pi-extensions/lib/fresh-call-composition.ts

@@ -23,6 +23,7 @@
  */
 
 import { randomBytes } from "node:crypto";
+import { PROVIDER_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./acp/model-ids.js";
 
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
  * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, `codex`
@@ -150,6 +151,34 @@ export const FRESH_CALL_TOOL_LOAD_HINT: Record<FreshCallBackend, readonly string
 	"pi-durable": [],
 };
 
+/**
+ * Which dialect table spells the bridge tools for THIS launch. The backend picks the runtime; the
+ * model can pick a different tool surface underneath it.
+ *
+ * `[측정 2026-11-13, D1]` a pi sibling opened on an ACP Claude model (`entwurf/claude-*`) does not
+ * see Pi's MCP names: its turns run inside the Claude Agent SDK, which mints the bridge tools as
+ * `mcp__entwurf-bridge__*` (the ACP Sonnet interview of 2026-11-13, n=1, called them by the schema
+ * it was given, not by the pi spelling its framing named). So the NAMES follow the claude-code
+ * table. The load hint stays the pi row (none): in that n=1 the bridge tools were directly callable
+ * without loading. Whether ToolSearch exists on this surface, or deferral can occur with more
+ * declared servers (`acp/tool-surface.ts` names the SDK's deferred tools), is unmeasured — not a
+ * claim that it cannot.
+ *
+ * Only an exact curated Anthropic id switches. A thinking suffix (`:high`) or fuzzy alias never
+ * reaches here through the public verb: the dispatch root refuses any `entwurf/` id that is not
+ * exactly curated (`isUncuratedEntwurfPiModel`, #128), and the test pins that alignment. Retired
+ * Cortex ids are refused at the dispatch root before framing. The ACP id list arrives from
+ * `acp/model-ids.js`, an import-free module.
+ */
+export function freshCallToolDialect(backend: FreshCallBackend, model: string): FreshCallBackend {
+	if (backend !== "pi") return backend;
+	const trimmed = model.trim();
+	const slash = trimmed.indexOf("/");
+	if (slash < 0 || trimmed.slice(0, slash) !== PROVIDER_ID) return backend;
+	const id = trimmed.slice(slash + 1);
+	return (SUPPORTED_ANTHROPIC_MODEL_IDS as readonly string[]).includes(id) ? "claude-code" : backend;
+}
+
 /**
  * What a launch has to say, in the two shapes the six backends need. pi, claude-code, copilot
  * and codex are handed the first-turn PROMPT as an argument; pi-durable is handed that same
@@ -413,15 +442,19 @@ export function composeBackendArgs(
  */
 export function composeFreshCallFraming(params: {
 	backend: FreshCallBackend;
+	/** The launch model, as the caller wrote it. It chooses the tool-name dialect
+	 * (`freshCallToolDialect`) and is never echoed into the framing. */
+	model: string;
 	callerGardenId: string;
 	nonce: string;
 	/** The rail's own first sentence — see `PLACEMENT SENTENCE` above. Empty is a crash, not a
 	 * default: a sibling told nothing about where it is would be told something false by silence. */
 	openingLine: string;
 }): string[] {
-	const birthTool = FRESH_CALL_CALLBACK_TOOL[params.backend];
-	const deliveryTool = FRESH_CALL_DELIVERY_TOOL[params.backend];
-	const peersTool = FRESH_CALL_PEERS_TOOL[params.backend];
+	const dialect = freshCallToolDialect(params.backend, params.model);
+	const birthTool = FRESH_CALL_CALLBACK_TOOL[dialect];
+	const deliveryTool = FRESH_CALL_DELIVERY_TOOL[dialect];
+	const peersTool = FRESH_CALL_PEERS_TOOL[dialect];
 	// The hint is a per-backend TEMPLATE so the two tool dialects stay the single source of their
 	// own spelling here too — a hint that hard-coded Claude's name would go stale the day a dialect
 	// moves, and it would go stale silently, in the one sentence a stuck child depends on.
@@ -490,6 +523,7 @@ export function composeFreshCallFraming(params: {
  */
 export function composeFreshCallPrompt(params: {
 	backend: FreshCallBackend;
+	model: string;
 	task: string;
 	callerGardenId: string;
 	nonce: string;

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -962,6 +962,7 @@ export async function herdrFreshCall(
 
 	const framing = composeFreshCallFraming({
 		backend,
+		model,
 		callerGardenId,
 		nonce,
 		openingLine: HERDR_FRESH_CALL_OPENING_LINE,
@@ -1796,6 +1797,7 @@ async function herdrLayoutFreshCall(
 
 	const prompt = composeFreshCallPrompt({
 		backend: "pi-durable",
+		model,
 		task,
 		callerGardenId,
 		nonce,
@@ -1876,7 +1878,7 @@ export const HERDR_REJECT_HINT: Record<
 	// #128: decided at the dispatch root (`fresh-call-dispatch.ts`), worded here because this rail's
 	// import fence admits no ACP module. The curated list itself lives in `acp/model-ids.js`.
 	"acp-model-not-curated":
-		"an entwurf model must be one exact curated ACP id — Pi would otherwise pick another row by substring (a retired claude-sonnet-5 lands on cortex-claude-sonnet-5), so nothing was opened and nothing was aliased",
+		"an entwurf model must be one exact curated ACP id; Cortex ACP is disabled. Pi may otherwise pick another row by substring, so nothing was opened or aliased",
 	"task-empty": "a sibling opened with nothing to do is a window nobody asked for",
 	"task-too-long": `the task is over the ${TASK_MAX_CHARS}-character interface bound this verb shares with entwurf_v2`,
 	"herdr-context-missing":

package/pi-extensions/lib/mux-fresh-call.ts

@@ -214,6 +214,7 @@ export function buildBackendArgs(
 /** The first turn for THIS rail: the neutral framing under this rail's placement sentence. */
 export function buildFreshCallPrompt(params: {
 	backend: FreshCallBackend;
+	model: string;
 	task: string;
 	callerGardenId: string;
 	nonce: string;
@@ -510,7 +511,7 @@ export function freshCall(
 		const runtime = layout === null ? null : checkPiDurableRuntime(layout);
 		const missing = piDurableFreshPreflight({
 			model,
-			firstInput: buildFreshCallPrompt({ backend: params.backend, task, callerGardenId, nonce }),
+			firstInput: buildFreshCallPrompt({ backend: params.backend, model, task, callerGardenId, nonce }),
 			layout,
 			runtime: runtime === null || runtime.ok ? null : runtime.reason,
 		});
@@ -549,6 +550,7 @@ export function freshCall(
 	const composition: FreshCallComposition = {
 		prompt: buildFreshCallPrompt({
 			backend: params.backend,
+			model,
 			task,
 			callerGardenId,
 			nonce,

package/run.sh

@@ -1344,9 +1344,13 @@ check_fresh_call_provider() {
 check_acp_set_model_readback() {
   # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
   # MUTANT EXECUTION COORDINATE for scripts/mutants/acp-set-model-readback.json (#128): the claude
-  # adapter refuses a set-model answer that does not name the requested model, before the prompt.
-  section "claude ACP set-model readback (mutant execution coordinate)"
-  run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
+  # adapter refuses a set-model answer that does not name the requested model, before the prompt;
+  # and (#142) pi's thinking level reaches Claude effort, set and read back before the prompt;
+  # and (#142) what a cancel leaves: the operator notice and the aborted-turn status in a rebuild;
+  # and (#163) Pi's summary request as a one-shot tool-less turn, and the child closed on compaction;
+  # and (#163) the display-only tool title, output preview and compaction lines in the event mapper.
+  section "claude ACP set-model + effort readback (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/acp/backend-adapter.test.ts pi-extensions/lib/acp/backend.thinking.test.ts pi-extensions/lib/acp/context.test.ts pi-extensions/lib/acp/cortex-admission.test.ts pi-extensions/lib/acp/backend.summary-turn.test.ts pi-extensions/lib/acp/event-mapper.test.ts
 }
 
 check_acp_vendor_rejection() {
@@ -1798,38 +1802,8 @@ smoke_acp_rgg_live() {
 }
 
 smoke_acp_cortex_live() {
-  # On-demand LIVE smoke for the Cortex (Snowflake Cortex Code) ACP backend — the
-  # first NON-claude adapter on the rail (docs/acp-backend-rail.md, Cortex audit). OUT of
-  # `pnpm check` AND OUTSIDE the claude-only aggregate LIVE floor (capability
-  # dignity, invariant #7): a host with no cortex install / no Snowflake auth must
-  # not redden a release for a backend it does not run, so this is deliberately
-  # absent from release-gate's 11-smoke ACP acceptance floor. That is a WIRING
-  # decision, not a lower evidence bar — a cut that SHIPS cortex still owes a
-  # deliberate run of this smoke, and the aggregate gate's silence is not a pass
-  # (ACP rail Cortex verification boundary). Drives one real
-  # cortex ACP turn through the entwurf provider path (outbound entwurf_v2 +
-  # dual-HOME overlay facts + process-group reclaim — CP2).
-  # HONEST-SKIP (protocol exit 97, never 0) when LIVE!=1 OR `cortex` is not on PATH OR no
-  # connection is pinned — the live turn needs `cortex` installed with the
-  # operator's own web-login auth already present (there is no `cortex auth`
-  # subcommand — CP0 D6), reached through the overlay's narrow credential
-  # symlinks — narrow in WHICH paths are reachable (D5), not read-only: a symlink
-  # carries no write protection (AGENTS §ACP Plugin Boundary: entwurf never
-  # provides/proxies the Snowflake credential). The connection must ride the adapter seam
-  # (ENTWURF_ACP_CORTEX_CONNECTION) because the dual-HOME overlay denies the
-  # operator settings.json where a default would live. PR #40 called this
-  # `smoke-cortex`; the canonical family name is smoke-acp-cortex-live.
-  #   LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live
-  entwurf_require_step_outcome
-  if [ "${LIVE:-}" != "1" ]; then
-    echo "[entwurf:skip] smoke-acp-cortex-live — set LIVE=1 (+ ENTWURF_ACP_CORTEX_CONNECTION) to run."
-    return "$ENTWURF_STEP_SKIP_EXIT"
-  fi
-  if ! command -v cortex >/dev/null 2>&1; then
-    echo "[entwurf:skip] smoke-acp-cortex-live — cortex not on PATH (install Snowflake Cortex Code and complete its own login flow)."
-    return "$ENTWURF_STEP_SKIP_EXIT"
-  fi
-  run_ts scripts/smoke-acp-cortex-live.ts
+  echo "[entwurf:cortex-acp-disabled] Cortex ACP is not supported; no live probe was started." >&2
+  return 2
 }
 
 smoke_entwurf_v2_matrix_live() {
@@ -3375,13 +3349,11 @@ check_acp_provider_surface() {
   # Deterministic gate for the ACP provider registration surface. Loads the REAL
   # provider lib modules AND compiles + drives the REAL entry against a fake pi,
   # asserting: one surface name, the no-auth sentinel shape, full
-  # ProviderModelConfig rows on the curated claude anchor, the EXACT curated model
-  # set both adapters contribute (claude 3 + cortex 4 —
-  # [QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE], the claim that catches an entry which
-  # silently drops a whole backend), and that streamSimple is the real
+  # ProviderModelConfig rows on the curated Claude anchor, the exact Claude-only
+  # set [QK:ACP-PROVIDER-CLAUDE-ONLY], and that streamSimple is the real
   # streamShellAcp backend (checked BY NAME, never invoked — invoking spawns an
   # ACP child). Pure, no pi runtime, no API.
-  section "ACP provider surface (registration + both-adapter model set)"
+  section "ACP provider surface (registration + Claude-only model set)"
   run_ts scripts/check-acp-provider-surface.ts
 }
 
@@ -3709,30 +3681,10 @@ check_acp_carrier_augment() {
 }
 
 check_acp_cortex() {
-  # Deterministic gate for the Cortex (Snowflake Cortex Code) ACP backend — the
-  # first non-claude adapter on the rail, landed 0.13.0 on the CP0-measured
-  # contract (docs/acp-backend-rail.md, Cortex audit D1–D10). The cortex source is one
-  # `cortexAdapter` object (backend-adapter.ts) + its curated surface (models.ts)
-  # + the dual-HOME overlay (overlay.ts); the 결합 규칙 requires the gate to land
-  # WITH it, extending the check-acp-* family, so cortex's whole
-  # deterministic axis lives here. Locks (each Cortex-audit D-pinned): the GLG-decided
-  # 4-row curation rides real registry bases and the `cortex-` prefix routes to
-  # cortexAdapter; launch is `cortex acp serve` with NO -m — the model is
-  # enforced per turn via session/set_config_option with the native id (E);
-  # CORTEX_HOME presence (empty included) refuses the spawn (D3); the dual-HOME
-  # overlay isolates HOME+SNOWFLAKE_HOME per session key (P0-1: scope =
-  # backend-passed resolveSessionKey, never ambient), passes through only
-  # connections.toml / optional config.toml / credential_cache (D5/F — never the
-  # whole cache, never skills; symlink-through, no copies — AGENTS §ACP Plugin
-  # Boundary), authors autoUpdate:false (D4), and projects envelope-enriched
-  # explicit servers into cortex/mcp.json with the real HOME restored on
-  # entwurf-bridge alone (D9/D10), non-stdio failing loud; the
-  # CORTEX_ACP_COMMAND override single-quotes shell-metachar connection tokens.
-  # The gate self-manages the tsc-emit layer for the .js-suffixed backend-adapter
-  # imports; no auth, no spawn, no live cortex needed. Kill-qualified via the
-  # `acp-cortex` mutant lane under check-gate-qualification.
-  section "ACP cortex backend (Snowflake Cortex Code — 1st non-claude adapter)"
-  run_ts scripts/check-acp-cortex.ts
+  # The old positive Cortex adapter contract is retired. Exercise the production
+  # admission and direct adapter refusal without launching a vendor process.
+  section "ACP Cortex disabled admission"
+  run_vitest pi-extensions/lib/acp/cortex-admission.test.ts
 }
 
 check_pack() {
@@ -5283,17 +5235,9 @@ _check_pack_install_impl() {
     echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
     return 1
   fi
-  # Verify the EXACT curated surface the installed package registers — both
-  # backends (claude 2 rows + cortex 4 rows = 6), as a SET, not as anchors.
-  #
-  # Why exact-set and not `grep -q <id>`: the cortex ids CONTAIN the claude ids
-  # as substrings (`cortex-claude-sonnet-5` matches a bare `claude-sonnet-5`
-  # grep), so a substring probe could go green on a surface that dropped every
-  # unprefixed Claude row. And an anchor-only probe cannot see a MISSING cortex
-  # row at all — that is exactly the installed-consumer gap this assertion
-  # closes: the source-side sets are pinned by check-acp-cortex /
-  # check-acp-provider-surface, but only THIS gate proves the ids survive the
-  # pack → install → pi-loader path into a real consumer's model list.
+  # Verify the EXACT supported surface the installed package registers: four
+  # Claude rows, no retired Cortex row. A substring probe cannot prove absence.
+  # This gate joins the source admission to pack → install → real Pi loader.
   #
   # Parse rows whose FIRST field is the provider `entwurf` (pi prints a
   # `provider model context …` table; the header row's first field is
@@ -5302,14 +5246,11 @@ _check_pack_install_impl() {
   loader_ids=$(awk '$1 == "entwurf" { print $2 }' <<<"$loader_out" | LC_ALL=C sort)
   loader_expected=$(printf '%s\n' \
     claude-fable-5-1 \
+    claude-fable-5-2 \
     claude-opus-5-5 \
-    claude-sonnet-5-5 \
-    cortex-auto \
-    cortex-claude-opus-5 \
-    cortex-claude-sonnet-5 \
-    cortex-openai-gpt-5.4 | LC_ALL=C sort)
+    claude-sonnet-5-5 | LC_ALL=C sort)
   if [ "$loader_ids" != "$loader_expected" ]; then
-    fail "[check-pack-install] installed provider model set drifted — expected exactly 7 curated ids (claude 3 + cortex 4):"
+    fail "[check-pack-install] installed provider model set drifted — expected exactly 4 Claude ids and no Cortex ids:"
     echo "  expected:" >&2
     echo "$loader_expected" | sed 's/^/    /' >&2
     echo "  actual (entwurf rows):" >&2
@@ -5321,7 +5262,7 @@ _check_pack_install_impl() {
   # Name the set on SUCCESS too, not only in the failure branch — same principle as
   # the pinned-pi version assert above: a gate that cannot name what it proved has
   # proved nothing, and a row COUNT without the ids cannot be audited from a CI log.
-  echo "[check-pack-install] pi loader smoke pass (entwurf registered; exact curated set: claude 3 + cortex 4):"
+  echo "[check-pack-install] pi loader smoke pass (entwurf registered; exact curated set: 4 Claude ids, no Cortex):"
   echo "$loader_ids" | sed 's/^/    /'
 
   # npm-managed neutral install regression — the README's PRIMARY install path is
@@ -7632,10 +7573,8 @@ release_gate() {
   #     green cut said nothing about them. Under the P1 outcome protocol wiring
   #     them costs nothing on a host that cannot run them — they SKIP honestly and
   #     `--cut` names the missing prerequisite — while a host that CAN run them now
-  #     must. Cortex is deliberately NOT here: its rail needs an external Snowflake
-  #     connection the HOST owns, so wiring it would block every cut taken without
-  #     that account; it stays a required DIRECT call for a Cortex-rail cut instead
-  #     (VERIFY 「Cortex is an on-demand axis」). Same for `smoke-acp-long-turn-live`,
+  #     must. Cortex ACP is disabled; its former direct smoke now refuses without
+  #     starting a probe. The excluded `smoke-acp-long-turn-live`,
   #     `smoke-agy-native-push-live` and `smoke-acp-ordering-probe-live`: >12min by
   #     construction, no aggregate-owned agy conversation id, and an opt-in instrument
   #     rather than acceptance. check-release-gate-outcomes pins that every LIVE smoke

package/scripts/check-acp-carrier-augment.ts

@@ -15,7 +15,7 @@
 // Pure + temp-dir fs, no spawn/child — IN pnpm check.
 
 import { strict as assert } from "node:assert";
-import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -379,23 +379,6 @@ function ctxWith(firstUser: string) {
 		"[QK:CARRIER-FRAME-NAMES-CLAUDE-CARRIER] the claude frame must name the real carrier AND scope it to the engraving — " +
 			`saying only "this is not your system prompt" leaves the model to guess what the system prompt then is. Got: ${JSON.stringify(claudeAug.slice(0, 500))}`,
 	);
-	assert.ok(
-		cortexAug.includes("carries no system-prompt carrier at all") &&
-			!cortexAug.includes("does have a system-prompt carrier"),
-		"[QK:CARRIER-FRAME-DENIES-CORTEX-CARRIER] the cortex frame must deny the carrier — cortex's buildSessionMeta returns " +
-			`undefined so no _meta is sent; claiming a tiny carrier there would be a lie. Got: ${JSON.stringify(cortexAug.slice(0, 500))}`,
-	);
-
-	// The rail difference is not a doc claim — it is in the adapter source.
-	const adapterSrc = readFileSync(join(REPO_DIR, "pi-extensions/lib/acp/backend-adapter.ts"), "utf8");
-	const cortexAt = adapterSrc.indexOf('backend: "cortex"');
-	assert.ok(cortexAt > 0, "backend-adapter.ts still declares the cortex adapter");
-	assert.match(
-		adapterSrc.slice(cortexAt),
-		/buildSessionMeta\(\)\s*\{\s*return undefined;/,
-		"[QK:CARRIER-RAIL-DIFF-IS-SOURCE-PINNED] cortex's buildSessionMeta must still return undefined — the source fact the " +
-			"cortex frame's 'no carrier at all' sentence rests on. If this ever grows a carrier, the frame becomes a lie.",
-	);
 
 	// DISJOINT SURFACES: the thing the model is told is its system prompt (the
 	// engraving) must not contain the narrative it is told is user text. If the
@@ -559,9 +542,8 @@ console.log(
 		"signature change (stable carrier → stable signature); augment: prepended on `new` only (reuse delta has none), " +
 		"wire-only so it never enters contextMessageSignatures, entwurf cwd/AGENTS.md de-dup (present → drop only that " +
 		"section, home kept; absent → kept), day-granularity date, 50KB truncation marker, shipped AGENTS budget; " +
-		"provenance: both rails state the augment is first-user-message text and not the system prompt, claude names its " +
-		"tiny engraving-only carrier while cortex denies having one (pinned against cortexAdapter.buildSessionMeta → " +
-		"undefined), and carrier/augment stay disjoint; A-join: the carrier opens its own block after the SDK's fixed " +
+		"provenance: the augment is first-user-message text and not the system prompt, Claude names its " +
+		"tiny engraving-only carrier, and carrier/augment stay disjoint; A-join: the carrier opens its own block after the SDK's fixed " +
 		"sentence, the boundary is a loader constant (not the template's whitespace, which trim eats) and does not " +
 		"resurrect an opted-out carrier, the shipped carrier stays under the tiny budget, and the meta hop sends the " +
 		"loader string byte-for-byte so the wire and the reuse signature cannot desynchronize",

package/scripts/check-acp-prompt-lifecycle.ts

@@ -41,7 +41,21 @@ import { normalizeContext } from "@earendil-works/pi-ai";
 import { isRetryableAssistantError } from "@earendil-works/pi-ai/compat";
 import { assertOverlayInSandbox, sandboxAcpGateHome } from "./lib/acp-gate-home.ts";
 
-const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
+// #142: a Claude turn carries pi's thinking level, which the backend sets as effort and reads back
+// before the prompt. This fixture runs every turn at one fixed level on rows carrying the curated
+// level map, and its fake driver reads back whatever config option it was asked to set. The effort
+// contract itself is certified in pi-extensions/lib/acp/backend.thinking.test.ts.
+const FIXTURE_THINKING_LEVEL = "medium";
+const FIXTURE_THINKING_LEVEL_MAP = {
+	off: null,
+	minimal: null,
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "xhigh",
+	max: "max",
+};
+const sonnet = { id: "claude-sonnet-5-5", thinkingLevelMap: FIXTURE_THINKING_LEVEL_MAP } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
 
@@ -152,7 +166,7 @@ function makeHarness(recordDir: string) {
 	const makeConnection = (handlers: any) => ({
 		initialize: async () => ({ agentCapabilities: {} }),
 		newSession: async () => ({ sessionId: "ACP-1" }),
-		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: p.configId, currentValue: p.value }] }),
 		prompt: ({ sessionId }: any) => {
 			promptCount++;
 			notifier = (update) => handlers.sessionUpdate({ update, sessionId });
@@ -287,7 +301,14 @@ try {
 	const promptsOut = resolve(TMP_EMIT, "pi-extensions/lib/acp/prompts");
 	mkdirSync(promptsOut, { recursive: true });
 	copyFileSync("pi-extensions/lib/acp/prompts/engraving.md", resolve(promptsOut, "engraving.md"));
-	const backend = (await import(pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href)) as any;
+	const backendModule = (await import(
+		pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href
+	)) as any;
+	const backend = {
+		...backendModule,
+		streamAcpTurn: (model: unknown, context: unknown, options: Record<string, unknown> | undefined, deps: unknown) =>
+			backendModule.streamAcpTurn(model, context, { reasoning: FIXTURE_THINKING_LEVEL, ...options }, deps),
+	};
 	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 
 	// ----------------------------------------------------------------------

package/scripts/check-acp-provider-surface.ts

@@ -35,7 +35,6 @@ import {
 	ENTWURF_ACP_NO_AUTH_SENTINEL,
 	PROVIDER_ID,
 	SUPPORTED_ANTHROPIC_MODEL_IDS,
-	SUPPORTED_CORTEX_MODEL_IDS,
 } from "../pi-extensions/lib/acp/models.ts";
 
 // ---------------------------------------------------------------------------
@@ -103,10 +102,16 @@ try {
 	const mod = await import(entryUrl);
 
 	const calls: Array<{ id: string; cfg: CapturedCfg }> = [];
+	const events: string[] = [];
 	const fakePi = {
 		registerProvider(id: string, cfg: CapturedCfg) {
 			calls.push({ id, cfg });
 		},
+		// #163: the entry closes a session's Claude child on compaction. Its behaviour is proven in
+		// pi-extensions/lib/acp/backend.summary-turn.test.ts; here only the registration count.
+		on(event: string) {
+			events.push(event);
+		},
 	};
 
 	// Drive the REAL default export twice — the second call must be a no-op.
@@ -118,6 +123,7 @@ try {
 		1,
 		`entry must register exactly once across two calls (idempotency) — got ${calls.length}`,
 	);
+	assert.deepEqual(events, ["session_compact"], `entry must subscribe to session_compact exactly once — got ${events}`);
 	const cap = calls[0];
 	assert.equal(cap.id, PROVIDER_ID, `entry registered the wrong provider id: ${cap.id}`);
 	assert.equal(cap.cfg.apiKey, ENTWURF_ACP_NO_AUTH_SENTINEL, "entry apiKey is not the no-auth sentinel");
@@ -127,33 +133,18 @@ try {
 		assert.ok(capIds.includes(want), `entry model surface missing ${want} (got: ${capIds.join(", ") || "none"})`);
 	}
 
-	// The REAL entry must register the curated rows of EVERY adapter on the rail —
-	// claude's 2 unprefixed ids AND cortex's 4 `cortex-` ids. This is the JOIN
-	// claim, distinct from the per-backend data claims: check-acp-cortex pins the
-	// 4-row cortex curation in models.ts, but nothing there proves those rows
-	// actually reach `pi.registerProvider`. An entry that filtered `cortex-` out
-	// of `allCuratedModels()` would leave models.ts and check-acp-cortex fully
-	// green while the operator's model list silently lost the whole backend.
-	//
-	// Set comparison (sorted, exact) — not `includes`: a substring/anchor probe
-	// cannot see a row that VANISHED, and the cortex ids contain the claude ids as
-	// substrings. Expected is derived from the two source id constants so there is
-	// one SSOT; the literal 7 below is the independent floor that catches a
-	// curation list that SHRANK — expected derives from the same constants, so a
-	// dropped row moves expected and captured together and the set comparison
-	// stays green. That is why the count is asserted separately and carries its
-	// own claim: the cortex list has `CORTEX-CURATED-FOUR-ROWS` for exactly this
-	// failure, and the claude list needs its own oracle rather than borrowing it.
-	const expectedIds = [...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS].slice().sort();
-	assert.equal(
-		expectedIds.length,
-		7,
-		`[QK:CLAUDE-CURATED-THREE-ROWS] curated id constants must total 7 rows (claude 3 + cortex 4) — got ${expectedIds.length}: ${expectedIds.join(", ")}`,
+	// Independent literal oracle: the compiled provider exposes the four Claude
+	// rows and no retired Cortex row, even if a source list drifts with the SUT.
+	const expectedIds = ["claude-fable-5-1", "claude-fable-5-2", "claude-opus-5-5", "claude-sonnet-5-5"];
+	assert.deepEqual(
+		[...SUPPORTED_ANTHROPIC_MODEL_IDS].sort(),
+		expectedIds,
+		"[QK:CLAUDE-CURATED-FOUR-ROWS] the four Claude IDs are an independent literal oracle",
 	);
 	assert.deepEqual(
 		capIds.slice().sort(),
 		expectedIds,
-		`[QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE] compiled entry must register the EXACT curated set of both adapters (claude 3 + cortex 4) — got: ${capIds.join(", ") || "none"}`,
+		`[QK:ACP-PROVIDER-CLAUDE-ONLY] compiled provider must expose exactly the four Claude rows — got: ${capIds.join(", ") || "none"}`,
 	);
 	assert.equal(typeof cap.cfg.streamSimple, "function", "entry streamSimple must be a function");
 	// Regression guard: the entry must wire the REAL backend (streamShellAcp),
@@ -200,7 +191,7 @@ assert.ok(!/backend-stub/.test(entrySrc), "entry must not import the removed S0
 
 console.log(
 	`[check-acp-provider-surface] ok — compiled entry registers ${PROVIDER_ID} once (idempotent) with the no-auth ` +
-		`sentinel + the EXACT curated set of both adapters (claude ${SUPPORTED_ANTHROPIC_MODEL_IDS.length} incl. ` +
-		`${CURATED_ANCHOR_MODEL_ID} + cortex ${SUPPORTED_CORTEX_MODEL_IDS.length}) + real streamShellAcp backend (S2c); ` +
+		`sentinel + the EXACT Claude-only curated set (${SUPPORTED_ANTHROPIC_MODEL_IDS.length} incl. ` +
+		`${CURATED_ANCHOR_MODEL_ID}) + real streamShellAcp backend (S2c); ` +
 		`claude lib surface verified live (${models.length} model(s))`,
 );

package/scripts/check-acp-session-reuse.ts

@@ -52,8 +52,22 @@ function tctx(messages: Context["messages"]): TranscriptContext {
 	return normalizeContext({ tools: PI_DECLARED_TOOLS, messages });
 }
 
-const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
-const opus = { id: "claude-opus-5-5" } as unknown as Model<Api>;
+// #142: a Claude turn carries pi's thinking level, which the backend sets as effort and reads back
+// before the prompt. This fixture runs every turn at one fixed level on rows carrying the curated
+// level map, and its fake driver reads back whatever config option it was asked to set. The effort
+// contract itself is certified in pi-extensions/lib/acp/backend.thinking.test.ts.
+const FIXTURE_THINKING_LEVEL = "medium";
+const FIXTURE_THINKING_LEVEL_MAP = {
+	off: null,
+	minimal: null,
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "xhigh",
+	max: "max",
+};
+const sonnet = { id: "claude-sonnet-5-5", thinkingLevelMap: FIXTURE_THINKING_LEVEL_MAP } as unknown as Model<Api>;
+const opus = { id: "claude-opus-5-5", thinkingLevelMap: FIXTURE_THINKING_LEVEL_MAP } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
@@ -155,7 +169,7 @@ function makeHarness(recordDir: string, config: any = DEFAULT_RESOLVED_CONFIG, e
 			newSessionSeq++;
 			return { sessionId: `ACP-${newSessionSeq}` };
 		},
-		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: p.configId, currentValue: p.value }] }),
 		prompt: async ({ sessionId, prompt }: any) => {
 			promptCalls.push({ sessionId, text: prompt.map((b: { text: string }) => b.text).join("\n") });
 			if (block) await block;
@@ -282,7 +296,12 @@ try {
 	copyFileSync("pi-extensions/lib/acp/prompts/engraving.md", resolve(promptsOut, "engraving.md"));
 	const backendUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href;
 	const storeUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/session-store.js")).href;
-	const backend = (await import(backendUrl)) as any;
+	const backendModule = (await import(backendUrl)) as any;
+	const backend = {
+		...backendModule,
+		streamAcpTurn: (model: unknown, context: unknown, options: Record<string, unknown> | undefined, deps: unknown) =>
+			backendModule.streamAcpTurn(model, context, { reasoning: FIXTURE_THINKING_LEVEL, ...options }, deps),
+	};
 	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 	const store = (await import(storeUrl)) as any;
 	const configUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/config.js")).href;

package/scripts/check-acp-stop-reason.ts

@@ -56,7 +56,21 @@ import type { Api, AssistantMessageEvent, Model } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 import { assertOverlayInSandbox, sandboxAcpGateHome } from "./lib/acp-gate-home.ts";
 
-const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
+// #142: a Claude turn carries pi's thinking level, which the backend sets as effort and reads back
+// before the prompt. This fixture runs every turn at one fixed level on rows carrying the curated
+// level map, and its fake driver reads back whatever config option it was asked to set. The effort
+// contract itself is certified in pi-extensions/lib/acp/backend.thinking.test.ts.
+const FIXTURE_THINKING_LEVEL = "medium";
+const FIXTURE_THINKING_LEVEL_MAP = {
+	off: null,
+	minimal: null,
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "xhigh",
+	max: "max",
+};
+const sonnet = { id: "claude-sonnet-5-5", thinkingLevelMap: FIXTURE_THINKING_LEVEL_MAP } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
@@ -123,7 +137,7 @@ function makeHarness(recordDir: string, wireReason: string | null) {
 		createConnection: (_child: any, handlers: any) => ({
 			initialize: async () => ({ agentCapabilities: {} }),
 			newSession: async () => ({ sessionId: "ACP-1" }),
-			setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
+			setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: p.configId, currentValue: p.value }] }),
 			prompt: async ({ sessionId }: any) => {
 				await handlers.sessionUpdate({
 					update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: "PARTIAL" } },
@@ -249,7 +263,12 @@ try {
 
 	const backendUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href;
 	const eventUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/event-mapper.js")).href;
-	const backend = (await import(backendUrl)) as any;
+	const backendModule = (await import(backendUrl)) as any;
+	const backend = {
+		...backendModule,
+		streamAcpTurn: (model: unknown, context: unknown, options: Record<string, unknown> | undefined, deps: unknown) =>
+			backendModule.streamAcpTurn(model, context, { reasoning: FIXTURE_THINKING_LEVEL, ...options }, deps),
+	};
 	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 	const eventMod = (await import(eventUrl)) as any;
 

package/scripts/check-acp-stream-hooks.ts

@@ -36,7 +36,21 @@ import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } fr
 import { normalizeContext } from "@earendil-works/pi-ai";
 import { assertOverlayInSandbox, sandboxAcpGateHome } from "./lib/acp-gate-home.ts";
 
-const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
+// #142: a Claude turn carries pi's thinking level, which the backend sets as effort and reads back
+// before the prompt. This fixture runs every turn at one fixed level on rows carrying the curated
+// level map, and its fake driver reads back whatever config option it was asked to set. The effort
+// contract itself is certified in pi-extensions/lib/acp/backend.thinking.test.ts.
+const FIXTURE_THINKING_LEVEL = "medium";
+const FIXTURE_THINKING_LEVEL_MAP = {
+	off: null,
+	minimal: null,
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "xhigh",
+	max: "max",
+};
+const sonnet = { id: "claude-sonnet-5-5", thinkingLevelMap: FIXTURE_THINKING_LEVEL_MAP } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
 
@@ -94,7 +108,7 @@ function makeHarness(recordDir: string) {
 	const makeConnection = (_handlers: any) => ({
 		initialize: async () => ({ agentCapabilities: {} }),
 		newSession: async () => ({ sessionId: "ACP-1" }),
-		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: p.configId, currentValue: p.value }] }),
 		prompt: async (params: any) => {
 			// Deep-cloned: the capture must be the bytes that crossed the seam, not a
 			// live reference a later mutation could rewrite.
@@ -195,7 +209,14 @@ try {
 	const promptsOut = resolve(TMP_EMIT, "pi-extensions/lib/acp/prompts");
 	mkdirSync(promptsOut, { recursive: true });
 	copyFileSync("pi-extensions/lib/acp/prompts/engraving.md", resolve(promptsOut, "engraving.md"));
-	const backend = (await import(pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href)) as any;
+	const backendModule = (await import(
+		pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href
+	)) as any;
+	const backend = {
+		...backendModule,
+		streamAcpTurn: (model: unknown, context: unknown, options: Record<string, unknown> | undefined, deps: unknown) =>
+			backendModule.streamAcpTurn(model, context, { reasoning: FIXTURE_THINKING_LEVEL, ...options }, deps),
+	};
 	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 
 	// ----------------------------------------------------------------------