@junghanacs/entwurf 0.52.0 → 0.53.1

package/docs/setup-clean-host.md

@@ -23,11 +23,11 @@ evidence split, and its three states must not collapse into "macOS is supported"
 
 ## Requirements
 
-The requirements table and pinned npm examples describe published Entwurf 0.51.0, whose exact SDK set is 1.5.0. The unpublished 0.52.0 source candidate (#158) instead pins SDK 1.5.2 and declares host Pi `>=1.5.2 <1.6`. Source validation, publication and a running host's loaded bytes are separate evidence; an addon-less validation tarball has been installed on one operating host, with same-identity return observed for the operating coordinator; that bounded observation is not full release or all-rail acceptance (see the [#158 candidate boundary](#sdk-152-candidate-boundary-158)).
+The current published Entwurf 0.52.0 uses the exact Pi 1.5.2 SDK set and host Pi `>=1.5.2 <1.6`. The marked 0.51.0 / SDK 1.5.0 examples below are historical and remain bound to their own published manifest. Source validation, publication and a running host's loaded bytes are separate evidence; the earlier addon-less validation tarball installed on one operating host is not the published artifact (see the [#158 boundary](#sdk-152-candidate-boundary-158)).
 
 The validation TGZ installed in #155's operating window before the D1 display repair is an earlier, separate artifact, not the published one; see the [SDK 1.5 boundary](#sdk-15-development-boundary-155) below.
 
-The previous package, `0.50.0`, ships the Pi 1.4.0 SDK set and requires a Pi 1.4.x host; the setup guide inside that tarball is its contract.
+The older package, `0.50.0`, ships the Pi 1.4.0 SDK set and requires a Pi 1.4.x host; the setup guide inside that tarball is its contract.
 
 | Component | Requirement | Needed for |
 |---|---|---|
@@ -35,14 +35,13 @@ The previous package, `0.50.0`, ships the Pi 1.4.0 SDK set and requires a Pi 1.4
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence — published 0.51.0: <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`>=1.5.0 <1.6`<!-- /entwurf:published -->; #158 source candidate: `>=1.5.2 <1.6`. Absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
-| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus its exact pi SDK set (1.5.0 in published 0.51.0; 1.5.2 in the #158 source candidate) as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
+| pi | optional-by-presence — current 0.52.0: `>=1.5.2 <1.6`; historical 0.51.0: <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`>=1.5.0 <1.6`<!-- /entwurf:published -->. Absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus its exact pi SDK set (1.5.2 in published 0.52.0; 1.5.0 in historical 0.51.0) as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.306`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
 | Antigravity `agy` | optional, operator-installed and authenticated | legacy citizen; native push paused (#152) |
 | OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all four operator-owned units (birth/MCP/status-line/terminal-title) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires the operator-owned app-server, started with `entwurf codex-app-server` in a tmux session of the operator's choosing (#95 D1 retired the fixed `codex` home) | native-push and visible fresh, supported in 0.21.0 |
-| Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
 Claude Code >=2.1.306 is required for the managed exec-hook lifecycle and same-id resume. The package
 never supplies or proxies backend credentials.
@@ -85,8 +84,8 @@ node --version
 npm --version
 ```
 
-The two npm forms below install the **published** package, `0.51.0` (Pi 1.5.x, the Pi 1.5.0 SDK
-set); they do not install the #158 source candidate (SDK 1.5.2), which is not published — a developer runs that from a source checkout (below). The [product entry](../README.md#install)'s unpinned `npm install -g @junghanacs/entwurf`
+The two npm forms below install the **published** package, `0.52.0` (Pi 1.5.x, the Pi 1.5.2 SDK
+set). The [product entry](../README.md#install)'s unpinned `npm install -g @junghanacs/entwurf`
 takes whichever version npm's `latest` dist-tag names; pin `@<version>` as below when you mean the
 exact artifact the [Requirements](#requirements) table describes.
 
@@ -94,7 +93,7 @@ Global install is simplest when native harnesses should find stable bins from ev
 working directory:
 
 ```bash
-npm install -g @junghanacs/entwurf@0.51.0
+npm install -g @junghanacs/entwurf@0.52.0
 entwurf --help
 entwurf setup /path/to/your-project
 entwurf check-bridge
@@ -105,7 +104,7 @@ A project-local installation is also supported:
 ```bash
 mkdir -p ~/entwurf-smoke && cd ~/entwurf-smoke
 npm init -y
-npm install --save-dev @junghanacs/entwurf@0.51.0
+npm install --save-dev @junghanacs/entwurf@0.52.0
 npx entwurf setup .
 npx entwurf check-bridge
 ```
@@ -115,10 +114,10 @@ project-local install, or `./run.sh <command>` from a source checkout. Keep that
 same scope when upgrading and checking; native process restarts are separate (§7).
 
 `check-bridge` is auth-free. It proves the installed prebuilt MCP server boots and
-lists the nine garden tools (0.51.0); it does not prove a backend model turn, native hook or retirement permission.
+lists the nine garden tools (0.52.0); it does not prove a backend model turn, native hook or retirement permission.
 
 Neither npm form installs a harness runtime. `pi`, Claude Code, Copilot CLI, Codex CLI, agy,
-Cortex, and their authentication remain operator-owned optional prerequisites for the
+and their authentication remain operator-owned optional prerequisites for the
 integrations that use them; all may be absent on an Entwurf-only host. A source checkout's
 pinned Pi development packages are for building and testing this repo, not a transitive product installation promise.
 
@@ -226,12 +225,11 @@ physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
 on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 `setup` names the pi row FAIL with the §1 Darwin wording.
 
-<!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->
-For published Entwurf 0.51.0, install its exact host Pi floor and wire the project as shown below.
-The previous 0.50.0 uses the Pi 1.4.x host named in its own setup guide:
+For published Entwurf 0.52.0, install its exact host Pi floor and wire the project as shown below.
+The previous 0.51.0 uses the Pi 1.5.0 floor named in its own setup guide:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.5.0
+npm install -g @earendil-works/pi-coding-agent@1.5.2
 pi --version
 
 cd ~/entwurf-smoke
@@ -239,13 +237,12 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported host Pi range for published Entwurf 0.51.0 is `>=1.5.0 <1.6`.
+The supported host Pi range for published Entwurf 0.52.0 is `>=1.5.2 <1.6`.
 A detected host outside that range is refused for Pi wiring; Entwurf does not upgrade it.
 Align the host explicitly, for example with the exact npm command above, before wiring Pi. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
-<!-- /entwurf:published -->
 
-The #158 source candidate instead requires host Pi `>=1.5.2 <1.6`; checkout `setup` reports a detected older host as FAIL. Prepare host Pi 1.5.2 before wiring this checkout, and use the checkout path rather than the global npm package for a direct `pi -e` invocation. Host Pi 1.5.2 also falls within published 0.51.0's declared range, but #158 has not measured that pairing; range eligibility does not replace installation, validation or operating approval. Ordinary Pi 1.5.2 defaults its global `cacheWarming` setting to `idle`, which may send additional provider requests; pi-durable does not map that setting. See the [#158 durable boundary](./durable-native-support.md#sdk-152-candidate-boundary-158).
+Published 0.52.0 requires host Pi `>=1.5.2 <1.6`; `setup` reports a detected older host as FAIL. Prepare host Pi 1.5.2 before wiring, and use the checkout path rather than the global npm package when running a checkout directly. Range eligibility does not replace installation, validation or operating approval. Ordinary Pi 1.5.2 defaults its global `cacheWarming` setting to `idle`, which may send additional provider requests; pi-durable does not map that setting. See the [#158 durable boundary](./durable-native-support.md#sdk-152-candidate-boundary-158).
 
 For daily garden-native pi sessions:
 
@@ -264,7 +261,7 @@ A plain `pi` can load the package without becoming a citizen.
 In that session ask for `entwurf_self`, then `entwurf_peers`. Pick an existing
 live garden id and ask for `entwurf_v2` with `intent: "fire-and-forget"` and your
 message. These are harness tools, not shell subcommands; pi exposes them through
-Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The 0.51.0 bridge has nine tools;
+Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The bridge has nine tools;
 pi hides `entwurf_inbox_read` and `entwurf_register_native`, leaving seven active.
 The added `entwurf_retire_call` is only for one target/action explicitly requested by the
 human operator, never autonomous cleanup. Where a host provides or is configured with an approval
@@ -349,12 +346,12 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
 
 What the Entwurf package supplies:
 
-1. **The pi SDK set** — published 0.51.0 supplies `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
-   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry, pi-schema}` at exactly `1.5.0`, plus
-   `proper-lockfile`, as Entwurf's own production dependencies; its model data rides <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`@earendil-works/pi-ai@1.5.0`<!-- /entwurf:published -->, not a catalog copy.
-   The #158 source candidate supplies the same ten-member set at exactly `1.5.2` (its model data rides the 1.5.2 pi-ai). The
-   [SDK pin](../pi/pi-durable/overlay/upstream-pin.json) and [package manifest](../package.json) are the authority
-   for the checkout you hold: they describe the source candidate, not the immutable published 0.51.0 bytes.
+1. **The pi SDK set** — published 0.52.0 supplies `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry, pi-schema}` at exactly `1.5.2`, plus
+   `proper-lockfile`, as production dependencies. Model data rides `pi-ai@1.5.2`, not a catalog copy.
+   Historical 0.51.0 used <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`@earendil-works/pi-ai@1.5.0`<!-- /entwurf:published -->.
+   The [SDK pin](../pi/pi-durable/overlay/upstream-pin.json) and [package manifest](../package.json)
+   describe the checkout you hold, not immutable published bytes.
 2. **The native app/TUI carrier** — upstream does not publish the experimental durable
    app (`pi-coding-agent` excludes `dist/experimental`; `pi-durable` on npm is the
    library). Entwurf owns the six app files as canonical source (`pi/pi-durable/src`,
@@ -364,7 +361,7 @@ What the Entwurf package supplies:
    (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
    own `dist/` as installed — never through a source checkout.
 
-The upstream library guide for the published 0.51.0 pairing is [v1.5.0](https://github.com/earendil-works/pi/blob/v1.5.0/packages/durable/README.md); for the #158 candidate's SDK APIs use [v1.5.2](https://github.com/earendil-works/pi/blob/v1.5.2/packages/durable/README.md).
+The upstream library guide for the published 0.51.0 pairing is [v1.5.0](https://github.com/earendil-works/pi/blob/v1.5.0/packages/durable/README.md); for the published 0.52.0 SDK APIs use [v1.5.2](https://github.com/earendil-works/pi/blob/v1.5.2/packages/durable/README.md).
 The [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
 (last published at v1.1.0) records the app's origin: Entwurf's maintained app source, not a newer upstream app, is the current composition authority. Both guides describe what the carrier is. Running the bare upstream app does not attach Entwurf's
 garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
@@ -379,7 +376,7 @@ carrier file, the license, the resolver and its relocation grammar are present
 (`pi-durable-carrier-drift`); every declared SDK package resolves from the carrier
 (`pi-durable-sdk-absent`); and every reachable physical edge — from the carrier to each package,
 and from every package copy it reaches, at any depth, to its own `@earendil-works` dependencies —
-lands on a package of the declared name at exactly the pinned version (`pi-durable-sdk-mismatch`). The members' declarations are exact in the published 1.5.0 set and, measured on the registry tarballs (#158), in the 1.5.2 candidate set; even so, the physical package each import binds must be checked. Sharing
+lands on a package of the declared name at exactly the pinned version (`pi-durable-sdk-mismatch`). The members' declarations are exact in the published 1.5.0 set and, measured on the registry tarballs (#158), in the 1.5.2 set; even so, the physical package each import binds must be checked. Sharing
 one copy with an aligned host install of the same version is an ordinary layout. A mixed
 tree (for example an override that binds pi-durable's `pi-ai` to an older published version) still
 *imports* — which is why the edge check exists — and is refused by name.
@@ -461,7 +458,7 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
   not a claim that every load path is harmless.
 
-The ordinary Pi CLI on PATH is a separate subject (§2; published 0.51.0 range <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`>=1.5.0 <1.6`<!-- /entwurf:published -->, #158 source candidate range `>=1.5.2 <1.6`): a host Pi is
+The ordinary Pi CLI on PATH is a separate subject (§2; historical 0.51.0 range <!-- entwurf:published @junghanacs/entwurf@0.51.0 pi 1.5.0 -->`>=1.5.0 <1.6`<!-- /entwurf:published -->, current 0.52.0 range `>=1.5.2 <1.6`): a host Pi is
 not needed to run pi-durable, and a host inside the range need not be the same copy as the
 carrier's. The native harnesses own credentials, model settings and their respective session stores — ordinary Pi JSONL and pi-durable SQLite; keep them
 in place rather than copying credentials or migrating ordinary Pi transcripts. Native
@@ -474,7 +471,7 @@ proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
 ### SDK 1.5 development boundary (#155)
 
-The published-0.51.0 instructions above describe the SDK 1.5.0 set that #155 shipped; the #155 SDK
+The historical 0.51.0 instructions describe the SDK 1.5.0 set that #155 shipped; the #155 SDK
 1.5 development candidates that preceded it were distinct subjects. Synthetic migration and
 downgrade-refusal fixtures on `0408a66` did not authorize an operating first write. A separately
 approved 1.5 operating window and Native LIVE were later measured as described below; neither made
@@ -483,7 +480,7 @@ the validation TGZ the published artifact. Installing an older package is not a
 
 ### SDK 1.5.2 candidate boundary (#158)
 
-The 0.52.0 source candidate (#158) pins the Pi SDK at exactly 1.5.2 (ten members) and declares host Pi `>=1.5.2 <1.6`. Assigning that version does not publish or install it: the published instructions above still describe 0.51.0 / SDK 1.5.0, and an operating move requires its own installation and same-identity return receipts. The #155 receipts above prove their own subject only; none is inherited by 1.5.2.
+The published 0.52.0 package (#158) pins the Pi SDK at exactly 1.5.2 (ten members) and declares host Pi `>=1.5.2 <1.6`. Publication does not install it on an operating host; an operating move requires its own installation and same-identity return receipts. The #155 receipts above prove their own subject only; none is inherited by 1.5.2.
 
 What #158 measured so far and what it did not is recorded in [the durable-native boundary](./durable-native-support.md#sdk-152-candidate-boundary-158) and in the #158 thread: registry tarball integrity and member edges, an isolated six-member scheduler comparison and a native SQLite cross-version read/append check. The pre-version checkpoint's frozen FULL belongs to its own recorded worktree. The earlier validation candidate has its own floor and installation receipts; later source edits and the final carrier-bearing artifact require their own acceptance. Operating-scale and interrupted sessions are not certified by the bounded fixtures. An operating move follows the default radius below, each step with its own receipt.
 
@@ -998,7 +995,7 @@ real initial Pi outside `codex`, then omitted-placement Codex and outbound Pi in
 callbacks and addressed delivery both ways. `DELIVERY.md` owns that 57-assertion receipt, its four
 coordinates, and its digest as history. The caller-seat re-run is **accepted** — 2026-09-16, 56
 assertions for the seat topology and 65 for the caller-DIRECTORY axis, both exit 0 — and it, not the
-fixed home, is the current contract (`DELIVERY.md`, `BASELINE.md:37-38`, `VERIFY.md` release
+fixed home, is the current contract (`DELIVERY.md`, BASELINE.md's release-host table (Codex caller-seat rows), `VERIFY.md` release
 acceptance).
 
 `entwurf_fresh_call` accepts backend `codex` — supported in 0.21.0 — and requires an explicit model. Its
@@ -1078,7 +1075,7 @@ LIVE=1 AGY_CONVERSATION_ID=<id> entwurf smoke-agy-native-push-live
 
 ACP turns are CERTIFIED on Linux; on macOS they are NOT CERTIFIED —
 pending physical host. Mux (visible fresh / resume) is the same state.
-A CI runner has no Claude or Cortex login.
+A CI runner has no Claude login.
 
 Claude uses the operator's existing local Claude authentication:
 
@@ -1086,16 +1083,10 @@ Claude uses the operator's existing local Claude authentication:
 LIVE=1 entwurf smoke-acp-provider-live
 ```
 
-Cortex requires an authenticated `cortex` CLI and an explicit connection. Keep
-`CORTEX_HOME` unset; the adapter refuses its presence because it bypasses containment.
-
-```bash
-LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> \
-  entwurf smoke-acp-cortex-live
-```
-
-The aggregate release gate is Claude-backed and does not run Cortex automatically.
-Its silence is not a Cortex PASS.
+Cortex ACP is disabled. Existing Cortex configuration and credentials are not modified.
+Entwurf fresh/resume exact admission refuses retired Cortex ids; the ACP adapter also
+refuses a Cortex id that reaches it, without a Claude fallback. Pi's own direct `--model`
+fuzzy selection precedes that adapter; its result for a typed retired id is unmeasured here.
 
 ### Backend prerequisites and resolver
 
@@ -1107,12 +1098,10 @@ operator-installed Claude runtime. Resolution order:
 2. `require.resolve(...)` against the bundled `@agentclientprotocol/claude-agent-acp`.
 3. `PATH:claude-agent-acp` fallback if package resolution fails.
 
-The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`, and
-`claude-fable-5-1`. Cortex exposes `cortex-auto`, `cortex-claude-opus-5`,
-`cortex-claude-sonnet-5`, and `cortex-openai-gpt-5.4`.
-`entwurfProvider.cortexConnection` or `ENTWURF_ACP_CORTEX_CONNECTION` selects
-an authenticated connection; the env override wins. Codex and Antigravity are
-native-push citizens (§4c/§5), not ACP backends.
+The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`,
+`claude-fable-5-1`, and `claude-fable-5-2`. Cortex ACP is disabled; a legacy
+`entwurfProvider.cortexConnection` does not select a backend or block Claude.
+Codex and Antigravity are native-push citizens (§4c/§5), not ACP backends.
 
 ### Settings reference and backend-specific keys
 
@@ -1147,15 +1136,11 @@ retired bundled `session-bridge` entry. It is not a general MCP catalog.
 user augment. Large Claude `_meta.systemPrompt` carriers can route OAuth sessions
 to metered “extra usage” billing.
 
-`entwurfProvider` is one block, not a promise that every key shapes both backends.
 `tools`, `permissionAllow`, `disallowedTools`, `settingSources`, `skillPlugins`
-and `appendSystemPrompt` are Claude's declaration surface, not Cortex's native
-tool surface. They still enter the config signature (and `tools` the common
-exclude-tools preflight), so editing them forces a fresh Cortex session.
-`cortexConnection` is Cortex-only; `mcpServers` reaches both through their own
-transports. `compaction` is a **top-level pi key**, not a backend knob. Unknown
-and retired keys are ignored; a wrong-backend key can fail silently, so check
-which backend consumes it before diagnosing bridge failure.
+and `appendSystemPrompt` are Claude's declaration surface. `mcpServers` carries
+explicit servers. `compaction` is a **top-level pi key**, not a backend knob.
+The retired `cortexConnection` key is not consumed by Claude and does not enable
+Cortex ACP; unknown and retired keys are ignored.
 
 ### Backend operation and containment
 
@@ -1170,12 +1155,8 @@ Read/Bash/Edit/Write; `Skill` is added for non-empty `skillPlugins`.
 The launch env sets `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1`: vendor-managed
 background work is off, not arbitrary processes a command detaches itself.
 
-Cortex uses its native tools, session-private HOME / `SNOWFLAKE_HOME`, and private
-`cortex/mcp.json` projection because it ignores wire `mcpServers`. Only the bridge
-receives the real operator HOME needed for the garden store; `CORTEX_HOME` is
-refused, including an empty value, because it bypasses containment.
 [ACP backend rail — Shipped adapters](./acp-backend-rail.md#shipped-adapters)
-owns the exact overlay/carrier/backend mechanics and audit limits.
+owns the exact Claude overlay/carrier mechanics and audit limits.
 
 Entwurf owns no memory layer or memory DB, and no backend is another's memory
 authority. Operator semantic-memory / Denote tools remain host-native skills,
@@ -1210,7 +1191,7 @@ Non-empty `skillPlugins` auto-adds `Skill` to `tools` and `Skill(*)` to
 path or missing `.claude-plugin/plugin.json` before starting the session; the
 SDK, not the bridge, validates plugin.json contents and SKILL.md bodies.
 Start a fresh Claude session and ask it to list callable skills. The operator
-judgement is `Q-SKILL-CALLABLE` in [VERIFY](../VERIFY.md).
+judgement is asking the session which skills it can call; it is not a named row in [VERIFY](../VERIFY.md).
 This is Claude-only; Codex uses native `~/.codex/skills/` passthrough.
 [agent-config](https://github.com/junghan0611/agent-config) is a real multi-harness
 consumer, not a requirement for this setup.
@@ -1236,8 +1217,7 @@ Bridge identity, pi context, `~/AGENTS.md`, cwd AGENTS and date/cwd ride a one-s
 first-user prepend (`pi-context-augment.ts`), not the system carrier. It removes
 duplicate cwd AGENTS already in `<project-context ...>`. Its descriptions do not
 grant tools: the actual callable schema is truth (`read` / `Read` / `exec_command`,
-MCP only when schema-visible). Cortex engraving rides this augment because it
-has no system-prompt carrier; Claude uses `_meta.systemPrompt`.
+MCP only when schema-visible). Claude uses `_meta.systemPrompt` for its engraving.
 
 ### Session reuse and compaction
 
@@ -1253,7 +1233,12 @@ owns the reuse policy and distinguishes live mapping from semantic recall.
 **Entwurf does not implement compaction.** A backend's native compaction preserves
 the pi session/mapping; configure its policy through that backend's own interface,
 not a pi-side JSONL summary. The bridge exposes no backend-specific compaction
-knobs. The ACP footer uses `usage_update.used / size` (backend prompt/tools/cache/
+knobs. One fixed exception on the Claude ACP rail: its adapter's idle `/compact` (an autonomous
+turn on an idle session) is turned off inline (`settings.idleCompaction: false`), because pi would
+not see that turn; in-prompt auto-compaction stays the backend's, and a managed settings tier would
+still win over the inline value ([rail §Capability posture](./acp-backend-rail.md#capability-posture)).
+Pi's own summaries on a Claude ACP model (`/compact`, the threshold, overflow recovery, `/tree`) are not that backend compaction: each runs as a one-shot tool-less turn on a new child, and the session's retained child is closed after a compaction ([rail §11-10](./acp-backend-rail.md)).
+The ACP footer uses `usage_update.used / size` (backend prompt/tools/cache/
 session included) with `[entwurf:usage]` diagnostics. Near limit choose a visible
 action: clear, open a new session with a different model, or let the backend
 compact natively.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/acp-client.js

@@ -16,7 +16,7 @@
 // This module owns the `AcpConnectionLike` seam so the backend and the live
 // smokes both drive ONE adapter — the SDK method-name mapping lives here only,
 // and the backend's orchestration + the gate fakes stay untouched.
-import { AGENT_METHODS, CLIENT_METHODS, client, } from "@agentclientprotocol/sdk";
+import { AGENT_METHODS, CLIENT_METHODS, client } from "@agentclientprotocol/sdk";
 /**
  * Production factory — wrap the SDK 1.1 fluent `client()` into the
  * `AcpConnectionLike` seam the backend (and the live smokes) drive.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -23,7 +23,7 @@ import { fileURLToPath } from "node:url";
 import { RequestError } from "@agentclientprotocol/sdk";
 import { enrichMcpServersWithEnvelope } from "./config.js";
 import { loadEngraving } from "./engraving.js";
-import { CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./models.js";
+import { CLAUDE_ACP_EFFORT_VALUES, CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, LEGACY_CORTEX_MODEL_IDS, SUPPORTED_ANTHROPIC_MODEL_IDS, } from "./models.js";
 import { claudeLaunchEnvDefaults, ensureClaudeConfigOverlay, ensureCortexDualHomeOverlay } from "./overlay.js";
 import { buildClaudeSessionMeta } from "./tool-surface.js";
 // POSIX-safe single-quote wrapper for shell arg interpolation. Byte-for-byte
@@ -114,7 +114,7 @@ export const CLAUDE_FOREGROUND_ONLY_ENV = { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS
  * The set-model answer is read back before the prompt (#128). claude-agent-acp resolves the
  * requested id onto one of the rows it offers and answers with that row's `value` as the model
  * option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). `[측정 2026-10-12]` 0.85.1, no
- * prompt: `claude-fable-5-1` answers its own row, while `claude-sonnet-5-5` and `claude-opus-5-5`
+ * prompt: `claude-fable-5-1` answers its own row (and, at 0.106.0 #142, so does `claude-fable-5-2`), while `claude-sonnet-5-5` and `claude-opus-5-5`
  * answer the alias rows `sonnet` and `opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row
  * resolves to (`ModelInfo.resolvedModel`) is not on the ACP wire, so an alias answer is accepted
  * only as the exact measured row, value AND name, declared here for the requested id. No other
@@ -148,6 +148,46 @@ export function confirmClaudeSetModelAnswer(response, nativeModelId) {
         `name the requested model. Refusing before the prompt so a different model cannot answer under this id; ` +
         `the installed driver and the curated id disagree, and repeating the turn cannot change that.`);
 }
+const CLAUDE_EFFORT_VALUE_SET = new Set(CLAUDE_ACP_EFFORT_VALUES);
+/** The named refusal for a thinking level ACP Claude cannot carry (#142). The text is fixed and
+ *  must read as NON-transient to pi's retry and overflow classifiers: replaying the turn cannot
+ *  change the level that was asked for. */
+export const ACP_THINKING_LEVEL_UNSUPPORTED = "acp-thinking-level-unsupported";
+/**
+ * Map pi's requested level to the claude-agent-acp effort value, or refuse by name (#142).
+ * The value is the registered row's `thinkingLevelMap` entry for that level — the documented pi
+ * meaning of the map — and must be one of the measured effort values. `undefined` (pi off, or no
+ * level) is refused rather than left at the vendor `default`: that would let the turn run at a
+ * depth nobody chose while the operator believes a level was applied.
+ */
+export function resolveClaudeEffort(modelId, reasoning, thinkingLevelMap) {
+    const value = reasoning === undefined ? undefined : thinkingLevelMap?.[reasoning];
+    if (typeof value === "string" && CLAUDE_EFFORT_VALUE_SET.has(value))
+        return value;
+    const asked = reasoning === undefined
+        ? "no thinking level (pi sends none for `off`, and none when no level is set; the two are indistinguishable here)"
+        : `thinking level ${JSON.stringify(reasoning)}`;
+    throw new Error(`entwurf: ${ACP_THINKING_LEVEL_UNSUPPORTED} — ${modelId} over Claude ACP carries effort ` +
+        `${CLAUDE_ACP_EFFORT_VALUES.join("/")} only, and was asked for ${asked}. Choose one of those levels; ` +
+        `the turn was not sent, and repeating it at the same level cannot change that.`);
+}
+function claudeEffortRefusal(modelId, value, what, cause) {
+    const error = new Error(`entwurf: claude-agent-acp ${what} for effort ${JSON.stringify(value)} on ${modelId}. Refusing before the prompt ` +
+        `so the turn cannot run at an effort nobody chose; repeating the turn cannot change the driver's answer.`);
+    if (cause !== undefined)
+        error.cause = cause;
+    return error;
+}
+/** Refuse unless the set-effort answer reads back the requested value. */
+export function confirmClaudeEffortAnswer(response, modelId, value) {
+    const configOptions = response?.configOptions;
+    const effort = Array.isArray(configOptions)
+        ? configOptions.find((option) => option?.id === "effort")
+        : undefined;
+    if (effort?.currentValue === value)
+        return;
+    throw claudeEffortRefusal(modelId, value, effort == null ? "answered with no effort option" : `answered effort ${jsonText(effort.currentValue)}`);
+}
 export const claudeAdapter = {
     backend: "claude",
     // Claude owns its UNPREFIXED curated ids only (rail “Adapter contract”). The native id
@@ -206,6 +246,23 @@ export const claudeAdapter = {
         });
         confirmClaudeSetModelAnswer(answer, nativeModelId);
     },
+    resolveThinking({ modelId, reasoning, thinkingLevelMap }) {
+        return resolveClaudeEffort(modelId, reasoning, thinkingLevelMap);
+    },
+    async enforceThinking({ connection, acpSessionId, modelId, value }) {
+        const setConfig = connection.setSessionConfigOption;
+        if (typeof setConfig !== "function") {
+            throw new Error(`setSessionConfigOption unsupported — cannot set effort for ${modelId}`);
+        }
+        let answer;
+        try {
+            answer = await setConfig.call(connection, { sessionId: acpSessionId, configId: "effort", value });
+        }
+        catch (err) {
+            throw claudeEffortRefusal(modelId, value, "refused the set", err);
+        }
+        confirmClaudeEffortAnswer(answer, modelId, value);
+    },
     configSignatureFields(_adapterSettings) {
         // Claude folds no extra backend-specific fields beyond backend + nativeModelId
         // (which backend.ts adds). A future backend reads its own stable id off
@@ -226,21 +283,15 @@ export const claudeAdapter = {
 // ---------------------------------------------------------------------------
 // Registry — modelId → adapter
 // ---------------------------------------------------------------------------
-/** Registered adapters. Order carries NO routing authority — routeModel decides.
- *  claude (unprefixed ids) + cortex (the `cortex-` prefix). A further backend
- *  appends here with its own reserved prefix; the fail-fast below proves no two
- *  adapters claim one id. */
-// ---------------------------------------------------------------------------
-// cortex adapter — Snowflake Cortex Code, the first non-claude backend on the
-// rail (docs/acp-backend-rail.md, “Shipped adapters”). It adds ZERO to the common layer:
-// everything cortex-specific lives here + models.ts + overlay.ts + the gates.
-// ---------------------------------------------------------------------------
-const SUPPORTED_CORTEX_IDS = new Set(SUPPORTED_CORTEX_MODEL_IDS);
+// The former Cortex implementation is retained privately for historical source
+// continuity only. The exported adapter below denies every side-effecting entry,
+// and the production registry does not contain this implementation.
+const SUPPORTED_CORTEX_IDS = new Set(LEGACY_CORTEX_MODEL_IDS);
 /** The env var an operator sets to pin a Snowflake connection per-shell without
  *  editing settings.json. Wins over `entwurfProvider.cortexConnection`. The
  *  ENTWURF_ACP_* convention (PR #40's legacy PI_SHELL_ACP* cortex-connection var renamed). */
 export const CORTEX_CONNECTION_ENV = "ENTWURF_ACP_CORTEX_CONNECTION";
-export const cortexAdapter = {
+const retiredCortexAdapter = {
     backend: "cortex",
     // Cortex owns the reserved `cortex-` prefix (rail “Adapter contract”). routeModel strips it to the
     // native id: `cortex-auto` → "auto", `cortex-claude-sonnet-5` → "claude-sonnet-5".
@@ -373,7 +424,29 @@ export const cortexAdapter = {
     // server rejects a prompt with, so every cortex failure keeps the verbatim-first
     // errorMessage. Borrowing claude's `incomplete_tool_call` reader would be a guess.
 };
-const ADAPTERS = [claudeAdapter, cortexAdapter];
+const cortexDisabled = () => {
+    throw new Error("entwurf: cortex-acp-disabled: Cortex ACP is not supported");
+};
+/** Retained exported shape refuses the retired adapter before a launch or overlay can be made. */
+export const cortexAdapter = {
+    ...retiredCortexAdapter,
+    routeModel: () => undefined,
+    curatedModels: () => [],
+    resolveAdapterSettings: cortexDisabled,
+    resolveLaunch: cortexDisabled,
+    launchEnvDefaults: cortexDisabled,
+    ensureOverlay: cortexDisabled,
+    loadCarrier: cortexDisabled,
+    buildSessionMeta: cortexDisabled,
+    enforceModel: cortexDisabled,
+    configSignatureFields: cortexDisabled,
+};
+const ADAPTERS = [claudeAdapter];
+/** A declared backend is only a guard, never a replacement routing authority. */
+export function assertSupportedDeclaredBackend(backend) {
+    if (backend?.toLowerCase() === "cortex")
+        cortexDisabled();
+}
 /**
  * Resolve the backend adapter that owns `modelId`.
  *
@@ -385,6 +458,9 @@ const ADAPTERS = [claudeAdapter, cortexAdapter];
  * so callers get `{ adapter, nativeModelId }` and never re-parse the id string.
  */
 export function resolveAcpBackendAdapter(modelId) {
+    if (modelId.toLowerCase().startsWith(CORTEX_MODEL_PREFIX)) {
+        throw new Error(`entwurf: cortex-acp-disabled: ${JSON.stringify(modelId)} is not supported`);
+    }
     const matches = [];
     for (const adapter of ADAPTERS) {
         const routed = adapter.routeModel(modelId);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/config.js

@@ -16,15 +16,10 @@
 //
 // The COMMON keys parsed here are Claude-SHAPED by origin (tools / permissionAllow /
 // disallowedTools / settingSources / skillPlugins are claude-agent-acp's surface).
-// What varies per backend is whether they are PROJECTED ONTO THE BACKEND SESSION —
-// not whether they are read at all. Cortex runs native tools and reaches MCP through
-// its own overlay mcp.json projection, so none of those keys shape a cortex session;
-// they nonetheless stay live on the common path, where backend.ts reads `tools` for
-// the backend-invariant exclude-tools preflight and folds every one of them into
-// `bridgeConfigSignature` (so changing one still invalidates a reused cortex
-// session). Backend-OWNED settings never land here: they ride the opaque
-// `adapterSettings` seam (rail “Adapter contract”), which is what keeps a backend-named key like
-// `cortexConnection` off this common shape.
+// The common path reads `tools` for the backend-invariant exclude-tools preflight
+// and folds these keys into `bridgeConfigSignature`. Backend-owned settings ride
+// the opaque `adapterSettings` seam. A dormant `cortexConnection` does not select
+// or enable Cortex ACP, which is disabled.
 //
 // PURITY / SIGNATURE contract (NEXT oracle C / 핀1 / GPT `…2f9325` boost):
 //   - `normalizeMcpServers` is pure: a SORTED, validated server list + a sha256

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/context.js

@@ -57,6 +57,17 @@ function textFromAssistantContent(content) {
         .map((c) => c.text)
         .join(""));
 }
+/**
+ * The harness fact pi already holds about an assistant turn that was cut
+ * (`stopReason: "aborted"` — an operator abort, or a vendor `cancelled` mapped to it; the line
+ * names no cause), stated so a NEW session's transcript does not read a
+ * cancelled turn as a clean refusal (#142: a fresh session concluded a command had
+ * not run when its first effect was on disk). It adds no claim about what did or
+ * did not happen — only that the turn was cut and that a cut is not a rollback.
+ * Only the full transcript carries it: a reused session already holds its own
+ * record of the interruption and receives just the latest user delta.
+ */
+export const ABORTED_TURN_STATUS = "[turn status: aborted — actions this turn had started may already have taken effect; cancellation is not rollback]";
 /** Render one pi message as a transcript line, or undefined to skip it. */
 function renderMessage(message) {
     switch (message.role) {
@@ -66,6 +77,10 @@ function renderMessage(message) {
         }
         case "assistant": {
             const text = textFromAssistantContent(message.content).trim();
+            if (message.stopReason === "aborted") {
+                // Kept even when the cut turn left no text: the cut itself is the fact.
+                return text ? `Assistant: ${text}\n${ABORTED_TURN_STATUS}` : `Assistant: ${ABORTED_TURN_STATUS}`;
+            }
             return text ? `Assistant: ${text}` : undefined;
         }
         case "toolResult": {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/model-ids.js

@@ -12,12 +12,9 @@
 // would need a `.ts` specifier the root config cannot allow.
 //
 // WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
-// case-insensitive substring match among the provider's rows and prefers the
-// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
-// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
-// silently open on the Snowflake Cortex rail instead of the Claude subscription.
-// An exact match against this list is the only admission; nothing is aliased,
-// substituted or rewritten.
+// case-insensitive substring match among provider rows. The old multi-backend
+// surface could silently match a retired Claude id to a Cortex row. Cortex is
+// now disabled; exact membership remains the admission, with no substitution.
 /** The single ACP provider id under which every curated row is registered. */
 export const PROVIDER_ID = "entwurf";
 // The curated Claude ids. Adding one here is a commitment to verify it across
@@ -26,20 +23,21 @@ export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
     "claude-sonnet-5-5",
     "claude-opus-5-5",
     "claude-fable-5-1",
+    "claude-fable-5-2",
 ]);
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
-// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
-// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+// These former IDs are retained only as historical refusal inputs. The prefix
+// is reserved so a disabled Cortex request never falls through to Claude.
 export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+export const LEGACY_CORTEX_MODEL_IDS = /** @type {const} */ ([
     "cortex-auto",
     "cortex-claude-opus-5",
     "cortex-claude-sonnet-5",
     "cortex-openai-gpt-5.4",
 ]);
 /** @type {ReadonlySet<string>} */
-const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+const CURATED_ACP_MODEL_IDS = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
 /**
  * Exact membership only — no trim, no case folding, no prefix.
  * @param {string} model
@@ -51,8 +49,7 @@ export function isCuratedAcpModelId(model) {
 /** The named refusal both launch seams answer with. */
 export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curated");
 export const ACP_MODEL_NOT_CURATED_HINT = `an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
-    "Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
-    "so nothing was opened, and nothing is aliased or rewritten";
+    "Cortex ACP is disabled; Pi may otherwise pick another row by substring, so nothing was opened and nothing is aliased or rewritten";
 /** Carries `reason` so callers match a FIELD, never the wording. */
 export class AcpModelNotCuratedError extends Error {
     /** @param {string} model */