fix(review): address PR #1681 feedback (acp.active accuracy + FNXC comments)

- Greptile P2: `acp.active` now reflects the ACTUAL dispatch determinant
  (FUSION_CLAUDE_ACP, which includes the operator force-override), not the
  experimental flag alone — so the status isn't misleading when forced on/off.
- CodeRabbit/Greptile P2: add FNXC:ClaudeAcp comments to the new code blocks
  per the AGENTS.md greppable-comment convention.

Already fixed in the prior commit (daa37d08c): the P1 "sticky env" / latch
(applyClaudeAcpEnable now recomputes each call + FUSION_CLAUDE_ACP_FORCE
override) and the enable->disable-on-same-env regression test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/dashboard/src/routes/register-auth-routes.ts

@@ -603,6 +603,12 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => {
       const acpBridgeAvailable =
         typeof process.env.FUSION_CLAUDE_ACP_BRIDGE === "string" &&
         process.env.FUSION_CLAUDE_ACP_BRIDGE.length > 0;
+      // FNXC:ClaudeAcp 2026-06-15-11:40:
+      // `active` must reflect the ACTUAL dispatch determinant — FUSION_CLAUDE_ACP
+      // (set by applyClaudeAcpEnable from the flag OR the operator force-override),
+      // not the flag alone — so the status isn't misleading when an operator forces
+      // it on/off.
+      const acpEnvOn = process.env.FUSION_CLAUDE_ACP === "1";
       // R17: the driver writes this signal when a turn comes back "Not logged in"
       // (the bridged `claude` can't authenticate). Surface it so the UI can offer
       // fall-back-to-`-p` or fix-auth. Path matches ACP_BRIDGE_AUTH_SIGNAL_PATH.
@@ -628,7 +634,7 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => {
         acp: {
           enabled: acpEnabled,
           bridgeAvailable: acpBridgeAvailable,
-          active: enabled && acpEnabled && acpBridgeAvailable,
+          active: enabled && acpBridgeAvailable && acpEnvOn,
           authFailed: acpAuthFailed,
           authReason: acpAuthReason,
         },

packages/engine/src/claude-acp-enable.ts

@@ -1,4 +1,5 @@
 /**
+ * FNXC:ClaudeAcp 2026-06-15-11:40:
  * Route A enable resolution (experimental, DEFAULT ON).
  *
  * The `pi-claude-cli` provider drives Claude through the `claude-code-cli-acp`

packages/pi-claude-cli/src/acp-driver.ts

@@ -79,6 +79,7 @@ const MAX_TURN_CHARS = 5_000_000;
 const MAX_ID_CHARS = 256;
 
 /**
+ * FNXC:ClaudeAcp 2026-06-15-11:40:
  * Cross-process signal for the dashboard: when the bridged `claude` can't
  * authenticate (R17 — e.g. a detached daemon with no keychain), the turn comes
  * back as "Not logged in · Please run /login" instead of a real answer. We

plugins/fusion-plugin-acp-runtime/src/index.ts

@@ -49,6 +49,7 @@ const plugin: FusionPlugin = definePlugin({
             "will be auto-approved under an allow-all policy. Prefer an approval-required policy.",
         );
       }
+      // FNXC:ClaudeAcp 2026-06-15-11:40:
       // KTD10 (Route A): publish the bundled `claude-code-cli-acp` bridge path
       // process-wide so the pi-claude-cli provider's kill-switch can resolve it
       // WITHOUT a manual FUSION_CLAUDE_ACP_BRIDGE env var. This only PUBLISHES the