diff --git a/dist/acp-agent.js b/dist/acp-agent.js
--- a/dist/acp-agent.js
+++ b/dist/acp-agent.js
@@ -2917,10 +2917,20 @@
                                         cost: {
                                             amount: message.total_cost_usd,
                                             currency: "USD",
                                         },
-                                        ...(message.origin && {
-                                            _meta: { "_claude/origin": message.origin },
-                                        }),
+                                        _meta: {
+                                            ...(message.origin && { "_claude/origin": message.origin }),
+                                            // ACP's core Usage shape exposes context occupancy and
+                                            // cost, but not the billable input/output split. Keep the
+                                            // SDK's bounded aggregate in extension metadata so ACPX can
+                                            // normalize it without persisting a raw provider message.
+                                            usage: {
+                                                input_tokens: message.usage.input_tokens,
+                                                output_tokens: message.usage.output_tokens,
+                                                cache_read_input_tokens: message.usage.cache_read_input_tokens,
+                                                cache_creation_input_tokens: message.usage.cache_creation_input_tokens,
+                                            },
+                                        },
                                     },
                                 });
                             }
@@ -5307,8 +5317,12 @@
         const options = {
             systemPrompt,
             settingSources: ["user", "project", "local"],
             ...(thinking !== undefined && { thinking }),
             ...userProvidedOptions,
+            // Paperclip Runner owns the complete session context. Its isolated
+            // user root contains only assigned skills; project/local settings
+            // would reintroduce host prompts, plugins, skills, and MCP servers.
+            ...(process.env.PAPERCLIP_ACPX_ISOLATED_CONTEXT === "1" && { settingSources: ["user"] }),
             ...(settings && { settings }),
             env,
             // Override certain fields that must be controlled by ACP
@@ -5317,7 +5331,9 @@
             includePartialMessages: true,
             forwardSubagentText,
             mcpServers: {
-                ...(userProvidedOptions?.mcpServers || {}),
+                ...(process.env.PAPERCLIP_ACPX_ISOLATED_CONTEXT === "1"
+                    ? {}
+                    : (userProvidedOptions?.mcpServers || {})),
                 ...mcpServers,
                 ...(fileChangeAuditSupport
                     ? { [FILE_CHANGE_AUDIT_SERVER_NAME]: fileChangeAuditSupport.mcpServer }