@junghanacs/entwurf 0.15.0 → 0.16.0

package/pi-extensions/lib/meta-session.ts

@@ -81,7 +81,7 @@ export class MetaRecordError extends Error {
  * every write, including its own. `./run.sh doctor-meta-bridge` already flags a
  * stale deployed writer — run it after the change.
  */
-export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot"] as const;
+export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp"] as const;
 export type MetaBackend = (typeof META_BACKENDS)[number];
 
 /**
@@ -170,6 +170,58 @@ export const META_BACKEND_DESCRIPTORS: Record<MetaBackend, MetaBackendDescriptor
 		deliveryLevel: "D6",
 		nativeIdLabel: "sessionId",
 	},
+	// SELF-FETCH citizen since #87 bundle B (oh-my-pi v18.0.0). An omp "hook" is an
+	// in-process EXTENSION (`--hook` aliases `--extension`), so BOTH units run inside the
+	// omp host: the birth unit mints on `session_start`/`session_switch`, and the receiver
+	// unit arms a mailbox watch in the same process and rings the doorbell.
+	//   self-fetch  The doorbell announces and the model drains its own inbox with
+	//             `entwurf_inbox_read` — that read is the receipt, and the notice never
+	//             carries the body. `[LIVE 2026-08-30, oracle, omp 18.0.0]` the vendor's
+	//             own wake surface was measured rather than inherited:
+	//             `pi.sendUserMessage(text,{deliverAs:"user"})` (on the FACTORY object, not
+	//             the event ctx) called on an IDLE tui session with zero typing started a
+	//             real turn — `agent_start` +31ms, `turn_start` +64ms, `turn_end` +2.45s,
+	//             model reply in the transcript. It was `direct-inject` while no process
+	//             held a watch; that label was the honest "not a drainable mailbox" bucket,
+	//             and it stopped being true when the receiver unit landed.
+	//             Replyability is still a fact about a LIVE marker, never a constant of this
+	//             backend: with no armed receiver every dispatch is refused
+	//             `mailbox-undeliverable`, which is exactly what an omp host with the birth
+	//             unit and no receiver unit still gets.
+	//   D6        the PRODUCT grade, earned by the LIVE roundtrip of 2026-08-30 on oracle
+	//             (omp 18.0.0). The code landing was NOT the evidence — this number moved
+	//             when the receipt did (`adding-a-harness.md` step 8(c)):
+	//             garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` /
+	//             `lastReadAt 05:08:23.958Z`, doorbell rung on an idle session with zero
+	//             typing, and the citizen's OWN transcript carrying
+	//             `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id — the join
+	//             that makes the drain a fact about THAT session rather than about the clock.
+	//             D3 is PROVEN here rather than pending: with two live omp citizens armed
+	//             (pids 3154765 / 3154835) a single addressed enqueue rang exactly one
+	//             doorbell, and the sibling persisted no transcript and kept an empty
+	//             mailbox. That is the cell the Copilot row still lists as PENDING.
+	//             D7 is PARTIAL, deliberately: `lastReadAt` is observable without scraping,
+	//             but the reply itself is only visible in the transcript, and no completion
+	//             taxonomy or long-haul operation was measured.
+	//             D8 is PARTIAL: fresh-only ring (dedupe), `/new` unarm, watch-error unarm,
+	//             vanished-signal unarm and the identity-guarded teardown are implemented and
+	//             pinned hermetically by `check-omp-receive-arm`; ordering under load, loop
+	//             guards and crash recovery are not measured.
+	//             Replyability stays a fact about a LIVE marker: with no armed receiver every
+	//             dispatch is still refused `mailbox-undeliverable` — re-proved on the same
+	//             day against a garden id whose session had just been replaced by `/new`.
+	//   sessionId the native join key: `ReadonlySessionManager.getSessionId()`
+	//             (`session-manager.ts:1946-1948`), a UUIDv7 minted at
+	//             `mintSessionId()` `:95-97` — NOT the transcript filename, which is
+	//             `<iso>_<uuidv7>.jsonl` (`:1134-1137`). Measured LIVE 2026-08-27:
+	//             host `01a042da-537a-7770-a275-7b8162eecca4`
+	//             (`scripts/raw-omp-measure/README.md` M1).
+	omp: {
+		backend: "omp",
+		wakeMode: "self-fetch",
+		deliveryLevel: "D6",
+		nativeIdLabel: "sessionId",
+	},
 };
 
 // ---------------------------------------------------------------------------
@@ -253,7 +305,7 @@ function isoNow(now: Date): string {
 export const META_SCHEMA_VERSION_V3 = 3 as const;
 
 /** Every backend admitted by the one V3 record-citizen schema. */
-export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "pi"] as const;
+export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi"] as const;
 export type MetaCitizenBackend = (typeof META_CITIZEN_BACKENDS)[number];
 
 /**
@@ -1234,12 +1286,16 @@ export function decideUpsert(
 // stays strip-types clean (see module header for why this is not a sibling file).
 // ---------------------------------------------------------------------------
 
-function expandTilde(p: string): string {
-	if (p === "~") return os.homedir();
-	if (p.startsWith("~/")) return path.join(os.homedir(), p.slice(2));
+function expandTildeIn(p: string, home: string): string {
+	if (p === "~") return home;
+	if (p.startsWith("~/")) return path.join(home, p.slice(2));
 	return p;
 }
 
+function expandTilde(p: string): string {
+	return expandTildeIn(p, os.homedir());
+}
+
 /**
  * The pi agent dir — the persistence root pi owns. `PI_CODING_AGENT_DIR` lets an
  * isolated install / test relocate it (symmetric with how pi's own sessions
@@ -1320,6 +1376,164 @@ export function defaultMetaReceiversDir(): string {
 	return path.join(piAgentDir(), "meta-receivers");
 }
 
+// ---------------------------------------------------------------------------
+// OMP meta-root policy (#87 B1) — ADDITIVE, and only for backend `omp`.
+//
+// THE COLLISION THIS CLOSES. `PI_CODING_AGENT_DIR` has two owners. To entwurf it
+// means "pi's persistence root", and `piAgentDir()` above derives all four garden
+// roots from it. To the OMP vendor it means "my agent dir": `setProfile` exports it
+// in-process for every named profile (`oh-my-pi` v18.0.0 `packages/utils/src/dirs.ts:452-473`,
+// reached from `cli.ts:342-360`), so a plain `omp --profile work` sets it. An OMP
+// birth that resolved its roots through `piAgentDir()` would therefore mint its record
+// and marker into a DIFFERENT garden store — and if the value came from a pi sandbox,
+// into that sandbox. Record-authority violation (Hard Rules 2 and 7), reachable on an
+// ordinary vendor workflow rather than an exotic one.
+//
+// WHY A BUNDLE OF FOUR AND NOT TWO. Splitting mailbox from receivers is the dangerous
+// cell: dispatch can trust an armed receiver marker in one root and enqueue into the
+// mailbox of the other while the real watcher drains the first — FALSE DELIVERABILITY.
+// So the four move together or not at all. Birth (bundle A) writes only sessions and
+// senders; receive (bundle B) consumes mailbox and receivers from this same object.
+//
+// WHAT IT DELIBERATELY DOES NOT DO. It does not change `piAgentDir()` or any
+// `defaultMeta*Dir()` — every existing backend keeps byte-identical behaviour, and pi's
+// own sandboxing still relocates through `PI_CODING_AGENT_DIR`. It honours the four
+// entwurf-owned `ENTWURF_META_*_DIR` overrides INDEPENDENTLY, so Hard Rule 12 sandboxing
+// stays usable. It bakes no absolute path into any record, marker, install-state or MCP
+// entry, and it introduces no new authority carrier: the roots are computed, never stored.
+// ---------------------------------------------------------------------------
+
+/** The four Entwurf-owned meta roots, resolved as ONE indivisible bundle. */
+export interface MetaRootBundle {
+	sessionsDir: string;
+	mailboxDir: string;
+	sendersDir: string;
+	receiversDir: string;
+}
+
+/** The env shape these pure resolvers read. `process.env` satisfies it. */
+export type MetaRootEnv = Record<string, string | undefined>;
+
+/**
+ * The exact provenance label the omp-native MCP entry carries
+ * (`scripts/omp-mcp-config.py` `EXTERNAL_AGENT_ID`). It is what lets a bridge CHILD know
+ * it is an OMP child — the same string both sides pin, never re-spelled.
+ */
+export const OMP_BRIDGE_PROVENANCE_LABEL = "external-mcp/omp";
+
+/** `HOME` as the process that owns this env sees it; `os.homedir()` returns exactly this
+ * on POSIX when HOME is set, so a real process and a composed child env agree. */
+function metaRootHome(env: MetaRootEnv): string {
+	const home = env.HOME;
+	return home !== undefined && home.length > 0 ? home : os.homedir();
+}
+
+/**
+ * THE shared OMP root policy — one pure function, two consumers (the in-process birth
+ * extension and the OMP-labeled bridge child). Agreement is by CONSTRUCTION, not by two
+ * places computing the same thing: both read this leaf, and both see the same HOME and the
+ * same four overrides because the vendor composes the child env as parent + entry env
+ * (`oh-my-pi` `packages/coding-agent/src/mcp/transports/stdio.ts:575-607`) and that entry
+ * env is provenance-only.
+ */
+export class MetaRootPolicyError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "MetaRootPolicyError";
+	}
+}
+
+/**
+ * The unambiguous base the OMP bundle hangs off when no override is set. Separate from
+ * {@link ompMetaRoots} because it must NEVER throw: the hook log is a diagnostic, and a
+ * policy refusal still has to be visible somewhere.
+ */
+export function ompMetaRootBase(env: MetaRootEnv = process.env, home: string = metaRootHome(env)): string {
+	// NEVER `piAgentDir()` here: for backend omp that variable is the VENDOR's agent dir.
+	return path.join(home, ".pi", "agent");
+}
+
+/**
+ * THE OVERRIDE GRAMMAR IS NARROW ON PURPOSE: absolute, or `~` / `~/…`. Anything else —
+ * a relative path, or `~user` — is a NAMED REFUSAL, not a resolution.
+ *
+ * Why fail closed rather than resolve: this bundle has to mean the same thing in two
+ * processes that do not share a working directory. `path.resolve` on a relative value
+ * silently makes CWD an authority, and the OMP extension's cwd is whatever the operator
+ * launched omp from while the doctor's is the repository (`run_ts` cd's there). `[측정]`
+ * the same `ENTWURF_META_SESSIONS_DIR=relative-records` resolved to two different stores
+ * that way, so the doctor could report NOT-YET off an empty directory while the extension's
+ * real store held records (#87 A2, Terra review). Refusing is what keeps cwd from becoming
+ * a garden-root carrier. `~` is allowed because it expands from HOME, which both halves
+ * share by construction.
+ *
+ * The refusal is shared: extension and OMP-labeled bridge child both reach it through this
+ * one leaf, so neither can proceed on a value the other would read differently.
+ */
+export function ompMetaRoots(env: MetaRootEnv = process.env, home: string = metaRootHome(env)): MetaRootBundle {
+	const base = ompMetaRootBase(env, home);
+	const surface = (key: string, leaf: string): string => {
+		const override = env[key];
+		if (override === undefined || override === "") return path.join(base, leaf);
+		if (override === "~" || override.startsWith("~/")) return path.resolve(expandTildeIn(override, home));
+		if (path.isAbsolute(override)) return path.resolve(override);
+		throw new MetaRootPolicyError(
+			`omp meta-root policy refuses ${key}=${JSON.stringify(override)}: a garden root must be absolute or ~-rooted ` +
+				"(`~` or `~/…`). A relative value would resolve against each process's own working directory, and the omp " +
+				"extension and its doctor do not share one — set an absolute path, or unset it to use the default under HOME.",
+		);
+	};
+	return {
+		sessionsDir: surface("ENTWURF_META_SESSIONS_DIR", "meta-sessions"),
+		mailboxDir: surface("ENTWURF_META_MAILBOX_DIR", "meta-mailbox"),
+		sendersDir: surface("ENTWURF_META_SENDERS_DIR", "meta-senders"),
+		receiversDir: surface("ENTWURF_META_RECEIVERS_DIR", "meta-receivers"),
+	};
+}
+
+/**
+ * The bridge CHILD half of the same policy, applied to that child's own environment.
+ *
+ * A bridge child selects this by the exact provenance label its managed entry carries —
+ * no probing, no guessing, and no effect on any other harness's child. It then does two
+ * things, in this order and before any lazy default-root consumer has run:
+ *
+ *   1. removes the foreign `PI_CODING_AGENT_DIR` from THIS PROCESS only. The OMP HOST
+ *      keeps it — there it is the vendor's own agent dir and deleting it would rewrite
+ *      vendor path semantics — but the child has no vendor lookup left to do.
+ *   2. pins the four `ENTWURF_META_*_DIR` overrides to this leaf's answer, so every
+ *      `defaultMeta*Dir()` consumer in the bridge reads the OMP bundle literally rather
+ *      than recomputing something that merely happens to match. Idempotent: an override
+ *      the operator already set was honoured by the leaf and is written back unchanged.
+ *
+ * These four are entwurf's OWN documented override vocabulary, set in our own process —
+ * not a new carrier, not a record field, not a marker.
+ *
+ * The in-process birth extension cannot use this and must not try: it runs INSIDE the omp
+ * host, so mutating that process's env is exactly the thing forbidden above. It passes
+ * explicit directories from {@link ompMetaRoots} instead.
+ */
+export function applyOmpBridgeChildRootPolicy(
+	env: MetaRootEnv = process.env,
+	home?: string,
+): { applied: boolean; roots: MetaRootBundle | null } {
+	// EXACT equality on the RAW label (#87 A3). Trimming was a courtesy that let a
+	// whitespace-drifted entry — one `doctor-omp-mcp` and the writer both call foreign —
+	// still select OMP root mutation in its child. The writer emits the literal and the
+	// doctor compares the literal; this compares the literal too, so all three agree on
+	// what "our entry" means.
+	if (env.ENTWURF_BRIDGE_EXTERNAL_AGENT_ID !== OMP_BRIDGE_PROVENANCE_LABEL) {
+		return { applied: false, roots: null };
+	}
+	const roots = ompMetaRoots(env, home ?? metaRootHome(env));
+	delete env.PI_CODING_AGENT_DIR;
+	env.ENTWURF_META_SESSIONS_DIR = roots.sessionsDir;
+	env.ENTWURF_META_MAILBOX_DIR = roots.mailboxDir;
+	env.ENTWURF_META_SENDERS_DIR = roots.sendersDir;
+	env.ENTWURF_META_RECEIVERS_DIR = roots.receiversDir;
+	return { applied: true, roots };
+}
+
 /**
  * A boot-unique identity for a live process: pid is reused, but pid + start-time
  * is unique within a boot. Linux reads `/proc/<pid>/stat` field 22 (starttime in

package/pi-extensions/lib/mux-fresh-call.ts

@@ -70,10 +70,14 @@ import {
 	runTmux,
 	type WindowHandle,
 } from "./mux-placement.ts";
+import { OMP_PREFLIGHT_HINT, type OmpPreflightRejectReason, ompFreshPreflight } from "./omp-fresh-preflight.ts";
 
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot"] as const;
+ * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract, and
+ * `omp` by #87 Bundle C under the same one. The set is joined to the citizen backends by
+ * `check-harness-admission-parity`: a harness that mints records but is missing HERE is not an
+ * unwired convenience, it is a release blocker. */
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp"] as const;
 export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
 
 /**
@@ -89,11 +93,20 @@ export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
  * flag, its recursion fence and its receiver precondition; fresh call reaches Copilot only
  * through it. The cost is named: a Copilot fresh call needs a current `entwurf` on PATH, the
  * way a pi fresh call needs `pi`.
+ *
+ * `omp` resolves the BARE vendor, and that difference is a measured one rather than an
+ * inconsistency. Copilot needs a managed wrapper because the bare CLI starts without
+ * `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` and skips its extension scan silently — there
+ * is a flag only a launcher can carry. omp has no such flag: it always scans its extensions
+ * directory, and the one thing it needs beyond that (`tools.xdev: false`) lives in the operator
+ * config, which is a PREFLIGHT fact and not something a launcher could supply. Inventing an
+ * `entwurf omp` verb here would add a managed surface with nothing to manage.
  */
 export const FRESH_CALL_RUNTIME: Record<FreshCallBackend, string> = {
 	pi: "pi",
 	"claude-code": "claude",
 	copilot: "entwurf",
+	omp: "omp",
 };
 
 /**
@@ -107,11 +120,21 @@ export const FRESH_CALL_RUNTIME: Record<FreshCallBackend, string> = {
  * `tool.execution_start.toolName` both carry `entwurf-bridge-entwurf_v2`, with
  * `mcpServerName`/`mcpToolName` beside them as the parts. Derive-and-measure, never copy a
  * sibling's spelling (`docs/adding-a-harness.md` step 5).
+ *
+ * `[측정]` omp 18.0.0 is the sharpest case for that rule: it mints
+ * `mcp__${sanitizedServerName}_${normalizedToolName}` with a sanitizer whose charset is
+ * `[a-z_]` (`mcp/tool-bridge.ts:351-357`, `:396`), so the DIGIT IN `entwurf_v2` IS EATEN and the
+ * hyphen in the server key becomes an underscore — the model-facing name is
+ * `mcp__entwurf_bridge_entwurf_v`, not `..._entwurf_v2` and not Claude's double-underscore form.
+ * Confirmed against a live tool dump of all seven bridge tools and a real session transcript
+ * (`scripts/raw-omp-measure/README.md` "Tool-name dialect"). Unlike Copilot there is no second
+ * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
  */
 export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
 	pi: "entwurf_v2",
 	"claude-code": "mcp__entwurf-bridge__entwurf_v2",
 	copilot: "entwurf-bridge-entwurf_v2",
+	omp: "mcp__entwurf_bridge_entwurf_v",
 };
 
 /** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
@@ -119,7 +142,7 @@ export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
  * that the OS refuses is a launch failure and fails loud — it never reads as a delivered task. */
 export const TASK_MAX_CHARS = 16000;
 export const MODEL_MAX_CHARS = 200;
-const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/;
+const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/:[\]-]*$/;
 
 /** A model is an explicit launch input, not ambient process state. The grammar admits canonical
  * pi provider/model ids, Claude model ids/aliases, and bracketed context variants, while refusing
@@ -140,6 +163,11 @@ export function isSafeFreshCallModel(model: string): boolean {
  *   copilot     — the managed VERB first, then the prompt as the value of `-i/--interactive`,
  *                 `--model`, value as two tokens, and the policy as the explicit `--yolo`
  *                 token. Measured from `copilot --help` (1.0.80).
+ *   omp         — NO positional prompt at all. The task rides `--entwurf-bootstrap`, a fixed
+ *                 flag the installed birth extension registers, then `--model`, value as two
+ *                 tokens, then the policy as `--approval-mode`, `yolo`. `-p/--print` remains
+ *                 the flag this argv must never carry — it processes a prompt and EXITS,
+ *                 closing the window on a sibling that has to stay open to be delivered to.
  *
  * Both pi/claude failures looked identical from outside: window open, record and socket minted,
  * no turn.
@@ -172,18 +200,108 @@ export function isSafeFreshCallModel(model: string): boolean {
  * `--allow-tool` takes `<mcp-server-name>(tool-name?)`, a different dialect from the
  * model-facing tool name — stays recorded in `docs/adding-a-harness.md` step 9's worked
  * example; it is a measured vendor fact even though this argv no longer uses it.
+ *
+ * OMP'S POLICY TOKEN IS THE ONE MOST EASILY ARGUED AWAY, SO READ THIS BEFORE DELETING IT.
+ * `[측정]` omp 18.0.0's schema default for `tools.approvalMode` IS ALREADY `yolo`
+ * (vendor doc `omp://approval-mode.md`; `omp config get tools.approvalMode` → `yolo` on the
+ * acceptance host). So dropping `--approval-mode yolo` changes NOTHING observable: the callback
+ * still fires, the LIVE smoke still passes, and the argv silently starts depending on a vendor
+ * default and on whatever the operator's config happens to say. That is exactly the drift step 9
+ * clause 2 forbids — "carry the chosen width as an explicit argv token rather than relying on a
+ * launcher's injected default" — and the reason the width is stated here even though the host
+ * would have granted it anyway. The width itself (task-wide, not callback-only) is a GLG
+ * operator decision of 2026-08-30, taken with the Copilot measurement in hand: a callback-only
+ * sibling names itself and then stops at the first tool its TASK needs. omp offers no argv
+ * grammar for a narrower grant at all — `tools.approval.<tool>` is a config axis, not a flag —
+ * so the honest choice was between `write` and `yolo`, and `yolo` matches what a human-typed
+ * `omp` gets on this host. `--approval-mode` takes both the space and equals form (measured);
+ * the space form is used for symmetry with `--model`.
+ *
+ * WHY OMP ALONE CARRIES NO PROMPT, AND WHY THAT IS A MEASUREMENT RATHER THAN A PREFERENCE.
+ * `[LIVE 2026-08-30]` the first public fresh call at omp DID pass the full framing as a bare
+ * positional. The window opened, the record minted (garden `20260830T181342-452167`), the
+ * prompt arrived byte-identical as a user message at `09:13:42.413Z` — and the model answered
+ * the literal text `ACK` with ZERO tool calls, because the callback tool did not exist yet.
+ * `[source]` the interactive UI defers MCP discovery and only refreshes the tool list once
+ * `discoverAndConnect()` settles (`sdk.ts:1847-1855`, `:1881-1905`), while the positional
+ * `initialMessage` prompts immediately after `await mode.init()` (`main.ts:540-565`,
+ * `595-610`). `[측정]` a `/tmp` observer on the same runtime: `turn_start` at +654ms with the
+ * entwurf tools ABSENT, callback tool present only at +1484ms — the turn began ~830ms before
+ * the tool it was told to call existed. No argv can close that gap, because the gap is a race
+ * inside the host. So the composition hands omp a PAYLOAD instead of a turn, and the
+ * in-process birth extension — which can see when the tool becomes callable — owns the first
+ * two messages (`pi-extensions/meta-bridge-omp.ts`, "THE TWO-STAGE FRESH BOOTSTRAP").
+ *
+ * The flag is fixed and one-purpose ON PURPOSE. `[측정 2026-08-30]` a normal discovered
+ * extension that registers a flag receives the operator's argv value byte-identical — quotes,
+ * `$VAR`, backticks and a semicolon all survived a 137-byte JSON payload — because extensions
+ * load before argv classification and the reparse writes the registered map
+ * (`main.ts:1799-1810`, `cli/extension-flags.ts:36-43`). An env carrier or a temp file would
+ * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
+ * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
+ * carrier would hand callers the launch-shaping power this rail exists to refuse.
  */
-export function buildBackendArgs(backend: FreshCallBackend, prompt: string, model: string): string[] {
+export function buildBackendArgs(
+	backend: FreshCallBackend,
+	composition: FreshCallComposition,
+	model: string,
+): string[] {
 	switch (backend) {
 		case "pi":
-			return [prompt, "--entwurf-control", "--model", model];
+			return [composition.prompt, "--entwurf-control", "--model", model];
 		case "claude-code":
-			return [prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
+			return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
 		case "copilot":
-			return ["copilot", "--interactive", prompt, "--model", model, "--yolo"];
+			return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
+		case "omp":
+			return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
 	}
 }
 
+/**
+ * What a launch has to say, in the two shapes the four backends need. Three of them are
+ * handed a first-turn PROMPT; omp is handed a bootstrap PAYLOAD its own installed extension
+ * unpacks. Both are always built, because building one is cheap and a backend switch must
+ * never be able to reach a field that was not composed.
+ */
+export interface FreshCallComposition {
+	prompt: string;
+	bootstrapPayload: string;
+}
+
+/**
+ * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
+ * name (`extensions/loader.ts:221-228`) and this composition adds the `--` itself.
+ *
+ * Held equal to the installed extension's own constant by
+ * `test/omp-fresh-bootstrap.contract.test.ts`. The two copies exist because the extension
+ * ships INSIDE the omp agent dir carrying only its own small closure and cannot import this
+ * module; the gate is what keeps the duplication from becoming drift.
+ */
+export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
+
+/** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
+ * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
+export const OMP_BOOTSTRAP_VERSION = 1;
+
+/**
+ * The whole of what a fresh omp sibling is launched with.
+ *
+ * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
+ * contract: who to call back, the nonce that proves it is this call, and the task that is
+ * released only after that callback succeeds. There is no command here, no path, no env name
+ * and no model — the model is already an explicit argv token, and a second copy of it inside
+ * a payload would be a second place for it to disagree with the launch.
+ */
+export function buildOmpBootstrapPayload(params: { callerGardenId: string; nonce: string; task: string }): string {
+	return JSON.stringify({
+		v: OMP_BOOTSTRAP_VERSION,
+		target: params.callerGardenId,
+		nonce: params.nonce,
+		task: params.task,
+	});
+}
+
 /**
  * The first-turn framing. Order is the contract: the callback is the FIRST action and the task
  * follows it, so a sibling that gets stuck in the task has already told the caller who it is.
@@ -224,6 +342,7 @@ export type FreshCallRejectReason =
 	| LaunchRejectReason
 	| TmuxCwdRejectReason
 	| CopilotPreflightRejectReason
+	| OmpPreflightRejectReason
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -256,9 +375,35 @@ function defaultRandomHex(): string {
 	return randomBytes(12).toString("hex");
 }
 
-/** Launch argv: the leaf's detached-append shape, optionally `-c` at the resume-symmetric token
- * position (after `-t`, before `-P -F`), the runtime, then the backend's dialect. An omitted cwd
- * yields the exact pre-#73 argv — no carrier at all. */
+/**
+ * The pi identity carrier, scrubbed at the launch seam for EVERY backend (#87 Bundle C).
+ *
+ * `[측정]` 2026-08-30, private tmux server: a `new-window` pane inherits the tmux SERVER's
+ * environment, not the caller's. A server started from a shell that exported `PI_SESSION_ID`
+ * hands that value to every window it will ever open — the control run printed
+ * `SID=[leaked-uuid]` in a pane the caller never touched. Nothing about the fresh call creates
+ * that leak and nothing about it notices: the sibling's own MCP child would read the STALE pair
+ * as its authoritative identity and call home as a citizen it is not (`mcp/entwurf-bridge/
+ * src/index.ts:692-698` keeps the measured incident — a fresh cell answering with the uuidv7 it
+ * found in the environment, confidently and wrong).
+ *
+ * `-e VAR=` sets the variable EMPTY rather than unsetting it, which tmux has no per-window form
+ * for. That is sufficient and not a compromise: every reader of the carrier trims and tests
+ * truthiness (`index.ts:212-217`), so empty and absent are the same answer by construction.
+ *
+ * It is applied to all four backends because the leak is a property of tmux, not of a vendor. A
+ * scrub only on the backend whose measurement surfaced it would encode the claim that the other
+ * three are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
+ * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
+ * exactly that after this argv has run. This is a fixed two-variable seam and deliberately NOT a
+ * general env carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping
+ * power this rail exists to refuse.
+ */
+const SCRUBBED_INHERITED_ENV = ["PI_SESSION_ID=", "PI_AGENT_ID="] as const;
+
+/** Launch argv: the leaf's detached-append shape, the identity scrub, optionally `-c` at the
+ * resume-symmetric token position (after `-t`, before `-P -F`), the runtime, then the backend's
+ * dialect. An omitted cwd adds no `-c` carrier at all. */
 export function buildFreshCallArgs(
 	placement: Placement,
 	runtimePath: string,
@@ -275,6 +420,7 @@ export function buildFreshCallArgs(
 		"new-window",
 		"-d",
 		"-a",
+		...SCRUBBED_INHERITED_ENV.flatMap((assignment) => ["-e", assignment]),
 		"-t",
 		`${placement.sessionId}:{end}`,
 		...(cwd === undefined ? [] : ["-c", cwd]),
@@ -337,20 +483,27 @@ export function freshCall(
 		const missing = copilotFreshPreflight(env);
 		if (missing) return { ok: false, reason: missing };
 	}
+	if (params.backend === "omp") {
+		const missing = ompFreshPreflight(env);
+		if (missing) return { ok: false, reason: missing };
+	}
 
 	const inspected = inspectPlacement(env);
 	if (!inspected.ok) return { ok: false, reason: inspected.reason };
 	const placement = inspected.placement;
 	requireSameContext("freshCall", placement, env);
 
-	const prompt = buildFreshCallPrompt({
-		backend: params.backend,
-		task,
-		callerGardenId: params.callerGardenId,
-		nonce,
-	});
+	const composition: FreshCallComposition = {
+		prompt: buildFreshCallPrompt({
+			backend: params.backend,
+			task,
+			callerGardenId: params.callerGardenId,
+			nonce,
+		}),
+		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
+	};
 	const run = runTmux(
-		buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model), cwd),
+		buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, composition, model), cwd),
 		env,
 	);
 	assertTmuxOk("new-window", run);
@@ -390,6 +543,7 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	// The Copilot capability reasons keep their repair text on the leaf that decides them, so
 	// the sentence an operator reads cannot drift away from the predicate that produced it.
 	...COPILOT_PREFLIGHT_HINT,
+	...OMP_PREFLIGHT_HINT,
 	"no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
 	"anchor-malformed": "TMUX_PANE is not a native pane id",
 	"anchor-unresolved": "tmux resolved no pane for this agent's anchor",