@junghanacs/entwurf 0.23.0 → 0.24.0

package/pi-extensions/lib/acp/backend.ts

@@ -44,8 +44,8 @@ import { type ChildProcessByStdio, spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { Readable, Writable } from "node:stream";
 import { ndJsonStream, PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
-import type { Api, AssistantMessage, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
-import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessage, Model, SimpleStreamOptions, TranscriptContext } from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream, getCurrentTools } from "@earendil-works/pi-ai";
 import {
 	type AcpClientHandlers,
 	type AcpConnectionLike,
@@ -81,7 +81,7 @@ import {
 	resolveLifecyclePolicy,
 	writeSessionRecord,
 } from "./session-store.js";
-import { assertExcludeToolsHonored, PI_BUILTIN_BACKED_TOOLS } from "./tool-surface.js";
+import { assertExcludeToolsHonored } from "./tool-surface.js";
 
 // Bootstrap boundaries ONLY. initialize / newSession / set-model are handshake
 // steps that make no model progress, so a stuck one is a dead session and a cold
@@ -137,7 +137,7 @@ function finiteOrZero(value: unknown): number {
  * "the accounting-grade figure per the SDK" — it also counts Task subagents,
  * sidechains, and INTERNAL CALLS SUCH AS COMPACTION, so its rows "can total more
  * than `token_count`" and are "the fuller picture, not a decomposition of it"
- * (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:6538-6558`). The narrower
+ * (read at claude-agent-acp 0.79.0 `dist/acp-agent.js:6551-6571`). The narrower
  * `PromptResponse.usage` (== `quota.token_count`) is the MAIN AGENT LOOP only.
  *
  * The wider one is the right numerator because the denominator already has that
@@ -1108,7 +1108,7 @@ async function applyProviderPayloadHook<T extends { sessionId: string }>(
  */
 export function streamShellAcp(
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options?: SimpleStreamOptions,
 ): ReturnType<typeof createAssistantMessageEventStream> {
 	return streamAcpTurn(model, context, options, defaultDeps());
@@ -1117,7 +1117,7 @@ export function streamShellAcp(
 /** The seam-aware turn driver. `streamShellAcp` calls this with the real deps. */
 export function streamAcpTurn(
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options: SimpleStreamOptions | undefined,
 	deps: AcpTurnDeps,
 ): ReturnType<typeof createAssistantMessageEventStream> {
@@ -1237,7 +1237,7 @@ export function streamAcpTurn(
 		// Writing zeros is not a placeholder for a better number we could compute:
 		// the per-request partition is genuinely absent from the wire. The vendor
 		// builds it in `lastAssistantUsage` and sends only its scalar sum (read at
-		// claude-agent-acp 0.76.0 `dist/acp-agent.js:3857-3882`) — #96.
+		// claude-agent-acp 0.79.0 `dist/acp-agent.js:3920-3945`) — #96.
 		//
 		// But silence is NOT the resting state. A cache miss the operator never sees
 		// is a false reading, not a modest one: a session can run for hours believing
@@ -1356,9 +1356,9 @@ export function streamAcpTurn(
 				// between them is exactly why the notice below names a MECHANISM and
 				// never a cause: claude-agent-acp's `conversation_reset` handler only
 				// switches the SDK to a fresh conversation and touches no cost at all
-				// (read at 0.76.0 `dist/acp-agent.js:4286-4293`), while claude-agent-sdk
+				// (read at 0.79.0 `dist/acp-agent.js:4349-4356`), while claude-agent-sdk
 				// separately documents that "a mid-session /clear resets the running
-				// total" (read at 0.3.257 `sdk.d.ts:4884`). A reset therefore PLAUSIBLY
+				// total" (read at 0.3.274 `sdk.d.ts:5342`). A reset therefore PLAUSIBLY
 				// explains a backwards total, but nothing here has MEASURED that it did,
 				// and asserting the cause would be the same unmeasured claim this lane
 				// exists to end.
@@ -1510,7 +1510,17 @@ export function streamAcpTurn(
 		// rather than lie to the model. Uses the RESOLVED tool surface (S2g) so an
 		// operator-narrowed `tools` is what the truthfulness check honors.
 		try {
-			const activeToolNames = context.tools?.map((t) => t.name) ?? [...PI_BUILTIN_BACKED_TOOLS];
+			// pi 0.86 folded `Context.systemPrompt`/`Context.tools` into a leading
+			// `role:"system"` message (`normalizeContext`, pi-ai
+			// `utils/transcript.ts`), so a provider only ever sees a
+			// `TranscriptContext`. The active surface is therefore REPLAYED from the
+			// system messages — `getCurrentTools` applies every toolsAdded/toolsRemoved
+			// delta in order. No `?? [...PI_BUILTIN_BACKED_TOOLS]` fallback: under 0.86
+			// the old `context.tools` read was ALWAYS undefined, so that fallback
+			// silently declared the full builtin set and the truthfulness preflight
+			// could never fire (false green). An empty replayed list means the operator
+			// excluded everything — keep that honest and let the preflight reject.
+			const activeToolNames = getCurrentTools(context.messages).map((t) => t.name);
 			assertExcludeToolsHonored(activeToolNames, { backend: adapter.backend, tools: config.tools });
 		} catch (err) {
 			finishError(err, false);

package/pi-extensions/lib/acp/context.ts

@@ -8,16 +8,26 @@
 //
 // S2c/S2d boundary (GPT S2c Q2): this is CONVERSATION TRANSCRIPT PASSTHROUGH, not
 // rich-carrier identity injection. Deliberately EXCLUDED here (all S2d):
-//   - `context.systemPrompt` — never read into the prompt or `_meta.systemPrompt`
+//   - the system prompt — never read into the prompt or `_meta.systemPrompt`
 //     (the billing carrier stays absent — NEXT §S2-scout 핀1);
 //   - `~/AGENTS.md` / cwd AGENTS / bridge identity narrative;
 //   - first-user-message augment + project-context de-dup;
-//   - `context.tools` — the ACP child tool surface is the S2b
+//   - the declared tool surface — the ACP child tool surface is the S2b
 //     `_meta.claudeCode.options` SSOT, never re-sent here.
+// Since pi 0.86 both of those ride a leading `role:"system"` message inside the
+// `TranscriptContext` (pi-ai `normalizeContext`) rather than their own `Context`
+// fields, so the exclusion is enforced by `renderMessage`'s explicit
+// `case "system"` below, not by simply not reading two fields.
 // Structured tool replay is also excluded: tool calls/results render as plain
 // transcript text, never as ACP tool invocations (the child runs its own tools).
 
-import type { AssistantMessage, Context, Message, ToolResultMessage, UserMessage } from "@earendil-works/pi-ai";
+import type {
+	AssistantMessage,
+	Message,
+	ToolResultMessage,
+	TranscriptContext,
+	UserMessage,
+} from "@earendil-works/pi-ai";
 
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
 // It is mirrored, not imported: the strip-types deterministic gates load these
@@ -80,16 +90,26 @@ function renderMessage(message: Message): string | undefined {
 			const tag = message.isError ? "Tool error" : "Tool result";
 			return text ? `${tag} (${message.toolName}): ${text}` : undefined;
 		}
+		case "system":
+			// The never-forward-systemPrompt invariant, stated rather than inherited.
+			// Since pi 0.86 the system prompt and the declared tool surface arrive AS
+			// transcript messages (`normalizeContext`), so what used to be "we simply
+			// do not read `context.systemPrompt`" is now an active decision on every
+			// turn. `default` would already skip it; the explicit case exists so
+			// deleting it is a visible change and a new pi role cannot quietly start
+			// leaking the prompt into the ACP child's transcript.
+			return undefined;
 		default:
 			return undefined;
 	}
 }
 
 /**
- * Flatten a pi Context into a single transcript string. Excludes
- * `context.systemPrompt` and `context.tools` by construction.
+ * Flatten a pi transcript into a single transcript string. Excludes the system
+ * prompt and the declared tool surface by construction — since 0.86 both ride
+ * the leading `role:"system"` message, which `renderMessage` drops explicitly.
  */
-export function contextTranscript(context: Context): string {
+export function contextTranscript(context: TranscriptContext): string {
 	const lines: string[] = [];
 	for (const message of context.messages) {
 		const line = renderMessage(message);
@@ -99,11 +119,11 @@ export function contextTranscript(context: Context): string {
 }
 
 /**
- * Convert a pi Context into the ACP `prompt` array (a single text block holding
+ * Convert a pi transcript into the ACP `prompt` array (a single text block holding
  * the flattened transcript). Empty history yields an empty array — the caller
  * decides whether that is a hard error.
  */
-export function contextToAcpPrompt(context: Context): AcpTextBlock[] {
+export function contextToAcpPrompt(context: TranscriptContext): AcpTextBlock[] {
 	const transcript = contextTranscript(context);
 	if (!transcript) return [];
 	return [{ type: "text", text: transcript }];
@@ -129,7 +149,7 @@ export type AcpBootstrapPath = "new" | "reuse" | "resume" | "load";
  * (reuse/resume/load): re-sending the whole transcript there would duplicate
  * history the backend already remembers.
  */
-export function latestUserDelta(context: Context): AcpTextBlock[] {
+export function latestUserDelta(context: TranscriptContext): AcpTextBlock[] {
 	let lastAssistantIdx = -1;
 	for (let i = context.messages.length - 1; i >= 0; i--) {
 		if (context.messages[i].role === "assistant") {
@@ -160,7 +180,7 @@ export function latestUserDelta(context: Context): AcpTextBlock[] {
  * `contextMessageSignatures` prefix-compat gate (mismatch → fall back to
  * `"new"` + full transcript); this pure function only splits the scope.
  */
-export function buildAcpPrompt(context: Context, bootstrapPath: AcpBootstrapPath): AcpTextBlock[] {
+export function buildAcpPrompt(context: TranscriptContext, bootstrapPath: AcpBootstrapPath): AcpTextBlock[] {
 	switch (bootstrapPath) {
 		case "new":
 			return contextToAcpPrompt(context);

package/pi-extensions/lib/acp/event-mapper.ts

@@ -60,8 +60,8 @@ export type AcpPiStreamState = {
 	 *
 	 * Last write wins, never a sum: both are latest session-level observations, and
 	 * one turn can legitimately see several (claude emits one per `result` message,
-	 * including a sub-agent's own — read at claude-agent-acp 0.76.0
-	 * `dist/acp-agent.js:3471-3486`), each carrying that result's current values.
+	 * including a sub-agent's own — read at claude-agent-acp 0.79.0
+	 * `dist/acp-agent.js:3504-3519`), each carrying that result's current values.
 	 */
 	observedSessionCostUsd?: number;
 	observedContextOccupancyTokens?: number;
@@ -346,9 +346,9 @@ export function applyAcpSessionUpdate(
 		case "usage_update": {
 			// `used` is OCCUPANCY-shaped — the backend's post-turn context size, not
 			// the prompt response's turn aggregate. Claude sends `lastAssistantTotalUsage`
-			// as `used` (read at claude-agent-acp 0.76.0
-			// `dist/acp-agent.js:3871-3882`), after constructing that scalar from the
-			// latest assistant snapshot (`:3853-3866`). pi reads `usage.totalTokens` as
+			// as `used` (read at claude-agent-acp 0.79.0
+			// `dist/acp-agent.js:3934-3945`), after constructing that scalar from the
+			// latest assistant snapshot (`:3916-3929`). pi reads `usage.totalTokens` as
 			// exactly that occupancy (`calculateContextTokens(usage) = usage.totalTokens
 			// || input + output + cacheRead + cacheWrite`, read at pi-coding-agent
 			// `dist/core/compaction/compaction.js:86-88`). The assignment below is the

package/pi-extensions/lib/acp/session-store.ts

@@ -27,7 +27,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import type { Context, Message, ToolResultMessage } from "@earendil-works/pi-ai";
+import type { Message, ToolResultMessage, TranscriptContext } from "@earendil-works/pi-ai";
 import type { AcpBootstrapPath } from "./context.js";
 
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
@@ -236,7 +236,7 @@ function rawMessageSignature(message: Message): string {
  * record never stores raw prompt/tool text — the prefix check works the same on
  * the digest array (GPT `c617cb` hardening).
  */
-export function contextMessageSignatures(context: Context): string[] {
+export function contextMessageSignatures(context: TranscriptContext): string[] {
 	return context.messages.map((m: Message) => sha256(rawMessageSignature(m)));
 }
 

package/pi-extensions/lib/acp/tool-surface.ts

@@ -154,7 +154,8 @@ export function buildClaudeSessionMeta(
 		// claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
 		// JSON.parse for that form moved out of `resolvedProvider` up onto the
 		// unconditional `session/new` path — a shape that WOULD reach us, and does not,
-		// only because we never hand it a path. Keep it inline: a path would put file
+		// only because we never hand it a path. Still on that path at 0.79.0
+		// (`dist/acp-agent.js:6010-6012`). Keep it inline: a path would put file
 		// IO, and its failure modes, inside every session creation.
 		settings: {
 			permissions: {

package/pi-extensions/lib/callback-env.ts

@@ -0,0 +1,78 @@
+/**
+ * Callback-env — the launch-computed pair that lets a fresh sibling call home
+ * without copying a garden id or nonce out of prose.
+ *
+ * WHY THIS FILE EXISTS. Until this seam, `composeFreshCallFraming` put
+ * `target=<caller gid>` and `message=<nonce>` into the first-turn prompt, and
+ * the sibling had to retype them into `entwurf_v2`. That is the one place in
+ * the garden Hard Rule 2 (record is the sole address axis) was violated: the
+ * transcript became the address carrier, and a model that dropped a `$` or a
+ * hex nibble produced a refused dispatch that looked like a flaky backend.
+ *
+ * WHAT TRAVELS. Two process-env names, injected by the launcher next to the
+ * identity scrub (`PI_SESSION_ID=` / `PI_AGENT_ID=`), never as a general env
+ * carrier. The no-arg `entwurf_callback` verb reads BOTH from its own process
+ * and refuses by name when they are absent, malformed, or this process is a
+ * Codex-provenance bridge (window env never reaches that MCP child — measured).
+ *
+ * This module does not dispatch. It parses, validates, and formats. Launchers
+ * and the verb share it so a drifted regex cannot inject what the verb rejects.
+ */
+
+import { SESSION_ID_RE } from "./session-id.js";
+
+export const CALLBACK_TARGET_ENV = "ENTWURF_CALLBACK_TARGET";
+export const CALLBACK_NONCE_ENV = "ENTWURF_CALLBACK_NONCE";
+
+/** Exactly what `mintNonce` emits (`fresh-call-composition.ts`): `mux-fresh-call-` + 12 random
+ *  bytes as hex. ONE minter, ONE grammar — both rails call the same `mintNonce`, so a second
+ *  accepted prefix would be a spelling no launcher produces and this leaf exists to refuse
+ *  exactly that. A gate fixture is an oracle and never a reason to widen the subject. */
+export const CALLBACK_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
+
+export type CallbackEnvReject = "callback-env-absent" | "callback-env-malformed" | "codex-callback-env-unsupported";
+
+export type CallbackEnvRead = { ok: true; target: string; nonce: string } | { ok: false; reason: CallbackEnvReject };
+
+function parseCallbackPair(target: unknown, nonce: unknown): CallbackEnvRead {
+	if (typeof target !== "string" || typeof nonce !== "string") {
+		return { ok: false, reason: "callback-env-malformed" };
+	}
+	if (!SESSION_ID_RE.test(target) || !CALLBACK_NONCE_RE.test(nonce)) {
+		return { ok: false, reason: "callback-env-malformed" };
+	}
+	return { ok: true, target, nonce };
+}
+
+/**
+ * Format the two `KEY=value` assignments a launcher injects. Throws rather than
+ * emitting a pair the verb would refuse — a launch that cannot name its caller
+ * must not open a window whose first action is a guaranteed reject.
+ */
+export function callbackEnvAssignments(params: { target: string; nonce: string }): readonly [string, string] {
+	const parsed = parseCallbackPair(params.target, params.nonce);
+	if (!parsed.ok) {
+		throw new Error(`callback-env: refusing to inject ${parsed.reason}`);
+	}
+	return [`${CALLBACK_TARGET_ENV}=${parsed.target}`, `${CALLBACK_NONCE_ENV}=${parsed.nonce}`];
+}
+
+/**
+ * Read the pair from a process environment. Codex provenance is a named refuse
+ * even when the pair is well-formed: that bridge is an app-server child, and a
+ * pane-injected value would be the wrong citizen's (or last-launch-wins).
+ *
+ * Both names absent → `callback-env-absent`. One present, or either failing
+ * grammar → `callback-env-malformed`. No fallback to a model-supplied target.
+ */
+export function readCallbackEnv(env: NodeJS.ProcessEnv = process.env): CallbackEnvRead {
+	if (env.ENTWURF_BRIDGE_NATIVE_HOST?.trim() === "codex") {
+		return { ok: false, reason: "codex-callback-env-unsupported" };
+	}
+	const target = env[CALLBACK_TARGET_ENV];
+	const nonce = env[CALLBACK_NONCE_ENV];
+	if (target === undefined && nonce === undefined) {
+		return { ok: false, reason: "callback-env-absent" };
+	}
+	return parseCallbackPair(target, nonce);
+}

package/pi-extensions/lib/compaction-send-guard.ts

@@ -1,7 +1,10 @@
 /**
  * compaction-send-guard — whether a control-socket `send` may call `pi.sendMessage`.
  *
- * Pi 0.85.1 has no public `ExtensionContext.isCompacting()`. Compaction is non-idle
+ * Pi 0.86.0 has no public `ExtensionContext.isCompacting()` (`[측정 2026-09-20]` the
+ * installed `dist/core/extensions/types.d.ts` declares `isIdle(): boolean` at :233 and
+ * `signal` at :237, and carries no `isCompacting` member at all; the identifier exists
+ * only inside the interactive/rpc modes' own bundles). Compaction is non-idle
  * (`AgentSession.isIdle` = no agent run AND not compacting) but `sendCustomMessage`
  * does not refuse it. A non-streaming `triggerTurn:true` send starts `_runAgentPrompt`
  * while `compact()` is rewriting the session tree — the field path that can make

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -111,7 +111,7 @@ export type DispatchLiveness = (typeof DISPATCH_LIVENESSES)[number];
 // unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
 // THIS set is a deliberate future decision, gated by a real compatible
 // control-socket predicate — never by silently mapping sessions to dead/indeterminate
-// (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
+// (R1 핵심). pi-extensions/lib/entwurf-facts.test.ts pins this == ["pi"] and asserts the native-push
 // domain is disjoint from it.
 export const LIVENESS_DOMAIN_BACKENDS = ["pi"] as const;
 export type LivenessDomainBackend = (typeof LIVENESS_DOMAIN_BACKENDS)[number];
@@ -125,7 +125,7 @@ export function isLivenessSupported(backend: string): boolean {
 // live vendor app-server target probe), NOT a control socket. This domain is DISJOINT
 // from LIVENESS_DOMAIN_BACKENDS: an Antigravity or Codex session is `unsupported` on
 // the socket FACT axis (entwurf_peers) yet independently measured on the native-push
-// axis. The two are separate rails on purpose — check-entwurf-facts pins both sets
+// axis. The two are separate rails on purpose — pi-extensions/lib/entwurf-facts.test.ts pins both sets
 // and asserts their intersection is ∅ (a backend can never be in both domains).
 export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"] as const;
 export type NativePushBackend = (typeof NATIVE_PUSH_BACKENDS)[number];

package/pi-extensions/lib/entwurf-v2-lock.ts

@@ -82,7 +82,7 @@ export const LOCK_SUFFIX = ".lock";
 export const LOCK_OWNER = "entwurf_v2" as const;
 
 /** The reject reason a lock conflict maps to. Kept as a literal here (the lock
- * primitive stays decoupled from the full contract); `check-entwurf-v2-lock`
+ * primitive stays decoupled from the full contract); `pi-extensions/lib/entwurf-v2-lock.test.ts`
  * cross-checks it against the contract's ENTWURF_V2_REJECT_REASONS so the two
  * cannot drift. */
 export const LOCK_CONFLICT_REASON = "target-locked" as const;

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -201,7 +201,7 @@ export async function executeDispatch(
 /**
  * 5d-2a: the deps `runEntwurfV2` joins. `decide` is the WHOLE decider as ONE injected
  * function — NOT `DispatchDeciderDeps`. The runner does not re-validate the 5b decider
- * logic (that is `check-entwurf-v2-decider`'s job); it proves only the decide→execute
+ * logic (that is `pi-extensions/lib/entwurf-v2-decider.test.ts`'s job); it proves only the decide→execute
  * COMPOSITION contract over a fake `decide`. Production wraps the real decider as
  * `decide: (input) => decideDispatch(input, productionDeciderDeps)` (assembled in 5d-2b),
  * so the runner stays gate-provable without any decider IO seam leaking in.

package/pi-extensions/lib/fresh-call-composition.ts

@@ -54,6 +54,17 @@ export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
  * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
  */
 export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
+	pi: "entwurf_callback",
+	"claude-code": "mcp__entwurf-bridge__entwurf_callback",
+	copilot: "entwurf-bridge-entwurf_callback",
+	omp: "mcp__entwurf_bridge_entwurf_callback",
+	// Codex's tool process is the operator app-server, not the pane: the no-arg
+	// verb refuses there by name. First action stays the delivery verb with args.
+	codex: "mcp__entwurf_bridge__entwurf_v2",
+};
+
+/** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
+export const FRESH_CALL_DELIVERY_TOOL: Record<FreshCallBackend, string> = {
 	pi: "entwurf_v2",
 	"claude-code": "mcp__entwurf-bridge__entwurf_v2",
 	copilot: "entwurf-bridge-entwurf_v2",
@@ -101,8 +112,11 @@ export const FRESH_CALL_PEERS_TOOL: Record<FreshCallBackend, string> = {
  * `[측정, n=3, same model]` adding the sentence below produced 3/3 callbacks. It is a FACT about the
  * runtime, in the register the rest of this framing uses since the prohibitions came out: it grants
  * nothing, forbids nothing, and names the one call that turns a listed name into a callable tool.
- * Both tools ride ONE `ToolSearch` select, so the corroboration the framing offers stays reachable
- * for a child that takes the offer.
+ * ALL THREE tools ride ONE `ToolSearch` select — the birth callback, the DELIVERY verb the last
+ * line of the framing names, and the peers listing the corroboration sentence offers. The delivery
+ * verb has to be in the same select or the deferral simply moves from the first action to the last:
+ * a sibling that finishes its task and cannot call `entwurf_v2` is the same production silence,
+ * spent instead of saved.
  *
  * Every other backend gets an EMPTY array, deliberately: pi has no deferred-tool surface, and the
  * other three were never measured to need it. A hint invented for a runtime nobody probed would be
@@ -112,7 +126,7 @@ export const FRESH_CALL_TOOL_LOAD_HINT: Record<FreshCallBackend, readonly string
 	pi: [],
 	"claude-code": [
 		"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its",
-		'tools are deferred: load them first with ToolSearch("select:${callbackTool},${peersTool}") —',
+		'tools are deferred: load them first with ToolSearch("select:${callbackTool},${deliveryTool},${peersTool}") —',
 		"it waits for the server — then call ${callbackTool}.",
 	],
 	copilot: [],
@@ -144,22 +158,22 @@ export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
 
 /** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
  * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
+export const OMP_BOOTSTRAP_VERSION = 2;
 
 /**
  * The whole of what a fresh omp sibling is launched with.
  *
- * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
- * contract: who to call back, the nonce that proves it is this call, and the task that is
- * released only after that callback succeeds. There is no command here, no path, no env name
- * and no model — the model is already an explicit argv token, and a second copy of it inside
- * a payload would be a second place for it to disagree with the launch.
+ * TWO FIELDS, CLOSED. Address (target + nonce) rides process env, not this payload — a second
+ * copy here would be a second address axis. The decoder refuses an unknown key, so this object
+ * is the entire remaining contract: the task released after the no-arg callback succeeds.
+ * `callerGardenId` / `nonce` stay on the function so launcher call sites do not grow a second
+ * shape; they are not serialised.
  */
 export function buildOmpBootstrapPayload(params: { callerGardenId: string; nonce: string; task: string }): string {
+	void params.callerGardenId;
+	void params.nonce;
 	return JSON.stringify({
 		v: OMP_BOOTSTRAP_VERSION,
-		target: params.callerGardenId,
-		nonce: params.nonce,
 		task: params.task,
 	});
 }
@@ -298,7 +312,11 @@ export function composeBackendArgs(
 		case "pi":
 			return [composition.prompt, "--entwurf-control", "--model", model];
 		case "claude-code":
-			return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
+			return [
+				composition.prompt,
+				`--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]},${FRESH_CALL_DELIVERY_TOOL["claude-code"]}`,
+				`--model=${model}`,
+			];
 		case "copilot":
 			return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
 		case "omp":
@@ -354,28 +372,44 @@ export function composeFreshCallFraming(params: {
 	 * default: a sibling told nothing about where it is would be told something false by silence. */
 	openingLine: string;
 }): string[] {
-	const tool = FRESH_CALL_CALLBACK_TOOL[params.backend];
+	const birthTool = FRESH_CALL_CALLBACK_TOOL[params.backend];
+	const deliveryTool = FRESH_CALL_DELIVERY_TOOL[params.backend];
 	const peersTool = FRESH_CALL_PEERS_TOOL[params.backend];
 	// The hint is a per-backend TEMPLATE so the two tool dialects stay the single source of their
 	// own spelling here too — a hint that hard-coded Claude's name would go stale the day a dialect
 	// moves, and it would go stale silently, in the one sentence a stuck child depends on.
 	const loadHint = FRESH_CALL_TOOL_LOAD_HINT[params.backend].map((line) =>
-		line.replaceAll("${callbackTool}", tool).replaceAll("${peersTool}", peersTool),
+		line
+			.replaceAll("${callbackTool}", birthTool)
+			.replaceAll("${deliveryTool}", deliveryTool)
+			.replaceAll("${peersTool}", peersTool),
 	);
 	const hintBlock = loadHint.length === 0 ? [] : ["", ...loadHint];
 	if (params.openingLine.length === 0) {
 		throw new Error("fresh-call composition: openingLine is empty — the rail must state where it placed the sibling");
 	}
+	const firstAction =
+		params.backend === "codex"
+			? [
+					`FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+						`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
+						`message set to exactly ${params.nonce} — that string alone, nothing added.`,
+					`${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
+					"secret and grants no access. Sending it is how the caller learns the garden id you were born",
+					"with, which it has no other way to know. Your own record does not carry the caller's address,",
+					"so reporting your identity here does not reach it — that tool call does.",
+					"entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
+				]
+			: [
+					`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+					"That call is how the caller learns the garden id you were born with. There are no",
+					"parameters: a target or message you type would be a second address axis.",
+					"Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
+				];
 	return [
 		params.openingLine,
 		"",
-		`FIRST ACTION, before reading files or anything else: call ${tool} with ` +
-			`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
-			`message set to exactly ${params.nonce} — that string alone, nothing added.`,
-		`${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
-		"secret and grants no access. Sending it is how the caller learns the garden id you were born",
-		"with, which it has no other way to know. Your own record does not carry the caller's address,",
-		"so reporting your identity here does not reach it — that tool call does.",
+		...firstAction,
 		"",
 		`You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
 		`this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
@@ -393,7 +427,7 @@ export function composeFreshCallFraming(params: {
 		// its window is not the delivery. Nothing here watches for completion or sends on the
 		// sibling's behalf — this rail launches and lets go (Hard Rule 16, and the reason there is no
 		// supervisor anywhere in it).
-		`When the task reaches its requested final result, send that result to the same target with ${tool}.`,
+		`When the task reaches its requested final result, send that result to the same target with ${deliveryTool}.`,
 		"Output in this sibling window is not delivered to the caller.",
 	];
 }

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -44,6 +44,7 @@
 import { createHash } from "node:crypto";
 import { statSync } from "node:fs";
 import path from "node:path";
+import { callbackEnvAssignments } from "./callback-env.ts";
 import {
 	buildOmpBootstrapPayload,
 	composeBackendArgs,
@@ -443,7 +444,11 @@ export function herdrAgentNameFromNonce(nonce: string): string {
  * not from a screen. Repeating the flag is the grammar; `--env KEY=` injects the EMPTY value
  * rather than dropping the key.
  */
-export function buildHerdrTabCreateArgs(params: { workspaceId: string; cwd?: string }): string[] {
+export function buildHerdrTabCreateArgs(params: {
+	workspaceId: string;
+	cwd?: string;
+	callback: { target: string; nonce: string };
+}): string[] {
 	return [
 		"tab",
 		"create",
@@ -455,6 +460,7 @@ export function buildHerdrTabCreateArgs(params: { workspaceId: string; cwd?: str
 		"PI_SESSION_ID=",
 		"--env",
 		"PI_AGENT_ID=",
+		...callbackEnvAssignments(params.callback).flatMap((assignment) => ["--env", assignment]),
 	];
 }
 
@@ -849,6 +855,7 @@ export async function herdrFreshCall(
 		buildHerdrTabCreateArgs({
 			workspaceId: callerPane.workspaceId,
 			...(cwd === undefined ? {} : { cwd }),
+			callback: { target: callerGardenId, nonce },
 		}),
 	);
 	if (tabRun.status !== 0) {
@@ -1205,9 +1212,10 @@ export function renderHerdrFreshCall(result: HerdrFreshCallResult): { text: stri
 			`mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
 			`coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
 			`dispatched to them.\n` +
-			`The sibling's garden id arrives separately — it calls entwurf_v2 back with the nonce above as its first ` +
-			`action, and the sender envelope of THAT message is the address. Nothing is polling for it; if it never ` +
-			`comes, the pane is visible and can be read directly.`,
+			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+			`the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
+			`the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
+			`never comes, the pane is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/herdr-placement.ts

@@ -21,7 +21,7 @@
  * THE TWO AXES ARE NOT EQUALLY EXACT, AND THE DIFFERENCE IS NAMED. On the claude axis
  * the reported value IS the key, byte for byte. On the pi axis it is a session FILE
  * PATH, and the key is recovered from that filename by a strict conversion measured on
- * pi 0.85.1 — a VENDOR FLOOR, not a key equality. Calling both "a unique-key join"
+ * pi 0.86.0 — a VENDOR FLOOR, not a key equality. Calling both "a unique-key join"
  * would hide which one can drift when a vendor renames a file. The conversion is
  * deliberately strict at both ends so that drift lands as a missed join, never a wrong
  * one, and a listing that declined to read anything says so (see `declinedReports`).
@@ -112,14 +112,23 @@ const OFFICIAL_REPORTS: Readonly<
 };
 
 /**
- * A pi session filename, measured 2026-09-14 on pi 0.85.1:
+ * A pi session filename, measured 2026-09-20 on pi 0.86.0:
  *
- *   2026-09-14T05-17-03-979Z_01a09e58-f06a-70e8-b14a-1f0f0c7f7c7d.jsonl
+ *   2026-09-20T00-35-44-197Z_01a0bc3d-87c4-738e-b391-265c8ba5a1b0.jsonl
  *   └────────── start stamp ─────────┘ └──────── nativeSessionId ────────┘
  *
+ * `[측정 2026-09-20]` that is a REAL file a sandboxed pi 0.86.0 wrote, and its own
+ * `{"type":"session"}` header carries `id: 01a0bc3d-87c4-738e-b391-265c8ba5a1b0` —
+ * the exact string `piNativeSessionIdFromPath` recovers from the name. The layout was
+ * re-measured rather than carried: pi 0.86.0 rewrote session-manager.ts (+269 −141
+ * over v0.85.1), but every line that BUILDS a name is byte-unchanged
+ * (`${fileTimestamp}_${this.sessionId}.jsonl`, session-manager.ts:991/1527/1703); the
+ * only diff in that file's `.jsonl` lines is a lambda parameter rename on the READER
+ * side. A source read alone would not have settled it, so the real file is the receipt.
+ *
  * WHY THIS IS PINNED HERE AND NOT INFERRED. The uuid is the join key and it lives in
  * a VENDOR filename, so this rule depends on pi's naming and would break silently if
- * pi changed it. **Vendor floor: pi 0.85.1, measured 2026-09-14** — whether that layout
+ * pi changed it. **Vendor floor: pi 0.86.0, measured 2026-09-20** — whether that layout
  * is a vendor contract or a convention is NOT measured, so this is the one place in the
  * axis that can drift under us. It is therefore strict on both ends — the name must end
  * in `.jsonl` and the tail after the last `_` must be a well-formed uuid — and a name